1486 files changed, 61321 insertions, 18951 deletions

diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index c583668ef..90efc6dba 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -1,5 +1,6 @@
 SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}"
+    "${WEBCORE_DIR}/Modules/geolocation"
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings"
     "${WEBCORE_DIR}/bindings/generic"
@@ -27,6 +28,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/notifications"
     "${WEBCORE_DIR}/page"
     "${WEBCORE_DIR}/page/animation"
+    "${WEBCORE_DIR}/page/scrolling"
     "${WEBCORE_DIR}/platform"
     "${WEBCORE_DIR}/platform/animation"
     "${WEBCORE_DIR}/platform/audio"
@@ -74,6 +76,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
+    "${JAVASCRIPTCORE_DIR}/llint"
     "${JAVASCRIPTCORE_DIR}/parser"
     "${JAVASCRIPTCORE_DIR}/profiler"
     "${JAVASCRIPTCORE_DIR}/runtime"
@@ -86,6 +89,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
 )
 
 SET(WebCore_IDL_INCLUDES
+    Modules/geolocation
     bindings/generic
     css
     dom
@@ -104,6 +108,13 @@ SET(WebCore_IDL_INCLUDES
 )
 
 SET(WebCore_IDL_FILES
+    Modules/geolocation/Geolocation.idl
+    Modules/geolocation/Geoposition.idl
+    Modules/geolocation/NavigatorGeolocation.idl
+    Modules/geolocation/PositionCallback.idl
+    Modules/geolocation/PositionError.idl
+    Modules/geolocation/PositionErrorCallback.idl
+
     css/Counter.idl
     css/CSSCharsetRule.idl
     css/CSSFontFaceRule.idl
@@ -205,6 +216,7 @@ SET(WebCore_IDL_FILES
     html/DOMSettableTokenList.idl
     html/DOMTokenList.idl
     html/DOMURL.idl
+    html/DOMWindowHTML.idl
     html/HTMLAllCollection.idl
     html/HTMLAnchorElement.idl
     html/HTMLAppletElement.idl
@@ -282,9 +294,6 @@ SET(WebCore_IDL_FILES
     html/MediaController.idl
     html/MediaError.idl
     html/TextMetrics.idl
-    html/TextTrack.idl
-    html/TextTrackCue.idl
-    html/TextTrackCueList.idl
     html/TimeRanges.idl
     html/ValidityState.idl
     html/VoidCallback.idl
@@ -309,6 +318,9 @@ SET(WebCore_IDL_FILES
     html/shadow/HTMLContentElement.idl
     html/shadow/HTMLShadowElement.idl
 
+    html/track/TextTrack.idl
+    html/track/TextTrackCue.idl
+    html/track/TextTrackCueList.idl
     html/track/TextTrackList.idl
     html/track/TrackEvent.idl
 
@@ -327,8 +339,6 @@ SET(WebCore_IDL_FILES
     page/DOMSelection.idl
     page/DOMWindow.idl
     page/EventSource.idl
-    page/Geolocation.idl
-    page/Geoposition.idl
     page/History.idl
     page/Location.idl
     page/MemoryInfo.idl
@@ -336,9 +346,6 @@ SET(WebCore_IDL_FILES
     page/Performance.idl
     page/PerformanceNavigation.idl
     page/PerformanceTiming.idl
-    page/PositionCallback.idl
-    page/PositionError.idl
-    page/PositionErrorCallback.idl
     page/Screen.idl
     page/SpeechInputEvent.idl
     page/SpeechInputResult.idl
@@ -384,6 +391,7 @@ SET(WebCore_IDL_FILES
     websockets/CloseEvent.idl
     websockets/DOMWindowWebSocket.idl
 
+    xml/DOMWindowXML.idl
     xml/DOMParser.idl
     xml/XMLHttpRequest.idl
     xml/XMLHttpRequestException.idl
@@ -399,6 +407,10 @@ SET(WebCore_IDL_FILES
 )
 
 SET(WebCore_SOURCES
+    Modules/geolocation/Geolocation.cpp
+    Modules/geolocation/GeolocationController.cpp
+    Modules/geolocation/NavigatorGeolocation.cpp
+
     accessibility/AXObjectCache.cpp
     accessibility/AccessibilityARIAGrid.cpp
     accessibility/AccessibilityARIAGridCell.cpp
@@ -478,7 +490,6 @@ SET(WebCore_SOURCES
     css/CSSValueList.cpp
     css/CSSValuePool.cpp
     css/CSSWrapShapes.cpp
-    css/FontFamilyValue.cpp
     css/FontFeatureValue.cpp
     css/FontValue.cpp
     css/MediaFeatureNames.cpp
@@ -489,6 +500,7 @@ SET(WebCore_SOURCES
     css/MediaQueryList.cpp
     css/MediaQueryListListener.cpp
     css/MediaQueryMatcher.cpp
+    css/PropertySetCSSStyleDeclaration.cpp
     css/RGBColor.cpp
     css/SelectorChecker.cpp
     css/ShadowValue.cpp
@@ -600,6 +612,7 @@ SET(WebCore_SOURCES
     dom/SecurityContext.cpp
     dom/SelectorQuery.cpp
     dom/ShadowRoot.cpp
+    dom/ShadowRootList.cpp
     dom/SpaceSplitString.cpp
     dom/StaticHashSetNodeList.cpp
     dom/StaticNodeList.cpp
@@ -863,10 +876,11 @@ SET(WebCore_SOURCES
     html/parser/XSSAuditor.cpp
 
     html/shadow/ContentSelectorQuery.cpp
-    html/shadow/ContentInclusionSelector.cpp
     html/shadow/DetailsMarkerControl.cpp
     html/shadow/HTMLContentElement.cpp
+    html/shadow/HTMLContentSelector.cpp
     html/shadow/HTMLShadowElement.cpp
+    html/shadow/InsertionPoint.cpp
     html/shadow/MediaControls.cpp
     html/shadow/MediaControlRootElement.cpp
     html/shadow/MeterShadowElement.cpp
@@ -878,6 +892,7 @@ SET(WebCore_SOURCES
     inspector/ContentSearchUtils.cpp
     inspector/DOMEditor.cpp
     inspector/DOMNodeHighlighter.cpp
+    inspector/DOMPatchSupport.cpp
     inspector/IdentifiersFactory.cpp
     inspector/InjectedScript.cpp
     inspector/InjectedScriptHost.cpp
@@ -890,6 +905,7 @@ SET(WebCore_SOURCES
     inspector/InspectorClient.cpp
     inspector/InspectorConsoleAgent.cpp
     inspector/InspectorController.cpp
+    inspector/InspectorCounters.cpp
     inspector/InspectorDOMAgent.cpp
     inspector/InspectorDOMDebuggerAgent.cpp
     inspector/InspectorDOMStorageAgent.cpp
@@ -980,6 +996,7 @@ SET(WebCore_SOURCES
     loader/cache/CachedResourceHandle.cpp
     loader/cache/CachedResourceLoader.cpp
     loader/cache/CachedScript.cpp
+    loader/cache/CachedSVGDocument.cpp
     loader/cache/CachedXSLStyleSheet.cpp
     loader/cache/MemoryCache.cpp
 
@@ -1009,8 +1026,6 @@ SET(WebCore_SOURCES
     page/FrameDestructionObserver.cpp
     page/FrameTree.cpp
     page/FrameView.cpp
-    page/Geolocation.cpp
-    page/GeolocationController.cpp
     page/GroupSettings.cpp
     page/History.cpp
     page/Location.cpp
@@ -1018,11 +1033,14 @@ SET(WebCore_SOURCES
     page/MouseEventWithHitTestResults.cpp
     page/Navigator.cpp
     page/NavigatorBase.cpp
+    page/NavigatorRegisterProtocolHandler.cpp
+    page/NavigatorSupplement.cpp
     page/OriginAccessEntry.cpp
     page/Page.cpp
     page/PageGroup.cpp
     page/PageGroupLoadDeferrer.cpp
     page/PageSerializer.cpp
+    page/PageSupplement.cpp
     page/PageVisibilityState.cpp
     page/Performance.cpp
     page/PerformanceNavigation.cpp
@@ -1045,6 +1063,9 @@ SET(WebCore_SOURCES
     page/animation/ImplicitAnimation.cpp
     page/animation/KeyframeAnimation.cpp
 
+    page/scrolling/ScrollingCoordinator.cpp
+    page/scrolling/ScrollingCoordinatorNone.cpp
+
     platform/Arena.cpp
     platform/CalculationValue.cpp
     platform/Clock.cpp
@@ -1053,7 +1074,6 @@ SET(WebCore_SOURCES
     platform/ContentType.cpp
     platform/CrossThreadCopier.cpp
     platform/DateComponents.cpp
-    platform/DefaultLocalizationStrategy.cpp
     platform/DragData.cpp
     platform/DragImage.cpp
     platform/FileChooser.cpp
@@ -1093,6 +1113,7 @@ SET(WebCore_SOURCES
     platform/graphics/BitmapImage.cpp
     platform/graphics/Color.cpp
     platform/graphics/CrossfadeGeneratedImage.cpp
+    platform/graphics/FractionalLayoutSize.cpp
     platform/graphics/FloatPoint.cpp
     platform/graphics/FloatPoint3D.cpp
     platform/graphics/FloatQuad.cpp
@@ -1383,8 +1404,8 @@ SET(WebCore_SOURCES
     storage/IDBFactory.cpp
     storage/IDBFactoryBackendInterface.cpp
     storage/IDBFactoryBackendImpl.cpp
-    storage/LocalStorageTask.cpp
-    storage/LocalStorageThread.cpp
+    storage/StorageTask.cpp
+    storage/StorageThread.cpp
     storage/OriginQuotaManager.cpp
     storage/OriginUsageRecord.cpp
     storage/SQLException.cpp
@@ -1583,6 +1604,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/DOMFileSystem.cpp
         fileapi/DOMFileSystemBase.cpp
         fileapi/DOMFileSystemSync.cpp
+        fileapi/DOMWindowFileSystem.cpp
         fileapi/Entry.cpp
         fileapi/EntryArray.cpp
         fileapi/EntryArraySync.cpp
@@ -1604,6 +1626,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/DirectoryReaderSync.idl
         fileapi/DOMFileSystem.idl
         fileapi/DOMFileSystemSync.idl
+        fileapi/DOMWindowFileSystem.idl
         fileapi/EntriesCallback.idl
         fileapi/Entry.idl
         fileapi/EntrySync.idl
@@ -1694,6 +1717,7 @@ IF (ENABLE_SVG)
         rendering/svg/SVGTextMetricsBuilder.cpp
         rendering/svg/SVGTextQuery.cpp
         svg/ColorDistance.cpp
+        svg/DOMWindowSVG.idl
         svg/SVGAElement.cpp
         svg/SVGAltGlyphDefElement.cpp
         svg/SVGAltGlyphElement.cpp
@@ -2038,6 +2062,7 @@ IF (ENABLE_WEB_SOCKETS)
         websockets/ThreadableWebSocketChannelClientWrapper.cpp
         websockets/WebSocket.cpp
         websockets/WebSocketChannel.cpp
+        websockets/WebSocketExtensionDispatcher.cpp
         websockets/WebSocketHandshake.cpp
         websockets/WebSocketHandshakeRequest.cpp
         websockets/WebSocketHandshakeResponse.cpp
@@ -2098,13 +2123,19 @@ IF (ENABLE_SHARED_WORKERS)
     )
 ENDIF ()
 
+IF (ENABLE_WORKERS OR ENABLE_SHARED_WORKERS)
+    LIST(APPEND WebCore_IDL_FILES
+        workers/DOMWindowWorker.idl
+    )
+ENDIF ()
+
 IF (ENABLE_VIDEO_TRACK)
     LIST(APPEND WebCore_SOURCES
         html/HTMLTrackElement.cpp
-        html/LoadableTextTrack.cpp
-        html/TextTrack.cpp
-        html/TextTrackCue.cpp
-        html/TextTrackCueList.cpp
+        html/track/LoadableTextTrack.cpp
+        html/track/TextTrack.cpp
+        html/track/TextTrackCue.cpp
+        html/track/TextTrackCueList.cpp
         html/track/TextTrackList.cpp
         html/track/TrackBase.cpp
         html/track/TrackEvent.cpp
@@ -2240,6 +2271,19 @@ IF (ENABLE_REQUEST_ANIMATION_FRAME)
     )
 ENDIF ()
 
+IF (ENABLE_VIBRATION)
+    LIST(APPEND WebCore_INCLUDE_DIRECTORIES
+        ${WEBCORE_DIR}/Modules/vibration
+    )
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/vibration/NavigatorVibration.idl
+    )
+    LIST(APPEND WebCore_SOURCES
+        Modules/vibration/NavigatorVibration.cpp
+        Modules/vibration/Vibration.cpp
+    )
+ENDIF ()
+
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_RESOLVE_SUPPLEMENTAL
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
@@ -2252,12 +2296,13 @@ SET(SCRIPTS_BINDINGS
 )
 SET(IDL_FILES_TMP ${DERIVED_SOURCES_WEBCORE_DIR}/idl_files.tmp)
 SET(SUPPLEMENTAL_DEPENDENCY_FILE ${DERIVED_SOURCES_WEBCORE_DIR}/supplemental_dependency.tmp)
+SET(IDL_ATTRIBUTES_FILE ${WEBCORE_DIR}/bindings/scripts/IDLAttributes.txt)
 
 INCLUDE(${WEBCORE_DIR}/UseJSC.cmake)
 
 SET(WebCore_LIBRARIES ${JavaScriptCore_LIBRARY_NAME})
 SET(WebCore_LINK_FLAGS "")
-INCLUDE_IF_EXISTS(${WEBCORE_DIR}/Platform${PORT}.cmake)
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 # ANGLE tokenizer & parser
 ADD_CUSTOM_COMMAND(
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b15d4c227..b0b5bdf70 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19849 @@
+2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Font related problem with newer Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=79402
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Apply the descent += 1 workaround needed to produce correct metrics only for Qt 4,
+        because the behaviour has been corrected in Qt 5.
+
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move XML-related APIs from DOMWindow.idl to DOMWindowXML.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79434
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves XML-related APIs
+        from DOMWindow.idl to DOMWIndowXML.idl.
+
+        No tests. No change in behavior.
+
+        * xml/DOMWindowXML.idl: Added.
+        * page/DOMWindow.idl:
+
+        * CMakeLists.txt: Added "DOMWindowXML.idl".
+        * DerivedSources.make: Ditto.
+        * DerivedSources.pri: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+2012-02-24  Renata Hodovan  <reni@webkit.org>
+
+        External <use> xlink:href references do not work
+        https://bugs.webkit.org/show_bug.cgi?id=12499
+
+        Reviewed by Nikolas Zimmermann.
+
+        Support external references on <use> by introducing CachedSVGDocument.
+        CachedSVGDocument is a CachedResource specialized for SVGDocuments.
+        This CachedSVGDocument will be stored for every use element with external reference.
+        This first patch only contains the new classes to test whether it works on every platform.
+        So they aren't used anywhere and just a follow-up patch will bind them into the caching system.
+
+        No new tests - no change in functionality.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::defaultPriorityForResourceType):
+        (WebCore::cachedResourceTypeToTargetType):
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceClient.h:
+        (CachedResourceClient):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::createResource):
+        (WebCore::CachedResourceLoader::checkInsecureContent):
+        (WebCore::CachedResourceLoader::canRequest):
+        * loader/cache/CachedSVGDocument.cpp: Added.
+        (WebCore):
+        (WebCore::CachedSVGDocument::CachedSVGDocument):
+        (WebCore::CachedSVGDocument::~CachedSVGDocument):
+        (WebCore::CachedSVGDocument::setEncoding):
+        (WebCore::CachedSVGDocument::encoding):
+        (WebCore::CachedSVGDocument::data):
+        * loader/cache/CachedSVGDocument.h: Added.
+        (WebCore):
+        (CachedSVGDocument):
+        (WebCore::CachedSVGDocument::document):
+        (WebCore::CachedSVGDocument::schedule):
+        (CachedSVGDocumentClient):
+        (WebCore::CachedSVGDocumentClient::~CachedSVGDocumentClient):
+        (WebCore::CachedSVGDocumentClient::expectedType):
+        (WebCore::CachedSVGDocumentClient::resourceClientType):
+
+2012-02-24  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Little optimization in CSSParser::parseShorthand.
+        https://bugs.webkit.org/show_bug.cgi?id=79356
+
+        Reviewed by Tony Chang.
+
+        Remove one loop by initializing array values at declaration time.
+        Also early return when the number of properties parsed are equals
+        with longhands count of the shorthand. It happens to be very often
+        the case (e.g. border). Instruments shows an improvement from 19ms
+        to 17ms on the time spent in this function for the css-parser-yui
+        benchmark.
+
+        No new tests : refactor, exisiting ones should cover.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseShorthand):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move HTML-related APIs from DOMWindow.idl to DOMWindowHTML.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79436
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves HTML-related APIs
+        from DOMWindow.idl to DOMWindowHTML.idl.
+
+        No tests. No change in behavior.
+
+        * html/DOMWindowHTML.idl:
+        * page/DOMWindow.idl:
+
+2012-02-24  Jochen Eisinger  <jochen@chromium.org>
+
+        [v8] when a named item on document goes out of scope, actually remove it
+        https://bugs.webkit.org/show_bug.cgi?id=79409
+
+        Reviewed by Adam Barth.
+
+        The original change already included the code, but it led to some
+        problems, so it was reverted in http://trac.webkit.org/changeset/63845.
+        However, not removing the items leaks a considerable amount of memory,
+        so I'm adding the code back. The bug that led to the revert was that
+        the accessor was removed unconditionally. I'm now only removing it,
+        when the last item with that name is removed.
+
+        Test: fast/dom/HTMLDocument/named-item.html
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::namedItemRemoved):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move Worker-related APIs from DOMWindow.idl to DOMWindowWorker.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79442
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves Worker-related APIs
+        from DOMWindow.idl to DOMWindowWorker.idl.
+
+        No tests. No change in behavior.
+
+        * workers/DOMWindowWorker.idl: Added.
+        * page/DOMWindow.idl:
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+
+2012-02-24  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream helper classes for skia
+        https://bugs.webkit.org/show_bug.cgi?id=79216
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/skia/ImageBufferData.h: Added.
+        (WebCore):
+        (ImageBufferData):
+        * platform/graphics/blackberry/skia/PlatformSupport.cpp: Added.
+        (WebCore):
+        (WebCore::setFontRenderStyleDefaults):
+        (WebCore::PlatformSupport::getRenderStyleForStrike):
+        (WebCore::PlatformSupport::getFontFamilyForCharacters):
+        * platform/graphics/blackberry/skia/PlatformSupport.h: Added.
+        (WebCore):
+        (PlatformSupport):
+        (FontFamily):
+
+2012-02-24  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream ImageBlackBerry in platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=79212
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * PlatformBlackBerry.cmake:
+        * platform/graphics/blackberry/ImageBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::Image::loadPlatformResource):
+
+2012-02-24  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/IntSize.h
+        https://bugs.webkit.org/show_bug.cgi?id=79430
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::IntSize and BlackBerry::Platform::IntSize.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/IntSize.h:
+        (Platform):
+        (IntSize):
+
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        WebKit clients should be able to get the context how the spellcheck happended.
+        For example, WebKit clients may want to change the behavior by a spellcheck request is
+        invoked in typing or in pasting.
+
+        This patch added an enum in SpellCheckRequest so that WebKit clients can understand the context.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::replaceSelectionWithFragment):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        * editing/SpellChecker.cpp:
+        (WebCore::SpellCheckRequest::SpellCheckRequest):
+        (WebCore::SpellCheckRequest::create):
+        (WebCore::SpellChecker::invokeRequest):
+        * editing/SpellChecker.h:
+        (SpellCheckRequest):
+        (WebCore::SpellCheckRequest::textCheckingRequest):
+        (WebCore::SpellCheckRequest::processType):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyTextCheckerClient::requestCheckingOfString):
+        * platform/text/TextCheckerClient.h:
+        (WebCore):
+        (TextCheckerClient):
+        * platform/text/TextChecking.h:
+        (TextCheckingRequest):
+        (WebCore::TextCheckingRequest::TextCheckingRequest):
+        (WebCore::TextCheckingRequest::setSequence):
+        (WebCore::TextCheckingRequest::sequence):
+        (WebCore::TextCheckingRequest::text):
+        (WebCore::TextCheckingRequest::mask):
+        (WebCore::TextCheckingRequest::processType):
+        (WebCore):
+
+2012-02-24  Hayato Ito  <hayato@chromium.org>
+
+        Make Node::showTreeForThis (and Node::showTreeForThisAcrossFrame) dump multiple shadow roots.
+        https://bugs.webkit.org/show_bug.cgi?id=79351
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests since these utility functions are only available in debug build.
+        I manually tested in GDB session.
+
+        * dom/Node.cpp:
+        (WebCore::oldestShadowRootFor):
+        (WebCore::traverseTreeAndMark):
+        (WebCore::parentOrHostOrFrameOwner):
+        (WebCore::showSubTreeAcrossFrame):
+        * dom/ShadowRoot.h:
+        (WebCore::ShadowRoot::youngerShadowRoot):
+        (WebCore::ShadowRoot::olderShadowRoot):
+        (WebCore::toShadowRoot):
+        (WebCore):
+
+2012-02-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up to inspector's r108331, using more general condition.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._getPopoverAnchor):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move WebGL APIs from DOMWindow.idl to DOMWindowWebGL.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79432
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves WebGL-related APIs
+        from DOMWindow.idl to DOMWindowWebGL.idl.
+
+        No tests. No change in behavior.
+
+        * html/canvas/DOMWindowWebGL.idl: Added.
+        * page/DOMWindow.idl:
+
+        * DerivedSources.make: Added DOMWindowWebGL.idl.
+        * DerivedSources.pri: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+2012-02-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] network worker tests crash on qt.
+        https://bugs.webkit.org/show_bug.cgi?id=79263
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::createDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+
+2012-02-24  Andreas Kling  <awesomekling@apple.com>
+
+        Miscellaneous CSSParser dodging in presentation attribute parsing.
+        <http://webkit.org/b/79468>
+
+        Reviewed by Antti Koivisto.
+
+        - Bypass CSSParser when adding constant values to attribute styles.
+        - Added fast paths for the valid HTMLTablePartElement align values.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::collectStyleForAttribute):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+
+2012-02-24  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Avoid culling work for fully-non-opaque tiles, and add tracing for draw culling
+        https://bugs.webkit.org/show_bug.cgi?id=79183
+
+        Reviewed by James Robinson.
+
+        Addresses performance issues with draw culling by avoiding the work
+        of mapRect and other function calls when the quad has no opaque area.
+        And adds a TRACE_EVENT to watch the time spent in draw culling.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+
+2012-02-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Scripts panel navigator overlay should be shown automatically only one time.
+        https://bugs.webkit.org/show_bug.cgi?id=79467
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWillHide):
+
+2012-02-23  MORITA Hajime  <morrita@google.com>
+
+        Adding a ShadowRoot to image-backed element causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=78878
+
+        Reviewed by Dimitri Glazkov.
+
+        The crash happened because NodeRenderingContext tried to append a
+        child to a renderer regardless one isn't capable of holding any
+        children if it appears in the shadow attaching phase. RenderImage
+        is one of such renderer classes which aren't capable.
+
+        NodeRenderingContext decide whether the contextual node as a child
+        can create its renderer based on RenderObject::canHaveChildren()
+        and Node::childShouldCreateRenderer(). But the responsibility
+        between these two methods are getting confused. which results this
+        unfortuante crash path.
+
+        This change re-aligns the responsibility:
+
+        - Now canHaveChildren() purely declares the ability of the
+          renderer. If the renderer is capable of having children, it
+          return true regardless of HTML semantics.
+
+        - On the other hand, childShouldCreateRenderer() cares about the
+          semantics. If the element doesn't allow children to be rendered,
+          this returns false.
+
+        - Note that these decision on elements are contextual. Each element
+          needs to know which role it is playing in the tree composition
+          algorithm of Shadow DOM. That's why the method parameter is changed
+          from Node* to NodeRenderingContext.
+
+        - Fixed updateFirstLetter() which relied on this confused assumption.
+          This change introduces RenderDeprecatedFlexibleBox::buttonText()
+          to refine the relying assumption.
+
+        With this change, some decision points are moved from a renderer to an
+        element. Following renderers no longer stop reject having children:
+
+        - RenderButton, RenderListBox, RenderMenuList, RenderMeter,
+          RenderProgress, RenderTextControl.
+
+        Corresponding element for such a render (HTMLProgressElement of
+        RenderProgress for exaple) now cares about that.
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests: fast/dom/shadow/shadow-on-image-expected.html
+               fast/dom/shadow/shadow-on-image.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::childShouldCreateRenderer):
+        * dom/Element.h:
+        (Element):
+        * dom/Node.h:
+        (WebCore::Node::childShouldCreateRenderer):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        (WebCore):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        * html/HTMLDetailsElement.h:
+        (HTMLDetailsElement):
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+        (WebCore::HTMLMediaElement::childShouldCreateRenderer):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLMeterElement.h:
+        (HTMLMeterElement):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLProgressElement.h:
+        (HTMLProgressElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderDeprecatedFlexibleBox.h:
+        (WebCore::RenderDeprecatedFlexibleBox::buttonText):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::canHaveChildren):
+        * rendering/RenderMenuList.h:
+        (RenderMenuList):
+        (WebCore::RenderMenuList::hasControlClip):
+        * rendering/RenderMeter.h:
+        * rendering/RenderProgress.h:
+        * rendering/RenderTextControl.h:
+        * rendering/svg/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::canHaveChildren):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childShouldCreateRenderer):
+        * svg/SVGAElement.h:
+        (SVGAElement):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
+        * svg/SVGAltGlyphElement.h:
+        (SVGAltGlyphElement):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+        (SVGDocument):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::childShouldCreateRenderer):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::childShouldCreateRenderer):
+        * svg/SVGForeignObjectElement.h:
+        (SVGForeignObjectElement):
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::childShouldCreateRenderer):
+        * svg/SVGSwitchElement.h:
+        (SVGSwitchElement):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::childShouldCreateRenderer):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::childShouldCreateRenderer):
+        * svg/SVGTSpanElement.h:
+        (SVGTSpanElement):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::childShouldCreateRenderer):
+        * svg/SVGTextElement.h:
+        (SVGTextElement):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::childShouldCreateRenderer):
+        * svg/SVGTextPathElement.h:
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Support [Supplemental] on static methods
+        https://bugs.webkit.org/show_bug.cgi?id=79357
+
+        Reviewed by Adam Barth.
+
+        [Supplemental] on static methods does not work in CodeGeneratorJS.pm
+        and CodeGeneratorV8.pm due to mis-ordered if-elsif statements.
+        This patch fixes it and supports [Supplemental] on static methods.
+
+        Test: bindings/scripts/test/TestSupplemental.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified as described above.
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateFunctionCallString):
+
+        * bindings/scripts/test/TestSupplemental.idl: Added a test case.
+
+        * bindings/scripts/test/CPP/WebDOMTestInterface.cpp: Updated run-bindings-tests results.
+        (WebDOMTestInterface::supplementalMethod4):
+        * bindings/scripts/test/CPP/WebDOMTestInterface.h: Ditto.
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp: Ditto.
+        (webkit_dom_test_interface_supplemental_method4):
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.h: Ditto.
+        * bindings/scripts/test/JS/JSTestInterface.cpp: Ditto.
+        (WebCore):
+        (WebCore::JSTestInterfaceConstructor::getOwnPropertySlot):
+        (WebCore::JSTestInterfaceConstructor::getOwnPropertyDescriptor):
+        (WebCore::jsTestInterfaceConstructorFunctionSupplementalMethod4):
+        * bindings/scripts/test/JS/JSTestInterface.h: Ditto.
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestInterface.h: Ditto.
+        * bindings/scripts/test/ObjC/DOMTestInterface.mm: Ditto.
+        (-[DOMTestInterface supplementalMethod4]):
+        * bindings/scripts/test/V8/V8TestInterface.cpp: Ditto.
+        (TestInterfaceInternal):
+        (WebCore::TestInterfaceInternal::supplementalMethod4Callback):
+        (WebCore::ConfigureV8TestInterfaceTemplate):
+
+2012-02-24  Tony Chang  <tony@chromium.org>
+
+        Small refactor in RenderFlexibleBox::layoutAndPlaceChildren
+        https://bugs.webkit.org/show_bug.cgi?id=79420
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, just a refactor.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Share some of the logic
+        in computing the cross axis length.
+
+2012-02-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: cannot drag timeline overview window when clicking inside the window
+        https://bugs.webkit.org/show_bug.cgi?id=79453
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-overview-window-rulers):
+
+2012-02-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108731.
+        http://trac.webkit.org/changeset/108731
+        https://bugs.webkit.org/show_bug.cgi?id=79464
+
+        Broke Chromium Win tests (Requested by bashi on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::fail):
+        (WebCore::WebSocketChannel::processFrame):
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Removed.
+        * websockets/WebSocketDeflateFramer.h: Removed.
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Show scripts panel navigator overlay on the first scripts panel opening.
+        https://bugs.webkit.org/show_bug.cgi?id=79248
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.wasShown):
+        (WebInspector.ScriptsPanel.prototype.set _showNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+
+2012-02-24  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc(): handle non-negative values
+        https://bugs.webkit.org/show_bug.cgi?id=79188
+
+        Reviewed by Daniel Bates.
+
+        Some CSS properties (e.g. padding) are required to be non-negative. These
+        are now restricted to the correct range.
+
+        Tests: css3/calc/negative-padding-expected.html
+               css3/calc/negative-padding.html
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore):
+        (WebCore::CSSCalcValue::clampToPermittedRange): Added
+        (WebCore::CSSCalcValue::doubleValue):
+        (WebCore::CSSCalcValue::isNegative): Added
+        (WebCore::CSSCalcValue::computeLengthPx):
+        (WebCore::CSSCalcValue::create):
+        * css/CSSCalculationValue.h:
+        (CSSCalcValue):
+        (WebCore::CSSCalcValue::CSSCalcValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validCalculationUnit):
+        (WebCore::CSSParser::parseCalculation):
+        * css/CSSParser.h:
+        * platform/CalculationValue.h:
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] xhr tests are crashing after r108506.
+        https://bugs.webkit.org/show_bug.cgi?id=79265
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setInitialScriptContent):
+        (WebCore::InspectorResourceAgent::setInitialXHRContent):
+
+2012-02-24  Huang Dongsung  <luxtella@company100.net>
+
+        Rename LocalStorageThread to StorageThread and LocalStorageTask to StorageTask.
+        https://bugs.webkit.org/show_bug.cgi?id=79358
+
+        Revision 45124 commented FIXME to rename these classes.
+
+        Reviewed by Kentaro Hara.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/LocalStorageTask.h: Removed.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        (WebCore::StorageSyncManager::scheduleDeleteEmptyDatabase):
+        * storage/StorageSyncManager.h:
+        (WebCore):
+        (StorageSyncManager):
+        * storage/StorageTask.cpp: Renamed from Source/WebCore/storage/LocalStorageTask.cpp.
+        (WebCore):
+        (WebCore::StorageTask::StorageTask):
+        (WebCore::StorageTask::~StorageTask):
+        (WebCore::StorageTask::performTask):
+        * storage/StorageTask.h: Added.
+        (WebCore):
+        (StorageTask):
+        (WebCore::StorageTask::createImport):
+        (WebCore::StorageTask::createSync):
+        (WebCore::StorageTask::createDeleteEmptyDatabase):
+        (WebCore::StorageTask::createOriginIdentifiersImport):
+        (WebCore::StorageTask::createSetOriginDetails):
+        (WebCore::StorageTask::createDeleteOrigin):
+        (WebCore::StorageTask::createDeleteAllOrigins):
+        (WebCore::StorageTask::createTerminate):
+        * storage/StorageThread.cpp: Renamed from Source/WebCore/storage/LocalStorageThread.cpp.
+        (WebCore):
+        (WebCore::StorageThread::create):
+        (WebCore::StorageThread::StorageThread):
+        (WebCore::StorageThread::~StorageThread):
+        (WebCore::StorageThread::start):
+        (WebCore::StorageThread::threadEntryPointCallback):
+        (WebCore::StorageThread::threadEntryPoint):
+        (WebCore::StorageThread::scheduleTask):
+        (WebCore::StorageThread::terminate):
+        (WebCore::StorageThread::performTerminate):
+        * storage/StorageThread.h: Renamed from Source/WebCore/storage/LocalStorageThread.h.
+        (WebCore):
+        (StorageThread):
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::StorageTracker):
+        (WebCore::StorageTracker::importOriginIdentifiers):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::scheduleTask):
+        (WebCore::StorageTracker::deleteAllOrigins):
+        (WebCore::StorageTracker::deleteOrigin):
+        * storage/StorageTracker.h:
+        (WebCore):
+        (StorageTracker):
+        * storage/wince/StorageThreadWinCE.cpp: Renamed from Source/WebCore/storage/wince/LocalStorageThreadWinCE.cpp.
+        (WebCore):
+        (WebCore::StorageThread::StorageThread):
+        (WebCore::StorageThread::~StorageThread):
+        (WebCore::StorageThread::start):
+        (WebCore::StorageThread::timerFired):
+        (WebCore::StorageThread::scheduleImport):
+        (WebCore::StorageThread::scheduleSync):
+        (WebCore::StorageThread::terminate):
+        (WebCore::StorageThread::performTerminate):
+        * storage/wince/StorageThreadWinCE.h: Renamed from Source/WebCore/storage/wince/LocalStorageThreadWinCE.h.
+        (WebCore):
+        (StorageThread):
+        (WebCore::StorageThread::create):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: prepare border images on timelines to enable zooming.
+        https://bugs.webkit.org/show_bug.cgi?id=79360
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/Images/timelineBarBlue.png:
+        * inspector/front-end/Images/timelineBarGray.png:
+        * inspector/front-end/Images/timelineBarGreen.png:
+        * inspector/front-end/Images/timelineBarOrange.png:
+        * inspector/front-end/Images/timelineBarPurple.png:
+        * inspector/front-end/Images/timelineBarRed.png:
+        * inspector/front-end/Images/timelineBarYellow.png:
+        * inspector/front-end/Images/timelineHollowPillBlue.png:
+        * inspector/front-end/Images/timelineHollowPillGray.png:
+        * inspector/front-end/Images/timelineHollowPillGreen.png:
+        * inspector/front-end/Images/timelineHollowPillOrange.png:
+        * inspector/front-end/Images/timelineHollowPillPurple.png:
+        * inspector/front-end/Images/timelineHollowPillRed.png:
+        * inspector/front-end/Images/timelineHollowPillYellow.png:
+        * inspector/front-end/Images/timelinePillBlue.png:
+        * inspector/front-end/Images/timelinePillGray.png:
+        * inspector/front-end/Images/timelinePillGreen.png:
+        * inspector/front-end/Images/timelinePillOrange.png:
+        * inspector/front-end/Images/timelinePillPurple.png:
+        * inspector/front-end/Images/timelinePillRed.png:
+        * inspector/front-end/Images/timelinePillYellow.png:
+        * inspector/front-end/inspectorCommon.css:
+        (body):
+        * inspector/front-end/networkLogView.css:
+        (.network-graph-bar):
+        (.resource-cached .network-graph-bar):
+        (.network-category-documents .network-graph-bar):
+        (.network-category-documents.resource-cached .network-graph-bar):
+        (.network-category-stylesheets .network-graph-bar):
+        (.network-category-stylesheets.resource-cached .network-graph-bar):
+        (.network-category-images.resource-cached .network-graph-bar):
+        (.network-category-fonts .network-graph-bar):
+        (.network-category-fonts.resource-cached .network-graph-bar):
+        (.network-category-scripts .network-graph-bar):
+        (.network-category-scripts.resource-cached .network-graph-bar):
+        (.network-category-xhr .network-graph-bar):
+        (.network-category-xhr.resource-cached .network-graph-bar):
+        (.network-category-websockets .network-graph-bar):
+        (.network-category-websockets.resource-cached .network-graph-bar):
+
+2012-02-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: exception in front-end on selecting an element in heap snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=79447
+
+        Fixed a typo in method name and added a check that selected node has
+        corresponding heap snapshot object before adding that object to the console
+        as $0 entry.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._inspectedObjectChanged):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: hide color picker upon panel switch.
+        https://bugs.webkit.org/show_bug.cgi?id=79355
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.willHide):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._showUserAgentStylesSettingChanged):
+        (WebInspector.StylesSidebarPane.prototype.willHide):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: make color review larger in the color picker.
+        https://bugs.webkit.org/show_bug.cgi?id=79339
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.hide):
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/elementsPanel.css:
+        (.spectrum-container):
+        (.spectrum-color):
+        (.spectrum-display-value):
+        (.spectrum-hue):
+        (.spectrum-fill):
+        (.spectrum-range-container label):
+        (.spectrum-range-container input):
+        (.spectrum-slider):
+        (.spectrum-container .swatch):
+        * inspector/front-end/inspector.css:
+        (.swatch):
+
+2012-02-23  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Add HarfBuzzShaperBase class
+        https://bugs.webkit.org/show_bug.cgi?id=79336
+
+        Extract a part of ComplexTextControllerHarfBuzz class as
+        HarfBuzzShaperBase class. This patch intends to share the code between
+        old HarfBuzz and HarfBuzz-ng.
+
+        Reviewed by Tony Chang.
+
+        No new tests. No behavior change. Existing tests in fast/text should pass.
+
+        * PlatformBlackBerry.cmake: Added HarfBuzzShaperBase.cpp.
+        * WebCore.gyp/WebCore.gyp: Added HarfBuzzShaperBase.(cpp|h).
+        * WebCore.gypi: Ditto.
+        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Removed redundant arguments.
+        (WebCore::ComplexTextController::nextScriptRun): Use m_normalizedBuffer and m_normalizedBufferLength instead of m_run.
+        (WebCore::ComplexTextController::setupFontForScriptRun): Ditto.
+        (WebCore::ComplexTextController::setGlyphPositions): Ditto.
+        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h:
+        (ComplexTextController):
+        * platform/graphics/harfbuzz/FontHarfBuzz.cpp:
+        (WebCore::Font::drawComplexText): Removed redundant arguments of ComplexTextController constructor.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        (WebCore::Font::selectionRectForComplexText): Ditto.
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp: Added.
+        (WebCore):
+        (WebCore::HarfBuzzShaperBase::HarfBuzzShaperBase):
+        (WebCore::normalizeSpacesAndMirrorChars):
+        (WebCore::HarfBuzzShaperBase::setNormalizedBuffer):
+        (WebCore::HarfBuzzShaperBase::isWordEnd):
+        (WebCore::HarfBuzzShaperBase::determineWordBreakSpacing):
+        (WebCore::HarfBuzzShaperBase::setPadding):
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.h: Added.
+        (WebCore):
+        (HarfBuzzShaperBase):
+        (WebCore::HarfBuzzShaperBase::~HarfBuzzShaperBase):
+        (WebCore::HarfBuzzShaperBase::isCodepointSpace):
+
+2012-02-23  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Add WebSocketDeflateFramer class which handles deflate-frame extension.
+        This class encapsulates WebSocketDeflater and WebSocketInflater classes,
+        which depend on zlib, so that WebSocketChannel is not necessary to aware
+        zlib dependency.
+
+        This is the second patch to land. The previous patch broke Chromium Win
+        release build. r108600 should fix the build failure. I also added
+        zlib entry to |export_dependent_settings| of |webcore_prerequisites|
+        target.
+
+        Reviewed by Kent Tamura.
+
+        Tests: http/tests/websocket/tests/hybi/compressed-control-frame.html
+               http/tests/websocket/tests/hybi/deflate-frame-comp-bit-onoff.html
+               http/tests/websocket/tests/hybi/deflate-frame-invalid-parameter.html
+               http/tests/websocket/tests/hybi/deflate-frame-parameter.html
+
+        * CMakeLists.txt: Added WebSocketDeflateFramer.(cpp|h)
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.gyp/WebCore.gyp: Added zlib dependency.
+        * WebCore.vcproj/WebCore.vcproj: Added WebSocketDeflateFramer.(cpp|h)
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect): Set m_extensions.
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect): Add deflate-frame extension processor to WebSocketHanshake if deflate can use.
+        (WebCore::WebSocketChannel::fail): Call m_deflateFramer.didFail().
+        (WebCore::WebSocketChannel::processFrame): Decompress frames if needed.
+        (WebCore::WebSocketChannel::sendFrame): Compress frames if possible.
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Added.
+        (WebCore):
+        (WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::create):
+        (WebCore::WebSocketExtensionDeflateFrame::~WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::handshakeString):
+        (WebCore::WebSocketExtensionDeflateFrame::processResponse):
+        (WebCore::DeflateResultHolder::DeflateResultHolder):
+        (WebCore::DeflateResultHolder::~DeflateResultHolder):
+        (WebCore::DeflateResultHolder::fail):
+        (WebCore::InflateResultHolder::InflateResultHolder):
+        (WebCore::InflateResultHolder::~InflateResultHolder):
+        (WebCore::InflateResultHolder::fail):
+        (WebCore::WebSocketDeflateFramer::WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::createExtensionProcessor):
+        (WebCore::WebSocketDeflateFramer::canDeflate):
+        (WebCore::WebSocketDeflateFramer::enableDeflate):
+        (WebCore::WebSocketDeflateFramer::deflate):
+        (WebCore::WebSocketDeflateFramer::resetDeflateContext):
+        (WebCore::WebSocketDeflateFramer::inflate):
+        (WebCore::WebSocketDeflateFramer::resetInflateContext):
+        (WebCore::WebSocketDeflateFramer::didFail):
+        * websockets/WebSocketDeflateFramer.h: Added.
+        (WebCore):
+        (DeflateResultHolder):
+        (WebCore::DeflateResultHolder::succeeded):
+        (WebCore::DeflateResultHolder::failureReason):
+        (InflateResultHolder):
+        (WebCore::InflateResultHolder::succeeded):
+        (WebCore::InflateResultHolder::failureReason):
+        (WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::enabled):
+
+2012-02-23  Andy Estes  <aestes@apple.com>
+
+        Rename [setS|s]uppressIncrementalRendering to [setS|s]uppressesIncrementalRendering and make it WebPreferences API.
+        https://bugs.webkit.org/show_bug.cgi?id=79433
+
+        Reviewed by Dan Bernstein.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::visualUpdatesAllowed):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setSuppressesIncrementalRendering):
+        (WebCore::Settings::suppressesIncrementalRendering):
+        (Settings):
+
+2012-02-23  Erik Arvidsson  <arv@chromium.org>
+
+        Rename DOMWindow to Window in the bindings
+        https://bugs.webkit.org/show_bug.cgi?id=78721
+
+        Reviewed by Adam Barth.
+
+        Covered by existing tests.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGenericObjectNode):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.isWindow):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get isWindow):
+        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
+        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
+        * page/DOMWindow.idl:
+
+2012-02-23  Shinya Kawanaka  <shinyak@chromium.org>
+
+        NodeRenderingContext should have ShadowRootList instead of ShadowRoot.
+        https://bugs.webkit.org/show_bug.cgi?id=79079
+
+        Reviewed by Dimitri Glazkov.
+
+        Apparently NodeRenderingContext should have ShadowRootList instead of ShadowRoot.
+        This patch changes it.
+
+        No new tests. Simple refactoring.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (WebCore):
+
+2012-02-23  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Implement keyframed animations for the cc thread.
+        https://bugs.webkit.org/show_bug.cgi?id=77229
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::hasActiveAnimation):
+        (WebCore):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
+        (WebCore::CCActiveAnimation::CCActiveAnimation):
+        (WebCore::CCActiveAnimation::isFinishedAt):
+        (WebCore::CCActiveAnimation::trimTimeToCurrentIteration):
+        (WebCore::CCActiveAnimation::cloneForImplThread):
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        (WebCore::CCActiveAnimation::curve):
+        (CCActiveAnimation):
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp: Added.
+        (WebCore::CCKeyframedFloatAnimationCurve::create):
+        (WebCore):
+        (WebCore::CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve):
+        (WebCore::CCKeyframedFloatAnimationCurve::~CCKeyframedFloatAnimationCurve):
+        (WebCore::CCKeyframedFloatAnimationCurve::duration):
+        (WebCore::CCKeyframedFloatAnimationCurve::clone):
+        (WebCore::CCKeyframedFloatAnimationCurve::getValue):
+        (WebCore::CCKeyframedTransformAnimationCurve::create):
+        (WebCore::CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::duration):
+        (WebCore::CCKeyframedTransformAnimationCurve::clone):
+        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h: Added.
+        (WebCore):
+        (WebCore::CCFloatKeyframe::CCFloatKeyframe):
+        (CCFloatKeyframe):
+        (WebCore::CCTransformKeyframe::CCTransformKeyframe):
+        (CCTransformKeyframe):
+        (CCKeyframedFloatAnimationCurve):
+        (CCKeyframedTransformAnimationCurve):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
+        (WebCore::CCLayerAnimationController::addAnimation):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        (WebCore::CCLayerAnimationController::hasActiveAnimation):
+        (CCLayerAnimationController):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+
+2012-02-23  Raymond Toy  <rtoy@google.com>
+
+        Use MathExtras round() in timeToSampleFrame
+        https://bugs.webkit.org/show_bug.cgi?id=79281
+
+        Reviewed by Chris Rogers.
+
+        No new tests. Existing tests cover this change.
+
+        * platform/audio/AudioUtilities.cpp:
+        (WebCore::AudioUtilities::timeToSampleFrame): Use round(). 
+
+2012-02-23  Greg Billock  <gbillock@google.com>
+
+        Don't clear IntentRequest callback pointers on stop()
+
+        This causes re-entry into ScriptExecutionContext when
+        the ActiveDOMCallback objects get deleted, which crashes.
+        Instead, just de-activate the object and wait for
+        context destruction to clean up.
+
+        Test crashes consistently without fix and passes with fix.
+        Added some test infrastructure to support this test.
+        https://bugs.webkit.org/show_bug.cgi?id=78638
+
+        Reviewed by Adam Barth.
+
+        * Modules/intents/IntentRequest.cpp:
+        (WebCore::IntentRequest::IntentRequest):
+        (WebCore::IntentRequest::stop):
+        (WebCore::IntentRequest::postResult):
+        (WebCore::IntentRequest::postFailure):
+        * Modules/intents/IntentRequest.h:
+        (IntentRequest):
+
+2012-02-23  Konrad Piascik  <kpiascik@rim.com>
+
+        Upstream BlackBerry Cookie Management Classes
+        https://bugs.webkit.org/show_bug.cgi?id=73654
+
+        Reviewed by Rob Buis.
+
+        Added ManualTests/cookieSpeedTest.html as well as tested functionality
+        on the BlackBerry port with http://testsuites.opera.com/cookies/
+        Passes all non Cookie 2 tests since Cookie 2 is not implemented/supported at this time.
+        Error handling and extended tests do not all pass and will be updated with future bugs/patches.
+
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp: Added.
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h: Added.
+        * platform/blackberry/CookieJarBlackBerry.cpp: Added.
+        * platform/blackberry/CookieManager.cpp: Added.
+        * platform/blackberry/CookieManager.h: Added.
+        * platform/blackberry/CookieMap.cpp: Added.
+        * platform/blackberry/CookieMap.h: Added.
+        * platform/blackberry/CookieParser.cpp: Added.
+        * platform/blackberry/CookieParser.h: Added.
+        * platform/blackberry/ParsedCookie.cpp: Added.
+        * platform/blackberry/ParsedCookie.h: Added.
+
+2012-02-23  Levi Weintraub  <leviw@chromium.org>
+
+        Switch drawLineForBoxSide to use integers
+        https://bugs.webkit.org/show_bug.cgi?id=78647
+
+        Reviewed by Eric Seidel.
+
+        drawLineForBoxSide handles painting lines for boxes which must be done on pixel boundaries.
+        Its interface doesn't make it possible to pixel snap properly within the function itself --
+        it draws one side of the box at a time, and the logical right and bottom lines can only be
+        properly determined using the logical top and left positions -- so it needs to be treated 
+        like a graphics context function, whereby the caller handles the proper pixel snapping before
+        passing the values in.
+
+        No new tests. No change in behavior.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRectFromEdges): convenience function for returning a pixel snapped
+        int rect from four LayoutUnits that are its edges (as opposed to position and size).
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnRules): Pixel snapping the column rule rect.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintOneBorderSide): Side rects are now IntRects by the time
+        they get to paintOneBorderSide.
+        (WebCore::calculateSideRect): Properly use RoundedRect as IntRects instead of LayoutRects.
+        (WebCore::RenderBoxModelObject::paintBorderSides): Ditto.
+        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
+        (WebCore::calculateSideRectIncludingInner): Ditto.
+        * rendering/RenderBoxModelObject.h:
+        (RenderBoxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine): Outline widths are related to borders and stored
+        as ints. Removing an unnecessary conversion to LayoutUnits. Pixel snapping the edges of the box.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide): Moving back to integers and removing an
+        unnecessary pixelSnappedIntRect call.
+        (WebCore::RenderObject::paintOutline): Pixel snapping the column rule rect and using an integer
+        for outlineOffset.
+        * rendering/RenderObject.h:
+        (RenderObject):
+
+2012-02-23  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/IntPoint.h
+        https://bugs.webkit.org/show_bug.cgi?id=79094
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::IntPoint and BlackBerry::Platform::IntPoint.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/IntPoint.h:
+        (Platform):
+        (IntPoint):
+
+2012-02-23  Justin Novosad  <junov@chromium.org>
+
+        [Chromium] Add profiling trace for deferred canvas rendering
+        https://bugs.webkit.org/show_bug.cgi?id=79376
+
+        Reviewed by Stephen White.
+
+        No new tests.
+
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::paintContentsIfDirty):
+        Profiling trace for the entire method, as well as for
+        calls to canvas flush and context flush, both of which may
+        cause deferred operation to be executed.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::bitmap):
+        Inserting a profiling trace in this method because it may cause
+        deferred draw commands to be executed.
+
+2012-02-23  Shinya Kawanaka  <shinyak@chromium.org>
+
+        ShadowRootList should have recalculation flag instead of ShadowRoot.
+        https://bugs.webkit.org/show_bug.cgi?id=79071
+
+        Reviewed by Hajime Morita.
+
+        When light children or shadow children are changed, we currently re-construct a shadow subtree.
+        However, when supporting multiple shadow subtrees, all shadow subtrees should be re-constructed.
+        So ShadowRootList should have re-construction flag instead of ShadowRoot.
+
+        Also, re-construction methods in ShadowRoot should be moved to ShadowRootList.
+
+        No new tests, should be convered by existing tests.
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::childrenChanged):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::list):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (ShadowRoot):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::ShadowRootList):
+        (WebCore::ShadowRootList::reattach):
+        (WebCore):
+        (WebCore::ShadowRootList::childNeedsStyleRecalc):
+        (WebCore::ShadowRootList::needsStyleRecalc):
+        (WebCore::ShadowRootList::recalcShadowTreeStyle):
+        (WebCore::ShadowRootList::needsReattachHostChildrenAndShadow):
+        (WebCore::ShadowRootList::hostChildrenChanged):
+        (WebCore::ShadowRootList::setNeedsReattachHostChildrenAndShadow):
+        (WebCore::ShadowRootList::reattachHostChildrenAndShadow):
+        * dom/ShadowRootList.h:
+        (WebCore):
+        (ShadowRootList):
+        (WebCore::ShadowRootList::clearNeedsReattachHostChildrenAndShadow):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        (WebCore::HTMLContentElement::parseAttribute):
+
+2012-02-23  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Unreviewed: add clause in ASSERT missing from r108474.
+
+        No new tests. (fix)
+
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::willRemove):
+
+2012-02-23  Eric Seidel  <eric@webkit.org>
+
+        Split out HTML constructors into new DOMWindowHTML suplemental idl
+        https://bugs.webkit.org/show_bug.cgi?id=79377
+
+        Reviewed by Adam Barth.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DOMWindowHTML.idl: Added.
+        * page/DOMWindow.idl:
+
+2012-02-23  Eric Seidel  <eric@webkit.org>
+
+        Move SVG element constructors out of DOMWindow.idl into a new DOMWindowSVG.idl suplemental
+        https://bugs.webkit.org/show_bug.cgi?id=79379
+
+        Reviewed by Adam Barth.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/DOMWindow.idl:
+        * svg/DOMWindowSVG.idl: Added.
+
+2012-02-23  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Plumb video damage to the damage tracker.
+        https://bugs.webkit.org/show_bug.cgi?id=79373
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::contentChanged):
+        (WebCore):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (VideoLayerChromium):
+
+2012-02-23  MORITA Hajime  <morrita@google.com>
+
+        This test checks select attribute of content element is valid.
+        https://bugs.webkit.org/show_bug.cgi?id=65595
+
+        Reviewed by Dimitri Glazkov.
+
+        This change introduces FrameTree::scopedChild() and
+        FrameTree::scopedChild(), which can be used for scope-aware
+        frame lookup. Using these, the named accessor and the indexed
+        acceccor on Document, and Window.length are now TreeScope
+        aware. They don't count iframes in Shadow DOM.
+
+        This change also removes FrameTree::m_childCount since
+        Frame::childCount() is no longer in the hot
+        path. m_scopedChildCount is added instead.
+
+        Test: fast/dom/shadow/iframe-shadow.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::childFrameGetter):
+        (WebCore::indexGetter):
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::indexedPropertyGetter):
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        (WebCore::V8DOMWindow::namedSecurityCheck):
+        (WebCore::V8DOMWindow::indexedSecurityCheck):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::length):
+        * page/Frame.cpp:
+        (WebCore::Frame::inScope):
+        (WebCore):
+        * page/Frame.h:
+        (WebCore):
+        (Frame):
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::actuallyAppendChild):
+        (WebCore::FrameTree::removeChild):
+        (WebCore::FrameTree::scopedChild):
+        (WebCore):
+        (WebCore::FrameTree::scopedChildCount):
+        (WebCore::FrameTree::childCount):
+        * page/FrameTree.h:
+        (WebCore):
+        (FrameTree):
+        (WebCore::FrameTree::FrameTree):
+
+2012-02-23  Philip Rogers  <pdr@google.com>
+
+        Recompute font metrics on scale changes
+        https://bugs.webkit.org/show_bug.cgi?id=75091
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG text metrics depend on the transform from renderer to the svg root
+        which requires that we propagate transform changes down to text.
+        This change adds a boolean for tracking transform changes to
+        SVGViewportContainers and SVGTransformableContainers, and updates
+        RenderSVGText::layout() to recalculate text metrics if the transform
+        of an ancestor has changed.
+
+        Tests: platform/mac/svg/text/text-rescale.html
+               platform/mac/svg/text/text-viewbox-rescale.html
+               svg/text/text-rescale.html
+               svg/text/text-viewbox-rescale.html
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGTransformableContainer):
+        (WebCore::RenderObject::isSVGViewportContainer):
+        * rendering/svg/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::didTransformToRootUpdate):
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeNewScaledFontForStyle):
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::RenderSVGText):
+        (WebCore::RenderSVGText::layout):
+        * rendering/svg/RenderSVGText.h:
+        (WebCore::RenderSVGText::setNeedsTextMetricsUpdate):
+        (RenderSVGText):
+        * rendering/svg/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::RenderSVGTransformableContainer):
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/svg/RenderSVGTransformableContainer.h:
+        (WebCore::RenderSVGTransformableContainer::isSVGTransformableContainer):
+        (WebCore::RenderSVGTransformableContainer::didTransformToRootUpdate):
+        (RenderSVGTransformableContainer):
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::didTransformToRootUpdate):
+        (RenderSVGViewportContainer):
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::transformToRootChanged):
+        (WebCore):
+        (WebCore::SVGRenderSupport::layoutChildren):
+        * rendering/svg/SVGRenderSupport.h:
+        (SVGRenderSupport):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Notify compositor of wheel event registration via ScrollingCoordinator
+        https://bugs.webkit.org/show_bug.cgi?id=79133
+
+        Reviewed by Dimitri Glazkov.
+
+        This notifies the chromium compositor of changes to the number of wheel event handlers via ScrollingCoordinator
+        instead of through ChromeClient/WebViewImpl. This is the path we'll use for other properties in the future and
+        is more extensible for handling things other than the root layer.
+
+        Property behavior is covered by new unit tests in LayerChromiumTests and CCLayerTreeHostImplTest.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore):
+        (ScrollingCoordinator):
+            Add a ScrollingCoordinatorPrivate so implementations can tack on additional data without having to #ifdef up
+            ScrollingCoordinator.h/cpp
+        * page/scrolling/ScrollingCoordinatorNone.cpp:
+        (WebCore):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (ScrollingCoordinatorPrivate):
+            ScrollingCoordinatorPrivate in the chromium implementation keeps a reference to the scroll layer.
+        (WebCore::ScrollingCoordinatorPrivate::ScrollingCoordinatorPrivate):
+        (WebCore::ScrollingCoordinatorPrivate::~ScrollingCoordinatorPrivate):
+        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
+        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
+        (WebCore):
+        (WebCore::ScrollingCoordinator::create):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setHaveWheelEventHandlers):
+        (WebCore):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCInputHandler.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::haveWheelEventHandlers):
+        (WebCore::CCLayerImpl::setHaveWheelEventHandlers):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::scrollBegin):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+
+2012-02-23  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Clipping is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78677
+
+        Reviewed by Simon Hausmann.
+
+        Rework the clipping stack in TextureMapperGL.
+        Instead of saving a stack of IntRect scissor clips, we save every clipping change in the
+        stack, and reapply it when we end the clip. Popping the stack is almost free, since we
+        don't reapply the stencil but simply change the stencil test index.
+
+        In addition, we don't use a special shader for clipping, and we don't apply clipping for
+        masked children, since they're already clipped because they're rendered into an intermediate
+        buffer.
+
+        This fixes exiting tests in LayoutTests/compositing/overflow.
+        It also fixes asserts in the leaves demo, as well as asserts in nytimes.com and other sites.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (ClipState):
+        (WebCore::TextureMapperGLData::SharedGLData::ClipState::ClipState):
+        (SharedGLData):
+        (WebCore::TextureMapperGLData::SharedGLData::pushClipState):
+        (WebCore::TextureMapperGLData::SharedGLData::popClipState):
+        (WebCore::TextureMapperGLData::SharedGLData::scissorClip):
+        (WebCore::TextureMapperGLData::SharedGLData::applyCurrentClip):
+        (TextureMapperGLData):
+        (BitmapTextureGL):
+        (WebCore::TextureMapperGLData::initStencil):
+        (WebCore):
+        (WebCore::TextureMapperGL::beginPainting):
+        (WebCore::TextureMapperGL::endPainting):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::BitmapTextureGL::initStencil):
+        (WebCore::BitmapTextureGL::bind):
+        (WebCore::BitmapTextureGL::destroy):
+        (WebCore::TextureMapperGL::bindSurface):
+        (WebCore::TextureMapperGL::beginScissorClip):
+        (WebCore::TextureMapperGL::beginClip):
+        (WebCore::TextureMapperGL::endClip):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::paintSelfAndChildren):
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+
+2012-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108685.
+        http://trac.webkit.org/changeset/108685
+        https://bugs.webkit.org/show_bug.cgi?id=79414
+
+        Broke Chromium builds (Requested by enne on #webkit).
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+
+2012-02-23  Koji Ishii  <kojiishi@gmail.com>
+
+        CSS2:text-decoration: <rt> element should not inherit text-decoration property
+        https://bugs.webkit.org/show_bug.cgi?id=71266
+
+        Reviewed by Kentaro Hara.
+
+        Tests: fast/ruby/text-decoration-in-descendants-ruby-expected.html
+               fast/ruby/text-decoration-in-descendants-ruby.html
+
+        The spec says "text decorations are not propagated to any out-of-flow descendants":
+        http://www.w3.org/TR/2011/WD-css3-text-20110901/#decoration
+        Floats etc. are fixed in bug 18611, but <rt> is not inline either and therefore
+        it should be included; it was confirmed at a discussion at www-style.
+        http://lists.w3.org/Archives/Public/www-style/2011Sep/0238.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTextDecorationColors):
+
+2012-02-23  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Allow to use WebCore imagedecoders
+        https://bugs.webkit.org/show_bug.cgi?id=32410
+
+        Add ENABLE(QT_IMAGE_DECODER) guards around Qt imagedecoders and set it to default.
+        By passing ENABLE_QT_IMAGE_DECODER=0 define to the build system WebKit will build
+        with WebCore's imagedecoders.
+
+        I added NO_RETURN attribute to 2 functions of PNG and JPEG decoders to avoid compiler warnings
+        because in Qt-port we treat warning as errors (-Werror).
+
+        I'm continuing the refactoring of this area and try to use Qt imagedecoders only in 
+        cases when WebCore doesn't support the image format.
+
+        Reviewed by Simon Hausmann.
+
+        No behavior change, no need new tests.
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        (WebCore):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore):
+        (WebCore::ImageFrame::asNewNativeImage):
+
+2012-02-23  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Push CCLayerIteratorPosition struct into CCLayerIterator class.
+        https://bugs.webkit.org/show_bug.cgi?id=75864
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::operator++):
+        (WebCore::CCLayerIterator::operator==):
+        (WebCore::CCLayerIterator::operator->):
+        (WebCore::CCLayerIterator::operator*):
+        (WebCore::CCLayerIterator::representsTargetRenderSurface):
+        (WebCore::CCLayerIterator::representsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayer):
+        (WebCore::CCLayerIterator::currentLayerRepresentsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayerRepresentsTargetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIterator::targetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceChildren):
+        * platform/graphics/chromium/cc/CCLayerIteratorPosition.h: Removed.
+
+2012-02-23  Daniel Sievers  <sievers@chromium.org>
+
+        [Chromium] Add video stream texture support
+        https://bugs.webkit.org/show_bug.cgi?id=78398
+
+        This upstreams the abstraction used on Android for
+        hardware video decoding with the compositor.
+
+        Most of the interfaces are kept generic and the core
+        of this change is to allow texturing from an external
+        texture while receiving notifications (on the compositor
+        thread if we are running it) when there are new frames to
+        be displayed.
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawSingleTextureVideoQuad):
+        (WebCore::LayerRendererChromium::drawRGBA):
+        (WebCore::LayerRendererChromium::drawNativeTexture):
+        (WebCore):
+        (WebCore::LayerRendererChromium::drawStreamTexture):
+        (WebCore::LayerRendererChromium::drawVideoQuad):
+        (WebCore::LayerRendererChromium::streamTextureLayerProgram):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::VertexShaderVideoTransform::VertexShaderVideoTransform):
+        (WebCore):
+        (WebCore::VertexShaderVideoTransform::init):
+        (WebCore::VertexShaderVideoTransform::getShaderString):
+        (WebCore::FragmentShaderOESImageExternal::init):
+        (WebCore::FragmentShaderOESImageExternal::getShaderString):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (VertexShaderVideoTransform):
+        (WebCore::VertexShaderVideoTransform::matrixLocation):
+        (WebCore::VertexShaderVideoTransform::texTransformLocation):
+        (WebCore::VertexShaderVideoTransform::texMatrixLocation):
+        (WebCore):
+        (FragmentShaderOESImageExternal):
+        * platform/graphics/chromium/VideoFrameChromium.h:
+        * platform/graphics/chromium/VideoFrameProvider.h:
+        (Client):
+        (VideoFrameProvider):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.cpp:
+        (WebCore::CCVideoDrawQuad::CCVideoDrawQuad):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.h:
+        (WebCore::CCVideoDrawQuad::matrix):
+        (CCVideoDrawQuad):
+        (WebCore::CCVideoDrawQuad::setMatrix):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore):
+        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
+        (WebCore::convertVFCFormatToGC3DFormat):
+        (WebCore::CCVideoLayerImpl::appendQuads):
+        (WebCore::CCVideoLayerImpl::didReceiveFrame):
+        (WebCore::CCVideoLayerImpl::didUpdateMatrix):
+        (WebCore::CCVideoLayerImpl::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (WebCore):
+        (CCVideoLayerImpl):
+
+2012-02-23  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Implement drop-shadow() CSS filter on composited layers.
+        https://bugs.webkit.org/show_bug.cgi?id=79386
+
+        Reviewed by James Robinson.
+
+        Covered by css3/filters/effect-drop-shadow-hw.html
+
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+        (WebCore::CCRenderSurfaceFilters::apply):
+        * platform/graphics/filters/FilterOperation.h:
+        (WebCore::DropShadowFilterOperation::movesPixels):
+
+2012-02-23  Erik Arvidsson  <arv@chromium.org>
+
+        Add support for InterfaceName in the bindings
+        https://bugs.webkit.org/show_bug.cgi?id=79384
+
+        Reviewed by Adam Barth.
+
+        This makes the interface name part of the idl file instead of being hard coded into the code generators.
+
+        * bindings/scripts/CodeGenerator.pm:
+        (GetVisibleInterfaceName): Extracted from CodeGenerator{JS,V8}.pm and changed to look at the extended attribute.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::ConfigureV8TestObjTemplate):
+        * dom/DOMCoreException.idl: Set the InterfaceName.
+        * html/DOMFormData.idl: Ditto.
+        * plugins/DOMMimeType.idl: Ditto.
+        * plugins/DOMMimeTypeArray.idl: Ditto.
+        * plugins/DOMPlugin.idl: Ditto.
+        * plugins/DOMPluginArray.idl: Ditto.
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r99076): WebKit pastes the trailing newline into a single-line text field
+        https://bugs.webkit.org/show_bug.cgi?id=79305
+
+        Reviewed by Tony Chang.
+
+        The bug was caused by ReplacementFragment::m_hasInterchangeNewlineAtEnd not reset even when
+        text field's beforeTextInserted event handler removed interchange new lines at the end.
+        Because the event handler is responsible for trimming new lines, we need to recompute the values
+        for m_hasInterchangeNewlineAt* after the event dispatch.
+
+        Test: editing/input/paste-text-ending-with-interchange-newline.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+
+2012-02-23  Andreas Kling  <awesomekling@apple.com>
+
+        Make use of StylePropertySet::setProperty(propertyID, CSSValue).
+        <http://webkit.org/b/79374>
+
+        Reviewed by Antti Koivisto.
+
+        Use the new setProperty() overload that takes a CSSValue in more places. This allows us
+        to get rid of 1/3 setProperty() overloads that don't expand shorthands.
+
+        * css/StylePropertySet.h:
+        * css/StylePropertySet.cpp:
+
+            Remove the setProperty() overload for specific primitive value types. StyledElement
+            can take care of this without help from StylePropertySet.
+
+        * dom/StyledElement.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::addPropertyToAttributeStyle):
+
+            Switch some functions over to using the setProperty() overload that takes a CSSValue.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::applyBorderAttributeToStyle):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+
+            Use shorthands where possible to shrink the code a bit. Pass border widths as CSS_PX
+            values directly instead of making a CSSParser round-trip.
+
+2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, use the strings in LocalizedStrings.cpp.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::localizedString):
+        (WebCore):
+
+2012-02-23  Alok Priyadarshi  <alokp@chromium.org>
+
+        Microsoft IE fishtank demo causes assertion in RenderLayer::convertToLayerCoords
+        https://bugs.webkit.org/show_bug.cgi?id=61964
+
+        Reviewed by James Robinson.
+        
+        The assertion is caused with the following callstack:
+        WebCore::RenderLayer::convertToLayerCoords
+        WebCore::RenderLayerCompositor::layerWillBeRemoved
+        WebCore::RenderLayer::removeChild
+        WebCore::RenderLayer::removeOnlyThisLayer
+        
+        WebCore::RenderLayer::removeOnlyThisLayer removes itself from the parent
+        before moving its children to its parent. When WebCore::RenderLayer::convertToLayerCoords
+        is called for one of the children, it tries to walk to root only to stop at the immediate
+        parent which was disconnected from the tree in WebCore::RenderLayer::removeOnlyThisLayer.
+        If removal of layer is delayed until the children has been moved, the ASSERT is avoided.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+
+2012-02-23  Matthew Delaney  <mdelaney@apple.com>
+
+        Fix for canvas breakage caused by r108597 from the following:
+        https://bugs.webkit.org/show_bug.cgi?id=79317
+
+        Reviewed by Oliver Hunt.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paintsIntoCanvasBuffer):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: mad Redo to Cmd+Shift+Z, not Cmd+Y on a Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=79341
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix after 108629.
+
+        * WebCore.exp.in:
+
+2012-02-23  Tom Sepez  <tsepez@chromium.org>
+
+        [chromium] XSS Auditor bypass via javascript url and control characters
+        https://bugs.webkit.org/show_bug.cgi?id=79154
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xssAuditor/javascript-link-control-char2.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore):
+        (WebCore::XSSAuditor::eraseDangerousAttributesIfInjected):
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
+        https://bugs.webkit.org/show_bug.cgi?id=79371
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt:
+
+2012-02-23  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Cleanup RenderBlock::moveChildrenTo
+        https://bugs.webkit.org/show_bug.cgi?id=79319
+
+        Reviewed by Eric Seidel.
+
+        Refactoring, no change in behavior expected.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::moveChildrenTo):
+        Removed inline check that was redundant, switched to |while| to a |for|
+        to show what's going on more closely and adds a call to moveChildTo to
+        share more code between the 2 functions.
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Add support for touch cancellation
+        https://bugs.webkit.org/show_bug.cgi?id=79348
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Map Qt touch cancel events to the WebCore equivalent.
+
+        No new tests, unskipped existing test for Qt 5.
+
+        * platform/PlatformTouchPoint.h:
+        (PlatformTouchPoint):
+        * platform/qt/PlatformTouchEventQt.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        * platform/qt/PlatformTouchPointQt.cpp:
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint):
+
+2012-02-23  Erik Arvidsson  <arv@chromium.org>
+
+        Unreviewed. Rebaseline binding test files.
+
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
+        (webkit_dom_test_interface_supplemental_method1):
+        (webkit_dom_test_interface_supplemental_method2):
+        (webkit_dom_test_interface_get_supplemental_str1):
+        (webkit_dom_test_interface_get_supplemental_str2):
+        (webkit_dom_test_interface_set_supplemental_str2):
+        (webkit_dom_test_interface_get_supplemental_node):
+        (webkit_dom_test_interface_set_supplemental_node):
+        (webkit_dom_test_interface_set_property):
+        (webkit_dom_test_interface_get_property):
+
+2012-02-23  Anders Carlsson  <andersca@apple.com>
+
+        Crash in ScrollElasticityController::snapRubberBandTimerFired()
+        https://bugs.webkit.org/show_bug.cgi?id=79372
+        <rdar://problem/10915193>
+
+        Reviewed by Andreas Kling.
+
+        Invalidate the rubber-band timer in the ScrollingTreeNodeMac destructor.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::~ScrollingTreeNodeMac):
+        (WebCore):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add experiment that loads stylesheets as links
+        https://bugs.webkit.org/show_bug.cgi?id=79340
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/View.js:
+        (WebInspector.View.prototype._doLoadCSS):
+
+2012-02-23  Adam Roben  <aroben@apple.com>
+
+        Mac build fix after r108615
+
+        * WebCore.exp.in: Added a missing export.
+
+2012-02-23  Adam Barth  <abarth@webkit.org>
+
+        Move MediaStream related declarations from DOMWindow to DOMWindowMediaStream
+        https://bugs.webkit.org/show_bug.cgi?id=79343
+
+        Reviewed by Eric Seidel.
+
+        These declarations belong in the MEDIA_STREAM module.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * mediastream/DOMWindowMediaStream.idl: Added.
+        * page/DOMWindow.idl:
+
+2012-02-22  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        Every call to RenderObject::setAnimatableStyle() iterates through all m_compositeAnimations: potentially O(N^2)
+        https://bugs.webkit.org/show_bug.cgi?id=38025
+
+        This patchs implements updateAnimationTimerForRenderer, it just checks the timeToNextService for
+        the current RenderObject reducing the amount of iterations.
+
+        Reviewed by Simon Fraser.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer):
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/AnimationControllerPrivate.h:
+        (AnimationControllerPrivate):
+
+2012-02-22  Hajime Morrita  <morrita@chromium.org>
+
+        NOTIFICATIONS should be implemented as PageSupplement
+        https://bugs.webkit.org/show_bug.cgi?id=79052
+
+        Reviewed by Adam Barth.
+
+        Turned NotificationController to a PageSupplement.
+
+        No new tests. No behavior change.
+
+        * notifications/NotificationController.cpp:
+        (WebCore::NotificationController::clientFrom):
+        (WebCore):
+        (WebCore::NotificationController::supplementName):
+        (WebCore::provideNotification):
+        * notifications/NotificationController.h:
+        (NotificationController):
+        (WebCore::NotificationController::from):
+        * notifications/NotificationPresenter.h:
+        (WebCore):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+
+2012-02-22  Dmitry Lomov  <dslomov@google.com>
+
+        [Chromium][V8] Support Uint8ClampedArray in postMessage
+        https://bugs.webkit.org/show_bug.cgi?id=79291.
+
+        Reviewed by Kenneth Russell.
+
+        Covered by existing tests.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+
+2012-02-22  Kentaro Hara  <haraken@chromium.org>
+
+        Enable Geolocation bindings for GObject
+        https://bugs.webkit.org/show_bug.cgi?id=79293
+
+        Reviewed by Adam Barth.
+
+        This patch adds "WebCore::" to supplemental method calls.
+        This will solve the GTK build failure we have observed in the Geolocation API,
+        and thus this patch enables the Geolocation API.
+
+        * Modules/geolocation/NavigatorGeolocation.idl:
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateProperty):
+        (GenerateFunction):
+
+2012-02-22  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] Align supplementName() values.
+        https://bugs.webkit.org/show_bug.cgi?id=79311
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavioral change.
+
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::supplementName):
+        * mediastream/UserMediaController.cpp:
+        (WebCore::UserMediaController::supplementName):
+
+2012-02-22  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108602.
+        http://trac.webkit.org/changeset/108602
+        https://bugs.webkit.org/show_bug.cgi?id=78878
+
+        Caused a couple of layout test failures on Chromium bots.
+
+        * dom/Element.cpp:
+        (WebCore::Element::childShouldCreateRenderer):
+        * dom/Element.h:
+        (Element):
+        * dom/Node.h:
+        (WebCore::Node::childShouldCreateRenderer):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        * html/HTMLDetailsElement.h:
+        (HTMLDetailsElement):
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * html/HTMLMeterElement.cpp:
+        * html/HTMLMeterElement.h:
+        (HTMLMeterElement):
+        * html/HTMLProgressElement.cpp:
+        * html/HTMLProgressElement.h:
+        (HTMLProgressElement):
+        * html/HTMLSelectElement.cpp:
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSummaryElement.cpp:
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+        * html/HTMLTextFormControlElement.cpp:
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::canHaveChildren):
+        (WebCore):
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::canHaveChildren):
+        (RenderListBox):
+        * rendering/RenderMedia.h:
+        * rendering/RenderMenuList.h:
+        (WebCore::RenderMenuList::canHaveChildren):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::canHaveChildren):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::canHaveChildren):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::canHaveChildren):
+        * rendering/svg/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::canHaveChildren):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childShouldCreateRenderer):
+        * svg/SVGAElement.h:
+        (SVGAElement):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
+        * svg/SVGAltGlyphElement.h:
+        (SVGAltGlyphElement):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+        (SVGDocument):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::childShouldCreateRenderer):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::childShouldCreateRenderer):
+        * svg/SVGForeignObjectElement.h:
+        (SVGForeignObjectElement):
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::childShouldCreateRenderer):
+        * svg/SVGSwitchElement.h:
+        (SVGSwitchElement):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::childShouldCreateRenderer):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::childShouldCreateRenderer):
+        * svg/SVGTSpanElement.h:
+        (SVGTSpanElement):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::childShouldCreateRenderer):
+        * svg/SVGTextElement.h:
+        (SVGTextElement):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::childShouldCreateRenderer):
+        * svg/SVGTextPathElement.h:
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderBlock::addChildIgnoringAnonymousColumnBlocks.
+        https://bugs.webkit.org/show_bug.cgi?id=79043
+
+        Reviewed by Julien Chaffraix.
+
+        Tests: fast/runin/runin-div-before-child.html
+               fast/runin/runin-table-before-child.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): handle
+        the case of run-in elements and strengthen code to handle cases where
+        beforeChild is incorrectly set.
+        * rendering/RenderObject.h: remove anonymousContainer function since
+        the new logic in RenderBlock does not need it.
+
+2012-02-22  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRootList manage a node distribution.
+        https://bugs.webkit.org/show_bug.cgi?id=79008
+
+        Reviewed by Dimitri Glazkov.
+
+        The result of node distributions is currently stored in
+        ShadowRoot. To support multiple ShadowRoots, such node distribution
+        information should be managed in one place per shadow host. Now
+        ShadowRootList takes this responsibility on behalf of owing
+        multiple ShadowRoots. Clients should ask ShadowRootList for such
+        information, not for each ShadowRoot.
+
+        No tests. No change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        (WebCore::ShadowRoot::attach):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::insertionPointFor):
+        (WebCore):
+        (WebCore::ShadowRootList::isSelectorActive):
+        (WebCore::ShadowRootList::ensureSelector):
+        * dom/ShadowRootList.h:
+        (WebCore):
+        (ShadowRootList):
+        (WebCore::ShadowRootList::hasShadowRoot):
+        (WebCore::ShadowRootList::youngestShadowRoot):
+        (WebCore::ShadowRootList::oldestShadowRoot):
+        (WebCore::ShadowRootList::selector):
+        (WebCore::ShadowRootList::host):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelector::willSelectOver):
+        * html/shadow/HTMLContentSelector.h:
+        (HTMLContentSelector):
+
+2012-02-22  Wei James  <james.wei@intel.com>
+
+        Add multi channels support in AudioBus and AudioBufferSourceNode
+        https://bugs.webkit.org/show_bug.cgi?id=79017
+
+        Reviewed by Chris Rogers.
+
+        Tests: webaudio/up-mixing-mono-51.html
+               webaudio/up-mixing-mono-stereo.html
+               webaudio/up-mixing-stereo-51.html
+
+        * platform/audio/AudioBus.cpp:
+        (WebCore::AudioBus::copyFrom):
+        (WebCore::AudioBus::sumFrom):
+        (WebCore::AudioBus::processWithGainFromMonoStereo):
+        (WebCore::AudioBus::processWithGainFrom):
+
+2012-02-22  Kentaro Hara  <haraken@chromium.org>
+
+        [Supplemental] should support constants
+        https://bugs.webkit.org/show_bug.cgi?id=79303
+
+        Reviewed by Adam Barth.
+
+        Given that we have
+
+            interface [Supplemental=Y] X { constant int A = 123; }
+
+        then the code generator should generate
+
+            X::A
+
+        to refer to the constant. However, the current code generator generates Y::A instead.
+        This patch fixes it.
+
+        Test: bindings/scripts/test/TestSupplemental.idl
+
+        * bindings/scripts/CodeGenerator.pm: Modified as described above.
+        (GenerateCompileTimeCheckForEnumsIfNeeded):
+
+        * bindings/scripts/test/JS/JSTestInterface.cpp: Updated run-bindings-tests results.
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.cpp: Ditto.
+        (WebCore):
+
+        * page/DOMWindow.h: Moved DOMWindow::FileSystemType to DOMWindowFileSystem::FileSystemType.
+        (DOMWindow):
+        * fileapi/DOMWindowFileSystem.h: Ditto.
+        (DOMWindowFileSystem):
+        * fileapi/DOMWindowFileSystem.cpp: Ditto.
+        (WebCore):
+
+2012-02-22  MORITA Hajime  <morrita@google.com>
+
+        Adding a ShadowRoot to image-backed element causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=78878
+
+        Reviewed by Dimitri Glazkov.
+
+        The crash happened because NodeRenderingContext tried to append a
+        child to a renderer regardless one isn't capable of holding any
+        children if it appears in the shadow attaching phase. RenderImage
+        is one of such renderer classes which aren't capable.
+
+        NodeRenderingContext decide whether the contextual node as a child
+        can create its renderer based on RenderObject::canHaveChildren()
+        and Node::childShouldCreateRenderer(). But the responsibility
+        between these two methods are getting confused. which results this
+        unfortuante crash path.
+
+        This change re-aligns the responsibility:
+
+        - Now canHaveChildren() purely declares the ability of the
+          renderer. If the renderer is capable of having children, it
+          return true regardless of HTML semantics.
+
+        - On the other hand, childShouldCreateRenderer() cares about the
+          semantics. If the element doesn't allow children to be rendered,
+          this returns false.
+
+        - Note that these decision on elements are contextual. Each element
+          needs to know which role it is playing in the tree composition
+          algorithm of Shadow DOM. That's why the method parameter is changed
+          from Node* to NodeRenderingContext.
+
+        With this change, some decision points are moved from a renderer to an
+        element. Following renderers no longer stop reject having children:
+
+        - RenderButton, RenderListBox, RenderMenuList, RenderMeter,
+          RenderProgress, RenderTextControl.
+
+        Corresponding element for such a render (HTMLProgressElement of
+        RenderProgress for exaple) now cares about that.
+
+        Tests: fast/dom/shadow/shadow-on-image-expected.html
+        fast/dom/shadow/shadow-on-image.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::childShouldCreateRenderer):
+        * dom/Element.h:
+        (Element):
+        * dom/Node.h:
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        (WebCore):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        * html/HTMLDetailsElement.h:
+        (HTMLDetailsElement):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLMeterElement.h:
+        (HTMLMeterElement):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::childShouldCreateRenderer):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLProgressElement.h:
+        (HTMLProgressElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSummaryElement.cpp:
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+        * html/HTMLTextFormControlElement.cpp:
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement):
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::canHaveChildren):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderMeter.h:
+        * rendering/RenderProgress.h:
+        * rendering/RenderTextControl.h:
+        * rendering/svg/RenderSVGRoot.h:
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childShouldCreateRenderer):
+        * svg/SVGAElement.h:
+        (SVGAElement):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
+        * svg/SVGAltGlyphElement.h:
+        (SVGAltGlyphElement):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+        (SVGDocument):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::childShouldCreateRenderer):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::childShouldCreateRenderer):
+        * svg/SVGForeignObjectElement.h:
+        (SVGForeignObjectElement):
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::childShouldCreateRenderer):
+        * svg/SVGSwitchElement.h:
+        (SVGSwitchElement):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::childShouldCreateRenderer):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::childShouldCreateRenderer):
+        * svg/SVGTSpanElement.h:
+        (SVGTSpanElement):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::childShouldCreateRenderer):
+        * svg/SVGTextElement.h:
+        (SVGTextElement):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::childShouldCreateRenderer):
+        * svg/SVGTextPathElement.h:
+
+2012-02-22  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] NetworkJob can access deleted objects.
+        https://bugs.webkit.org/show_bug.cgi?id=79246
+
+        Reviewed by Antonio Gomes.
+
+        When a NetworkJob is created by unload handler, we still need
+        to send the request to the server, but we shouldn't save and
+        keep using the Frame pointer because the frame is being detached.
+        The NetworkJob will be cancelled by PingLoader as soon as it gets
+        first response from host.
+        Also see https://bugs.webkit.org/show_bug.cgi?id=30457.
+
+        No new tests because existing test case is good enough like
+        LayoutTests/http/tests/navigation/image-load-in-unload-handler.html.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::NetworkJob):
+        (WebCore::NetworkJob::initialize):
+
+2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Remove zlib.h from WebSocketDeflater.h
+        https://bugs.webkit.org/show_bug.cgi?id=79298
+
+        Use forward declaration and OwnPtr for z_stream to move zlib.h from
+        .h file to .cpp file.
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior change.
+
+        * websockets/WebSocketDeflater.cpp:
+        (WebCore::WebSocketDeflater::WebSocketDeflater):
+        (WebCore::WebSocketDeflater::initialize):
+        (WebCore::WebSocketDeflater::~WebSocketDeflater):
+        (WebCore::setStreamParameter):
+        (WebCore::WebSocketDeflater::addBytes):
+        (WebCore::WebSocketDeflater::finish):
+        (WebCore::WebSocketDeflater::reset):
+        (WebCore::WebSocketInflater::WebSocketInflater):
+        (WebCore::WebSocketInflater::initialize):
+        (WebCore::WebSocketInflater::~WebSocketInflater):
+        (WebCore::WebSocketInflater::addBytes):
+        (WebCore::WebSocketInflater::finish):
+        * websockets/WebSocketDeflater.h:
+        (WebSocketDeflater): Use OwnPtr for m_stream.
+        (WebSocketInflater): Ditto.
+
+2012-02-22  James Robinson  <jamesr@chromium.org>
+
+        Remove GraphicsContext3D::paintsIntoCanvasBuffer and unify WebGL and canvas 2d logic
+        https://bugs.webkit.org/show_bug.cgi?id=79317
+
+        Reviewed by Kenneth Russell.
+
+        HTMLCanvasElement::paint needs to know whether to attempt to paint the canvas buffer for its context. In the
+        case of an accelerated canvas or WebGL context, unless we are printing it is typically the composited layer's
+        responsibility to present the contents and the element itself is only responsible for backgrounds, borders and
+        the like.  This removes a rather indirect path that WebGL content used to take to accomplish this and unifies
+        the logic with CanvasRenderingContext2D's, which has the exact same needs.
+
+        Covered by existing canvas layout tests.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paintsIntoCanvasBuffer):
+        (WebCore):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/HTMLCanvasElement.h:
+        (HTMLCanvasElement):
+        * html/canvas/CanvasRenderingContext.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+
+2012-02-22  Pablo Flouret  <pablof@motorola.com>
+
+        PopStateEvent.state should use the same object as history.state
+        https://bugs.webkit.org/show_bug.cgi?id=77493
+
+        Reviewed by Kentaro Hara.
+
+        Tests: fast/loader/stateobjects/state-attribute-history-getter.html
+               fast/loader/stateobjects/state-attribute-popstate-event.html
+
+        * bindings/js/JSPopStateEventCustom.cpp:
+        (WebCore):
+        (WebCore::cacheState):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::stateAccessorGetter):
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        (WebCore):
+        (WebCore::cacheState):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+        * dom/Document.cpp:
+        (WebCore::Document::enqueuePopstateEvent):
+        * dom/PopStateEvent.cpp:
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::create):
+        * dom/PopStateEvent.h:
+        (WebCore):
+        (PopStateEvent):
+        (WebCore::PopStateEvent::history):
+        * dom/PopStateEvent.idl:
+        * page/History.cpp:
+        (WebCore::History::stateChanged):
+        (WebCore):
+        (WebCore::History::isSameAsCurrentState):
+        * page/History.h:
+        (History):
+
+2012-02-22  Adam Klein  <adamk@chromium.org>
+
+        Remove obsolete FIXMEs from ContainerNode
+        https://bugs.webkit.org/show_bug.cgi?id=79295
+
+        Reviewed by Ryosuke Niwa.
+
+        Each of these three identical FIXMEs has since been fixed by adding
+        "RefPtr<Node> protect(this)" at the top of each method.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+
+2012-02-22  Dmitry Lomov  <dslomov@google.com>
+
+        [JSC] Implement ArrayBuffer and typed array cloning in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=79294
+
+        Reviewed by Oliver Hunt.
+
+        Covered by existing tests.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::typedArrayElementSize):
+        (WebCore):
+        (WebCore::CloneSerializer::dumpArrayBufferView):
+        (CloneSerializer):
+        (WebCore::CloneSerializer::dumpIfTerminal):
+        (WebCore::CloneSerializer::write):
+        (WebCore::CloneDeserializer::readArrayBufferViewSubtag):
+        (CloneDeserializer):
+        (WebCore::CloneDeserializer::readArrayBuffer):
+        (WebCore::CloneDeserializer::readArrayBufferView):
+        (WebCore::CloneDeserializer::getJSValue):
+        (WebCore::CloneDeserializer::readTerminal):
+
+2012-02-22  Adrienne Walker  <enne@google.com>
+
+        [chromium] Unreviewed speculative chromium-mac build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=75874
+
+        This broke in r108581.
+
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        (WebCore):
+
+2012-02-22  Raymond Toy  <rtoy@google.com>
+
+        exponentialRampToValue doesn't use starting value
+        https://bugs.webkit.org/show_bug.cgi?id=78035
+
+        Reviewed by Chris Rogers.
+
+        Test: webaudio/audioparam-exponentialRampToValueAtTime.html
+
+        * webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl): Set
+        starting value for exponential ramp.
+
+2012-02-22  Andreas Kling  <awesomekling@apple.com>
+
+        Make parsing color presentation attributes do less pointless work.
+        <http://webkit.org/b/79304>
+
+        Reviewed by Antti Koivisto.
+
+        Let HTMLElement::addHTMLColorToStyle() construct the color CSSValue directly
+        rather than passing a string that has to go through CSSParser.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::setProperty):
+        * css/StylePropertySet.h:
+
+            Added a setProperty(propertyID, CSSValue) overload that expands shorthand
+            properties if necessary. Also added a little comment about the behavior
+            differences between setProperty() overloads.
+
+        * html/HTMLElement.cpp:
+        (WebCore::parseColorStringWithCrazyLegacyRules):
+
+            Changed this to return an RGBA32.
+
+        (WebCore::HTMLElement::addHTMLColorToStyle):
+
+            Figure out the RGB value and construct a (pooled) CSSValue directly.
+
+2012-02-22  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Plumb from GraphicsLayer to the cc thread animation code
+        https://bugs.webkit.org/show_bug.cgi?id=75874
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setThreadedAnimationEnabled):
+        (WebCore::Settings::threadedAnimationEnabled):
+        (Settings):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (std):
+        (WebCore::GraphicsLayerChromium::addChild):
+        (WebCore::GraphicsLayerChromium::addAnimation):
+        (WebCore):
+        (WebCore::GraphicsLayerChromium::pauseAnimation):
+        (WebCore::GraphicsLayerChromium::removeAnimation):
+        (WebCore::GraphicsLayerChromium::suspendAnimations):
+        (WebCore::GraphicsLayerChromium::resumeAnimations):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerChromium::mapAnimationNameToId):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::addAnimation):
+        (WebCore):
+        (WebCore::LayerChromium::pauseAnimation):
+        (WebCore::LayerChromium::removeAnimation):
+        (WebCore::LayerChromium::suspendAnimations):
+        (WebCore::LayerChromium::resumeAnimations):
+        (WebCore::LayerChromium::setLayerAnimationController):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (LayerChromium):
+        (WebCore::LayerChromium::layerAnimationController):
+        (WebCore::LayerChromium::numChildren):
+        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
+        (WebCore::CCActiveAnimation::create):
+        (WebCore):
+        (WebCore::CCActiveAnimation::CCActiveAnimation):
+        (WebCore::CCActiveAnimation::~CCActiveAnimation):
+        (WebCore::CCActiveAnimation::isWaiting):
+        (WebCore::CCActiveAnimation::isRunningOrHasRun):
+        (WebCore::CCActiveAnimation::cloneForImplThread):
+        (WebCore::CCActiveAnimation::synchronizeProperties):
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        (CCActiveAnimation):
+        (WebCore::CCActiveAnimation::AnimationSignature::AnimationSignature):
+        (AnimationSignature):
+        (WebCore::CCActiveAnimation::id):
+        (WebCore::CCActiveAnimation::group):
+        (WebCore::CCActiveAnimation::signature):
+        * platform/graphics/chromium/cc/CCAnimationCurve.h:
+        (CCAnimationCurve):
+        (CCTransformAnimationCurve):
+        * platform/graphics/chromium/cc/CCAnimationEvents.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h.
+        (WebCore):
+        (WebCore::CCAnimationStartedEvent::CCAnimationStartedEvent):
+        (CCAnimationStartedEvent):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp: Added.
+        (WebCore):
+        (WebCore::CCLayerAnimationController::CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::~CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::create):
+        (WebCore::CCLayerAnimationController::addAnimation):
+        (WebCore::CCLayerAnimationController::pauseAnimation):
+        (WebCore::CCLayerAnimationController::removeAnimation):
+        (WebCore::CCLayerAnimationController::suspendAnimations):
+        (WebCore::CCLayerAnimationController::resumeAnimations):
+        (WebCore::CCLayerAnimationController::synchronizeAnimations):
+        (WebCore::CCLayerAnimationController::removeCompletedAnimations):
+        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
+        (WebCore::CCLayerAnimationController::removeAnimationsCompletedOnMainThread):
+        (WebCore::CCLayerAnimationController::pushAnimationProperties):
+        (WebCore::CCLayerAnimationController::getActiveAnimation):
+        (WebCore::CCLayerAnimationController::remove):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h: Added.
+        (WebCore):
+        (CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::activeAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::~CCLayerAnimationControllerImpl):
+        (WebCore):
+        (WebCore::CCLayerAnimationControllerImpl::animate):
+        (WebCore::CCLayerAnimationControllerImpl::add):
+        (WebCore::CCLayerAnimationControllerImpl::getActiveAnimation):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability):
+        (WebCore::CCLayerAnimationControllerImpl::purgeFinishedAnimations):
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h:
+        (CCLayerAnimationControllerImplClient):
+        (CCLayerAnimationControllerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::id):
+        (WebCore::CCLayerImpl::opacity):
+        (WebCore::CCLayerImpl::transform):
+        (WebCore::CCLayerImpl::bounds):
+        (WebCore::CCLayerImpl::layerAnimationController):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setAnimationEvents):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCSettings::CCSettings):
+        (CCSettings):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::animate):
+        (WebCore::CCLayerTreeHostImpl::animateLayersRecursive):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::animatePageScale):
+        (WebCore::CCLayerTreeHostImpl::animateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::needsAnimateLayers):
+        (WebCore::CCLayerTreeHostImpl::setNeedsAnimateLayers):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        (WebCore):
+        (DebugScopedSetMainThread):
+        (WebCore::DebugScopedSetMainThread::DebugScopedSetMainThread):
+        (WebCore::DebugScopedSetMainThread::~DebugScopedSetMainThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore):
+        (WebCore::CCThreadProxy::setAnimationEvents):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-02-22  Anders Carlsson  <andersca@apple.com>
+
+        Subframes with scrollable areas must be added to the non-fast scrollable region
+        https://bugs.webkit.org/show_bug.cgi?id=79306
+        <rdar://problem/10915564>
+
+        Reviewed by Andreas Kling.
+
+        When computing the non-fast scrollable region, add subframes with scrollable regions to the region.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::computeNonFastScrollableRegion):
+
+2012-02-22  Nate Chapin  <japhet@chromium.org>
+
+        CachedResourceLoader ignores the Range header
+        in determineRavlidationPolicy(), resulting in incorrect
+        cache hits.
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/xmlhttprequest/range-test.html
+        Test written by Aaron Colwell (acolwell@chromium.org).
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::determineRevalidationPolicy):
+
+2012-02-22  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r104060): Web font is not loaded if specified by link element dynamically inserted
+        https://bugs.webkit.org/show_bug.cgi?id=79186
+
+        Reviewed by Andreas Kling.
+
+        Test: fast/css/font-face-insert-link.html
+        
+        If a dynamically inserted stylesheet contains @font-face rules, we may fail to update the rendering.
+        
+        Before r104060 the style selector was destroyed on every style change, and the font selector along with it.
+        This is no longer the case and we can't rely on comparing font selector pointers when comparing Fonts
+        for equality. This patch adds version number to the font selector and checks it in Font::operator==.
+        The version number is incremented when new font-face rules are added to the font selector.
+        
+        FontFallbackList is an object shared between Fonts so the extra field shouldn't matter much in terms
+        of memory.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::CSSFontSelector):
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSFontSelector.h:
+        (CSSFontSelector):
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::operator==):
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        * platform/graphics/FontFallbackList.h:
+        (FontFallbackList):
+        (WebCore::FontFallbackList::fontSelectorVersion):
+        * platform/graphics/FontSelector.h:
+        (FontSelector):
+
+2012-02-22  Nate Chapin  <japhet@chromium.org>
+
+        Prevent CachedRawResource from sending the same data
+        chunk multiple times.
+        https://bugs.webkit.org/show_bug.cgi?id=78810
+
+        Reviewed by Adam Barth.
+
+        If a CachedRawResource receives data while a CachedRawResourceCallback
+        timer is active, the incremental data will be sent to the client, followed
+        but all data received so far, resulting in invalid data. Resolving this adds
+        complexity to CachedRawResource and requires making a few more CachedResource
+        functions virtual, so push the callback logic into CachedResource where it can
+        be implemented more cleanly.
+
+        Test: inspector/debugger/script-formatter-console.html
+            should no longer be flaky.
+
+        * loader/cache/CachedRawResource.cpp: CachedRawResourceCallback renamed and moved to CachedResource.
+        (WebCore::CachedRawResource::didAddClient): More or less the same as sendCallbacks() was.
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::addClient): Check the return value of addClientToSet() to determine whether
+            or not to call didAddClient.
+        (WebCore::CachedResource::didAddClient): May be called during addClient(), or may be called on a timer.
+            If called on a timer, move the client between sets.
+        (WebCore::CachedResource::addClientToSet): Determine whether didAddClient() can be called synchronously and
+            return true if it can.
+        (WebCore::CachedResource::removeClient): Ensure we cancel pending callbacks if necessary.
+        (WebCore::CachedResource::CachedResourceCallback::CachedResourceCallback): Renamed and moved from CachedRawResource.
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::hasClients): Check m_clientsAwaitingCallback as well as m_clients.
+        (WebCore::CachedResource::CachedResourceCallback::schedule):
+        (WebCore::CachedResource::hasClient): Helper for calling contains() on both m_clientsAwaitingCallback and m_clients.
+
+2012-02-22  Daniel Bates  <dbates@webkit.org>
+
+        Update change log entry for r108561 to reflect removal of "if (m_dispatchSoonList.isEmpty())".
+        https://bugs.webkit.org/show_bug.cgi?id=78840
+
+        Mention removal of unnecessary check for empty list m_dispatchSoonList in EventSender::cancelEvent().
+
+        Also, fix the date in the change log entry for changeset r108562 since it landed today (02/22/2012).
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        Changed the argument types of shouldApplyStyle, applyParagraphStyle, applyStyleToSelection,
+        applyParagraphStyleToSelection, and computeAndSetTypingStyle in Editor from CSSStyleDeclaration
+        to StylePropertySet.
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::shouldApplyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        (WebCore::Editor::applyStyleToSelection):
+        (WebCore::Editor::applyParagraphStyleToSelection):
+        (WebCore::Editor::setBaseWritingDirection):
+        (WebCore::Editor::computeAndSetTypingStyle):
+        * editing/Editor.h:
+        (WebCore):
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame):
+        (WebCore::executeApplyParagraphStyle):
+        (WebCore::executeMakeTextWritingDirectionLeftToRight):
+        (WebCore::executeMakeTextWritingDirectionNatural):
+        (WebCore::executeMakeTextWritingDirectionRightToLeft):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::shouldApplyStyle):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EditorClient.h:
+        (WebCore):
+        (EditorClient):
+
+2012-02-22  Daniel Bates  <dbates@webkit.org>
+
+        Abstract ImageEventSender into a general purpose EventSender
+        https://bugs.webkit.org/show_bug.cgi?id=78840
+
+        Reviewed by Adam Barth.
+
+        Abstract the functionality in ImageEventSender so that it can be used again.
+        This functionality may be useful in fixing WebKit Bug #38995.
+
+        No functionality was changed; no new tests.
+
+        * GNUmakefile.list.am: Added EventSender.h.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/EventSender.h: Added.
+        (WebCore):
+        (EventSender):
+        (WebCore::EventSender::eventType):
+        (WebCore::EventSender::hasPendingEvents):
+        (WebCore::EventSender::timerFired):
+        (WebCore::::EventSender):
+        (WebCore::::dispatchEventSoon):
+        (WebCore::::cancelEvent): Removed unnecessary check for empty list m_dispatchSoonList;
+        As far as I can tell this is an artifact of using a
+        QPtrList data structure for this functionality when it was originally in
+        DocumentImpl::removeImage() (see <http://trac.webkit.org/browser/trunk/WebCore/khtml/xml/DocumentImpl.cpp?rev=12515#L2302>),
+        which actually removed items from a list (as opposed to zeroing them out as we do
+        now).
+        (WebCore::::dispatchPendingEvents):
+        * loader/ImageLoader.cpp: Modified to use EventSender.
+        (WebCore):
+        (WebCore::ImageLoader::dispatchPendingEvent): Added; called by EventSender when the ImageLoader
+        should dispatch a pending BeforeLoad or Load event.
+        * loader/ImageLoader.h:
+        (WebCore):
+        (ImageLoader):
+
+2012-02-22  Max Vujovic  <mvujovic@adobe.com>
+
+        Paddings and borders on root SVG element with viewbox causes child SVG elements to be rendered with the incorrect size
+        https://bugs.webkit.org/show_bug.cgi?id=78613
+
+        Reviewed by Nikolas Zimmermann.
+
+        When computing its localToBorderBoxTransform, RenderSVGRoot was using its width and height
+        as the dimensions of the SVG viewport. However, width and height include CSS borders and
+        paddings, which are not part of the SVG viewport area. Now, RenderSVGRoot uses its
+        contentWidth and contentHeight, which correspond to the SVG viewport area.
+
+        Tests: svg/custom/svg-root-padding-border-margin-expected.html
+               svg/custom/svg-root-padding-border-margin.html
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::buildLocalToBorderBoxTransform):
+
+2012-02-22  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Get rid of GeolocationServiceEfl
+        https://bugs.webkit.org/show_bug.cgi?id=79270
+
+        Reviewed by Adam Barth.
+
+        These were just a bunch of dummy files with no real functionality, and
+        removing them helps the preparation of bug 78853, which will make
+        client-based geolocation the default.
+
+        No new tests, this functionality was not used.
+
+        * PlatformEfl.cmake:
+        * platform/efl/GeolocationServiceEfl.cpp: Removed.
+        * platform/efl/GeolocationServiceEfl.h: Removed.
+
+2012-02-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Clean-up RenderTableSection::calcRowLogicalHeight
+        https://bugs.webkit.org/show_bug.cgi?id=77705
+
+        Reviewed by Eric Seidel.
+
+        Refactoring / simplication of the code.
+
+        This change removes some variables that were unneeded and were
+        hiding what the code was really doing. Also some of the code was
+        split and moved down to RenderTableCell.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        Added the previous helper function to calculate the cell's
+        adjusted logical height.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        Removed some variables, simplified the rowspan logic to be clearer
+        (and added a comment about how we handle rowspans).
+
+2012-02-22  Adam Barth  <abarth@webkit.org>
+
+        Move FILE_SYSTEM code out of DOMWindow and into the fileapi folder
+        https://bugs.webkit.org/show_bug.cgi?id=79259
+
+        Reviewed by Eric Seidel.
+
+        This patch is part of our ongoing effort to remove ifdefs from code
+        classes.  The FILE_SYSTEM code in DOMWindow doesn't really have any
+        necessary connection to DOMWindow.  DOMWindow is just the context
+        object that the API hangs off of.
+
+        This patch moves the FILE_SYSTEM code into the fileapi folder using
+        [Supplemental].
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * fileapi/DOMWindowFileSystem.cpp: Added.
+        (WebCore):
+        (WebCore::DOMWindowFileSystem::DOMWindowFileSystem):
+        (WebCore::DOMWindowFileSystem::~DOMWindowFileSystem):
+        (WebCore::DOMWindowFileSystem::webkitRequestFileSystem):
+        (WebCore::DOMWindowFileSystem::webkitResolveLocalFileSystemURL):
+        * fileapi/DOMWindowFileSystem.h: Added.
+        (WebCore):
+        (DOMWindowFileSystem):
+        * fileapi/DOMWindowFileSystem.idl: Added.
+        * page/DOMWindow.cpp:
+        (WebCore):
+        * page/DOMWindow.h:
+        (WebCore):
+        (DOMWindow):
+        * page/DOMWindow.idl:
+
+2012-02-22  Luke Macpherson   <macpherson@chromium.org>
+
+        Re-implement many more HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE macros in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79200
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * rendering/style/RenderStyle.h:
+
+2012-02-22  Tom Sepez  <tsepez@chromium.org>
+
+        XSSAuditor bypass with <svg> tags and html-entities.
+        https://bugs.webkit.org/show_bug.cgi?id=78836
+
+        Reviewed by Adam Barth.
+
+        Tests: http/tests/security/xssAuditor/iframe-onload-in-svg-tag.html
+               http/tests/security/xssAuditor/script-tag-inside-svg-tag.html
+               http/tests/security/xssAuditor/script-tag-inside-svg-tag2.html
+               http/tests/security/xssAuditor/script-tag-inside-svg-tag3.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter):
+        (WebCore::isTerminatingCharacter):
+        (WebCore):
+        (WebCore::startsHTMLCommentAt):
+        (WebCore::startsSingleLineCommentAt):
+        (WebCore::fullyDecodeString):
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::init):
+        (WebCore::XSSAuditor::filterToken):
+        (WebCore::XSSAuditor::filterStartToken):
+        (WebCore::XSSAuditor::filterEndToken):
+        (WebCore::XSSAuditor::filterCharacterToken):
+        (WebCore::XSSAuditor::filterScriptToken):
+        (WebCore::XSSAuditor::filterObjectToken):
+        (WebCore::XSSAuditor::filterParamToken):
+        (WebCore::XSSAuditor::filterEmbedToken):
+        (WebCore::XSSAuditor::filterAppletToken):
+        (WebCore::XSSAuditor::filterIframeToken):
+        (WebCore::XSSAuditor::filterMetaToken):
+        (WebCore::XSSAuditor::filterBaseToken):
+        (WebCore::XSSAuditor::filterFormToken):
+        (WebCore::XSSAuditor::decodedSnippetForAttribute):
+        (WebCore::XSSAuditor::snippetForJavaScript):
+        * html/parser/XSSAuditor.h:
+        (XSSAuditor):
+
+2012-02-22  Anders Carlsson  <andersca@apple.com>
+
+        Crash when marking cached pages for full style recalc
+        https://bugs.webkit.org/show_bug.cgi?id=79276
+        <rdar://problem/10884036>
+
+        Reviewed by Beth Dakin.
+
+        Guard against a null history item.
+
+        * history/BackForwardController.cpp:
+        (WebCore::BackForwardController::markPagesForFullStyleRecalc):
+
+2012-02-22  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from empty anonymous block preceding :before content
+        https://bugs.webkit.org/show_bug.cgi?id=78250
+
+        Reviewed by David Hyatt.
+
+        RenderListMarkers getting removed from the tree in updateMarkerLocation()
+        can leave parent anonymous blocks behind with no children. This was
+        confusing updateBeforeAfterContent() because it does not expect
+        an empty block to precede :before content renderers.
+
+        Fix is to remove the anonymous block if it will lose all of its children.
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::updateMarkerLocation):
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to accessing removed parent lineboxes when clearing view selection.
+        https://bugs.webkit.org/show_bug.cgi?id=79264
+
+        Reviewed by Eric Seidel.
+
+        When our block needed a full layout, we were deleting our own lineboxes
+        and letting descendant children (at any level in hierarchy and not just 
+        immediate children) clear their own lineboxes as we keep laying them out.
+        This was problematic because those descendant children lineboxes were
+        pointing to removed parent lineboxes in the meantime. An example scenario
+        where this would go wrong is first-letter object removal, which can cause
+        clearing view selection, leading to accessing parent lineboxes. The patch
+        modifies clearing the entire linebox tree upfront. It shouldn't introduce
+        performance issues since it will eventually happen as we are laying out
+        those children.
+ 
+        Test: fast/css-generated-content/first-letter-textbox-parent-crash.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
+        Cloning and linebox issues in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78273
+
+        Reviewed by Eric Seidel.
+
+        Tests: fast/multicol/span/clone-flexbox.html
+               fast/multicol/span/clone-summary.html
+               fast/multicol/span/textbox-not-removed-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone): Fix cloning algorithm to take
+        care of cloning descendant classes of RenderBlock.
+        (WebCore::RenderBlock::splitBlocks): When we move our inline children
+        to cloneBlock, we need to clear our entire line box tree. Any descendant
+        child in the hierarchy could be a part of our line box tree and will
+        never get cleared since the child has moved to new parent cloneBlock.
+
+2012-02-22  Tim Dresser  <tdresser@chromium.org>
+
+        CCLayerTreeHostImpl calls didDraw more frequently than willDraw
+        https://bugs.webkit.org/show_bug.cgi?id=79139
+
+        Reviewed by James Robinson.
+
+        Ensure that didDraw is called if and only if willDraw was called previously.
+
+        CCLayerTreeHostImplTest.didDrawNotCalledOnHiddenLayer has been added to ensure that
+        hidden layers, for which willDraw is not called, will also not have didDraw called.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::didDraw):
+
+2012-02-22  Levi Weintraub  <leviw@chromium.org>
+
+        ScrollbarThemeComposite::thumbPosition uses the result of a divide by zero
+        https://bugs.webkit.org/show_bug.cgi?id=78910
+
+        Reviewed by Eric Seidel.
+
+        Adding a check to avoid doing a floating point divide by zero and assigning NaN to an integer.
+        This causes problems with our conversion to subpixel layout, which asserts when we overflow.
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::thumbPosition):
+
+2012-02-22  Raymond Liu  <raymond.liu@intel.com>
+
+        Have the DynamicsCompressorNode support multi-channel data
+        https://bugs.webkit.org/show_bug.cgi?id=77856
+
+        Reviewed by Chris Rogers.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+        (WebCore::DynamicsCompressor::setEmphasisStageParameters):
+        (WebCore::DynamicsCompressor::process):
+        (WebCore::DynamicsCompressor::reset):
+        (WebCore::DynamicsCompressor::setNumberOfChannels):
+        (WebCore):
+        * platform/audio/DynamicsCompressor.h:
+        (DynamicsCompressor):
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setNumberOfChannels):
+        (WebCore):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::process):
+        (WebCore::DynamicsCompressorKernel::reset):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::initialize):
+
+2012-02-22  Bear Travis  <betravis@adobe.com>
+
+        Not correctly recalculating layout for elements within nested SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=77535
+
+        Reviewed by Dirk Schulze.
+
+        Relatively positioned text is not correctly updating its position when the
+        size of its nearest viewport changes. Updating to mark text for layout when
+        viewPort size changes.
+        
+        Test: svg/repaint/inner-svg-change-viewPort-relative.svg
+
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::layoutChildren):
+
+2012-02-22  Alexei Svitkine  <asvitkine@chromium.org>
+
+        [chromium] Fix remaining compositing/rubberbanding test failures
+        https://bugs.webkit.org/show_bug.cgi?id=78008
+
+        These were happening due to the fact that ScrollView wasn't updating
+        the overhang layer when the contentsSize was updated. This is necessary
+        because calculateOverhangAreasForPainting() takes the contentsSize into
+        account when determining whether the overhang areas are visible.
+
+        Reviewed by James Robinson.
+
+        Re-enabled the following tests with updated baselines:
+        * platform/chromium/compositing/rubberbanding/transform-overhang-e-expected.png:
+        * platform/chromium/compositing/rubberbanding/transform-overhang-s-expected.png:
+        * platform/chromium/compositing/rubberbanding/transform-overhang-se-expected.png:
+        * platform/chromium/test_expectations.txt:
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setContentsSize):
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::updateOverhangAreas):
+        (WebCore):
+        * platform/ScrollView.h:
+        (ScrollView):
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] network worker tests crash on qt.
+        https://bugs.webkit.org/show_bug.cgi?id=79263
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::createDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+
+2012-02-22  Adrienne Walker  <enne@google.com>
+
+        Unreviewed, rolling out r108518.
+        http://trac.webkit.org/changeset/108518
+        https://bugs.webkit.org/show_bug.cgi?id=75864
+
+        Breaks surfaceOcclusionWithOverlappingSiblingSurfaces unit test.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore):
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore):
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::operator++):
+        (WebCore::CCLayerIterator::operator==):
+        (WebCore::CCLayerIterator::operator->):
+        (WebCore::CCLayerIterator::operator*):
+        (WebCore::CCLayerIterator::representsTargetRenderSurface):
+        (WebCore::CCLayerIterator::representsContributingRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (CCLayerIterator):
+        (BackToFront):
+        (FrontToBack):
+        * platform/graphics/chromium/cc/CCLayerIteratorPosition.h: Added.
+        (WebCore):
+        (CCLayerIteratorPositionValue):
+        (WebCore::CCLayerIteratorPosition::CCLayerIteratorPosition):
+        (CCLayerIteratorPosition):
+        (WebCore::CCLayerIteratorPosition::currentLayer):
+        (WebCore::CCLayerIteratorPosition::currentLayerRepresentsContributingRenderSurface):
+        (WebCore::CCLayerIteratorPosition::currentLayerRepresentsTargetRenderSurface):
+        (WebCore::CCLayerIteratorPosition::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIteratorPosition::targetRenderSurface):
+        (WebCore::CCLayerIteratorPosition::targetRenderSurfaceChildren):
+        (WebCore::CCLayerIteratorPosition::operator==):
+
+2012-02-22  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r62632): page-break-inside: avoid is ignored
+        https://bugs.webkit.org/show_bug.cgi?id=79262
+
+        Reviewed by Adele Peterson.
+
+        This was disabled in r62632 because of <http://webkit.org/b/41532>. Changes to the
+        pagination code since then have invalidated that bug, so enabling the feature again does not
+        re-introduce the bug.
+
+        Updated expected results for printing/page-break-inside-avoid.html.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+
+2012-02-22  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] webkitwebsrc: use HTTP referer provided by MediaPlayer
+        https://bugs.webkit.org/show_bug.cgi?id=79236
+
+        Reviewed by Martin Robinson.
+
+        Store a pointer to the MediaPlayer object in the private structure
+        of the WebKitWebSrc element so we can call its public methods,
+        like ::referrer().
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::sourceChanged):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (_WebKitWebSrcPrivate):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h:
+
+2012-02-22  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Clean build is broken when using make -j
+        https://bugs.webkit.org/show_bug.cgi?id=76388
+
+        No new tests. This is just a build fix.
+
+        Use order-only dependencies to ensure that built sources are built before
+        files that depend on them.
+
+        * GNUmakefile.am: Establish an order-only dependency on some built sources before starting
+        to build non-generated sources. Rename some temporary files and variables to be more consistent.
+        * bindings/gobject/GNUmakefile.am: Updated to reflect new variable names.
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] New CCOcclusionTracker class with tests
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Reviewed by James Robinson.
+
+        Adds a CCOcclusionTrackerBase template class that is able to track occlusion
+        of layers while traversing the layer tree from front-to-back, with typedefed
+        versions for the main and impl threads.
+
+        At each step of the front-to-back traversal, the class should be notified of
+        changes to the current render target, and when done working with a layer, the
+        layer is added the tracked occlusion.
+
+        The class provides tests for checking if a rect in content space
+        for a layer/surface is occluded by others in front of it.
+
+        Unit tests: CCOcclusionTrackerTest.cpp
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp: Added.
+        (WebCore):
+        (WebCore::::enterTargetRenderSurface):
+        (WebCore::::finishedTargetRenderSurface):
+        (WebCore::transformSurfaceOpaqueRegion):
+        (WebCore::::leaveToTargetRenderSurface):
+        (WebCore::contentToScreenSpaceTransform):
+        (WebCore::contentToTargetSurfaceTransform):
+        (WebCore::computeOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::testContentRectOccluded):
+        (WebCore::::occluded):
+        (WebCore::::surfaceOccluded):
+        (WebCore::rectSubtractRegion):
+        (WebCore::computeUnoccludedContentRect):
+        (WebCore::::unoccludedContentRect):
+        (WebCore::::surfaceUnoccludedContentRect):
+        (WebCore::::currentOcclusionInScreenSpace):
+        (WebCore::::currentOcclusionInTargetSurface):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h: Added.
+        (WebCore):
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::CCOcclusionTrackerBase):
+        (StackObject):
+
+2012-02-22  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: Integrate with about:tracing
+        https://bugs.webkit.org/show_bug.cgi?id=78831
+
+        Annotate interesting IDB functions so they show up in the
+        tracing utility included in the Chromium port.
+
+        Reviewed by Tony Chang.
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
+        (WebCore::injectIDBKeyIntoSerializedValue):
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::direction):
+        (WebCore::IDBCursor::key):
+        (WebCore::IDBCursor::primaryKey):
+        (WebCore::IDBCursor::value):
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::continueFunction):
+        (WebCore::IDBCursor::deleteFunction):
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::direction):
+        (WebCore::IDBCursorBackendImpl::key):
+        (WebCore::IDBCursorBackendImpl::primaryKey):
+        (WebCore::IDBCursorBackendImpl::value):
+        (WebCore::IDBCursorBackendImpl::update):
+        (WebCore::IDBCursorBackendImpl::continueFunction):
+        (WebCore::IDBCursorBackendImpl::continueFunctionInternal):
+        (WebCore::IDBCursorBackendImpl::deleteFunction):
+        (WebCore::IDBCursorBackendImpl::prefetchContinue):
+        (WebCore::IDBCursorBackendImpl::prefetchContinueInternal):
+        (WebCore::IDBCursorBackendImpl::prefetchReset):
+        (WebCore::IDBCursorBackendImpl::close):
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::dispatchEvent):
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::count):
+        (WebCore::IDBIndex::openKeyCursor):
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        (WebCore::IDBIndexBackendImpl::openCursor):
+        (WebCore::IDBIndexBackendImpl::openKeyCursor):
+        (WebCore::IDBIndexBackendImpl::countInternal):
+        (WebCore::IDBIndexBackendImpl::count):
+        (WebCore::IDBIndexBackendImpl::getInternal):
+        (WebCore::IDBIndexBackendImpl::get):
+        (WebCore::IDBIndexBackendImpl::getKey):
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::name):
+        (WebCore::IDBObjectStore::keyPath):
+        (WebCore::IDBObjectStore::indexNames):
+        (WebCore::IDBObjectStore::transaction):
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore::IDBObjectStore::clear):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::openCursor):
+        (WebCore::IDBObjectStore::count):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::get):
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        (WebCore::fetchKeyFromKeyPath):
+        (WebCore::injectKeyIntoKeyPath):
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::clear):
+        (WebCore::IDBObjectStoreBackendImpl::openCursor):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        (WebCore::IDBObjectStoreBackendImpl::count):
+        (WebCore::IDBObjectStoreBackendImpl::countInternal):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::onSuccessWithContinuation):
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBTracing.h: Added.
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::dispatchEvent):
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::abort):
+        (WebCore::IDBTransactionBackendImpl::commit):
+        (WebCore::IDBTransactionBackendImpl::taskTimerFired):
+        (WebCore::IDBTransactionBackendImpl::taskEventTimerFired):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Push CCLayerIteratorPosition struct into CCLayerIterator class.
+        https://bugs.webkit.org/show_bug.cgi?id=75864
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::operator++):
+        (WebCore::CCLayerIterator::operator==):
+        (WebCore::CCLayerIterator::operator->):
+        (WebCore::CCLayerIterator::operator*):
+        (WebCore::CCLayerIterator::representsTargetRenderSurface):
+        (WebCore::CCLayerIterator::representsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayer):
+        (WebCore::CCLayerIterator::currentLayerRepresentsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayerRepresentsTargetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIterator::targetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceChildren):
+        * platform/graphics/chromium/cc/CCLayerIteratorPosition.h: Removed.
+
+2012-02-22  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: console doesn't show properly arrays from which tail values have been deleted
+        https://bugs.webkit.org/show_bug.cgi?id=79242
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._printArray.appendUndefined):
+        (WebInspector.ConsoleMessageImpl.prototype._printArray):
+
+2012-02-22  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: warning external font mime (font/font/woff).
+        https://bugs.webkit.org/show_bug.cgi?id=79244
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/Resource.js:
+
+2012-02-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: use dots as markers on the counter graphs
+        https://bugs.webkit.org/show_bug.cgi?id=79243
+
+        Changed counter graphs marker and counter text styles.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics):
+        (WebInspector.MemoryStatistics.prototype._createCounterSidebarElement):
+        (WebInspector.MemoryStatistics.prototype.addTimlineEvent):
+        (WebInspector.MemoryStatistics.prototype._draw):
+        (WebInspector.MemoryStatistics.prototype._onMouseOut):
+        (WebInspector.MemoryStatistics.prototype._onMouseOver):
+        (WebInspector.MemoryStatistics.prototype._onMouseMove):
+        (WebInspector.MemoryStatistics.prototype._refreshCurrentValues):
+        (WebInspector.MemoryStatistics.prototype._recordIndexAt):
+        (WebInspector.MemoryStatistics.prototype._highlightCurrentPositionOnGraphs):
+        (WebInspector.MemoryStatistics.prototype._clearMarkers):
+        (WebInspector.MemoryStatistics.prototype._saveImageUnderMarker):
+        (WebInspector.MemoryStatistics.prototype.refresh):
+        (WebInspector.MemoryStatistics.prototype._drawPolyline):
+        (WebInspector.MemoryStatistics.prototype._clear):
+        * inspector/front-end/timelinePanel.css:
+        (.memory-counter-sidebar-info):
+        (.memory-counter-sidebar-info .title):
+        (.memory-counter-sidebar-info .counter-value):
+
+2012-02-22  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: make 'glue asynchronous events' optional.
+        https://bugs.webkit.org/show_bug.cgi?id=79240
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._glueParentButtonClicked):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._repopulateRecords):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._calculateAggregatedStats):
+        * inspector/front-end/timelinePanel.css:
+        (.glue-async-status-bar-item .glyph):
+        (.timeline-start-at-zero-status-bar-item .glyph):
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [REGRESSION] Console xhr logging is broken for async xhrs since r107672.
+        https://bugs.webkit.org/show_bug.cgi?id=79229
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/console-xhr-logging-async.html
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setInitialScriptContent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2012-02-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: fix memory counters and start-at-zero modes of timeline panels to co-exist nicely
+        https://bugs.webkit.org/show_bug.cgi?id=79241
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype.addTimlineEvent):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._timelinesOverviewModeChanged):
+
+2012-02-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [experimental] add a mode to display timeline events aligned by the start time
+        https://bugs.webkit.org/show_bug.cgi?id=79123
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewWindow):
+        (WebInspector.TimelineOverviewWindow.prototype.reset):
+        (WebInspector.TimelineOverviewWindow.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewWindow.prototype.scrollWindow):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.reset):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.update):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._filterRecords):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._buildBar):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._onWindowChanged):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype.get _startAtZero):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype._onRecordsCleared):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._filterRecords):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineStartAtZeroCalculator):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.calculateWindow):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.reset):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.formatValue):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generateAggregatedInfo):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._calculateAggregatedStats):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype.get aggregatedStats):
+        (WebInspector.TimelineModel.prototype.get records):
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowIndices):
+        (WebInspector.TimelineRecordFilter):
+        (WebInspector.TimelineRecordFilter.prototype.accept):
+        (WebInspector.TimelineStartAtZeroRecordFilter):
+        (WebInspector.TimelineStartAtZeroRecordFilter.prototype.accept):
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-start-at-zero #timeline-overview-sidebar):
+        (.timeline-start-at-zero #timeline-overview-grid):
+        (.timeline-overview-window):
+        (.timeline-start-at-zero .timeline-overview-window):
+        (.timeline-start-at-zero .timeline-overview-dividers-background):
+        (.timeline-overview-window-rulers):
+        (.timeline-start-at-zero #timeline-overview-memory):
+        (.popover .timeline-loading):
+        (.popover .timeline-scripting):
+        (.popover .timeline-rendering):
+        (.timeline-start-at-zero-status-bar-item .glyph):
+        (.timeline-start-at-zero-status-bar-item.toggled-on .glyph):
+        (.timeline-overview-start-at-zero):
+        (.timeline-overview-start-at-zero-bars):
+        (.timeline-overview-start-at-zero-bars .padding):
+        (.timeline-overview-start-at-zero-bars .timeline-bar-vertical):
+        (.timeline-bar-vertical div:first-child):
+        (.timeline-bar-vertical .timeline-loading):
+        (.timeline-bar-vertical .timeline-scripting):
+        (.timeline-bar-vertical .timeline-rendering):
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Disregard previous backing store as soon as possible
+        https://bugs.webkit.org/show_bug.cgi?id=79232
+
+        Reviewed by Simon Hausmann and No'am Rosenthal.
+
+        Make it possible to drop non-visible tiles and to test
+        if the current visible rect is fully covered.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::visibleContentsRect):
+        (WebCore::TiledBackingStore::coverageRatio):
+        (WebCore::TiledBackingStore::visibleAreaIsCovered):
+        (WebCore):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::removeAllNonVisibleTiles):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move QMenu dependant scrollbar context menu handling out of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=79233
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move the code into WebKit/qt/Api/qwebpage.cpp, the only place where it is called from.
+
+        * Target.pri: Remove ScrollbarQt.cpp from build.
+        * platform/Scrollbar.h: Remove Qt-only context menu handling but make moveThum
+        accessible from the outside.
+        * platform/qt/ScrollbarQt.cpp: Removed. Not needed anymore.
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: retrieving content for some XHR requests crashes inspected page renderer
+        https://bugs.webkit.org/show_bug.cgi?id=79026
+
+        Reviewed by Pavel Feldman.
+
+        Fixed loading empty xhr content and xhr content decoding that was
+        broken in r107672.
+
+        Tests: http/tests/inspector/network/network-cyrillic-xhr.html
+               http/tests/inspector/network/network-empty-xhr.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorPageAgent::createDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+        * inspector/InspectorPageAgent.h:
+        (WebCore):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
+        (WebCore::NetworkResourcesData::responseReceived):
+        * inspector/NetworkResourcesData.h:
+        (WebCore::NetworkResourcesData::ResourceData::decoder):
+        (WebCore::NetworkResourcesData::ResourceData::setDecoder):
+
+2012-02-22  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: CodeGeneratorInspector.py: remove neural-net-style constructions
+        https://bugs.webkit.org/show_bug.cgi?id=79153
+
+        Reviewed by Yury Semikhatsky.
+
+        CParamType class removed completely, some ("virtual") methods are
+        removed. TypeModel notion is added instead with some minor helper
+        classes and methods.
+
+        * inspector/CodeGeneratorInspector.py:
+        (DomainNameFixes):
+        (RawTypes.BaseType):
+        (RawTypes.String):
+        (RawTypes.String.get_raw_type_model):
+        (RawTypes.Int):
+        (RawTypes.Int.get_raw_type_model):
+        (RawTypes.Number):
+        (RawTypes.Number.get_raw_type_model):
+        (RawTypes.Bool):
+        (RawTypes.Bool.get_raw_type_model):
+        (RawTypes.Object):
+        (RawTypes.Object.get_raw_type_model):
+        (RawTypes.Any):
+        (RawTypes.Any.get_raw_type_model):
+        (RawTypes.Array):
+        (RawTypes.Array.get_raw_type_model):
+        (replace_right_shift):
+        (CommandReturnPassModel):
+        (CommandReturnPassModel.ByReference):
+        (CommandReturnPassModel.ByReference.__init__):
+        (CommandReturnPassModel.ByReference.get_return_var_type):
+        (CommandReturnPassModel.get_output_argument_prefix):
+        (CommandReturnPassModel.get_output_to_raw_expression):
+        (CommandReturnPassModel.get_output_parameter_type):
+        (CommandReturnPassModel.get_set_return_condition):
+        (CommandReturnPassModel.ByPointer):
+        (CommandReturnPassModel.ByPointer.__init__):
+        (CommandReturnPassModel.ByPointer.get_return_var_type):
+        (TypeModel):
+        (TypeModel.RefPtrBased):
+        (TypeModel.RefPtrBased.__init__):
+        (TypeModel.RefPtrBased.get_optional):
+        (TypeModel.RefPtrBased.get_command_return_pass_model):
+        (TypeModel.RefPtrBased.get_input_param_type_text):
+        (TypeModel.RefPtrBased.get_event_setter_expression_pattern):
+        (TypeModel.Enum):
+        (TypeModel.Enum.__init__):
+        (TypeModel.Enum.get_optional):
+        (TypeModel.Enum.get_optional.EnumOptional):
+        (TypeModel.Enum.get_optional.EnumOptional.get_optional):
+        (TypeModel.Enum.get_optional.EnumOptional.get_command_return_pass_model):
+        (TypeModel.Enum.get_input_param_type_text):
+        (TypeModel.Enum.get_event_setter_expression_pattern):
+        (TypeModel.Enum.get_command_return_pass_model):
+        (TypeModel.ValueType):
+        (TypeModel.ValueType.__init__):
+        (TypeModel.ValueType.get_optional):
+        (TypeModel.ValueType.get_command_return_pass_model):
+        (TypeModel.ValueType.get_input_param_type_text):
+        (TypeModel.ValueType.get_event_setter_expression_pattern):
+        (TypeModel.ValueType.ValueOptional):
+        (TypeModel.ValueType.ValueOptional.__init__):
+        (TypeModel.ValueType.ValueOptional.get_optional):
+        (TypeModel.ValueType.ValueOptional.get_command_return_pass_model):
+        (TypeModel.ValueType.ValueOptional.get_input_param_type_text):
+        (TypeModel.ValueType.ValueOptional.get_event_setter_expression_pattern):
+        (TypeModel.init_class):
+        (TypeBindings.create_ad_hoc_type_declaration.Helper):
+        (TypeBindings.create_type_declaration_.EnumBinding.get_array_item_c_type_text):
+        (TypeBindings.create_type_declaration_.EnumBinding.get_setter_value_expression_pattern):
+        (TypeBindings.create_type_declaration_.EnumBinding):
+        (TypeBindings.create_type_declaration_.EnumBinding.get_type_model):
+        (TypeBindings.create_type_declaration_):
+        (TypeBindings.create_type_declaration_.get_type_model):
+        (TypeBindings.create_type_declaration_.get_array_item_c_type_text):
+        (get_type_model):
+        (AdHocTypeContextImpl.__init__):
+        (PlainObjectBinding):
+        (PlainObjectBinding.get_type_model):
+        (AdHocTypeContext):
+        (ArrayBinding.get_array_item_c_type_text):
+        (ArrayBinding):
+        (ArrayBinding.get_type_model):
+        (RawTypeBinding.get_validator_call_text):
+        (RawTypeBinding.reduce_to_raw_type):
+        (RawTypeBinding):
+        (RawTypeBinding.get_type_model):
+        (MethodGenerateModes.StrictParameterMode.get_c_param_type_text):
+        (MethodGenerateModes.RawParameterMode.get_c_param_type_text):
+        (MethodGenerateModes.CombinedMode.get_c_param_type_text):
+        (Generator.go):
+        (Generator.process_event):
+        (Generator.process_command):
+        (Generator.resolve_type_and_generate_ad_hoc):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+
+2012-02-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Show IndexedDB views on selection IndexedDB elements in resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=79098
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.prototype._assertFrameId):
+        (WebInspector.IndexedDBModel.prototype.loadObjectStoreData):
+        (WebInspector.IndexedDBModel.prototype.loadIndexData):
+        * inspector/front-end/IndexedDBViews.js: Added.
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showIndexedDB):
+        (WebInspector.IndexedDBTreeElement.prototype.refreshIndexedDB):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBAdded):
+        (WebInspector.IDBDatabaseTreeElement):
+        (WebInspector.IDBDatabaseTreeElement.prototype.get itemURL):
+        (WebInspector.IDBDatabaseTreeElement.prototype.update):
+        (WebInspector.IDBDatabaseTreeElement.prototype.onselect):
+        (WebInspector.IDBObjectStoreTreeElement):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.get itemURL):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.update):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.onselect):
+        (WebInspector.IDBIndexTreeElement):
+        (WebInspector.IDBIndexTreeElement.prototype.get itemURL):
+        (WebInspector.IDBIndexTreeElement.prototype.update):
+        (WebInspector.IDBIndexTreeElement.prototype.onselect):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/externs.js:
+        * inspector/front-end/indexedDBViews.css: Added.
+        * inspector/front-end/inspector.html:
+
+2012-02-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        REGRESSION(58212): html foreignObjects with positions other than static not hidden correctly when parent has display:none
+        https://bugs.webkit.org/show_bug.cgi?id=41386
+
+        Reviewed by Zoltan Herczeg.
+
+        r58212 gave SVGGElements a renderer, regardless if "display: none" was set or not, for various reasons (see change set).
+        The <g> renderer for such cases is a RenderSVGHiddenContainer. We make sure in SVG that such subtrees are never used
+        for painting & hittesting - they only exist for the purpose of SVG DOM (query getCTM, etc..) and to create renderers
+        for child resources, like <g display="none"><linearGradient>.
+
+        This concept still works fine for: <g display="none"><foreignObject><body>Foobar</body></foreignObject></g>, as
+        RenderSVGForeignObject::paint is never called thus we never paint the subtree of the <fO>. If the <body> elements
+        contains "position: relative" a new layer is created for the <body>. When the document paints we have two seperated
+        layers, and the <body> layer doesn't know that it's actually inside a "SVG hidden subtree", and gets painted, where it
+        shouldn't. HTML doesn't have this problems, as a display: none object, never creates a renderer.
+
+        The fix is to disallow layer creation in hidden SVG subtrees, to mimic what would happen if we'd follow HTML rules
+        to not create renderers for display: none objects. This avoids any indirections - as no layers are created anymore.
+
+        Tests: svg/foreignObject/fO-display-none-with-relative-pos-content.svg
+               svg/foreignObject/fO-display-none.svg
+               svg/foreignObject/fO-parent-display-changes.svg
+               svg/foreignObject/fO-parent-display-none-with-relative-pos-content.svg
+               svg/foreignObject/fO-parent-display-none.svg
+               svg/foreignObject/fO-parent-of-parent-display-none-with-relative-pos-content.svg
+               svg/foreignObject/fO-parent-of-parent-display-none.svg
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleDidChange): Only create layers, if its allowed -- layerCreationAllowedForSubtree() will always return true for HTML, and only false for layers inside a hidden SVG subtree.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild): Only create layers, if its allowed.
+        * rendering/RenderObject.h: Add inline layerCreationAllowedForSubtree() helper, that craws the tree to find a RenderSVGHiddenContainer ancestor, if not present, return true.
+
+2012-02-22  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Drop clipToImageBuffer from RenderBoxModelObject
+        https://bugs.webkit.org/show_bug.cgi?id=79225
+
+        Reviewed by Nikolas Zimmermann.
+
+        -webkit-background-clip: text is a rarely used non-standard
+        feature uses clipToImageBuffer. It is replaced by
+        CompositeDestinationIn on a transparent layer. The new
+        approach has the same speed as the old one.
+
+        Existing tests cover this issue.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Merge setVisibleRectTrajectoryVector and adjustVisibleRect to
+        the more descriptive coverWithTilesIfNeeded
+        https://bugs.webkit.org/show_bug.cgi?id=79230
+
+        Reviewed by Simon Hausmann.
+
+        Both setVisibleRectTrajectoryVector and the adjustVisibleRect are
+        used for initiating re-tiling, so make that more obvious and merge
+        the two.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::coverWithTilesIfNeeded):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        REGRESSION: unbalanced transparency layers for clipPath
+        https://bugs.webkit.org/show_bug.cgi?id=78074
+
+        Reviewed by Zoltan Herczeg.
+
+        If we're rendering to a mask image buffer, all children are rendered with opacity=1, regardless what their RenderStyles specify.
+        SVGRenderSupport::finishRenderSVGContent() did not take this into account and always called endTransparencyLayer(). Fix that
+        by checking if we're rendering to a mask image buffer, if so don't call endTransparencyLayer().
+
+        Add new reftest covering both the visual & logical correctness (no assertion).
+
+        Tests: svg/clip-path/opacity-assertion-expected.svg
+               svg/clip-path/opacity-assertion.svg
+
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::isRenderingMaskImage): Extraced as sharable helper function.
+        (WebCore::SVGRenderSupport::prepareToRenderSVGContent): Factor out isRenderingMaskImage() function.
+        (WebCore::SVGRenderSupport::finishRenderSVGContent): Only call endTransparencyLayer(), if we actually called beginTL() first. 
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Improve comments in tiling code.
+
+        Rubberstamped by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+
+2012-02-22  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: build fix.
+
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        (InspectorController):
+
+2012-02-21  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: do not filter out requestAnimationFrame from timeline, implement stop on animation events.
+        https://bugs.webkit.org/show_bug.cgi?id=79116
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * dom/ScriptedAnimationController.cpp:
+        (WebCore::ScriptedAnimationController::registerCallback):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didRequestAnimationFrameCallbackImpl):
+        (WebCore::InspectorInstrumentation::didCancelAnimationFrameCallbackImpl):
+        (WebCore::InspectorInstrumentation::willFireAnimationFrameEventImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didRequestAnimationFrameCallback):
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        (WebCore::InspectorTimelineAgent::didRequestAnimationFrameCallback):
+        (WebCore::InspectorTimelineAgent::didCancelAnimationFrameCallback):
+        (WebCore::InspectorTimelineAgent::willFireAnimationFrameEvent):
+        (WebCore::InspectorTimelineAgent::didFireAnimationFrameEvent):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._onRecordsCleared):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+
+2012-02-22  Changhun Kang  <temoochin@company100.net>
+
+        Remove unused class declaration in WebCore/page/scrolling/ScrollingCoordinator.h
+        https://bugs.webkit.org/show_bug.cgi?id=79175
+
+        Reviewed by Kentaro Hara.
+
+        * page/scrolling/ScrollingCoordinator.h:
+        Remove PlatformGestureEvent class declaration.
+        (WebCore):
+
+2012-02-22  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Fix the N9 build
+        https://bugs.webkit.org/show_bug.cgi?id=79101
+
+        Reviewed by Simon Hausmann.
+
+        Fixed the include order of the rolled out r108359 not to break
+        the build with CONFIG+=force_static_libs_as_shared.
+
+        * platform/graphics/OpenGLShims.h: Add missing include.
+
+2012-02-22  Shinya Kawanaka  <shinyak@chromium.org>
+
+        firstRendererOf() should also return a fallback element renderer in NodeRenderingContext.
+        https://bugs.webkit.org/show_bug.cgi?id=79180
+
+        Reviewed by Hajime Morita.
+
+        Currently we have handled AttachingFallback in some special mannger, however if firstRendererOf
+        and lastRendererOf return a fallback element renderer, we don't need to handle it in such a manner.
+
+        We have introduced new attaching phase: AttachingFallbacked, and AttachingNotFallbacked.
+        They are used for fallback elements.
+
+        Added new test cases in:
+          fast/dom/shadow/shadow-contents-fallback.html
+          fast/dom/shadow/shadow-contents-fallback-dynamic.html
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        * html/shadow/InsertionPoint.h:
+        (WebCore::isInsertionPoint):
+        (WebCore):
+        (WebCore::toInsertionPoint):
+
+2012-02-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed gardening after r108464.
+
+        * Target.pri:
+
+2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108468.
+        http://trac.webkit.org/changeset/108468
+        https://bugs.webkit.org/show_bug.cgi?id=79219
+
+        Broke Chromium Win release build (Requested by bashi on
+        #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::fail):
+        (WebCore::WebSocketChannel::processFrame):
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Removed.
+        * websockets/WebSocketDeflateFramer.h: Removed.
+
+2012-02-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Add runtime-flag
+        https://bugs.webkit.org/show_bug.cgi?id=79074
+
+        Added runtime-flag.
+        Query runtime flag when (un)registering a <style scoped> element, and when determineing a style sheet's scope.
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests. (no change in functionality)
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::styleScopedEnabled):
+        (WebCore::RuntimeEnabledFeatures::setStyleScopedEnabled):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::determineScopingElement):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::registerWithScopingNode):
+        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
+        * html/HTMLStyleElement.idl:
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Audit rules to recommend unprefixing supported CSS properties
+        https://bugs.webkit.org/show_bug.cgi?id=78985
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/AuditCategories.js:
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.CSSRuleBase):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.doRun.sheetsCallback):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CSSRuleBase.prototype._visitStyleSheet.sheetCallback):
+        (WebInspector.AuditRules.CSSRuleBase.prototype._visitStyleSheet):
+        (WebInspector.AuditRules.CSSRuleBase.prototype._visitRule):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.visitStyleSheet):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.didVisitStyleSheet):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.visitRule):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.didVisitRule):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.visitProperty):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.didVisitStyleSheet):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.visitRule):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.didVisitRule):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.visitProperty):
+        * inspector/front-end/ResourceUtils.js:
+
+2012-02-22  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Node::attach() should be after attaching children in Element::attach().
+        https://bugs.webkit.org/show_bug.cgi?id=79201
+
+        Reviewed by Hajime Morita.
+
+        In Element::attach(), Node::attach() is called before attaching children if a shaodw root exists.
+        This may cause O(N^2) problem in NodeRenderingContext.
+
+        No new tests. Existing tests should cover this.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+
+2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Add WebSocketDeflateFramer class which handles deflate-frame extension.
+        This class encapsulates WebSocketDeflater and WebSocketInflater classes,
+        which depend on zlib, so that WebSocketChannel is not necessary to aware
+        zlib dependency.
+
+        Reviewed by Kent Tamura.
+
+        Tests: http/tests/websocket/tests/hybi/compressed-control-frame.html
+               http/tests/websocket/tests/hybi/deflate-frame-comp-bit-onoff.html
+               http/tests/websocket/tests/hybi/deflate-frame-invalid-parameter.html
+               http/tests/websocket/tests/hybi/deflate-frame-parameter.html
+
+        * CMakeLists.txt: Added WebSocketDeflateFramer.(cpp|h)
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect): Set m_extensions.
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect): Add deflate-frame extension processor to WebSocketHanshake if deflate can use.
+        (WebCore::WebSocketChannel::fail): Call m_deflateFramer.didFail().
+        (WebCore::WebSocketChannel::processFrame): Decompress frames if needed.
+        (WebCore::WebSocketChannel::sendFrame): Compress frames if possible.
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Added.
+        (WebCore):
+        (WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::create):
+        (WebCore::WebSocketExtensionDeflateFrame::~WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::handshakeString):
+        (WebCore::WebSocketExtensionDeflateFrame::processResponse):
+        (WebCore::DeflateResultHolder::DeflateResultHolder):
+        (WebCore::DeflateResultHolder::~DeflateResultHolder):
+        (WebCore::DeflateResultHolder::fail):
+        (WebCore::InflateResultHolder::InflateResultHolder):
+        (WebCore::InflateResultHolder::~InflateResultHolder):
+        (WebCore::InflateResultHolder::fail):
+        (WebCore::WebSocketDeflateFramer::WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::createExtensionProcessor):
+        (WebCore::WebSocketDeflateFramer::canDeflate):
+        (WebCore::WebSocketDeflateFramer::enableDeflate):
+        (WebCore::WebSocketDeflateFramer::deflate):
+        (WebCore::WebSocketDeflateFramer::resetDeflateContext):
+        (WebCore::WebSocketDeflateFramer::inflate):
+        (WebCore::WebSocketDeflateFramer::resetInflateContext):
+        (WebCore::WebSocketDeflateFramer::didFail):
+        * websockets/WebSocketDeflateFramer.h: Added.
+        (WebCore):
+        (DeflateResultHolder):
+        (WebCore::DeflateResultHolder::succeeded):
+        (WebCore::DeflateResultHolder::failureReason):
+        (InflateResultHolder):
+        (WebCore::InflateResultHolder::succeeded):
+        (WebCore::InflateResultHolder::failureReason):
+        (WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::enabled):
+
+2012-02-22  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108453.
+        http://trac.webkit.org/changeset/108453
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Broke Chromium's webkit_unit_tests.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp: Removed.
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h: Removed.
+
+2012-02-22  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt] clipToImageBuffer assertion fix in debug mode on Qt.
+
+        Rubber stamped by Csaba Osztrogonác.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::restorePlatformState):
+
+2012-02-22  Adam Barth  <abarth@webkit.org>
+
+        [GTK] fast/frames/frame-dead-region.html crash
+        https://bugs.webkit.org/show_bug.cgi?id=79205
+
+        Unreviewed.
+
+        Apparently we're not supposed to call willDetachPage from
+        CachedFrame::destroy.  This call got added in
+        http://trac.webkit.org/changeset/108428, but it seems to cause a crash.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::closeAndRemoveChild):
+        (WebCore::FrameLoader::detachFromParent):
+        * page/Frame.h:
+        (WebCore::Frame::detachFromPage):
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+
+2012-02-22  Adam Barth  <abarth@webkit.org>
+
+        Move Geolocation code into Modules/geolocation
+        https://bugs.webkit.org/show_bug.cgi?id=79204
+
+        Reviewed by Hajime Morita.
+
+        There are still some dangling references into the Geolocation module,
+        which I will clean up in a followup patch.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/geolocation/Geolocation.cpp: Copied from Source/WebCore/page/Geolocation.cpp.
+        * Modules/geolocation/Geolocation.h: Copied from Source/WebCore/page/Geolocation.h.
+        * Modules/geolocation/Geolocation.idl: Copied from Source/WebCore/page/Geolocation.idl.
+        * Modules/geolocation/GeolocationController.cpp: Copied from Source/WebCore/page/GeolocationController.cpp.
+        * Modules/geolocation/GeolocationController.h: Copied from Source/WebCore/page/GeolocationController.h.
+        * Modules/geolocation/GeolocationError.h: Copied from Source/WebCore/page/GeolocationError.h.
+        * Modules/geolocation/GeolocationPosition.h: Copied from Source/WebCore/page/GeolocationPosition.h.
+        * Modules/geolocation/Geoposition.h: Copied from Source/WebCore/page/Geoposition.h.
+        * Modules/geolocation/Geoposition.idl: Copied from Source/WebCore/page/Geoposition.idl.
+        * Modules/geolocation/PositionCallback.h: Copied from Source/WebCore/page/PositionCallback.h.
+        * Modules/geolocation/PositionCallback.idl: Copied from Source/WebCore/page/PositionCallback.idl.
+        * Modules/geolocation/PositionError.h: Copied from Source/WebCore/page/PositionError.h.
+        * Modules/geolocation/PositionError.idl: Copied from Source/WebCore/page/PositionError.idl.
+        * Modules/geolocation/PositionErrorCallback.h: Copied from Source/WebCore/page/PositionErrorCallback.h.
+        * Modules/geolocation/PositionErrorCallback.idl: Copied from Source/WebCore/page/PositionErrorCallback.idl.
+        * Modules/geolocation/PositionOptions.h: Copied from Source/WebCore/page/PositionOptions.h.
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Geolocation.cpp: Removed.
+        * page/Geolocation.h: Removed.
+        * page/Geolocation.idl: Removed.
+        * page/GeolocationController.cpp: Removed.
+        * page/GeolocationController.h: Removed.
+        * page/GeolocationError.h: Removed.
+        * page/GeolocationPosition.h: Removed.
+        * page/Geoposition.h: Removed.
+        * page/Geoposition.idl: Removed.
+        * page/PositionCallback.h: Removed.
+        * page/PositionCallback.idl: Removed.
+        * page/PositionError.h: Removed.
+        * page/PositionError.idl: Removed.
+        * page/PositionErrorCallback.h: Removed.
+        * page/PositionErrorCallback.idl: Removed.
+        * page/PositionOptions.h: Removed.
+
+2012-02-22  Frederik Gladhorn  <frederik.gladhorn@nokia.com>
+
+        [gtk] Accessibility: use find funtion in vector instead of for.
+        https://bugs.webkit.org/show_bug.cgi?id=77878
+
+        Reviewed by Hajime Morita.
+
+        Minor cleanup, use the find function from vector.
+
+        * accessibility/gtk/WebKitAccessibleWrapperAtk.cpp:
+        (webkitAccessibleGetIndexInParent):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        Changed the argument types of shouldApplyStyle, applyParagraphStyle, applyStyleToSelection,
+        applyParagraphStyleToSelection, and computeAndSetTypingStyle in Editor from CSSStyleDeclaration
+        to StylePropertySet.
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::shouldApplyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        (WebCore::Editor::applyStyleToSelection):
+        (WebCore::Editor::applyParagraphStyleToSelection):
+        (WebCore::Editor::setBaseWritingDirection):
+        (WebCore::Editor::computeAndSetTypingStyle):
+        * editing/Editor.h:
+        (WebCore):
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame):
+        (WebCore::executeApplyParagraphStyle):
+        (WebCore::executeMakeTextWritingDirectionLeftToRight):
+        (WebCore::executeMakeTextWritingDirectionNatural):
+        (WebCore::executeMakeTextWritingDirectionRightToLeft):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::shouldApplyStyle):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EditorClient.h:
+        (WebCore):
+        (EditorClient):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Cull quads outside of the scissoring damage rect
+        https://bugs.webkit.org/show_bug.cgi?id=79181
+
+        Reviewed by James Robinson.
+
+        Quads outside of the partial swap cause us to execute GL operations
+        that actually use a fair amount of CPU time (enough to affect power
+        usage). Here we cull quads by only keeping their intersection
+        with the damage rect used for partial swap.
+
+        Unit test: CCQuadCuller.cpp
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+        * platform/graphics/chromium/cc/CCQuadCuller.h:
+        (CCQuadCuller):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::optimizeQuads):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (CCRenderPass):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] New CCOcclusionTracker class with tests
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Reviewed by James Robinson.
+
+        Adds a CCOcclusionTrackerBase template class that is able to track occlusion
+        of layers while traversing the layer tree from front-to-back, with typedefed
+        versions for the main and impl threads.
+
+        At each step of the front-to-back traversal, the class should be notified of
+        changes to the current render target, and when done working with a layer, the
+        layer is added the tracked occlusion.
+
+        The class provides tests for checking if a rect in content space
+        for a layer/surface is occluded by others in front of it.
+
+        Unit tests: CCOcclusionTrackerTest.cpp
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp: Added.
+        (WebCore):
+        (WebCore::::enterTargetRenderSurface):
+        (WebCore::::finishedTargetRenderSurface):
+        (WebCore::transformSurfaceOpaqueRegion):
+        (WebCore::::leaveToTargetRenderSurface):
+        (WebCore::contentToScreenSpaceTransform):
+        (WebCore::contentToTargetSurfaceTransform):
+        (WebCore::computeOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::testContentRectOccluded):
+        (WebCore::::occluded):
+        (WebCore::::surfaceOccluded):
+        (WebCore::rectSubtractRegion):
+        (WebCore::computeUnoccludedContentRect):
+        (WebCore::::unoccludedContentRect):
+        (WebCore::::surfaceUnoccludedContentRect):
+        (WebCore::::currentOcclusionInScreenSpace):
+        (WebCore::::currentOcclusionInTargetSurface):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h: Added.
+        (WebCore):
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::CCOcclusionTrackerBase):
+        (StackObject):
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Cache <font face> family lists in CSSValuePool.
+        <http://webkit.org/b/79195>
+
+        Reviewed by Antti Koivisto.
+
+        HTMLFontElements with "face" attributes are very common in legacy web content.
+        Add a String->CSSValue cache for these in CSSValuePool and use it to avoid
+        reparsing and recreating duplicate font face values.
+
+        This knocks 20ms (~1.5%) worth of samples off of the Moz page cycler on my system.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceValue):
+        * css/CSSParser.h:
+        * css/CSSValuePool.cpp:
+        (WebCore::CSSValuePool::createFontFaceValue):
+        * css/CSSValuePool.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::collectStyleForAttribute):
+
+2012-02-21  Adam Barth  <abarth@webkit.org>
+
+        Separate the implementation of registerProtocolHandler from Navigator.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78945
+
+        Reviewed by Eric Seidel.
+
+        The implementation of registerProtocolHandler needlessly complicates
+        the implementation of Navigator.cpp.  In principle,
+        registerProtocolHandler (and possibly registerContentHandler, when we
+        implement that feature) could be its own module, but that seems like
+        overkill for one or two files.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (Navigator):
+        * page/Navigator.idl:
+
+2012-02-21  MORITA Hajime  <morrita@google.com>
+
+        HasIDFlag and HasClassFlag can be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77861
+
+        Reviewed by Andreas Kling.
+
+        Replaced HasIDFlag and HasClassFlag with a check against
+        ElementAttributeData. It looks these flags (originally bitfields)
+        were legacy of ancient era, where we didn't cache @id and @class
+        values and needed a hash lookup for each check.
+
+        No new tests. No behavioral change.
+
+        * dom/Element.cpp:
+        (WebCore::Element::idAttributeChanged):
+        * dom/Element.h:
+        (WebCore::Element::hasID):
+        (WebCore):
+        (WebCore::Element::hasClass):
+        (WebCore::Node::hasID):
+        (WebCore::Node::hasClass):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::hasID):
+        (WebCore::ElementAttributeData::hasClass):
+        (ElementAttributeData):
+        * dom/Node.h:
+        (Node):
+        (WebCore::nodeStyleChangeShift):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged):
+
+2012-02-21  Matthew Delaney  <mdelaney@apple.com>
+
+        2D Canvas setTransform makes unnecessary matrix mults
+        https://bugs.webkit.org/show_bug.cgi?id=79190
+
+        Reviewed by Dan Bernstein.
+
+        No new tests - plenty of current tests using setTransform.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setTransform):
+
+2012-02-21  MORITA Hajime <morrita@google.com>
+
+        INPUT_SPEECH should be implemented as a PageSupplement.
+        https://bugs.webkit.org/show_bug.cgi?id=79051
+
+        Turned SpeechInput to a PageSupplement.
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavior change.
+
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::speechInput):
+        (WebCore::InputFieldSpeechButtonElement::attach):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+        * page/SpeechInput.cpp:
+        (WebCore::SpeechInput::supplementName):
+        (WebCore):
+        (WebCore::provideSpeechInputTo):
+        * page/SpeechInput.h:
+        (SpeechInput):
+        (WebCore::SpeechInput::from):
+        * page/SpeechInputClient.h:
+        (WebCore):
+
+2012-02-21  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Add three small zoom gesture features
+        https://bugs.webkit.org/show_bug.cgi?id=74216
+
+        Reviewed by James Robinson.
+
+        1. Support panning around with two fingers.
+        2. When double-tap zooming, issue the commit at final/scroll scale as
+        early as possible.
+        3. When pinch zooming out, issue a commit at minimum scale to avoid
+        showing checkerboard.
+
+        Added test for panning to CCLayerTreeHostImplTest::pinchGesture.
+        (The other features are heuristics whose exact behavior we don't need
+        to lock in with a test.)
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
+        (WebCore::CCLayerTreeHostImpl::pinchGestureBegin):
+        (WebCore::CCLayerTreeHostImpl::pinchGestureUpdate):
+        (WebCore::CCLayerTreeHostImpl::computeDoubleTapZoomDeltas):
+        (WebCore::CCLayerTreeHostImpl::computePinchZoomDeltas):
+        (WebCore::CCLayerTreeHostImpl::makeScrollAndScaleSet):
+        (WebCore::CCLayerTreeHostImpl::processScrollDeltas):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        No new tests, because there is no change in behavior.
+
+        * CMakeLists.txt:
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        NavigatorMediaStream.idl defines an interface for NavigatorGamepad
+        https://bugs.webkit.org/show_bug.cgi?id=79152
+
+        Reviewed by Adam Barth.
+
+        Fixed a typo: NavigatorGamepad => NavigatorMediaStream
+
+        This typo fix just changes the name of generated files:
+
+        - V8NavigatorGamepad.h => V8NavigatorMediaStream.h
+        - V8NavigatorGamepad.cpp => V8NavigatorMediaStream.cpp
+
+        The reason why the typo has not caused any serious build issues is that
+        the generate files for supplemental interfaces are "empty" and not important.
+        They just exist to control makefile dependencies.
+
+        No tests. No change in behavior.
+
+        * mediastream/NavigatorMediaStream.idl:
+
+2012-02-21  Daniel Sievers  <sievers@chromium.org>
+
+        [Chromium] Fix compositor setting color uniforms incorrectly for solid color quads.
+        https://bugs.webkit.org/show_bug.cgi?id=76017
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawSolidColorQuad):
+
+2012-02-21  Max Vujovic  <mvujovic@adobe.com>
+
+        getCTM() on SVG root element with borders, paddings, and viewbox returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=78631
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement::currentViewportSize was returning the size of the SVG viewport plus CSS
+        borders and paddings, causing the CTM calculation to be off.
+
+        Test: svg/dom/SVGLocatable-getCTM-svg-root.html
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::currentViewportSize):
+
+            SVGSVGElement::currentViewportSize now uses the contentBoxRect instead of the frameRect.
+            The contentBoxRect corresponds to the SVG viewport and does not include borders and
+            paddings.
+
+2012-02-21  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream Icon class in platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=79088
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/IconBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::paint):
+        (WebCore::Icon::createIconForFiles):
+
+2012-02-21  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Rename "reserved1" flag of WebSocketFrame to compress
+        https://bugs.webkit.org/show_bug.cgi?id=79187
+
+        WebSocket deflate-frame extension draft specification defines COMP bit.
+        http://tools.ietf.org/html/draft-tyoshino-hybi-websocket-perframe-deflate-05#page-11
+
+        Reviewed by Kent Tamura.
+
+        No new tests. http/tests/websocket/tests/hybi/reserved-bits.html is revised to follow the change.
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore):
+        (WebCore::WebSocketChannel::parseFrame): "reserved1" renamed "compress".
+        (WebCore::WebSocketChannel::processFrame): Removed reserved1 flag check.
+        (WebCore::makeFrameData):
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketFrame.h: "reserved1" flag renamed "compress".
+        (WebCore::WebSocketFrame::WebSocketFrame):
+        (WebSocketFrame):
+
+2012-02-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Move all TextureMapper related files to graphics/texmap
+        https://bugs.webkit.org/show_bug.cgi?id=79141
+
+        Reviewed by Martin Robinson.
+
+        Move TextureMaooerGL and TextureMapperShaderManager files to graphics/texmap.
+        No new tests. 
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp
+        * platform/graphics/opengl/TextureMapperGL.cpp: Removed.
+        * platform/graphics/opengl/TextureMapperGL.h: Removed.
+        * platform/graphics/opengl/TextureMapperShaderManager.cpp: Removed.
+        * platform/graphics/opengl/TextureMapperShaderManager.h: Removed.
+        * platform/graphics/texmap/TextureMapperGL.cpp: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp.
+        * platform/graphics/texmap/TextureMapperGL.h: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperGL.h.
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperShaderManager.cpp.
+        * platform/graphics/texmap/TextureMapperShaderManager.h: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperShaderManager.h.
+
+2012-02-20  MORITA Hajime  <morrita@google.com>
+
+        MEDIA_STREAM should be implemented as a PageSupplement.
+        https://bugs.webkit.org/show_bug.cgi?id=79050
+
+        Reviewed by Adam Barth.
+
+        Added UserMediaController which implements PageSupplement. This
+        controller mediates WebCore-to-client communication and lifecycle
+        management. Then pushed UserMediaController out as a
+        PageSupplement module.
+
+        No new tests. No behavior change.
+
+        * WebCore.gypi:
+        * GNUmakefile.list.am:
+        * mediastream/NavigatorMediaStream.cpp:
+        (WebCore::NavigatorMediaStream::webkitGetUserMedia):
+        * mediastream/UserMediaClient.h:
+        (WebCore):
+        * mediastream/UserMediaController.cpp: Added.
+        (WebCore):
+        (WebCore::UserMediaController::supplementName):
+        (WebCore::UserMediaController::UserMediaController):
+        (WebCore::UserMediaController::~UserMediaController):
+        (WebCore::UserMediaController::create):
+        (WebCore::provideUserMediaTo):
+        * mediastream/UserMediaController.h: Added.
+        (WebCore):
+        (UserMediaController):
+        (WebCore::UserMediaController::client):
+        (WebCore::UserMediaController::from):
+        (WebCore::UserMediaController::requestUserMedia):
+        (WebCore::UserMediaController::cancelUserMediaRequest):
+        * mediastream/UserMediaRequest.cpp:
+        (WebCore::UserMediaRequest::create):
+        (WebCore::UserMediaRequest::UserMediaRequest):
+        (WebCore::UserMediaRequest::didCompleteQuery):
+        (WebCore::UserMediaRequest::contextDestroyed):
+        * mediastream/UserMediaRequest.h:
+        (WebCore):
+        (UserMediaRequest):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Node::isContentEditable should only update styles, not layout
+        https://bugs.webkit.org/show_bug.cgi?id=78637
+
+        Reviewed by Ryosuke Niwa.
+
+        isContentEditable depends on knowing the node's current computed style, so it has to update styles if they are
+        out of date.  It does not depend on knowing any layout-derived properties, however, so updating layout is just a
+        waste of time.
+
+        Behavior is covered by existing layout tests, primarily in editing/
+
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable):
+        (WebCore::Node::isContentRichlyEditable):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Partially revert r108418 - move allowEventDispatch() call back to where it used to be.
+
+        Rubber-stamped by Ryosuke Niwa.
+
+        Tested by fast/text/find-layout-crash.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
+
+2012-02-21  Anders Carlsson  <andersca@apple.com>
+
+        Background jitters on pages with background-attachment: fixed
+        https://bugs.webkit.org/show_bug.cgi?id=79182
+
+        Reviewed by Dan Bernstein.
+
+        Make sure to update the main frame scroll position before updating the scrolling layer.
+        This also fixes a (purely theoretical) bug where we wouldn't be updating the main frame
+        position if the main frame didn't have a scroll layer.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        Early-out in Region::unite() for adding an empty region.
+        https://bugs.webkit.org/show_bug.cgi?id=79174
+
+        Reviewed by Anders Carlsson.
+
+        * platform/graphics/Region.cpp:
+        (WebCore::Region::unite):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Painting a layer clears opaque rect in untouched tiles
+        https://bugs.webkit.org/show_bug.cgi?id=79157
+
+        Reviewed by James Robinson.
+
+        When painting a tiled layer, we would throw away the saved opaque rect
+        for any tiles that were not part of the paint. So now we check
+        if we are able to save the existing saved opaque rect in a more
+        proper way:
+        1. If any pixels of the saved rect are painted non-opaque, we replace
+        the saved rect.
+        2. If an opaque rect is drawn outside of the saved rect, we replace
+        the saved rect.
+
+        Unit test: TiledLayerChromiumTest.cpp
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::addSelfToOccludedScreenSpace):
+
+2012-02-21  Raymond Toy  <rtoy@google.com>
+
+        Small typo in AudioPannerNode.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=75890
+
+        Change to check elevation as intended instead of azimuth.
+        
+        Reviewed by Chris Rogers.
+
+        No new tests for correction of typo.
+
+        * webaudio/AudioPannerNode.cpp:
+        (WebCore::AudioPannerNode::getAzimuthElevation):
+
+2012-02-21  Adam Barth  <abarth@webkit.org>
+
+        Frame and Navigator shouldn't need to worry about Geolocation
+        https://bugs.webkit.org/show_bug.cgi?id=78860
+
+        Reviewed by Eric Seidel.
+
+        This patch removes some Geolocation-specific code from Frame and
+        Navigator in favor of our new supplemental module mechanism.  We're
+        still refining the module system, but we seem to be converging on a
+        simple Observer/Supplement design.
+
+        In a future patch, I'll move the remaining Geolocation-related files in
+        WebCore into Modules/geolocation.  This patch appears to be the first
+        patch that introduces a module used by all the various build systems,
+        which is why there's a bit more build system overhead than usual.
+
+        * Modules/geolocation: Added.
+        * Modules/geolocation/NavigatorGeolocation.cpp: Added.
+        (WebCore):
+        (WebCore::NavigatorGeolocation::NavigatorGeolocation):
+        (WebCore::NavigatorGeolocation::~NavigatorGeolocation):
+        (WebCore::NavigatorGeolocation::pageDestroyed):
+        (WebCore::NavigatorGeolocation::from):
+        (WebCore::NavigatorGeolocation::geolocation):
+        * Modules/geolocation/NavigatorGeolocation.h: Added.
+        (WebCore):
+        (NavigatorGeolocation):
+        * Modules/geolocation/NavigatorGeolocation.idl: Added.
+            - I've temporarily disabled this API for GObject because it generates
+              a strange compile error.  Once I land this patch, I'll spend some
+              more time fixing the compile error.
+        * page/DOMWindow.cpp:
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/FrameDestructionObserver.cpp:
+        (WebCore::FrameDestructionObserver::pageDestroyed):
+        (WebCore):
+        * page/FrameDestructionObserver.h:
+        (FrameDestructionObserver):
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (WebCore):
+        (Navigator):
+        * page/Navigator.idl:
+
+2012-02-21  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: merge scattered setTargetRenderSurface logic
+        https://bugs.webkit.org/show_bug.cgi?id=78936
+
+        Reviewed by James Robinson.
+
+        No change in behavior, the code moved around already covered by existing tests.
+
+        In calculateDrawTransformsAndVisibility(), there are two separate
+        if-else statements where setTargetRenderSurface logic is
+        performed, and this makes the code less readable and more error
+        prone. This patch merges the logic, removing the redundant if-else
+        statements.
+
+        This code also merges one other set of if-statements that are
+        equivalent, if (layer->parent()) and if (layer!=rootLayer).
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::createRenderSurface):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::createRenderSurface):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        Remove FIXME from resolve-supplemental.pl
+        https://bugs.webkit.org/show_bug.cgi?id=79160
+
+        Reviewed by Adam Barth.
+
+        The IDL attribute checker has been enabled in all build systems.
+        This patch removes FIXME in resolve-supplemental.pl.
+        Also, this patch improves a comment in IDLAttributes.txt.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/resolve-supplemental.pl:
+
+2012-02-21  Emil A Eklund  <eae@chromium.org>
+
+        Add FractionalLayoutRect for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78924
+
+        Reviewed by Eric Seidel.
+
+        Add FractionalLayoutUnit version of Rect class. Uses FractionalLayoutPoint
+        and FractionalLayoutSize internally.
+
+        Also add conversions to int/float versions of same.
+
+        No new tests.
+
+        * GNUmakefile.list.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::FloatRect):
+        (WebCore):
+        * platform/graphics/FloatRect.h:
+        (WebCore):
+        (FloatRect):
+        * platform/graphics/FractionalLayoutRect.cpp: Added.
+        (WebCore):
+        (WebCore::FractionalLayoutRect::FractionalLayoutRect):
+        (WebCore::FractionalLayoutRect::intersects):
+        (WebCore::FractionalLayoutRect::contains):
+        (WebCore::FractionalLayoutRect::intersect):
+        (WebCore::FractionalLayoutRect::unite):
+        (WebCore::FractionalLayoutRect::uniteIfNonZero):
+        (WebCore::FractionalLayoutRect::scale):
+        (WebCore::unionRect):
+        (WebCore::enclosingIntRect):
+        (WebCore::enclosingFractionalLayoutRect):
+        (WebCore::pixelSnappedIntRect):
+        * platform/graphics/FractionalLayoutRect.h: Added.
+        (WebCore):
+        (FractionalLayoutRect):
+        (WebCore::FractionalLayoutRect::FractionalLayoutRect):
+        (WebCore::FractionalLayoutRect::location):
+        (WebCore::FractionalLayoutRect::size):
+        (WebCore::FractionalLayoutRect::setLocation):
+        (WebCore::FractionalLayoutRect::setSize):
+        (WebCore::FractionalLayoutRect::x):
+        (WebCore::FractionalLayoutRect::y):
+        (WebCore::FractionalLayoutRect::maxX):
+        (WebCore::FractionalLayoutRect::maxY):
+        (WebCore::FractionalLayoutRect::width):
+        (WebCore::FractionalLayoutRect::height):
+        (WebCore::FractionalLayoutRect::setX):
+        (WebCore::FractionalLayoutRect::setY):
+        (WebCore::FractionalLayoutRect::setWidth):
+        (WebCore::FractionalLayoutRect::setHeight):
+        (WebCore::FractionalLayoutRect::isEmpty):
+        (WebCore::FractionalLayoutRect::center):
+        (WebCore::FractionalLayoutRect::move):
+        (WebCore::FractionalLayoutRect::moveBy):
+        (WebCore::FractionalLayoutRect::expand):
+        (WebCore::FractionalLayoutRect::contract):
+        (WebCore::FractionalLayoutRect::shiftXEdgeTo):
+        (WebCore::FractionalLayoutRect::shiftMaxXEdgeTo):
+        (WebCore::FractionalLayoutRect::shiftYEdgeTo):
+        (WebCore::FractionalLayoutRect::shiftMaxYEdgeTo):
+        (WebCore::FractionalLayoutRect::minXMinYCorner):
+        (WebCore::FractionalLayoutRect::maxXMinYCorner):
+        (WebCore::FractionalLayoutRect::minXMaxYCorner):
+        (WebCore::FractionalLayoutRect::maxXMaxYCorner):
+        (WebCore::FractionalLayoutRect::contains):
+        (WebCore::FractionalLayoutRect::inflateX):
+        (WebCore::FractionalLayoutRect::inflateY):
+        (WebCore::FractionalLayoutRect::inflate):
+        (WebCore::FractionalLayoutRect::transposedRect):
+        (WebCore::FractionalLayoutRect::infiniteRect):
+        (WebCore::intersection):
+        (WebCore::unionRect):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        * platform/graphics/IntRect.cpp:
+        (WebCore::IntRect::IntRect):
+        (WebCore):
+        * platform/graphics/IntRect.h:
+        (WebCore):
+        (IntRect):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Enable ScrollingCoordinator in chromium whenever compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79165
+
+        Reviewed by Adam Barth.
+
+        As the title says.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+            Remove ASSERT_NOT_REACHED()ed from these functions, they are now expected to be called but do nothing.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+            Guard a mac-specific piece of code in #if PLATFORM(MAC). This code already has a FIXME.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::shouldCompositeOverflowControls):
+            Make coordinatesScroll..() sufficient but not necessary for compositing overflow controls. In chromium, we
+            want to composite overflow controls even for FrameViews that we aren't coordinating via the
+            ScrollingCoordinator.
+
+2012-02-21  Adam Klein  <adamk@chromium.org>
+
+        Setting innerText causes DOMSubtreeModified to be dispatched too early
+        https://bugs.webkit.org/show_bug.cgi?id=79140
+
+        Reviewed by Ryosuke Niwa.
+
+        Followup to r108152: move children change notifications later in
+        ContainerNode::removeChildren(), thus making sure Node::inDocument()
+        is in the correct state when we call into script.
+
+        Tests: fast/dom/getElementById-consistency3.html
+               fast/dom/getElementById-consistency4.html
+               fast/dom/getElementById-consistency5.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
+
+2012-02-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Assertion failure in TextIterator::handleTextBox
+        https://bugs.webkit.org/show_bug.cgi?id=78530
+
+        Reviewed by Eric Seidel.
+
+        The assertion failure was caused by handleTextNodeFirstLetter's updating m_text without clearing
+        m_sortedTextBoxesPosition. Re-structured handleTextNode so that we always reset m_sortedTextBoxesPosition
+        when we have a first-letter.
+
+        Test: editing/text-iterator/rtl-first-letter-text-iterator-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleTextNode):
+        (WebCore::TextIterator::handleTextBox):
+        (WebCore::TextIterator::handleTextNodeFirstLetter):
+
+2012-02-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed build fix.
+
+        No new tests.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+
+2012-02-21  Adam Klein  <adamk@chromium.org>
+
+        ContainerNode::childrenChanged must be called immediately after removing children
+        https://bugs.webkit.org/show_bug.cgi?id=79162
+
+        Reviewed by Ryosuke Niwa.
+
+        In r108152, a call to childrenChanged() was erroneously moved
+        below the call to child->removedFromDocument(). This breaks, at the
+        least, the behavior of the <title> element. This patch corrects the
+        mistake and adds a test.
+
+        Test: fast/dom/title-directionality-removeChild.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild):
+
+2012-02-21  Luke Macpherson   <macpherson@chromium.org>
+
+        Implement many instances of HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79067
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * rendering/style/RenderStyle.h:
+
+2012-02-21  Jon Lee  <jonlee@apple.com>
+
+        Bring notifications support to WK1 mac
+        https://bugs.webkit.org/show_bug.cgi?id=78783
+        <rdar://problem/10610578>
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.exp.in: Expose dispatchErrorEvent on Notification.
+
+2012-02-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Previous web page appears outside content rect
+        https://bugs.webkit.org/show_bug.cgi?id=78816
+
+        Adjust the scissor clipping by -1, as the glScissor() function requires coordinates and
+        not sizes.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new functionality.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::scissorClip):
+
+2012-02-21  Victor Carbune  <vcarbune@adobe.com>
+
+        Added support for pause-on-exit flag on a TextTrackCue.
+        https://bugs.webkit.org/show_bug.cgi?id=72173
+
+        Reviewed by Eric Carlson.
+
+        Test: media/track/track-cues-pause-on-exit.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Implemented
+        support for pausing the video if the pause-on-exit flag is set on
+        a cue that is currently exiting.
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        Enable the IDL attribute checker in all build systems
+        https://bugs.webkit.org/show_bug.cgi?id=79090
+
+        Reviewed by Adam Barth.
+
+        We have enabled the IDL attribute checker in Chromium in r108322.
+        This patch enables the IDL attribute checker in all other
+        build systems.
+
+        No tests. I manually checked that [Custommm], [CallWith=],
+        [CallWith=ScriptExecutionContext|Foo] cause build failures.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/IDLAttributes.txt: Added [ObjCCustomImplementation]
+        since I forgot to add it in r108322.
+
+2012-02-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Better management of shaders in TextureMapperGL
+        https://bugs.webkit.org/show_bug.cgi?id=78674
+ 
+        Reviewed by Noam Rosenthal.
+ 
+        Split TextureMapperGL.cpp into two files.
+        Get rid of the enums that we were using to identify shaders and to identify variables.
+        Switch flip and opaque from using bool to using enums.
+ 
+        No new tests. This is refactoring only.
+ 
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/OpenGLShims.h:
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore):
+        (SharedGLData):
+        (WebCore::TextureMapperGLData::SharedGLData::SharedGLData):
+        (WebCore::TextureMapperGLData::SharedGLData::~SharedGLData):
+        (WebCore::TextureMapperGLData::TextureMapperGLData):
+        (TextureMapperGLData):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::TextureMapperGL::drawTextureWithMaskAndOpacity):
+        (WebCore::TextureMapperGL::drawTextureSimple):
+        (WebCore::TextureMapperGL::beginClip):
+        * platform/graphics/opengl/TextureMapperGL.h:
+        * platform/graphics/opengl/TextureMapperShaderManager.cpp: Added.
+        (WebCore):
+        (WebCore::FRAGMENT_SHADER):
+        (WebCore::TextureMapperShaderProgram::initializeProgram):
+        (WebCore::TextureMapperShaderProgram::getUniformLocation):
+        (WebCore::TextureMapperShaderProgram::~TextureMapperShaderProgram):
+        (WebCore::TextureMapperShaderProgramSimple::create):
+        (WebCore::TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple):
+        (WebCore::TextureMapperShaderProgramSimple::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramSimple::fragmentShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::create):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMask):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource):
+        (WebCore::TextureMapperShaderProgramClip::create):
+        (WebCore::TextureMapperShaderProgramClip::TextureMapperShaderProgramClip):
+        (WebCore::TextureMapperShaderProgramClip::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramClip::fragmentShaderSource):
+        (WebCore::TextureMapperShaderManager::TextureMapperShaderManager):
+        (WebCore::TextureMapperShaderManager::~TextureMapperShaderManager):
+        * platform/graphics/opengl/TextureMapperShaderManager.h: Added.
+        (WebCore):
+        (WebCore::debugGLCommand):
+        (TextureMapperShaderProgram):
+        (WebCore::TextureMapperShaderProgram::id):
+        (WebCore::TextureMapperShaderProgram::vertexAttrib):
+        (WebCore::TextureMapperShaderProgram::shaderType):
+        (TextureMapperShaderProgramSimple):
+        (WebCore::TextureMapperShaderProgramSimple::matrixVariable):
+        (WebCore::TextureMapperShaderProgramSimple::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgramSimple::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgramSimple::opacityVariable):
+        (TextureMapperShaderProgramOpacityAndMask):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::matrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskTextureVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::opacityVariable):
+        (TextureMapperShaderProgramClip):
+        (WebCore::TextureMapperShaderProgramClip::matrixVariable):
+        (TextureMapperShaderManager):
+        (WebCore::TextureMapperShaderManager::getShaderProgram):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::reset):
+        (WebCore::BitmapTexture::isOpaque):
+        (BitmapTexture):
+
+2012-02-21  Anders Carlsson  <andersca@apple.com>
+
+        The tile cache should keep track of the tile coverage rect
+        https://bugs.webkit.org/show_bug.cgi?id=79149
+        <rdar://problem/10877338>
+
+        Reviewed by Andreas Kling.
+
+        Keep track of the tile coverage rect and use it to avoid trying to iterate over non-existent tiles on large pages.
+
+        * platform/graphics/ca/mac/TileCache.h:
+        (TileCache):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setNeedsDisplayInRect):
+        (WebCore::TileCache::revalidateTiles):
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Make WebKitCSSShaderValue inherit directly from CSSValue.
+        <http://webkit.org/b/79144>
+
+        Reviewed by Antti Koivisto.
+
+        WebKitCSSShaderValue was inheriting from CSSPrimitiveValue but only used
+        it for storing the shader URL. Moved that to a String member instead.
+
+        WebKitCSSShaderValues didn't even return true for isPrimitiveValue() so
+        there should be no behavior change whatsoever here.
+
+        * css/WebKitCSSShaderValue.cpp:
+        (WebCore::WebKitCSSShaderValue::WebKitCSSShaderValue):
+        (WebCore::WebKitCSSShaderValue::cachedShader):
+        (WebCore::WebKitCSSShaderValue::customCssText):
+        * css/WebKitCSSShaderValue.h:
+        (WebKitCSSShaderValue):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed windows build fix - avoid return statement after return if USE(ACCELERATED_COMPOSITING) is set.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::coordinatesScrollingForFrameView):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        ScrollingCoordinator::coordinatesScrollingForFrameView should be conditional on compositing being active
+        https://bugs.webkit.org/show_bug.cgi?id=79126
+
+        Reviewed by Anders Carlsson.
+
+        The ScrollingCoordinator should only attempt to coordinate scrolling when compositing is active, since it's all
+        about manipulating GraphicsLayers. Adds a runtime check.
+
+        Also removes some stray #if ENABLE(THREADED_SCROLLING) guards that snuck into FrameView.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::coordinatesScrollingForFrameView):
+        (WebCore::ScrollingCoordinator::frameViewRootLayerDidChange):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Chromium build fix. Unreviwed but rubber-stamped by Antti.
+
+        * dom/Document.cpp:
+        * editing/ReplaceSelectionCommand.cpp:
+        * inspector/InspectorStyleSheet.h:
+
+2012-02-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Set Referrer header for media downloads
+        https://bugs.webkit.org/show_bug.cgi?id=78614
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: http/tests/media/video-referer.html was modified to test this change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerReferrer): New, return the document's referer.
+        * html/HTMLMediaElement.h:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::referrer): New, return the client's mediaPlayerReferrer.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerReferrer):
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Tell AVFoundation to add
+            a referer header.
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+
+        Remove some obsolete comments, use consistent name for propertyID.
+
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Clean up StylePropertySet included headers
+        https://bugs.webkit.org/show_bug.cgi?id=79134
+
+        Reviewed by Andreas Kling.
+
+        Remove unneccesary includes.
+
+        * bindings/js/JSDOMBinding.h:
+        * css/StylePropertySet.cpp:
+        * css/StylePropertySet.h:
+        (WebCore):
+        (StylePropertySet):
+        * editing/RemoveCSSPropertyCommand.cpp:
+
+2012-02-21  Lin Wei  <wei.a.lin@intel.com>
+
+        Fix bug from r107672.
+        https://bugs.webkit.org/show_bug.cgi?id=78773
+
+        Before set MediaStreamTrack disable/enable operation,
+        checking the status of MediaStream that contains this MediaStreamTrack.
+        if MediaStream is finished, then skipping operation of 
+        didSetMediaStreamTrackEnabled().
+
+        Reviewed by Adam Barth.
+        * mediastream/MediaStreamTrack.cpp:
+        (WebCore::MediaStreamTrack::setEnabled):
+
+2012-02-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move RenderLayer::scrolledContentOffset calls to a common function
+        https://bugs.webkit.org/show_bug.cgi?id=76971
+
+        Reviewed by David Hyatt.
+
+        Refactoring without any change in behavior.
+
+        This change adds a RenderBox::scrolledContentOffset function to handle all
+        the calls that goes through the layer(). This indirection will enable us to
+        add layer() checks without patching a lot of call sites as part of bug 75568.
+
+        We also moved down the concept of scroll offset down to RenderBox where it belongs!
+
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        (WebCore::RenderLayer::scrolledContentOffset):
+        Moved scrolledContent to the private section of the class to prevent misuse.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrolledContentOffset):
+        New function to add an indirection with RenderLayer.
+
+        * editing/visible_units.cpp:
+        (WebCore::absoluteLineDirectionPointToLocalPointInBlock):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::paintSelection):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::computeRectForRepaint):
+        (WebCore::RenderInline::offsetFromContainer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::mapLocalToContainer):
+        (WebCore::RenderObject::mapAbsoluteToLocalPoint):
+        (WebCore::RenderObject::offsetFromContainer):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        Patched all those call sites to use the new function.
+
+2012-02-21  Emil A Eklund  <eae@chromium.org>
+
+        Remove obsolete float comparison FIXMEs
+        https://bugs.webkit.org/show_bug.cgi?id=79127
+
+        Reviewed by Eric Seidel.
+
+        Remove obsolete FIXME comments added back when we were planning to use
+        floating point units for layout.
+
+        No new tests, no code changes.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::init):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
+        (WebCore::RenderBlock::getClearDelta):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::computeLogicalHeightUsing):
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: it is nearly impossible to select and copy text on the Elements panel.
+        https://bugs.webkit.org/show_bug.cgi?id=60814
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+
+2012-02-21  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderTableSection::nodeAtPoint.
+        https://bugs.webkit.org/show_bug.cgi?id=78922
+
+        Reviewed by Julien Chaffraix.
+
+        Test: fast/table/table-section-node-at-point-crash.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint): recalc cells if the
+        m_needsCellRecalc is set. Otherwise, we will end up accessing
+        removed table cells.
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Move PropertySetCSSStyleDeclaration to a file of its own
+        https://bugs.webkit.org/show_bug.cgi?id=79121
+
+        Rubber-stamped by Andreas Kling.
+
+        This makes StylePropertySet.cpp more readable.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/PropertySetCSSStyleDeclaration.cpp: Copied from Source/WebCore/css/StylePropertySet.cpp.
+        (WebCore::PropertySetCSSStyleDeclaration::ref):
+        (WebCore::PropertySetCSSStyleDeclaration::deref):
+        (WebCore):
+        * css/PropertySetCSSStyleDeclaration.h: Added.
+        (WebCore):
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::parentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentRule):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::contextStyleSheet):
+        (WebCore::PropertySetCSSStyleDeclaration::setNeedsStyleRecalc):
+        (RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::parentRule):
+        (WebCore::RuleCSSStyleDeclaration::clearParentRule):
+        (InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::parentElement):
+        (WebCore::InlineCSSStyleDeclaration::clearParentElement):
+        * css/StylePropertySet.cpp:
+        (WebCore):
+
+2012-02-21  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] WebAudio build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=79113
+
+        Reviewed by Martin Robinson.
+
+        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
+        (webKitWebAudioGStreamerChannelPosition): Set a default value for
+        the position variable.
+        * platform/audio/gtk/AudioBusGtk.cpp: Include CString.h, needed
+        for sharedResourcesPath().
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Kill FontFamilyValue.
+        <http://webkit.org/b/79103>
+
+        Reviewed by Antti Koivisto.
+
+        Remove FontFamilyValue and replace all usage by CSSPrimitiveValue.
+        The class was only used to filter font family names, removing bracketed
+        suffixes, e.g "[Xft]".
+
+        This was added to KHTML in 2002 to support the use of specific X11 font
+        families inside KMail: <https://bugs.kde.org/show_bug.cgi?id=38808>
+
+        Test: fast/css/font-family-trailing-bracket-gunk.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSParser.cpp:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSValue.cpp:
+        (WebCore::CSSValue::cssText):
+        (WebCore::CSSValue::destroy):
+        * css/CSSValue.h:
+        * css/CSSValuePool.cpp:
+        (WebCore::CSSValuePool::createFontFamilyValue):
+        * css/CSSValuePool.h:
+        (CSSValuePool):
+        * css/FontFamilyValue.cpp: Removed.
+        * css/FontFamilyValue.h: Removed.
+
+2012-02-21  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Little optimization for CSSParser::parseFillShorthand.
+        https://bugs.webkit.org/show_bug.cgi?id=79042
+
+        Reviewed by Hajime Morita.
+
+        Remove one extra loop that we can combine with the following one
+        which adds the properties to the parser's list of properties. I also
+        removed a useless check.
+        Instruments shows on the css-parser-yui benchmark an improvement
+        of 13ms (from 77ms spent in the function to 64ms).
+
+        No new tests : refactoring, existings tests should cover.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillShorthand):
+
+2012-02-20  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79046
+        
+        width of overflow:hidden blocks is wrong when their margins overlap floats.
+        
+        Relevant discussion is here: http://lists.w3.org/Archives/Public/www-style/2012Feb/0954.html
+        
+        This patch makes the following changes to how objects shrink when avoiding floats:
+        (1) The containing block width used for percentage calculations is now constant. This means that
+        an overflow:hidden block with a margin-left of 10% will no longer change what 10% means depending
+        on the available line width. From a code perspective, containingBlockLogicalWidthForContent and
+        containingBlockLogicalWidthForContentInRegion no longer contain any special-case code for
+        shrinkToAvoidFloats() objects.
+
+        (2) Now the computation of the logical width for the shrinking object itself handles the adjustments.
+        Two kinds of adjustments are made for both the start and end margins. Conceptually what we do is shrink
+        the object to the available line width minus our margins, and then expand the width back out to the content edge
+        or to the float edge as necessary. If the float fully fits in the margin, then we expand back out to the
+        content edge. Otherwise if the float doesn't fit, then we expand only to the float edge, making sure our
+        margin overlaps with the float. This expansion is not performed for negative margins, since our result is already
+        correct in that case.
+        
+        Reviewed by Dan Bernstein.
+
+        Added the new tests from the thread on www-style about this issue (from Alan Gresley and George Talbot)
+        in fast/block/float.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containsFloat):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::containsFloats):
+        Changed to be const.
+
+        (WebCore::RenderBlock::endOffsetForLine):
+        (WebCore::RenderBlock::endOffsetForContent):
+        Added endOffsetForXXX methods to mirror their startOffset counterparts. Used by the width adjustment code.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
+        New method that handles shrinking the logical width to the line width (and then re-expanding back out to the
+        float and/or content edges as needed).
+
+        (WebCore::RenderBox::containingBlockLogicalWidthForContent):
+        (WebCore::RenderBox::containingBlockLogicalWidthForContentInRegion):
+        Patched to no longer do the shrinking of objects to avoid floats.
+
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
+        Patched to handle calling the new shrinking code to adjust our logical width.
+
+        * rendering/RenderBox.h:
+        (RenderBox):
+        The signature of computeLogicalWithUsing changed to be region-specific and to carry along enough information
+        to efficiently perform the shrinking.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::computeLogicalWidth):
+        Patched to handle calling the new shrinking code to adjust our logical width.
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Mac build fix
+
+        * WebCore.xcodeproj/project.pbxproj: Mark TextTrack.h and TextTrackCue.h private so that
+        WebKit can include them.
+
+2012-02-21  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Fix the N9 build
+        https://bugs.webkit.org/show_bug.cgi?id=79101
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests needed.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp: Add missing include.
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r108309, r108323, and r108326
+
+        They broke the 32-bit Lion build.
+
+        Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
+
+        * CMakeLists.txt:
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [SuggestBox] textPrompt.css disablement displays garbled suggest box
+        https://bugs.webkit.org/show_bug.cgi?id=79107
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.SuggestBox):
+        (WebInspector.TextPrompt.SuggestBox.prototype.get visible):
+        (WebInspector.TextPrompt.SuggestBox.prototype.hide):
+        (WebInspector.TextPrompt.SuggestBox.prototype.removeFromElement):
+        (WebInspector.TextPrompt.SuggestBox.prototype._completionsReady):
+        * inspector/front-end/textPrompt.css:
+        (.suggest-box):
+
+2012-02-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: timeline hangs on a page with deep chain of nested events.
+        https://bugs.webkit.org/show_bug.cgi?id=79106
+
+        Use stack of states instead of recursive calls when traversing records tree to
+        avoid stack overflow.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._forAllRecords):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._filterRecords):
+
+2012-02-21  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: [crash] upon style modification after navigation
+        https://bugs.webkit.org/show_bug.cgi?id=79108
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::undo):
+        (WebCore::InspectorHistory::redo):
+        (WebCore::InspectorHistory::reset):
+
+2012-02-21  Patrick Gansterer  <paroga@webkit.org>
+
+        Use WTF::cryptographicallyRandomValues in FileSystemWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79089
+
+        Reviewed by Adam Roben.
+
+        Avoid loading and unloading of the crypto library during every
+        call to openTemporaryFile() and make the code easier.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openTemporaryFile):
+
+2012-02-21  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Remove stylesheet pointer from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=79092
+
+        Reviewed by Csaba Osztrogonác.
+
+        Qt buildfix after r108345.
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorValue):
+
+2012-02-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove stylesheet pointer from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=79092
+
+        Reviewed by Antti Koivisto.
+
+        Qt buildfix after r108345. We need this workaround because of buggy gcc (4.4.5), which
+        reported a false warning: 'value$m_ptr' may be used uninitialized in this function
+
+        * css/CSSParser.cpp:
+        (WebCore::parseSimpleLengthValue):
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Shrink attribute style property sets after populating them.
+        <http://webkit.org/b/78972>
+
+        Reviewed by Antti Koivisto.
+
+        Add a StylePropertySet::shrinkToFit() and call it at the end of updateStyleAttribute()
+        to minimize the amount of wasted space.
+
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::shrinkToFit):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateAttributeStyle):
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Remove stylesheet pointer from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=79092
+
+        Reviewed by Andreas Kling.
+
+        The context should be passed as an argument for CSS parser invoking setters that actually need it.
+        
+        - Remove the context stylesheet pointer.
+        - Add context stylesheet argument to setters.
+        - Drop an unnecessary StylePropertySet constructor, pass strict parsing flag directly.
+        - Adapt to changes by passing in the context stylesheet where needed.
+        - Add StyledElement::applyPresentationAttributeToStyle helpers for building up the attribute style.
+
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::addSubresourceStyleURLs):
+        * css/CSSParser.cpp:
+        (WebCore::parseColorValue):
+        (WebCore::parseSimpleLengthValue):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseDeclaration):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createKeyframeRule):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::addSubresourceStyleURLs):
+        * css/StylePropertySet.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::contextStyleSheet):
+        (WebCore::PropertySetCSSStyleDeclaration::setNeedsStyleRecalc):
+        (RuleCSSStyleDeclaration):
+        (InlineCSSStyleDeclaration):
+        (WebCore):
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::setProperty):
+        (WebCore::StylePropertySet::parseDeclaration):
+        (WebCore::StylePropertySet::addSubresourceStyleURLs):
+        (WebCore::StylePropertySet::clearParentRule):
+        (WebCore::StylePropertySet::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::parentStyleSheet):
+        (WebCore::RuleCSSStyleDeclaration::setNeedsStyleRecalc):
+        (WebCore::RuleCSSStyleDeclaration::contextStyleSheet):
+        (WebCore::InlineCSSStyleDeclaration::contextStyleSheet):
+        (SameSizeAsStylePropertySet):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::create):
+        (StylePropertySet):
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::ensureInlineStyleDecl):
+        * dom/StyledElement.cpp:
+        (WebCore):
+        (WebCore::StyledElement::parseAttribute):
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::addSubresourceAttributeURLs):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (StyledElement):
+        (WebCore::StyledElement::applyPresentationAttributeToStyle):
+        (WebCore):
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::collectStyleForAttribute):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::collectStyleForAttribute):
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::collectStyleForAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::applyBorderAttributeToStyle):
+        (WebCore::HTMLElement::mapLanguageAttributeToLocale):
+        (WebCore::HTMLElement::collectStyleForAttribute):
+        (WebCore::HTMLElement::applyAlignmentAttributeToStyle):
+        (WebCore::HTMLElement::addHTMLLengthToStyle):
+        (WebCore::HTMLElement::addHTMLColorToStyle):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::collectStyleForAttribute):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::collectStyleForAttribute):
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::collectStyleForAttribute):
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::collectStyleForAttribute):
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::collectStyleForAttribute):
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::collectStyleForAttribute):
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::collectStyleForAttribute):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::collectStyleForAttribute):
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::insertedIntoDocument):
+        (WebCore::SVGFontFaceElement::removedFromDocument):
+        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::collectStyleForAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::collectStyleForAttribute):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::collectStyleForAttribute):
+
+2012-02-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        [V8] Web Inspector: set breakpoint/pause doesn't work when worker is in a tight loop
+        https://bugs.webkit.org/show_bug.cgi?id=79097
+
+        Worker script will be interrupted to dispatch all arriving inspector commands.
+        This way debugger will be operable even if worker is in a tight loop.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/ScriptDebugServer.h:
+        (Task):
+        (WebCore::ScriptDebugServer::Task::~Task):
+        (ScriptDebugServer):
+        * bindings/js/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::interruptAndRunTask):
+        (WebCore):
+        * bindings/js/WorkerScriptDebugServer.h:
+        (WorkerScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::interruptAndRun):
+        * bindings/v8/ScriptDebugServer.h:
+        (ScriptDebugServer):
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::interruptAndRunTask):
+        (WebCore):
+        * bindings/v8/WorkerScriptDebugServer.h:
+        (v8):
+        (WebCore):
+        (WorkerScriptDebugServer):
+        * inspector/WorkerDebuggerAgent.cpp:
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::~WorkerDebuggerAgent):
+        (WebCore):
+        (WebCore::WorkerDebuggerAgent::interruptAndDispatchInspectorCommands):
+        * inspector/WorkerDebuggerAgent.h:
+        (WebCore):
+        (WorkerDebuggerAgent):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore):
+        (WebCore::WorkerMessagingProxy::sendMessageToInspector):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::run):
+        (WebCore::WorkerRunLoop::runInMode):
+        * workers/WorkerRunLoop.h:
+        (WorkerRunLoop):
+
+2012-02-21  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: fixing Mac build (take 2).
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::setShowPaintRects):
+
+2012-02-21  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: fixing Mac build.
+
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::DOMNodeHighlighter::drawOutline):
+        * inspector/DOMNodeHighlighter.h:
+        (DOMNodeHighlighter):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willPaintImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willPaint):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::willPaint):
+        (WebCore::InspectorPageAgent::didPaint):
+        * inspector/InspectorPageAgent.h:
+
+2012-02-21  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Switch Debugger agent to TypeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=78390
+
+        Reviewed by Vsevolod Vlasov.
+
+        Client code is switched to TypeBuilder.
+
+        * inspector/CodeGeneratorInspector.py:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getFunctionDetails):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::getFunctionDetails):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+
+2012-02-21  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: fixing poor merge in r108332.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorClick):
+        * inspector/front-end/externs.js:
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Rule source URL tooltip should show line number
+        https://bugs.webkit.org/show_bug.cgi?id=79087
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode):
+
+2012-02-21  Pavel Feldman  <pfeldman@chomium.org>
+
+        Web Inspector: clicking empty space should not re-enter edit mode
+        https://bugs.webkit.org/show_bug.cgi?id=79024
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceMouseDown):
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceClick):
+
+2012-02-21  Pavel Feldman  <pfeldman@chomium.org>
+
+        Web Inspector: evaluate on hover does not work for large files.
+        https://bugs.webkit.org/show_bug.cgi?id=79015
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._getPopoverAnchor):
+        (WebInspector.JavaScriptSourceFrame.prototype._highlightExpression):
+        * inspector/front-end/Popover.js:
+        (WebInspector.PopoverHelper.prototype._handleMouseAction):
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+
+2012-02-21  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: add "show paint rectangles" setting.
+        https://bugs.webkit.org/show_bug.cgi?id=79030
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::DOMNodeHighlighter::drawOutline):
+        (DOMNodeHighlighter):
+        * inspector/DOMNodeHighlighter.h:
+        (WebCore):
+        (DOMNodeHighlighter):
+        * inspector/Inspector.json:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willPaintImpl):
+        (WebCore::InspectorInstrumentation::didPaintImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willPaint):
+        * inspector/InspectorPageAgent.cpp:
+        (PageAgentState):
+        (WebCore::InspectorPageAgent::create):
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::setShowPaintRects):
+        (WebCore):
+        (WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorPageAgent::willPaint):
+        (WebCore::InspectorPageAgent::didPaint):
+        (WebCore::InspectorPageAgent::buildObjectForFrame):
+        * inspector/InspectorPageAgent.h:
+        (WebCore):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+        (WebInspector.SettingsScreen.prototype._showPaintRectsChanged):
+        * inspector/front-end/inspector.js:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+
+2012-02-21  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt] Clean-up project file after r108310
+
+        Reviewed by Csaba Osztrogonác.
+
+        No new tests needed.
+
+        * Target.pri: Fix path for TextTrack headers.
+
+2012-02-17  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] media/W3C failures
+        https://bugs.webkit.org/show_bug.cgi?id=75078
+
+        Reviewed by Martin Robinson.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::load): Clean out everything
+        after file:// url path to cope with media/W3C tests loading
+        file:///path/to/media.ext?some parameters.
+
+2012-02-21  Matt Lilek  <mrl@apple.com>
+
+        Not reviewed, build fix for non-client-based Geolocation builds after r107982.
+
+        * page/Geolocation.cpp:
+
+2012-02-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        [V8] Web Inspector: simplify worker debugger implementation
+        https://bugs.webkit.org/show_bug.cgi?id=79085
+
+        There is one instance of WorkerScriptDebugServer per worker thread. We don't
+        need to resolve WorkerContext from V8::Context anymore.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        (WebCore::WorkerScriptDebugServer::getDebugListenerForContext):
+        (WebCore::WorkerScriptDebugServer::runMessageLoopOnPause):
+        * bindings/v8/WorkerScriptDebugServer.h:
+        (WorkerScriptDebugServer):
+        * inspector/WorkerDebuggerAgent.cpp:
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::stopListeningScriptDebugServer):
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        Enable the IDL attribute checker in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=79082
+
+        Reviewed by Adam Barth.
+
+        We have fixed 10~ bugs caused by typos of IDL attributes.
+        This patch adds an IDL attribute checker, which checks if all IDL attributes
+        used in IDL files are implemented by code generators.
+
+            - The IDL attribute checker uses IDLAttributes.txt, which lists all
+              IDL attributes implemented in code generators. If we want to add
+              a new IDL attribute, we need to add it to IDLAttributes.txt manually.
+            - The IDL attribute checker checks if all IDL attributes used in IDL files
+              are listed in IDLAttributes.txt.
+            - If the IDL attribute checker fails, the build fails with a verbose error message.
+
+        No tests. I manually checked that [Custommm], [CallWith=],
+        [CallWith=ScriptExecutionContext|Foo] cause build failures.
+
+        * WebCore.gyp/WebCore.gyp: Modified to enable the IDL attribute checker.
+
+        * bindings/scripts/resolve-supplemental.pl:
+        (loadIDLAttributes): This method loads a list of IDL attributes from IDLAttributes.txt.
+        (checkIDLAttributes): This method implementes the IDL attribute checker as described above.
+        (checkIfIDLAttributesExists):
+
+        * bindings/scripts/IDLParser.pm: "1" is not good to represent that
+        the IDL attribute does not have any value. This patch changed it to "VALUE_IS_MISSING".
+        (parseExtendedAttributes):
+        (ParseInterface):
+        * bindings/scripts/CodeGenerator.pm: Ditto.
+        (ContentAttributeName):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateNormalAttrGetter):
+        (GenerateNormalAttrSetter):
+        (GenerateSingleBatchedAttribute):
+        (GetRuntimeEnableFunctionName):
+        * bindings/scripts/IDLAttributes.txt: Added. This file lists all IDL attributes implemented
+        in code generators.
+
+2012-02-21  Patrick Gansterer  <paroga@webkit.org>
+
+        Use Win32 API to get file information
+        https://bugs.webkit.org/show_bug.cgi?id=55336
+
+        Reviewed by Adam Roben.
+
+        Use FindFirstFile() in favour over _wstat64() to share the code with WinCE.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore):
+        (WebCore::getFindData):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::fileExists):
+
+2012-02-20  Adam Barth  <abarth@webkit.org>
+
+        Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+        https://bugs.webkit.org/show_bug.cgi?id=78975
+
+        Reviewed by Eric Seidel.
+
+        We're supposed to set the action attribute on the form element we just
+        created.  Previously, we assumed the newly created form element would
+        be on the top of the stack of open elements, but if we're in the table
+        body insertion mode, the form element gets treated as self closing and
+        is therefore popped off the stack of open elements.
+
+        Fortunately, we already cache a pointer to the most recently inserted
+        form element on the HTMLConstructionSite, so we can just grab the
+        element from there.
+
+        Test: html5lib/runner.html
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
+        (WebCore):
+
+2012-02-20  Adam Barth  <abarth@webkit.org>
+
+        Unite TextTrack-related files with their friends in WebCore/html/track
+        https://bugs.webkit.org/show_bug.cgi?id=78941
+
+        Reviewed by Eric Seidel.
+
+        The code that supports <track> seems to be split between the
+        WebCore/html directory and the WebCore/html/track directory.  This
+        patch unites this code in the WebCore/html/track directory.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/LoadableTextTrack.cpp: Removed.
+        * html/LoadableTextTrack.h: Removed.
+        * html/TextTrack.cpp: Removed.
+        * html/TextTrack.h: Removed.
+        * html/TextTrack.idl: Removed.
+        * html/TextTrackCue.cpp: Removed.
+        * html/TextTrackCue.h: Removed.
+        * html/TextTrackCue.idl: Removed.
+        * html/TextTrackCueList.cpp: Removed.
+        * html/TextTrackCueList.h: Removed.
+        * html/TextTrackCueList.idl: Removed.
+        * html/track/LoadableTextTrack.cpp: Copied from Source/WebCore/html/LoadableTextTrack.cpp.
+        * html/track/LoadableTextTrack.h: Copied from Source/WebCore/html/LoadableTextTrack.h.
+        * html/track/TextTrack.cpp: Copied from Source/WebCore/html/TextTrack.cpp.
+        * html/track/TextTrack.h: Copied from Source/WebCore/html/TextTrack.h.
+        * html/track/TextTrack.idl: Copied from Source/WebCore/html/TextTrack.idl.
+        * html/track/TextTrackCue.cpp: Copied from Source/WebCore/html/TextTrackCue.cpp.
+        * html/track/TextTrackCue.h: Copied from Source/WebCore/html/TextTrackCue.h.
+        * html/track/TextTrackCue.idl: Copied from Source/WebCore/html/TextTrackCue.idl.
+        * html/track/TextTrackCueList.cpp: Copied from Source/WebCore/html/TextTrackCueList.cpp.
+        * html/track/TextTrackCueList.h: Copied from Source/WebCore/html/TextTrackCueList.h.
+        * html/track/TextTrackCueList.idl: Copied from Source/WebCore/html/TextTrackCueList.idl.
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        No new tests, because there is no change in behavior.
+
+        * CMakeLists.txt:
+
+2012-02-20  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of the LocalizationStrategy
+        https://bugs.webkit.org/show_bug.cgi?id=78324
+
+        Reviewed by Sam Weinig.
+
+        Remove LocalizationStrategy and unify the localization behind
+        LocalizedStrings.h and LocalizedStrings.cpp.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/DefaultLocalizationStrategy.cpp: Removed.
+        * platform/DefaultLocalizationStrategy.h: Removed.
+        * platform/LocalizationStrategy.h: Removed.
+        * platform/LocalizedStrings.cpp:
+        * platform/LocalizedStrings.h:
+        (WebCore):
+        * platform/PlatformStrategies.cpp:
+        * platform/PlatformStrategies.h:
+        (WebCore):
+        (WebCore::PlatformStrategies::PlatformStrategies):
+        (PlatformStrategies):
+        * platform/qt/LocalizedStringsQt.cpp: Copied from Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp.
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [TreatReturnedNullStringAsNull] from HTMLMediaElement.mediaGroup
+        https://bugs.webkit.org/show_bug.cgi?id=79064
+
+        Reviewed by Hajime Morita.
+
+        [TreatReturnedNullStringAsNull] is a typo of [TreatReturnedNullStringAs=Null].
+        But as far as I read the spec
+        (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#attr-media-mediagroup),
+        there is no statement about what value should be returned when HTMLMediaElement.mediaGroup
+        is not yet initialized. In particular, there is no statement that says "null should
+        be returned when HTMLMediaElement.mediaGroup is not initialized". Thus, instead of
+        fixing the typo, just removing [TreatReturnedNullStringAsNull] would make sense.
+        Removing [TreatReturnedNullStringAsNull] does not change the current behavior.
+
+        Test: media/media-controller.html (No change in the test results.)
+
+        * html/HTMLMediaElement.idl:
+
+2012-02-20  Hayato Ito  <hayato@chromium.org>
+
+        Use InsertinonPoint instead of HTMLContentElement.
+        https://bugs.webkit.org/show_bug.cgi?id=78778
+
+        Reviewed by Hajime Morita.
+
+        Replace HTMLContentElement with InsertionPoint in NodeRenderingContext and HTMLContentSelection.
+        This is one of followup patches for r108207.
+
+        No new tests, no change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::nextRendererOf):
+        (WebCore::previousRendererOf):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        * dom/NodeRenderingContext.h:
+        (WebCore):
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::insertionPoint):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertionPointFor):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::HTMLContentElement):
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelector::select):
+        * html/shadow/HTMLContentSelector.h:
+        (WebCore):
+        (HTMLContentSelection):
+        (WebCore::HTMLContentSelection::insertionPoint):
+        (WebCore::HTMLContentSelection::HTMLContentSelection):
+        (WebCore::HTMLContentSelection::create):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::InsertionPoint):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::selections):
+        (WebCore::InsertionPoint::hasSelection):
+        (InsertionPoint):
+
+2012-02-20  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - code clean-up for RenderMathMLSubSup
+        https://bugs.webkit.org/show_bug.cgi?id=79063
+
+        Reviewed by Eric Seidel.
+
+        In the next patch, I will shrink and revise the <msubsup> formatting code. To make this
+        easier to follow, I am first doing some simple code clean-up.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::layout):
+        * rendering/mathml/RenderMathMLRow.h:
+        (WebCore::RenderMathMLRow::isRenderMathMLRow):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        (WebCore::RenderMathMLSubSup::layout):
+            - There is no need to iterate over baseWrapper's children since it should have only
+              one child, the base of the <msubsup>.
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [V8Custom=DOMWindowNOP] with [V8Custom]
+        https://bugs.webkit.org/show_bug.cgi?id=79062
+
+        Reviewed by Adam Barth.
+
+        [V8Custom=DOMWindowNOP] is not implemented by CodeGeneratorV8.pm.
+        This patch replaces it with [V8Custom].
+
+        No new tests. No change in behavior.
+
+        * page/DOMWindow.idl:
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        [JSGenerateIsReachable=ImplRoot] is not implemented, it should be [JSGenerateIsReachable]
+        https://bugs.webkit.org/show_bug.cgi?id=79061
+
+        Reviewed by Adam Barth.
+
+        CSSStyleDeclaration.idl uses [JSGenerateIsReachable=ImplRoot],
+        but "ImplRoot" is not implemented in CodeGeneratorJS.pm.
+        This patch replaces [JSGenerateIsReachable=ImplRoot] with [JSGenerateIsReachable].
+
+        No tests. No change in behavior.
+
+        * css/CSSStyleDeclaration.idl:
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        [EnabledAtRuntime] in HTMLShadowElement.idl should be [V8EnabledAtRuntime]
+        https://bugs.webkit.org/show_bug.cgi?id=79058
+
+        Reviewed by Adam Barth.
+
+        [EnabledAtRuntime] does not exist any longer. It should be [V8EnabledAtRuntime].
+
+        No tests.
+
+        * html/shadow/HTMLShadowElement.idl:
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [Callback=FunctionOnly] with [Callback]
+        https://bugs.webkit.org/show_bug.cgi?id=79060
+
+        Reviewed by Adam Barth.
+
+        [Callback=FunctionOnly] is not implemented by any code generator.
+        This patch replaces it with [Callback].
+
+        No tests. No change in behavior.
+
+        * Modules/intents/IntentResultCallback.idl:
+        * Modules/intents/NavigatorIntents.idl:
+        * dom/RequestAnimationFrameCallback.idl:
+        * mediastream/NavigatorMediaStream.idl:
+        * mediastream/NavigatorUserMediaErrorCallback.idl:
+        * mediastream/NavigatorUserMediaSuccessCallback.idl:
+        * mediastream/PeerConnection.idl:
+        * mediastream/SignalingCallback.idl:
+        * page/PositionCallback.idl:
+        * page/PositionErrorCallback.idl:
+
+2012-02-20  Andy Chen  <andchen@rim.com>
+
+        2012-02-17  Andy Chen  <andchen@rim.com>
+
+        [BlackBerry] Need to override active/inactive text search highlight color for RenderThemeBlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=78920
+
+        Override two functions for text search highlight colors so that we can
+        provide platform specified colors.
+
+        Reviewed by Antonio Gomes.
+
+        No function change so no new tests.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderThemeBlackBerry::platformInactiveTextSearchHighlightColor):
+        * platform/blackberry/RenderThemeBlackBerry.h:
+
+2012-02-20  John Knottenbelt  <jknotten@chromium.org>
+
+        Default canvas backing store to be 1:1 with specified dimensions.
+        https://bugs.webkit.org/show_bug.cgi?id=78971
+
+        Reviewed by Adam Barth.
+
+        Although the canvas specification states that the backing image may
+        be larger than the user-specified dimensions, there are a number of
+        philip canvas tests that fail when the backing image data is not
+        1:1 with the specified canvas dimensions. These failures are
+        tracked in https://bugs.webkit.org/show_bug.cgi?id=73645
+
+        This change defaults the canvas backing store to be 1:1 with the
+        user-specified dimensions, while also providing an
+        ENABLE(HIGH_DPI_CANVAS) build option to reinstate the original
+        behaviour, so that the above bug may be more easily fixed.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
+
+2012-02-20  Mary Wu  <mary.wu@torchmobile.com.cn>
+
+        Upstream RenderThemeBlackberry.h/.cpp into WebCore/platform/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=78785
+
+        Main Contributors:
+        Daniel Bates <dbates@rim.com>
+        Bryan Gislason <bgislason@rim.com>
+        Akash Vaswani <akvaswani@rim.com>
+        Dave Battista <dbattista@rim.com>
+        Robin Cao  <robin.cao@torchmobile.com.cn>
+        Genevieve Mak <gmak@rim.com>
+        Mike Fenton  <mifenton@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp: Added.
+        * platform/blackberry/RenderThemeBlackBerry.h: Added.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [EFL] Collapse duplicate WebGL support code
+        https://bugs.webkit.org/show_bug.cgi?id=78970
+
+        Reviewed by Gustavo Noronha Silva.
+
+        No new tests. This just cleans up duplicated code.
+
+        Centralize duplicated WebGL code for EFL and GTK+ in the Cairo
+        directory. This is in preparation for the changes necessary to
+        connect WebGL to the TextureMapper AC.
+
+        * GNUmakefile.list.am: Update source list.
+        * PlatformEfl.cmake: Update source list.
+        * platform/graphics/cairo/DrawingBufferCairo.cpp: Renamed from Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp.
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp: Integrated the code From GraphicsContext3DGtk.cpp.
+        * platform/graphics/efl/DrawingBufferEfl.cpp: Removed.
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp: Removed.
+        * platform/graphics/gtk/GraphicsContext3DGtk.cpp: Removed.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [UNIX] Plugin information fields are not interpreted as UTF-8
+        https://bugs.webkit.org/show_bug.cgi?id=78635
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Interpret plugin metadata as UTF8 aways. This matches the behavior
+        of Chromium and the Totem plugin.
+
+        This is tested by a change to TestNetscapePlugin and expectations updates.
+
+        * plugins/efl/PluginPackageEfl.cpp:
+        (WebCore::PluginPackage::fetchInfo): Use String::fromUTF8.
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo): Use String::fromUTF8.
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo): Use String::fromUTF8.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Web content oftens steals focus from other widgets
+        https://bugs.webkit.org/show_bug.cgi?id=77791
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus): No longer do anything special to try
+        to grab "real" widget focus. This matches the behavior on Qt.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setFocus): Moved the focus handling to here.
+        This ensures that behavior for plugins does not change.
+
+2012-02-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Regression (108135) isOpaque() returns uninitialized variable.
+        https://bugs.webkit.org/show_bug.cgi?id=79049
+
+        Reviewed by Noam Rosenthal.
+
+        isOpaque() should use the new m_flags instead of the old m_isOpaque.
+        No new tests. No new functionality.
+
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::reset):
+        (WebCore::BitmapTexture::isOpaque):
+        (BitmapTexture):
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/CPP/WebDOMTestInterface.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestInterface.h:
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+
+2012-02-20  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Clipping is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78677
+
+        It's not necessary to add a full-viewport rect to the scissor clip stack.
+        It creates a situation where if there's a clip in the page, we return to
+        the viewport clip instead of applying the WebView's clip we got from the
+        scenegraph.
+
+        Also, it's unnecessary to clip before we paint the layer's content, we should
+        only clip afterwards, before painting the children. 
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new functionality.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::size):
+        (WebCore::scissorClip):
+        (WebCore):
+        (WebCore::TextureMapperGL::beginScissorClip):
+        (WebCore::TextureMapperGL::endScissorClip):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::paintSelfAndChildren):
+
+2012-02-20  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Layers and tiles appear to have missing pixels in their right/bottom borders
+        https://bugs.webkit.org/show_bug.cgi?id=78961
+
+        The relativeSize member should point to one pixel before the edge, since it's used
+        by glVertexAttribPointer, which takes edge points and not sizes.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new funcionality.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::didReset):
+
+2012-02-20  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add a new API for the Vibration API(W3C).
+        https://bugs.webkit.org/show_bug.cgi?id=72010
+
+        http://dev.w3.org/2009/dap/vibration/
+        This patch implements navigator.webkitvibrate() API.
+        This API operates differently depending upon a given parameter:
+        1. It cancels vibration when given 0 or [].
+        2. It gives a vibration duration in milliseconds when given as a single integer value.
+        3. It gives a vibration pattern when given as an integer array. For instance, [1000 300 1000] generates a vibration of 1000ms followed by 300ms of idle time, and then creates another vibration of 1000ms.
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/dom/navigator-vibration.html
+
+        * CMakeLists.txt:
+        * Modules/vibration/NavigatorVibration.cpp: Added.
+        (WebCore):
+        (WebCore::NavigatorVibration::NavigatorVibration):
+        (WebCore::NavigatorVibration::~NavigatorVibration):
+        (WebCore::NavigatorVibration::webkitVibrate):
+        Add webkitVibrate method to get an array or single integer parameter for vibrating.
+        They check vibration is activated in the platform, and then call vibrate() in the Vibration class.
+        * Modules/vibration/NavigatorVibration.h: Added.
+        (WebCore):
+        (NavigatorVibration):
+        * Modules/vibration/NavigatorVibration.idl: Added.
+        * Modules/vibration/Vibration.cpp: Added.
+        This class implements the entire vibration logic.
+        (WebCore):
+        (WebCore::Vibration::Vibration):
+        (WebCore::Vibration::~Vibration):
+        (WebCore::Vibration::create):
+        (WebCore::Vibration::vibrate):
+        (WebCore::Vibration::cancelVibration):
+        (WebCore::Vibration::suspendVibration):
+        (WebCore::Vibration::resumeVibration):
+        (WebCore::Vibration::timerStartFired):
+        (WebCore::Vibration::timerStopFired):
+        (WebCore::Vibration::supplementName):
+        (WebCore::Vibration::isActive):
+        (WebCore::provideVibrationTo):
+        * Modules/vibration/Vibration.h: Added.
+        (WebCore):
+        (Vibration):
+        (WebCore::Vibration::from):
+        * Modules/vibration/VibrationClient.h: Added.
+        vibrate() and cancelVibrate() need to be implemented in the VibrationClient.
+        (WebCore):
+        (VibrationClient):
+        (WebCore::VibrationClient::~VibrationClient):
+
+2012-02-20  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108263.
+        http://trac.webkit.org/changeset/108263
+        https://bugs.webkit.org/show_bug.cgi?id=77856
+
+        Broke Chromium Windows build.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+        (WebCore::DynamicsCompressor::setEmphasisStageParameters):
+        (WebCore::DynamicsCompressor::process):
+        (WebCore::DynamicsCompressor::reset):
+        * platform/audio/DynamicsCompressor.h:
+        (WebCore::DynamicsCompressor::isStereo):
+        (DynamicsCompressor):
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::process):
+        (WebCore::DynamicsCompressorKernel::reset):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::initialize):
+
+2012-02-20  Raymond Liu  <raymond.liu@intel.com>
+
+        Have the DynamicsCompressorNode support multi-channel data
+        https://bugs.webkit.org/show_bug.cgi?id=77856
+
+        Reviewed by Chris Rogers.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+        (WebCore::DynamicsCompressor::setEmphasisStageParameters):
+        (WebCore::DynamicsCompressor::process):
+        (WebCore::DynamicsCompressor::reset):
+        (WebCore::DynamicsCompressor::setNumberOfChannels):
+        (WebCore):
+        * platform/audio/DynamicsCompressor.h:
+        (DynamicsCompressor):
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setNumberOfChannels):
+        (WebCore):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::process):
+        (WebCore::DynamicsCompressorKernel::reset):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::initialize):
+
+2012-02-20  David Barton  <dbarton@mathscribe.com>
+
+        RenderMathMLRow::baselinePosition() only if linePositionMode == PositionOnContainingLine
+        https://bugs.webkit.org/show_bug.cgi?id=79039
+
+        Reviewed by Eric Seidel.
+
+        RenderMathMLRow::baselinePosition() is actually unnecessary, but I am deleting it in two
+        steps. First we add a guard to restrict it to the intended PositionOnContainingLine
+        case, leaving PositionOfInteriorLineBoxes to a superclass, RenderBlock. This removes
+        some randomness, and tightens up the results of four existing test files.
+
+        Test: mathml/presentation/row.xhtml, fenced.xhtml, mo.xhtml, and mo-stretch.html
+
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::baselinePosition):
+
+2012-02-18  Jon Lee  <jonlee@apple.com>
+
+        HTML input file control "No File Selected" needs more room in some languages
+        https://bugs.webkit.org/show_bug.cgi?id=32366
+        <rdar://problem/4481028>
+
+        Reviewed by David Hyatt.
+
+        The patch exposes a function to return the "no file(s) selected" label text.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::fileListDefaultLabel): Added to expose the text for the label in
+        file upload controls when nothing has been selected.
+        (WebCore::RenderTheme::fileListNameForWidth): Refactor to use fileListDefaultLabel().
+        * rendering/RenderTheme.h: Change fileListNameForWidth() to be a const function.
+
+        * rendering/RenderThemeMac.h: Update fileListNameForWidth() to be a const function for
+        platform implementations.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::fileListNameForWidth): Refactor to use fileListDefaultLabel().
+
+        Update fileListNameForWidth() to be a const function for platform implementations.
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/RenderThemeQt.cpp:
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths): Change the calculation
+        of the max preferred logical width. Calculate the length of the "no file(s) selected" text,
+        and include the button and after-button margin. Take the max of that and the original
+        default width, which was a string of 34 (defaultWidthNumChars) "0"'s, in the case that the
+        label text is too short.
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+            - Errk, remove dead code from end of function.
+
+2012-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+        (WebCore):
+            - expose allowsAccessFrom check to JSC.
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+            - expose allowsAccessFrom check to JSC.
+
+2012-02-20  Benjamin Poulain  <benjamin@webkit.org>
+
+        Make JSCSSStyleDeclaration work directly with CSS Property ID
+        https://bugs.webkit.org/show_bug.cgi?id=79014
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, accessing the CSS property was done by converting from
+        the JavaScript name to the CSS name, then converting that name to a lowercase
+        character array, and finally getting the CSS property ID.
+
+        This patch cut the indirection and make the code go directly from the
+        JavaScript name conversion to the CSS property ID.
+
+        This improves the performance mainly due to the following:
+        -avoid dynamic memory allocation
+        -cut the conversion early when possible
+        -do not parse the string twice
+        The previous fast-path optimization was removed because it is no longer
+        necessary with this change.
+
+        The improvement are the following:
+        -previous fast-path: no change
+        -previous slow-path: ~3 times faster
+
+        Test: fast/dom/CSSStyleDeclaration/access-longest-css-property.html
+        This just test the edge case of CSSPropertyName.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::writeWebKitPrefix):
+        (WebCore::writeEpubPrefix):
+        (WebCore::cssPropertyIDForJSCSSPropertyName):
+        (WebCore::isCSSPropertyName):
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::putDelegate):
+        * css/CSSParser.cpp:
+        (WebCore::cssPropertyID):
+        (WebCore):
+        (WebCore::cssPropertyNameIOSAliasing):
+        * css/CSSParser.h:
+        (WebCore):
+
+2012-02-20  Dan Bernstein  <mitz@apple.com>
+
+        Updated Localizable.strings after r107440.
+
+        Rubber-stamped by Joseph Pecoraro.
+
+        * English.lproj/Localizable.strings:
+
+2012-02-20  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - remove nonOperatorHeight(), hasBase()
+        https://bugs.webkit.org/show_bug.cgi?id=78977
+
+        Reviewed by Eric Seidel.
+
+        Stretchy operators, including embellished ones, should stretch to the largest height of
+        the non-stretchy items in the same explicit or implicit <mrow>.
+        RenderMathMLRow::layout() used to use hasBase(), isRenderMathMLOperator(), and
+        nonOperatorHeight() to approximate this height. We now use unembellishedOperator() to
+        improve this approximation, while also simplifying the code. More plainly, the code used
+        to skip all operators when estimating this height, instead of just the stretchy ones. We
+        continue to do that for now, but we more accurately skip all embellished operators
+        (using our currently implemented approximate definition of this), and use the simple and
+        true height of the remaining items. In case all items in the row are stretchy,
+        style()->fontSize() is better than using whatever heights these items currently happen
+        to be stretched to.
+
+        Test: mathml/presentation/mo-stretch.html, and many existing tests
+
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore):
+        * rendering/mathml/RenderMathMLBlock.h:
+        (WebCore::RenderMathMLBlock::unembellishedOperator):
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore):
+        (WebCore::RenderMathMLRow::layout):
+        * rendering/mathml/RenderMathMLRow.h:
+        (WebCore::RenderMathMLRow::isRenderMathMLRow):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore):
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore):
+        * rendering/mathml/RenderMathMLUnderOver.h:
+        (RenderMathMLUnderOver):
+
+2012-02-17  Anders Carlsson  <andersca@apple.com>
+
+        Stop the committer timer when the page is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=78907
+
+        Reviewed by Adam Roben.
+
+        We don't want the committer timer to fire after the scrolling tree has been invalidated,
+        so stop the committer timer to prevent it from firing and trying to access the scrolling tree.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::pageDestroyed):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Allow compiling FileSystem without CoreFoundation.
+        https://bugs.webkit.org/show_bug.cgi?id=79032
+
+        Reviewed by Adam Roben.
+
+        Add #if USE(CF) around code using the CoreFoundation functions.
+
+        * platform/FileSystem.h:
+        * platform/win/FileSystemWin.cpp:
+
+2012-02-20  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the first few files in platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=79023
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/FloatPointBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BlackBerry::Platform::FloatPoint):
+        * platform/graphics/blackberry/FloatRectBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BlackBerry::Platform::FloatRect):
+        * platform/graphics/blackberry/FloatSizeBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::FloatSize::FloatSize):
+        (WebCore::FloatSize::operator BlackBerry::Platform::FloatSize):
+        * platform/graphics/blackberry/IntPointBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BlackBerry::Platform::IntPoint):
+        * platform/graphics/blackberry/IntRectBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BlackBerry::Platform::IntRect):
+        * platform/graphics/blackberry/IntSizeBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BlackBerry::Platform::IntSize):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Share openTemporaryFile with WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=58750
+
+        Reviewed by Adam Roben.
+
+        Use pathByAppendingComponent instead of PathCombine to share the
+        code with WinCE. Also use the wide version of Windows functions.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openTemporaryFile):
+
+2012-02-20  Victor Carbune  <victor@rosedu.org>
+
+        Added code to support dispatching of missed cues in case of normal playback
+        and event sorting in case of simultaneous event triggering.
+
+        <track>-related events cuechange, enter, and exit should be sorted and filtered before dispatching
+        https://bugs.webkit.org/show_bug.cgi?id=72171
+
+        Reviewed by Eric Carlson.
+
+        Tests: media/track/track-cues-missed.html
+               media/track/track-cues-sorted-before-dispatch.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Added initialization code
+        for newly added state variables.
+        (WebCore::trackIndexCompare): Static boolean compare function between
+        the index of two tracks.
+        (WebCore):
+        (WebCore::eventTimeCueCompare): Static boolean compare function between
+        events associated with text track cues.
+        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Added code to
+        sort the events associated with text track cues before dispatching.
+        Each step from the specification is commented within the code.
+        (WebCore::HTMLMediaElement::finishSeek): Added a boolean variable that
+        is needed within the text track update function, to know whether a seek
+        event has occured before or not.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Moved the update
+        call for text tracks at the beginning of the function instead of the end.
+        'ended' events for video should be dispatched after track specific events.
+        * html/HTMLMediaElement.h: Added variables to keep
+        state information required by the text track update algorithm (last time
+        the algorithm was run, and whether a seeking event has occured)
+        (HTMLMediaElement):
+
+        * html/LoadableTextTrack.cpp: Refactored fireCueChangeEvent method
+        (WebCore::LoadableTextTrack::fireCueChangeEvent): The method dispatches a
+        synchronous cue change event for the track element.
+        * html/LoadableTextTrack.h:
+        (LoadableTextTrack):
+        * html/TextTrack.cpp: Modified the fireCueChange method, cached track index.
+        (WebCore::TextTrack::TextTrack):
+        (WebCore::TextTrack::trackIndex): Cached the track index.
+        (WebCore):
+        (WebCore::TextTrack::invalidateTrackIndex): Invalidates the track. Used
+        when a new track is added in a TextTrackList instance.
+        * html/TextTrack.h:
+        (TextTrack):
+        (WebCore::TextTrack::fireCueChangeEvent): The fireCueChangeEvent has been changed,
+        as events need to be fired asyncronously.
+        * html/TextTrackCue.cpp: Added internal variables to keep the current index
+        position in the track cue order. This is invalidated when an element is
+        inserted before.
+        (WebCore::TextTrackCue::TextTrackCue):
+        (WebCore::TextTrackCue::cueIndex): Getter for the cueIndex.
+        (WebCore):
+        (WebCore::TextTrackCue::invalidateCueIndex): Invalidates the currently stored
+        cue index.
+        (WebCore::TextTrackCue::dispatchEvent): Event dispatching is done asynchronously
+        now. This should be the only method used for event dispatching.
+        (WebCore::TextTrackCue::setIsActive): The setIsActive method no longer dispatches
+        events, but rather just changes the m_isActive variable.
+        * html/TextTrackCue.h:
+        (TextTrackCue):
+
+        * html/TextTrackCueList.cpp:
+        (WebCore::TextTrackCueList::getCueIndex): Retrieves the cue index, in the track cue
+        order, of a given cue.
+        (WebCore):
+        (WebCore::TextTrackCueList::add): Modified the add method such that all the next cue
+        indexes are invalidated.
+        (WebCore::TextTrackCueList::invalidateCueIndexes): Invalidates all cue indexes starting
+        with a specific position.
+        * html/TextTrackCueList.h:
+        (TextTrackCueList):
+        * html/track/TextTrackList.cpp:
+        (TextTrackList::getTrackIndex): Retrieves the track index position.
+        (TextTrackList::append): Added method for invalidating the text track index in case of
+        changing the list contents.
+        * html/track/TextTrackList.h:
+        (TextTrackList):
+
+2012-02-20  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Move WebSocketChannel::FrameData into a separate header file
+        https://bugs.webkit.org/show_bug.cgi?id=78682
+
+        Extract WebSocketChannel::FrameData as WebSocketFrame. This brings
+        flexibility to add classes which want to do something for
+        incoming/outgoing frames (e.g. compression/decompression).
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior change.
+
+        * GNUmakefile.list.am: AddedWebSocketFrame.h
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketChannel.cpp: Modified to use WebSocketFrame instead of FrameData
+        (WebCore):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::startClosingHandshake):
+        (WebCore::WebSocketChannel::parseFrame):
+        (WebCore::WebSocketChannel::processFrame):
+        (WebCore::WebSocketChannel::enqueueTextFrame):
+        (WebCore::WebSocketChannel::enqueueRawFrame):
+        (WebCore::WebSocketChannel::enqueueBlobFrame):
+        (WebCore::appendMaskedFramePayload): Added.
+        (WebCore::makeFrameData): Added.
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketChannel.h: Removed FrameData.
+        (WebSocketChannel):
+        (QueuedFrame):
+        * websockets/WebSocketFrame.h: Added.
+        (WebCore):
+        (WebSocketFrame):
+        (WebCore::WebSocketFrame::isNonControlOpCode):
+        (WebCore::WebSocketFrame::isControlOpCode):
+        (WebCore::WebSocketFrame::isReservedOpCode):
+        (WebCore::WebSocketFrame::WebSocketFrame):
+
+2012-02-20  Adam Roben  <aroben@apple.com>
+
+        32-bit build fix
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::setRawValue): Explicitly cast long long to int, since they
+        are different widths in 32-bit.
+
+2012-02-20  Adam Roben  <aroben@apple.com>
+
+        Clang build fix
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::willModifyDOMAttr): Removed unused parameter.
+
+2012-02-20  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed manual rollout of r107970 which breaks table column widths
+        updates from javascript (e.g. inspector's network panel).
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderTableCol.h:
+        (RenderTableCol):
+
+2012-02-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Inconsistent alignment of non-parsed properties (having an exclamation mark)
+        https://bugs.webkit.org/show_bug.cgi?id=79028
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section .properties li.not-parsed-ok img.exclamation-mark):
+
+2012-02-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: DOMAttrModified should not be fired if the attribute value remains the same
+        https://bugs.webkit.org/show_bug.cgi?id=79025
+
+        Reviewed by Pavel Feldman.
+
+        * dom/Element.cpp:
+        (WebCore::Element::willModifyAttribute):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::willModifyDOMAttr):
+        (WebCore):
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willModifyDOMAttrImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willModifyDOMAttr):
+
+2012-02-20  Kwonjin Jeong  <gram@company100.net>
+
+        Correct a typo error in ScrollingCoordinator.h
+        https://bugs.webkit.org/show_bug.cgi?id=79012
+
+        Reviewed by Andreas Kling.
+
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+
+2012-02-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] box-shadow and -webkit-box-shadow properties are not considered color-aware
+        https://bugs.webkit.org/show_bug.cgi?id=78988
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/CSSKeywordCompletions.js:
+
+2012-02-20  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Spin buttons of number input type should fire both input and change event
+        https://bugs.webkit.org/show_bug.cgi?id=75067
+
+        Reviewed by Kent Tamura.
+
+        This patch makes spin button in number input field clicks to fire input and change events as described in WHATWG HTML5 specification.
+        To implement this behavior, this patch introduces new value DispatchInputAndChangeEvent in TextFieldEventBehavior.
+
+        Test: fast/forms/number/spin-button-events.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepUpFromRenderer): Pass DispatchInputAndChangeEvent instead of DispatchChangeEvent to applyStep, setValue, and setValueAsNumber.
+        * html/HTMLTextFormControlElement.h: Add new enum value DispatchInputAndChangeEvent to TextFieldEventBehavior.
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::setValue): Handle DispatchInputAndChangeEvent and use RefPtr for element to keep reference.
+
+2012-02-20  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Attached/Detached state must be testable
+        https://bugs.webkit.org/show_bug.cgi?id=79010
+
+        Reviewed by Hajime Morita.
+
+        Added a method to check an element attached or not.
+
+        Test: fast/dom/shadow/shadow-root-attached.html
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::attached):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-20  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add deflater/inflater classes
+        https://bugs.webkit.org/show_bug.cgi?id=78449
+
+        Add WebSocketDeflater/WebSocketInflater classes which wrap zlib
+        functions. These classes are not used yet, but will be used for
+        supporting WebSocket deflate-frame extension.
+
+        This patch is second try. The previous patch broke Chromium Win
+        build. I added dependency of zlib to WebCore.gyp. I think it's
+        OK because Chromium already depends on zlib.
+
+        Reviewed by Kent Tamura.
+
+        No new tests except for chromium port. Behavior is unchanged.
+
+        * GNUmakefile.list.am: Added WebSocketDeflater.(cpp|h).
+        * WebCore.gyp/WebCore.gyp: Added zlib dependency.
+        * WebCore.gypi: Added WebSocketDeflater.(cpp|h).
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketDeflater.cpp: Added.
+        (WebCore):
+        (WebCore::WebSocketDeflater::create):
+        (WebCore::WebSocketDeflater::WebSocketDeflater):
+        (WebCore::WebSocketDeflater::initialize):
+        (WebCore::WebSocketDeflater::~WebSocketDeflater):
+        (WebCore::setStreamParameter):
+        (WebCore::WebSocketDeflater::addBytes):
+        (WebCore::WebSocketDeflater::finish):
+        (WebCore::WebSocketDeflater::reset):
+        (WebCore::WebSocketInflater::create):
+        (WebCore::WebSocketInflater::WebSocketInflater):
+        (WebCore::WebSocketInflater::initialize):
+        (WebCore::WebSocketInflater::~WebSocketInflater):
+        (WebCore::WebSocketInflater::addBytes):
+        (WebCore::WebSocketInflater::finish):
+        (WebCore::WebSocketInflater::reset):
+        * websockets/WebSocketDeflater.h: Added.
+        (WebCore):
+        (WebSocketDeflater):
+        (WebCore::WebSocketDeflater::data):
+        (WebCore::WebSocketDeflater::size):
+        (WebSocketInflater):
+        (WebCore::WebSocketInflater::data):
+        (WebCore::WebSocketInflater::size):
+
+2012-02-20  pfeldman@chomium.org  <pavel.feldman@gmail.com>
+
+        Web Inspector: consume undo/redo shortcuts.
+        https://bugs.webkit.org/show_bug.cgi?id=79016
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-20  Philippe Normand  <pnormand@igalia.com>
+
+        MediaPlayer: MediaPlayerPrivate registration cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78897
+
+        Reviewed by Martin Robinson.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::installedMediaEngines): Simplified GStreamer Private
+        player registration by using the PlatformMediaEngineClassName
+        macro like other players do.
+
+2012-02-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        [Chromium] Web Inspector: terminated workers are not removed from dedicated worker list
+        https://bugs.webkit.org/show_bug.cgi?id=78899
+
+        Notify inspector about starting context from WorkerContextProxy not from Worker.
+
+        Reviewed by Pavel Feldman.
+
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+
+2012-02-19  Keishi Hattori  <keishi@webkit.org>
+
+        Use shadowRootList for ColorInputType
+        https://bugs.webkit.org/show_bug.cgi?id=79007
+
+        Reviewed by Kent Tamura.
+
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::createShadowSubtree): Changed shadowRoot to shadowRootList.
+        (WebCore::ColorInputType::shadowColorSwatch): Changed shadowRoot to shadowRootList.
+
+2012-02-19  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Introduce InsertionPoint, which will be a common base class of HTMLShadowElement and HTMLContentElement.
+        https://bugs.webkit.org/show_bug.cgi?id=78771
+
+        Reviewed by Hajime Morita.
+
+        This patch introduces InsertionPoint, which will be a common base class of HTMLShadowElement and HTMLContentElement.
+
+        This is a step for rendering <shadow> correctly, because <shadow> has almost the same function of <content>.
+        After this patch, we will change NodeRenderingContext and related classes to accept InsertionPoint instead of
+        HTMLContentElement only.
+
+        No new tests, no change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::HTMLContentElement):
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/HTMLContentElement.h:
+        * html/shadow/InsertionPoint.cpp: Added.
+        (WebCore):
+        (WebCore::InsertionPoint::InsertionPoint):
+        (WebCore::InsertionPoint::~InsertionPoint):
+        * html/shadow/InsertionPoint.h: Added.
+        (WebCore):
+        (InsertionPoint):
+
+2012-02-19  Paweł Forysiuk  <tuxator@o2.pl>
+
+        [GTK] Can't find webinspector and error page redirection on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=51616
+
+        Create and use an abstraction for finding shared resources on Windows.
+
+        Reviewed by Martin Robinson.
+
+        * platform/FileSystem.h:
+        (WebCore):
+        * platform/audio/gtk/AudioBusGtk.cpp:
+        (WebCore::AudioBus::loadPlatformResource):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getPathToImageResource):
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::sharedResourcesPath):
+        (WebCore):
+
+2012-02-19  James Robinson  <jamesr@chromium.org>
+
+        Move stub implementations of ScrollingCoordinator functions into ScrollingCoordinatorNone.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78951
+
+        Reviewed by Adam Barth.
+
+        This move stubs for ScrollingCoordinator functions into ScrollingCoordinatorNone.cpp instead of #ifdefing inside
+        ScrollingCoordinator.cpp.  The mac port uses ScrollingCoordinator when #if ENABLE(THREADED_SCROLLING) is not set
+        and implementations in ScrollingCoordinator.cpp / ScrollingCoordinatorMac.mm otherwise.  The chromium port
+        always uses implementations in ScrollingCoordinatorChromium.cpp.  All other ports use
+        ScrollingCoordinatorNone.cpp.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbx:
+        * page/scrolling/ScrollingCoordinator.cpp:
+        * page/scrolling/ScrollingCoordinatorNone.cpp:
+        (WebCore):
+        (WebCore::ScrollingCoordinator::create):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinator::create):
+        (WebCore):
+
+2012-02-19  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [CheckDomainSecurity] to [CheckSecurity]
+        https://bugs.webkit.org/show_bug.cgi?id=78874
+
+        Reviewed by Adam Barth.
+
+        "Domain security" isn't a term that's used elsewhere.
+        This patch renames IDL attributes as follows:
+
+        - [CheckDomainSecurity] => [CheckSecurity]
+        - [DoNotCheckDomainSecurity] => [DoNotCheckSecurity]
+        - [DoNotCheckDomainSecurityOnGetter] => [DoNotCheckSecurityOnGetter]
+        - [DoNotCheckDomainSecurityOnSetter] => [DoNotCheckSecurityOnSetter]
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (IsVisibleAcrossOrigins):
+        (GenerateFunctionCallback):
+        (GenerateSingleBatchedAttribute):
+        (GenerateImplementation):
+        (GenerateToV8Converters):
+        * bindings/scripts/test/TestDomainSecurity.idl:
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+
+2012-02-19  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r108195.
+        http://trac.webkit.org/changeset/108195
+        https://bugs.webkit.org/show_bug.cgi?id=77700
+
+        Lots of failing ASSERT()s on v8 bots, requested by kling on
+        #webkit
+
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+
+2012-02-19  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [CheckAccessToNode] to [CheckSecurityForNode]
+        https://bugs.webkit.org/show_bug.cgi?id=78991
+
+        Reviewed by Adam Barth.
+
+        For naming consistency with [CheckSecurity], this patch renames
+        [CheckAccessToNode] to [CheckSecurityForNode].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (GenerateFunctionCallback):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+        * page/DOMWindow.idl:
+
+2012-02-19  James Robinson  <jamesr@chromium.org>
+
+        Sort WebCore Xcode project files with sort-Xcode-project-files script. Unreviewed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-02-19  Andreas Kling  <awesomekling@apple.com>
+
+        Make CSSValue wrapper getters return unique objects every time.
+        <http://webkit.org/b/77700>
+
+        Reviewed by Antti Koivisto.
+
+        Change the behavior of CSSValue getters to return unique JS wrappers every
+        time they are called. This means we no longer have to deal with the risk
+        of leaking custom properties between unrelated documents, and are free to
+        implement global value sharing across WebCore.
+
+        This patch will be followed by one making CSSValuePool globally shared,
+        it's done in two steps to monitor the impact of this change.
+
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (IsCSSValueType):
+
+2012-02-19  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderBlock::splitAnonymousBlocksAroundChild.
+        https://bugs.webkit.org/show_bug.cgi?id=78994
+
+        Reviewed by Eric Seidel.
+
+        Generalize splitTablePartsAroundChild to handle splitting
+        in nested tables.
+        Table->Table Section->Table Row->Table Cell->Table->Table Section->Table Row
+
+        Test: fast/table/table-split-inside-table.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitTablePartsAroundChild):
+
+2012-02-19  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Fix build on platforms where UChar is wchar_t
+        https://bugs.webkit.org/show_bug.cgi?id=78996
+
+        Reviewed by Martin Robinson.
+
+        The ICU backend defines UChar as wchar_t for platforms where wchar_t is
+        16 bits wide, e.g. win32.
+
+        * platform/graphics/pango/FontPango.cpp:
+        (WebCore::utf16ToUtf8): Use reinterpret_cast instead of static_cast.
+        * platform/gtk/GtkPopupMenu.cpp:
+        (WebCore::GtkPopupMenu::typeAheadFind): Ditto.
+
+2012-02-19  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Add missing header.
+
+2012-02-18  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: inline-box-002.htm fails
+        https://bugs.webkit.org/show_bug.cgi?id=69210
+
+        Reviewed by David Hyatt.
+
+        Tests: css2.1/20110323/dynamic-top-change-005.htm
+               css2.1/20110323/dynamic-top-change-005a.htm
+               css2.1/20110323/dynamic-top-change-005b.htm
+               css2.1/20110323/inline-box-002.htm
+               fast/css/relative-positioned-block-nested-with-inline-parent-dynamic-removed.html
+               fast/css/relative-positioned-block-nested-with-inline-parent-dynamic.html
+               fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic.html
+               fast/css/relative-positioned-block-nested-with-inline-parent.html
+               fast/css/relative-positioned-block-with-inline-ancestor-and-parent-dynamic.html
+               fast/css/relative-positioned-block-with-inline-ancestor-dynamic-removed.html
+               fast/css/relative-positioned-block-with-inline-ancestor-dynamic.html
+               fast/css/relative-positioned-block-with-inline-ancestor.html
+               fast/css/relative-positioned-block-with-inline-parent-dynamic-removed.html
+               fast/css/relative-positioned-block-with-inline-parent-dynamic.html
+               fast/css/relative-positioned-block-with-inline-parent-keeps-style.html
+               fast/css/relative-positioned-block-with-inline-parent.html
+
+        A block within an inline is affected by relative positioning on the inline box. Give
+        the anonymous block containing the block a layer and make it relative positioned. Then
+        calculate the offset of the anonymous block's layer by accumulating the offsets from its
+        inline continuation and the inline continuation's inline parents.
+        If the position of an inline changes from or to relative positioned then ensure that any
+        descendant blocks update their position and layer accordingly.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (): add an enum RelPosAxis
+        (WebCore::accumulateRelativePositionOffsets): 
+        Total up the offsets of all relatively positioned inlines that are de-facto parents of the relatively 
+        positioned anonymous block's child block.
+
+        (WebCore):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX): 
+        Use accumulateRelativePositionOffsets when calculating the relative position offset of a relatively positioned anonymous block.
+
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY): ditto
+
+        * rendering/RenderInline.cpp:
+        (WebCore::hasRelPositionedInlineAncestor): 
+        Detects if the anonymous block contains a block that is the de-facto descendant of a relatively positioned inline.
+
+        (WebCore::updateStyleOfAnonymousBlockContinuations): 
+        Update the style's positioning for each anonymous block containing a block that is descendant from the inline whose style has changed.
+
+        (WebCore::RenderInline::styleDidChange): 
+        If an inline changes to or from relative positioning ensure that any descendant blocks change to or from relative positioning
+        as well, unless they still have a relatively positioned ancestor after the current ancestor loses its relative positioning.
+
+        (WebCore::RenderInline::addChildIgnoringContinuation): 
+        If the anonymous block contains a block that is effectively descended from a relatively positioned inline, make it relatively
+        positioned so the block will respect its inline ancestor's relative positioning.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::propagateStyleToAnonymousChildren): 
+        Preserve style position in anonymous block continuations when the parent block propagates a style change. 
+
+2012-02-18  raman Tenneti  <rtenneti@chromium.org>
+
+        Track the NPN protocol version negotiated with the server
+        https://bugs.webkit.org/show_bug.cgi?id=77349
+
+        Reviewed by Darin Fisher..
+
+        [chromium] Added ExtraData to WebURLResponse.
+        
+        No intended functionality change.
+
+        * platform/network/chromium/ResourceResponse.h:
+        (ExtraData):
+        (WebCore::ResourceResponse::ExtraData::~ExtraData):
+        (ResourceResponse):
+        (WebCore::ResourceResponse::extraData):
+        (WebCore::ResourceResponse::setExtraData):
+
+2012-02-18  Abhishek Arya  <inferno@chromium.org>
+
+        Unreviewed, rolling out r107965.
+        http://trac.webkit.org/changeset/107965
+        https://bugs.webkit.org/show_bug.cgi?id=78273
+
+        crashes
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone):
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Make WebCore compile with libc++ (Part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=78974
+
+        Reviewed by Anders Carlsson.
+
+        * config.h:
+        Disable the DisallowCType check when using libc++.
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * page/DOMWindow.idl:
+
+2012-02-14  Sam Weinig  <sam@webkit.org>
+
+        Make WebCore compile with libc++ (Part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=78974
+
+        Reviewed by Anders Carlsson.
+
+        Add a workaround for <rdar://problem/10858112>, which cause the standard heap functions
+        not to work when using an iterator with proxy objects for reference and pointer types.
+
+        * WebCorePrefix.h:
+        (move):
+        Add an overload of std::move that the heap functions can call successfully.
+
+2012-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for C++ bindings after recent changes.
+        
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (ShouldSkipType):
+        (GenerateHeader):
+        * page/DOMWindow.idl:
+
+2012-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add new platform method wx impl.
+
+        * platform/wx/ContextMenuWx.cpp:
+        (ContextMenu::itemCount):
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix part of the windows build failure.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Don't build JSWebKitCSSRegionRule.cpp, since it is already being built
+        as part of DerivedSources.cpp.
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix the ENABLE(THREADED_SCROLLING) build.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+
+2012-02-18  Andreas Kling  <awesomekling@apple.com>
+
+        HTML: Remove unnecessary attributeChange() overrides.
+        <http://webkit.org/b/78890>
+
+        Reviewed by Anders Carlsson.
+
+        Move logic from attributeChanged() overrides into parseAttribute().
+        This is a step towards making attributeChanged() non-virtual.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseAttribute):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseAttribute):
+        * html/HTMLScriptElement.h:
+        (HTMLScriptElement):
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::parseAttribute):
+        * html/HTMLTrackElement.h:
+        (HTMLTrackElement):
+
+2012-02-18  Andreas Kling  <awesomekling@apple.com>
+
+        Remove Element::createAttribute().
+        <http://webkit.org/b/78965>
+
+        Reviewed by Anders Carlsson.
+
+        Switch call sites to use Attribute::create() directly, as there is no magic
+        in calling Element::createAttribute() anymore (it used to be virtual and handled
+        differently by StyledElement.)
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeInternal):
+        * dom/Element.h:
+        * svg/properties/SVGAnimatedPropertySynchronizer.h:
+
+2012-02-18  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLBodyElement: Avoid synchronous style recalc when setting link/vlink/alink.
+        <http://webkit.org/b/78959>
+
+        Reviewed by Anders Carlsson.
+
+        Mark the body element for deferred style recalc instead of doing it synchronously
+        when the attributes change.
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseAttribute):
+
+2012-02-18  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the TextureMapper build for non-Qt ports. Qt debug builds
+        must use RTTI, but GTK+, at least, does not.
+
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::updateBackingStore): Make the RTTI check
+        Qt only.
+
+2012-02-16  Andreas Kling  <awesomekling@apple.com>
+
+        FontFamilyValue: Utilize inheritance from CSSPrimitiveValue better.
+        <http://webkit.org/b/78806>
+
+        Reviewed by Antti Koivisto.
+
+        Now that FontFamilyValue's string doesn't change after creation, we can just
+        pass the massaged family name up to the CSSPrimitiveValue constructor and get
+        cached cssText() for free. This also shrinks FontFamilyValue by sizeof(String)
+        though that's less of an issue now that we cache them in CSSValuePool.
+
+        * css/FontFamilyValue.cpp:
+        (WebCore::stripFontFamilyJunk):
+        (WebCore::FontFamilyValue::FontFamilyValue):
+        * css/FontFamilyValue.h:
+        (WebCore::FontFamilyValue::familyName):
+        (FontFamilyValue):
+
+2012-02-17  Adam Klein  <adamk@chromium.org>
+
+        Avoid inconsistency in Node::inDocument due to DOMSubtreeModified dispatch
+        https://bugs.webkit.org/show_bug.cgi?id=76087
+
+        Reviewed by Ryosuke Niwa.
+
+        Move post-removal notifications after call to Node::removeFromDocument
+        to avoid inconsistent state of Node::inDocument() and thus avoid
+        inconsistent state in DocumentOrderedMap.
+
+        Tests: fast/dom/getElementById-consistency.html
+               fast/dom/getElementById-consistency2.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::updateReferencedText): Fixed to work with new timing of DOMSubtreeModified dispatch.
+
+2012-02-17  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Support overloaded methods that take IDBKey or IDBKeyRange
+        https://bugs.webkit.org/show_bug.cgi?id=78399
+
+        Implements IDBObjectStore.delete(IDBKeyRange) to exercise the functionality.
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/delete-range.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateFunctionCallString): Use .get() to disambiguate when passing RefPtr.
+        * bindings/scripts/test/V8/V8TestObj.cpp: Update test expectations.
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore):
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore):
+        * storage/IDBObjectStore.h:
+        (IDBObjectStore):
+        * storage/IDBObjectStore.idl:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
+        (WebCore):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+        (IDBObjectStoreBackendImpl):
+        * storage/IDBObjectStoreBackendInterface.h:
+
+2012-02-17  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [V8OnInstance] with [V8Unforgeable]
+        https://bugs.webkit.org/show_bug.cgi?id=78894
+
+        Reviewed by Adam Barth.
+
+        [V8OnInstance] means that the method should be defined
+        (not on a prototype chain but) on a DOM object. It is the
+        same meaning as [V8Unforgeable]. This patch replaces [V8OnInstance]
+        with [V8Unforgeable].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation):
+        * page/Location.idl:
+
+2012-02-17  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Unreviewed build fix. MSVS gyp generator can't handle multiple .cpps with the same name in the same
+        target from different paths.
+
+        * WebCore.gypi:
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp: Renamed from Source/WebCore/page/scrolling/chromium/ScrollingCoordinator.cpp.
+        (WebCore):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+
+2012-02-17  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed mac compile fix pt 2
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+
+2012-02-17  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed mac compile fix (unused parameter warning)
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+
+2012-02-14  James Robinson  <jamesr@chromium.org>
+
+        Move ScrollingCoordinator out of ENABLE(THREADED_SCROLLING) ifdef and enable on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78401
+
+        Reviewed by Adam Barth.
+
+        Separates THREADED_SCROLLING from ScrollingCoordinator and enables ScrollingCoordinator-related code on
+        chromium. ScrollingCoordinator receives scrolling information to be used with an external scrolling source.
+        ENABLE(THREADED_SCROLLING) enables a codepath that uses a thread in WebCore to handle scrolling related input
+        events and interact with composited layers.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * dom/Document.cpp:
+        (WebCore::wheelEventHandlerCountChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        (WebCore::FrameView::performPostLayoutTasks):
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+        (WebCore):
+        * page/Page.h:
+        (Page):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (Settings):
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::pageDestroyed):
+        (WebCore):
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore):
+        (ScrollingCoordinator):
+        * page/scrolling/ScrollingThread.cpp:
+        (WebCore::ScrollingThread::createThreadIfNeeded):
+        * page/scrolling/ScrollingTreeState.cpp:
+        * page/scrolling/ScrollingTreeState.h:
+        * page/scrolling/chromium/ScrollingCoordinator.cpp: Added.
+        (WebCore):
+        (WebCore::ScrollingCoordinator::scheduleTreeStateCommit):
+        (WebCore::ScrollingCoordinator::frameViewScrollLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll):
+        (WebCore::shouldCompositeOverflowControls):
+        (WebCore::RenderLayerCompositor::requiresOverhangAreasLayer):
+        (WebCore::RenderLayerCompositor::requiresContentShadowLayer):
+        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
+        (WebCore::RenderLayerCompositor::ensureRootLayer):
+        (WebCore):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore):
+        (RenderLayerCompositor):
+
+2012-02-17  Emil A Eklund  <eae@chromium.org>
+
+        Add FractionalLayoutPoint for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78913
+
+        Reviewed by Eric Seidel.
+
+        Add FractionalLayoutUnit version of Point class and a couple of
+        conversion methods to the Int and Float versions of same.
+
+        No new tests.
+
+        * GNUmakefile.list.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore):
+        (WebCore::FloatPoint::moveBy):
+        * platform/graphics/FloatPoint.h:
+        (WebCore):
+        (FloatPoint):
+        * platform/graphics/FractionalLayoutPoint.h: Added.
+        (WebCore):
+        (FractionalLayoutPoint):
+        (WebCore::FractionalLayoutPoint::FractionalLayoutPoint):
+        (WebCore::FractionalLayoutPoint::zero):
+        (WebCore::FractionalLayoutPoint::x):
+        (WebCore::FractionalLayoutPoint::y):
+        (WebCore::FractionalLayoutPoint::setX):
+        (WebCore::FractionalLayoutPoint::setY):
+        (WebCore::FractionalLayoutPoint::move):
+        (WebCore::FractionalLayoutPoint::moveBy):
+        (WebCore::FractionalLayoutPoint::scale):
+        (WebCore::FractionalLayoutPoint::expandedTo):
+        (WebCore::FractionalLayoutPoint::shrunkTo):
+        (WebCore::FractionalLayoutPoint::clampNegativeToZero):
+        (WebCore::FractionalLayoutPoint::transposedPoint):
+        (WebCore::operator+=):
+        (WebCore::operator-=):
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::toPoint):
+        (WebCore::toSize):
+        (WebCore::flooredIntPoint):
+        (WebCore::roundedIntPoint):
+        (WebCore::ceiledIntPoint):
+        * platform/graphics/FractionalLayoutSize.cpp:
+        (WebCore::pixelSnappedIntSize):
+        * platform/graphics/FractionalLayoutSize.h:
+        (WebCore):
+
+2012-02-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Move textDirectionForSelection from Editor to EditingStyle
+        https://bugs.webkit.org/show_bug.cgi?id=78868
+
+        Reviewed by Enrica Casucci.
+
+        Move textDirectionForSelection from Editor to EditingStyle to centralize the editing code's
+        dependency on CSSStyleDeclaration.
+
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::textDirectionForSelection):
+        (WebCore):
+        * editing/EditingStyle.h:
+        (EditingStyle):
+        * editing/Editor.cpp:
+        (WebCore):
+        * editing/Editor.h:
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::stateTextWritingDirection):
+        * editing/ReplaceSelectionCommand.cpp:
+        * editing/markup.cpp:
+
+2012-02-17  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - embellished operators, getBase() accessor functions
+        https://bugs.webkit.org/show_bug.cgi?id=78617
+
+        Reviewed by Eric Seidel.
+
+        Define functions that return an unembellished "base", by omitting
+        subscripts/superscripts, underscripts/overscripts, or denominators. This is needed in
+        subsequent patches both for correct operator stretching and simple code factoring.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLBlock.h:
+        (WebCore):
+        (RenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::unembellishedOperator):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::unembellishedOperator):
+        (WebCore):
+        * rendering/mathml/RenderMathMLFraction.h:
+        (RenderMathMLFraction):
+        * rendering/mathml/RenderMathMLOperator.h:
+        (WebCore::RenderMathMLOperator::unembellishedOperator):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::base):
+        (WebCore):
+        (WebCore::RenderMathMLSubSup::unembellishedOperator):
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+            - renamed a variable for clarity, especially in later patches
+        (WebCore::RenderMathMLSubSup::layout):
+            - renamed a variable for clarity, especially in later patches
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::base):
+        (WebCore):
+        (WebCore::RenderMathMLUnderOver::unembellishedOperator):
+        (WebCore::RenderMathMLUnderOver::stretchToHeight):
+        * rendering/mathml/RenderMathMLUnderOver.h:
+        (RenderMathMLUnderOver):
+
+2012-02-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow opaque tiles
+        https://bugs.webkit.org/show_bug.cgi?id=78809
+
+        Replace the isOpaque boolean in BitmapTexture to a SupportsAlpha flag.
+        Use reset/didReset instead of a virtual function that has to call the superclass.
+
+        Make sure that all calls to BitmapTexture::reset() pass the correct SupportsAlpha flag,
+        based on the source image.
+        Since we now disable blending for opaque textures, we also have to make sure that we treat
+        the depth buffer correctly and bring it back to its previous state.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No behavior changes.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (TextureMapperGLData):
+        (WebCore::TextureMapperGLData::initStencil):
+        (WebCore::TextureMapperGLData::TextureMapperGLData):
+        (BitmapTextureGL):
+        (WebCore::TextureMapperGL::beginPainting):
+        (WebCore::TextureMapperGL::endPainting):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::BitmapTextureGL::didReset):
+        (WebCore::BitmapTextureGL::bind):
+        (WebCore::TextureMapperGL::beginClip):
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::BitmapTexture):
+        (WebCore::BitmapTexture::flags):
+        (WebCore::BitmapTexture::didReset):
+        (WebCore::BitmapTexture::reset):
+        (BitmapTexture):
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
+        (WebCore::TextureMapperTile::updateContents):
+        (WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):
+        (WebCore::TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded):
+        (WebCore::TextureMapperTiledBackingStore::updateContents):
+        * platform/graphics/texmap/TextureMapperBackingStore.h:
+        (TextureMapperTiledBackingStore):
+        * platform/graphics/texmap/TextureMapperImageBuffer.cpp:
+        (WebCore::BitmapTextureImageBuffer::didReset):
+        (WebCore):
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (BitmapTextureImageBuffer):
+
+2012-02-17  Stephen Chenney  <schenney@chromium.org>
+
+        Crash in SVGAnimateElement due to changed target
+        https://bugs.webkit.org/show_bug.cgi?id=75096
+
+        Reviewed by Nikolas Zimmermann.
+
+        The SVGAnimateElement object creates various internal objects
+        depending on the type of property being animated, which depends on the
+        target. These objects were not being recreated when the target
+        changed, and crashes ensued. Now the SVGSMILElement provides a virtual
+        method that is called when the target changes, and SVGAnimateElement
+        updates its objects as necessary. We also deactivate the animation
+        when the target changes, forcing recomputation of other derived
+        objects.
+
+        This change also removes various unnecessary calls to semi-expensive
+        methods.
+
+        Not only does this change fix the new test, it also fixes potential
+        crashes in other tests that apparently never manifested before (but
+        manifest when this new test is included in DRT).
+
+        Test: svg/animations/svglength-animation-retarget-crash.html
+
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::SVGAnimateElement::hasValidAttributeType):
+        (WebCore::SVGAnimateElement::calculateAnimatedValue):
+        (WebCore::SVGAnimateElement::calculateFromAndToValues):
+        (WebCore::SVGAnimateElement::calculateFromAndByValues):
+        (WebCore::SVGAnimateElement::resetToBaseValue):
+        (WebCore::SVGAnimateElement::calculateDistance):
+        (WebCore):
+        (WebCore::SVGAnimateElement::targetElementDidChange):
+        * svg/SVGAnimateElement.h:
+        (SVGAnimateElement):
+        * svg/SVGAnimatedTypeAnimator.h:
+        (SVGAnimatedTypeAnimator):
+        (WebCore::SVGAnimatedTypeAnimator::type):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::targetElement):
+        (WebCore::SVGSMILElement::resetTargetElement):
+        (WebCore):
+        * svg/animation/SVGSMILElement.h:
+        (SVGSMILElement):
+        (WebCore::SVGSMILElement::targetElementDidChange):
+
+2012-02-17  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78934
+        
+        Add the -webkit-line-align property to support the alignment of lines in the inline direction
+        to the line grid.
+
+        Reviewed by Dan Bernstein.
+
+        Added fast/line-grid/line-align-parsing.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::operator LineAlign):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+
+2012-02-17  Emil A Eklund  <eae@chromium.org>
+
+        Add FractionalLayoutSize for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78852
+
+        Reviewed by Eric Seidel.
+
+        Add FractionalLayoutUnit version of Size class and a couple of
+        conversion methods to the Int and Float versions of same.
+
+        No new tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::move):
+        Add FractionalLayoutSize version of move.
+
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatSize.cpp:
+        (WebCore::FloatSize::FloatSize):
+        Add FloatSize(FractionalLayoutSize) constructor.
+
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FractionalLayoutSize.cpp: Added.
+        * platform/graphics/FractionalLayoutSize.h: Added.
+
+2012-02-17  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r107606): Copy Link writes malformed WebURLsWithTitlesPboardType
+        data to the pasteboard.
+        https://bugs.webkit.org/show_bug.cgi?id=78933
+        <rdar://problem/10874553>
+        
+        For this format, the data needs to be placed in the pasteboard as array of arrays
+        of strings. Currently is it stored as array of strings, which causes the code
+        that uses this format to break.
+        
+        Reviewed by Ryosuke Niwa.
+
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::setPathnamesForType):
+
+2012-02-17  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect placement of a new child when beforeChild and its
+        previous sibling are in the same table.
+        https://bugs.webkit.org/show_bug.cgi?id=78269
+
+        Reviewed by Julien Chaffraix.
+
+        Tests: fast/table/table-cell-split.html
+               fast/table/table-row-split.html
+               fast/table/table-section-split-with-after-content.html
+               fast/table/table-section-split.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitAnonymousBlocksAroundChild): add
+        call to splitTablePartsAroundChild to take care of splitting the
+        table first if the child is part of table.
+        (WebCore::markTableForSectionAndCellRecalculation): add helper to
+        mark table for complete relayout by invalidating sections and cells.
+        (WebCore):
+        (WebCore::moveAllTableChildrenTo): moves children to another table.
+        (WebCore::RenderBlock::splitTablePartsAroundChild): split table child
+        and its next siblings into a new table. This allows adding a new
+        non-table child between the tables.
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): calls
+        splitTablePartsAroundChild to see if we need to split the table
+        for adding this new child.
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createAnonymousTable): add helper for
+        creating anonymous table.
+        (WebCore):
+        (WebCore::RenderObject::addChild): use the new helper for creating
+        anonymous table.
+        * rendering/RenderObject.h:
+        (WebCore):
+        (RenderObject):
+        (WebCore::RenderObject::isTablePart): add helper to tell if the object
+        is a table part.
+
+2012-02-17  Andreas Kling  <awesomekling@apple.com>
+
+        Element: Inline style selector and AX invalidation in attributeChanged().
+        <http://webkit.org/b/78888>
+
+        Reviewed by Antti Koivisto.
+
+        Inline the updateAfterAttributeChanged() and recalcStyleIfNeededAfterAttributeChanged()
+        methods into Element::attributeChanged(). They were separated when we needed them in
+        StyledElement::attributeChanged(), but that's no longer the case.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        * dom/Element.h:
+
+2012-02-17  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Texture eviction doesn't show up in traces.
+        https://bugs.webkit.org/show_bug.cgi?id=78851
+
+        Reviewed by James Robinson.
+
+        Add TextureManager::evictTexture() function with TRACE statement so
+        that texture eviction shows up in traces.
+
+        No new tests.
+
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictTexture):
+        (WebCore):
+        (WebCore::TextureManager::reduceMemoryToLimit):
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureManager):
+
+2012-02-17  Kalev Lember  <kalevlember@gmail.com>
+
+        Remove unused parameters from WTF threading API
+        https://bugs.webkit.org/show_bug.cgi?id=78389
+
+        Reviewed by Adam Roben.
+
+        waitForThreadCompletion() had an out param 'void **result' to get the
+        'void *' returned by ThreadFunction. However, the implementation in
+        ThreadingWin.cpp ignored the out param, not filling it in. This had
+        led to a situation where none of the client code made use of the param
+        and just ignored it.
+
+        To clean this up, the patch changes the signature of ThreadFunction to
+        return void instead of void* and drops the the unused 'void **result'
+        parameter from waitForThreadCompletion. Also, all client code is
+        updated for the API change.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=78389 , even
+        though the change only affects internal API, Safari is using it
+        directly and we'll need to keep the old versions around for ABI
+        compatibility. For this, the patch adds compatibility wrappers with
+        the old ABI.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectOnAlternateThreadForDebugging):
+        * fileapi/FileThread.cpp:
+        (WebCore::FileThread::fileThreadStart):
+        (WebCore::FileThread::runLoop):
+        * fileapi/FileThread.h:
+        (FileThread):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::close):
+        (WebCore::IconDatabase::iconDatabaseSyncThreadStart):
+        (WebCore::IconDatabase::iconDatabaseSyncThread):
+        (WebCore::IconDatabase::syncThreadMainLoop):
+        * loader/icon/IconDatabase.h:
+        (IconDatabase):
+        * page/scrolling/ScrollingThread.cpp:
+        (WebCore::ScrollingThread::threadCallback):
+        * page/scrolling/ScrollingThread.h:
+        (ScrollingThread):
+        * platform/audio/HRTFDatabaseLoader.cpp:
+        (WebCore::databaseLoaderEntry):
+        (WebCore::HRTFDatabaseLoader::waitForLoaderThreadCompletion):
+        * platform/audio/ReverbConvolver.cpp:
+        (WebCore::backgroundThreadEntry):
+        (WebCore::ReverbConvolver::~ReverbConvolver):
+        * platform/network/cf/LoaderRunLoopCF.cpp:
+        (WebCore::runLoaderThread):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThreadStart):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (DatabaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::terminate):
+        * storage/LocalStorageThread.h:
+        (LocalStorageThread):
+        * webaudio/AsyncAudioDecoder.cpp:
+        (WebCore::AsyncAudioDecoder::~AsyncAudioDecoder):
+        (WebCore::AsyncAudioDecoder::threadEntry):
+        * webaudio/AsyncAudioDecoder.h:
+        (AsyncAudioDecoder):
+        * webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::uninitialize):
+        (WebCore::OfflineAudioDestinationNode::renderEntry):
+        * webaudio/OfflineAudioDestinationNode.h:
+        (OfflineAudioDestinationNode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThreadStart):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-02-17  Robert Hogan  <robert@webkit.org>
+
+        AppleMac Build fix for r108111
+
+        Remove variable that is now unused.
+
+        Unreviewed, build fix.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::alwaysRequiresLineBox): Remove lineInfo
+        (WebCore::requiresLineBox): 
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
+2012-02-17  Michal Mocny  <mmocny@google.com>
+
+        [chromium] GL_CHROMIUM_gpu_memory_manager extension
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (WebCore::Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM::~GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (Extensions3DChromium):
+
+2012-01-23  Robert Hogan  <robert@webkit.org>
+
+        REGRESSION: empty span creates renders with non-zero height
+        https://bugs.webkit.org/show_bug.cgi?id=76465
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/css/empty-span.html
+               fast/css/non-empty-span.html
+
+        Empty inlines with line-height, vertical-alignment or font metrics should only get a linebox if there is some
+        other content in the line. So only create line boxes for such elements on lines that are not empty.
+
+        This patch fixes a regression where an empty inline with line-height was propagating its height to an empty line.
+        It also fixes cases where lines with content that had a leading empty inline element weren't respecting the 
+        vertical alignment or font-height of the empty inline.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::constructLine): only create line boxes for lines that are not empty.
+        (WebCore::requiresLineBoxForContent): an inline flow with line-height, vertical-alignment, or font-size
+         will need a linebox if the rest of the line is not empty.
+        (WebCore):
+        (WebCore::alwaysRequiresLineBox): rename from inlineFlowRequiresLineBox.
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak): if the inline flow definitely requires a line, mark
+         the line non-empty - otherwise hold off.
+
+2012-02-17  Raymond Toy  <rtoy@google.com>
+
+        RealtimeAnalyserNode does not consistently respect .minDecibels
+        https://bugs.webkit.org/show_bug.cgi?id=78729
+
+        Make use of m_minDecibel consistent.  Clean up some style issues
+        with names of local variables and style issues with float
+        constants.
+        
+        Reviewed by Chris Rogers.
+
+        No new tests because the changes are cosmetic for style issues.
+
+        * webaudio/RealtimeAnalyser.cpp:
+        (WebCore):
+        (WebCore::RealtimeAnalyser::doFFTAnalysis):
+        (WebCore::RealtimeAnalyser::getFloatFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteTimeDomainData):
+
+2012-02-17  Abhishek Arya  <inferno@chromium.org>
+
+        :before content incorrectly placed in continuation
+        when we don't have a first child.
+        https://bugs.webkit.org/show_bug.cgi?id=78380
+
+        Reviewed by David Hyatt.
+
+        Test: fast/css-generated-content/before-content-continuation-chain.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSS regions enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=78525
+
+        Reviewed by David Hyatt.
+
+        Test: fast/regions/css-regions-disabled.html
+
+        Add a runtime preference to enable/disable regions functionality at runtime(WebKitCSSRegionsEnabled).
+        CSSRegions are still enabled by default.
+        In DRT, use layoutTestController.overridePreference("WebKitCSSRegionsEnabled", "0") to disable the css regions functionality.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::cssRegionsEnabled):
+        (WebCore):
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore::CSSParser::parseRegionThread):
+        (WebCore::CSSParser::createRegionRule):
+        * css/CSSParser.h:
+        * dom/Document.cpp:
+        (WebCore::Document::cssRegionsEnabled):
+        (WebCore):
+        (WebCore::Document::webkitGetFlowByName):
+        * dom/Document.h:
+        (Document):
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::moveToFlowThreadIfNeeded):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setCSSRegionsEnabled):
+        (WebCore::Settings::cssRegionsEnabled):
+        (Settings):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::RenderRegion):
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]Implement NamedFlow::overflow
+        https://bugs.webkit.org/show_bug.cgi?id=78880
+
+        Reviewed by David Hyatt.
+
+        Test: fast/regions/webkit-named-flow-overflow.html
+
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
+        (WebCore::WebKitNamedFlow::overflow):
+        (WebCore):
+        * dom/WebKitNamedFlow.h:
+        (WebCore):
+        (WebCore::WebKitNamedFlow::create):
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        (WebCore::RenderFlowThread::ensureNamedFlow):
+        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
+        * rendering/RenderFlowThread.h:
+
+2012-02-17  Joe Thomas  <joethomas@motorola.com>
+
+        flex-wrap:nowrap should be flex-wrap:none
+        https://bugs.webkit.org/show_bug.cgi?id=78772
+
+        As per the spec http://dev.w3.org/csswg/css3-flexbox/#flex-wrap0, flex-wrap:nowrap should be changed to flex-wrap:none.
+
+        Reviewed by Ojan Vafai.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFlexWrap):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2012-02-17  Enrica Casucci  <enrica@apple.com>
+
+        Refactor DragData class to use PlatformStrategies in the Mac implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=78768
+
+        Reviewed by Darin Adler.
+
+        No new tests. No behavior change.
+
+        * WebCore.exp.in: Added new exported method of the PlatformPasteboard class.
+        * platform/DragData.h:
+        (WebCore::DragData::pasteboardName): Added pasteboardName and removed pasteboard.
+        * platform/PasteboardStrategy.h: Added color() method.
+        * platform/PlatformPasteboard.h: Ditto.
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::Clipboard::create): Changed to use pasteboardName() method.
+        * platform/mac/DragDataMac.mm: All the methods below have been changed to use pasteboardName
+        and the pasteboardStrategy() methods.
+        (WebCore::DragData::DragData):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsColor):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::numberOfFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asColor):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::asFragment):
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::color): Added implementation of the color() method.
+
+2012-02-17  Nate Chapin  <japhet@chromium.org>
+
+        [Chromium mac] Cursors and background images disappear.
+        https://bugs.webkit.org/show_bug.cgi?id=78834
+
+        The issue occurs because a CachedImage sees that it has no clients
+        and decide it is safe to purge its m_data buffer. However,
+        StyleCachedImage is holding a CachedResourceHandle to the
+        CachedImage, and it can still add a client later. If it does so,
+        the CachedImage says everything is loaded but has no data.
+
+        Reviewed by Adam Barth.
+
+        No new tests, since the known repros have resisted reduction.
+        Tested manually with chrome.angrybirds.com, redfin.com and a
+        couple of other sites.
+
+        * rendering/style/StyleCachedImage.cpp:
+        * rendering/style/StyleCachedImage.h: Ensure the underlying
+            CachedImage has a client for the lifetime of the
+            StyleCachedImage and doesn't purge its buffer. Call
+            addClient(this) in the constructor and removeClient(this) in
+            the destructor, then ignore all cache callbacks.
+
+2012-02-17  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Table cell's anonymous wrappers are left in the tree, impacting our layout
+        https://bugs.webkit.org/show_bug.cgi?id=7180
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/table/table-switch-cell-position-bad-layout-expected.html
+               fast/table/table-switch-cell-position-bad-layout.html
+
+        This patch implements cell's anonymous wrapper removal at detach time.
+
+        Trimming the render tree when we remove objects from it would be more complex
+        to generalize as several objects override the behavior to do their own clean-ups.
+        This would also open more potential for programming errors.
+
+        This change is limited to table cells' as a simple step towards fixing bug 52123
+        and more generally eliminate some anonymous wrappers from the tree at detach time.
+
+        * dom/Node.cpp:
+        (WebCore::Node::detach):
+        Patched detach to call destroyAndCleanupAnonymousWrappers. The Document does not need
+        to clean up any anonymous wrappers on detach.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):
+        Added this method to wrap destroy() call and trim the render tree. To avoid slowing down
+        detach in some cases, added a fast path.
+
+        * rendering/RenderObject.h: Added destroyAndCleanupAnonymousWrappers.
+
+2012-02-17  Rob Buis  <rbuis@rim.com>
+
+        ASSERT (and crash) with dynamically moved <font-face>
+        https://bugs.webkit.org/show_bug.cgi?id=64839
+
+        Reviewed by Antti Koivisto.
+
+        Reset the style declaration when rmeoving the font-face element from the document.
+
+        Test: svg/custom/font-face-move.svg
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::removedFromDocument):
+
+2012-02-17  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix some warnings encountered during the GTK+ build
+        https://bugs.webkit.org/show_bug.cgi?id=78911
+
+        Reviewed by Xan Lopez.
+
+        No new tests. These are just fixes for warnings.
+
+        * page/GestureTapHighlighter.cpp: Avoid using potentially signed operations on
+        a size_t type. Use size_t for iterating over members of a vector.
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp: Use size_t where necessary.
+        (WebCore::TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded): Ditto.
+        * platform/graphics/texmap/TextureMapperLayer.cpp: Ditto.
+        (WebCore::TextureMapperLayer::computeTransformsRecursive): Ditto.
+        (WebCore::TextureMapperLayer::paintSelfAndChildren): Ditto.
+        (WebCore::TextureMapperLayer::intermediateSurfaceRect): Ditto.
+
+2012-02-17  Tim Dresser  <tdresser@chromium.org>
+
+        [chromium] Refactor video drawing to be more data driven
+        https://bugs.webkit.org/show_bug.cgi?id=76720
+
+        Reviewed by James Robinson.
+
+        CCVideoLayerImpl no longer handles drawing itself, but produces a list of CCVideoDrawQuads.
+        These quads are then drawn by LayerRendererChromium.
+
+        CCLayerImpl::willDraw(LayerRendererChromium*) is called directly before appendQuads.
+        CCLayerImpl::didDraw() is called directly after all drawing has been completed.
+        CCLayerImpl::draw has been removed.
+
+        willDraw and didDraw are used to handle interaction with the VideoFrameProvider
+        in CCVideoLayerImpl. willDraw gets a frame from the VideoFrameProvider, and
+        didDraw returns it.
+
+        A unit test has been added: CCLayerTreeHostImplTest.didDrawCalledOnAllLayers.
+        This test ensures that CCLayerImpl::didDraw() is called on all layers,
+        including layers on different render surfaces.
+
+        As this was a refactor, no other tests were added.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawYUV):
+        (WebCore):
+        (WebCore::LayerRendererChromium::drawSingleTextureVideoQuad):
+        (WebCore::LayerRendererChromium::drawRGBA):
+        (WebCore::LayerRendererChromium::drawNativeTexture):
+        (WebCore::LayerRendererChromium::copyFrameToTextures):
+        (WebCore::LayerRendererChromium::copyPlaneToTexture):
+        (WebCore::LayerRendererChromium::drawVideoQuad):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::didDraw):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.cpp:
+        (WebCore::CCVideoDrawQuad::create):
+        (WebCore::CCVideoDrawQuad::CCVideoDrawQuad):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.h:
+        (CCVideoDrawQuad):
+        (WebCore::CCVideoDrawQuad::textures):
+        (WebCore::CCVideoDrawQuad::frame):
+        (WebCore::CCVideoDrawQuad::format):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::appendQuads):
+        (WebCore::CCVideoLayerImpl::didDraw):
+        (WebCore::CCVideoLayerImpl::computeVisibleSize):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::providerMutex):
+        (WebCore::CCVideoLayerImpl::provider):
+        (Texture):
+
+2012-02-17  Stephen Chenney  <schenney@chromium.org>
+
+        Crash at WebCore::SVGUseElement::expandSymbolElementsInShadowTree
+        https://bugs.webkit.org/show_bug.cgi?id=77639
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix a SVG crash in Release builds, although it still crashes in Debug builds.
+        The crash occurred when an SVG use element attempted to reference a style element while the file
+        contained an error causing the error banner to display. The fix is to prevent SVGUseElement
+        from recalculating style during tree building and return immediately when style is recalculated and
+        the tree is building.
+
+        Test: svg/custom/use-referencing-style-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::willRecalcStyle): Return false if the tree is being built.
+        (WebCore::SVGUseElement::didRecalcStyle): Check and return if the tree
+        is being built and we are not yet ready for style update.
+
+2012-02-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed, rolling out r108077.
+        http://trac.webkit.org/changeset/108077
+        https://bugs.webkit.org/show_bug.cgi?id=78390
+
+        it broke compilation.
+
+        * inspector/CodeGeneratorInspector.py:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getFunctionDetails):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::getFunctionDetails):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+
+2012-02-17  Florin Malita  <fmalita@google.com>
+
+        chrome.dll!WebCore::SVGTRefElement::updateReferencedText ReadAV@NULL (e85cb8e140071fa7790cad215b0109dc)
+        https://bugs.webkit.org/show_bug.cgi?id=74858
+
+        Reviewed by Nikolas Zimmermann.
+
+        Tests: svg/custom/tref-remove-target-crash-expected.svg
+               svg/custom/tref-remove-target-crash.svg
+
+        Add a DOMNodeRemovedFromDocumentEvent listener to detect when the target element is removed. Upon removal,
+        cleanup all listeners and re-activate the pending resource to attach if the referenced ID is added
+        at a later time programmatically. Also move the DOMSubtreeModifiedEvent listener from the parent to
+        the target element to simplify the implementation and reduce the scope.
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::TargetListener::create):
+        (WebCore::TargetListener::cast):
+        (WebCore::TargetListener::clear):
+        (WebCore::TargetListener::TargetListener):
+        (WebCore::TargetListener::operator==):
+        (WebCore::TargetListener::handleEvent):
+        (WebCore::SVGTRefElement::detachTarget):
+        (WebCore::SVGTRefElement::buildPendingResource):
+        * svg/SVGTRefElement.h:
+
+2012-02-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build after r108077.
+
+        * inspector/CodeGeneratorInspector.py:
+        (RawTypes.Any.generate_validate_method):
+
+2012-02-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Avoid using a transparency layer for rgba() border drawing when possible
+        https://bugs.webkit.org/show_bug.cgi?id=63176
+
+        Reviewed by Dan Bernstein.
+        
+        The non-radiused border drawing code would use a transparency layer
+        when drawing any one or more borders with alpha colors. However,
+        we only need to use a transparency layer when there is a corner
+        join between the borders being rendered with any one color,
+        so add a utility function includesAdjacentEdges() that can tell us
+        that, and use it to avoid making extraneous transparency layers.
+
+        Optimization only, no new tests.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::includesAdjacentEdges):
+        (WebCore):
+        (WebCore::RenderBoxModelObject::paintTranslucentBorderSides):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Not reviewed: Qt minimal build fix.
+
+        * inspector/InjectedScript.h:
+        (WebCore):
+
+2012-02-17  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Switch Debugger agent to TypeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=78390
+
+        Reviewed by Vsevolod Vlasov.
+
+        Client code is switched to TypeBuilder.
+
+        * inspector/CodeGeneratorInspector.py:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getFunctionDetails):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::getFunctionDetails):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: hide color picker on selected node update.
+        https://bugs.webkit.org/show_bug.cgi?id=78896
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum.prototype.get visible):
+        (WebInspector.Spectrum.prototype.toggle):
+        (WebInspector.Spectrum.prototype.show):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: check undo-redo boundaries based on current action index, not history size.
+        https://bugs.webkit.org/show_bug.cgi?id=78895
+
+        Reviewed by Vsevolod Vlasov.
+
+        Tests: inspector/elements/perform-undo-undo.html
+               inspector/styles/perform-undo-perform-of-mergable-action.html
+
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::perform):
+
+2012-02-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed, rolling out r108071.
+        http://trac.webkit.org/changeset/108071
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        chromium-mac compilation failed
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+
+2012-02-17  Michal Mocny  <mmocny@google.com>
+
+        [chromium] GL_CHROMIUM_gpu_memory_manager extension
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (WebCore::Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM::~GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (Extensions3DChromium):
+
+2012-02-17  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake, EFL] Unreviewed, fix the build when building with
+        SHARED_CORE=ON after r107820.
+
+        RunLoopEfl.cpp has not been upstreamed yet, and building only
+        RunLoop.cpp created an .so with some missing, unimplemented
+        symbols. The BlackBerry port seems to be in the same situation.
+
+        The best solution for now is to build RunLoop.cpp only on the
+        WinCE port.
+
+        * CMakeLists.txt: Remove RunLoop.cpp from the list of files to build.
+        * PlatformWinCE.cmake: Add RunLoop.cpp to the list of files to build.
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: a bit of color picker polish
+        https://bugs.webkit.org/show_bug.cgi?id=78892
+
+        - Fixed computed style swatch
+        - Removed color: caption
+        - Rendered value as source code, user-selectable
+        - Removed scroller gap
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.setCanShrink):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype._resetMouseDownElement):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+        * inspector/front-end/elementsPanel.css:
+        (.spectrum-container):
+        (.spectrum-display-value):
+        (.spectrum-range-container):
+        * inspector/front-end/popover.css:
+        (.popover .content.fixed-height):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: color picker does not allow changing the color.
+        https://bugs.webkit.org/show_bug.cgi?id=78886
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._showPopover.showPopover):
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.setCanShrink):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: new image preview has poorly positioned popover arrow.
+        https://bugs.webkit.org/show_bug.cgi?id=78884
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.boxInWindow):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: enable "Single click CSS editing" experiment by default.
+        https://bugs.webkit.org/show_bug.cgi?id=78881
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section .properties .enabled-button):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: split innerUpdate into rebuildUpdate and refreshUpdate, make computed styles load lazily.
+        https://bugs.webkit.org/show_bug.cgi?id=78827
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._refreshUpdate.computedStyleCallback):
+        (WebInspector.StylesSidebarPane.prototype._refreshUpdate):
+        (WebInspector.StylesSidebarPane.prototype._rebuildUpdate):
+        (WebInspector.StylesSidebarPane.prototype._validateNode):
+        (WebInspector.StylesSidebarPane.prototype._styleSheetOrMediaQueryResultChanged):
+        (WebInspector.StylesSidebarPane.prototype._attributesModified):
+        (WebInspector.StylesSidebarPane.prototype._attributesRemoved):
+        (WebInspector.StylesSidebarPane.prototype._styleInvalidated):
+        (WebInspector.StylesSidebarPane.prototype._innerRefreshUpdate):
+        (WebInspector.StylesSidebarPane.prototype._innerRebuildUpdate):
+        (WebInspector.StylesSidebarPane.prototype._nodeStylesUpdatedForTest):
+        (WebInspector.StylesSidebarPane.prototype._toggleElementStatePane):
+        (WebInspector.StylesSidebarPane.prototype._createElementStatePane.clickListener):
+        (WebInspector.StylesSidebarPane.prototype._showUserAgentStylesSettingChanged):
+        (WebInspector.ComputedStyleSidebarPane.prototype.expand):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-02-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow partial updates
+        https://bugs.webkit.org/show_bug.cgi?id=78824
+
+        BitmapTextureGL should not zero-fill the textures when resetting.
+        This was needed in the previous buffer management system, where texture were not completely
+        filled by the backing store.
+
+        Reviewed by Simon Hausmann.
+
+        No new behavior.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (BitmapTextureGL):
+        (WebCore::texSubImage2DResourceSafe):
+        (WebCore):
+        (WebCore::BitmapTextureGL::reset):
+
+2012-02-17  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Integrate InputType::dispatchChangeEventInResponseToSetValue into InputType::setValue
+        https://bugs.webkit.org/show_bug.cgi?id=78873
+
+        Reviewed by Kent Tamura.
+
+        This patch moves event dispatch logic to InputType and TextFieldInputType from HTMLInputElement
+        and merge dispatchChangeEventInResponseToSetValue to setValue.
+
+        No new tests. No change in behavior.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue): Move dispatch logic to InputType and TextFieldInput.
+        * html/InputType.cpp: Remove dispatchChangeEventInResponseToSetValue implementation.
+        * html/InputType.h: Remove dispatchChangeEventInResponseToSetValue declaration.
+        (WebCore::InputType::setValue): Move code from dispatchChangeEventInResponseToSetValue.
+        * html/TextFieldInputType.cpp: Remove dispatchChangeEventInResponseToSetValue implementation.
+        * html/TextFieldInputType.h: Remove dispatchChangeEventInResponseToSetValue declaration.
+        (WebCore::TextFieldInputType::setValue): Move code from dispatchChangeEventInResponseToSetValue. Stop dispatching event in InputType::setValue.
+        * html/HTMLTextFormControlElement.h: Make setTextAsOfLastFormControlChangeEvent to public from protected for accessing from InputType class.
+
+2012-02-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Mac build fix after r108047.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-02-16  Andreas Kling  <awesomekling@apple.com>
+
+        Removing the last presentation attribute should result in a null attributeStyle().
+        <http://webkit.org/b/78812>
+
+        Reviewed by Antti Koivisto.
+
+        If the collectStyleForAttribute() pass in updateAttributeStyle() doesn't encounter any
+        respected presentation attributes, set a null attributeStyle() instead of an empty one.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateAttributeStyle):
+
+2012-02-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: use static counters for estimation of allocated Documents, Nodes and JS EventListeners
+        https://bugs.webkit.org/show_bug.cgi?id=78825
+
+        Introduced static counters of allocated Documents, Nodes and JS EventListeners.
+        Their values are displayed on the Timeline panel.
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Node::Node):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        * inspector/InspectorAllInOne.cpp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorCounters.cpp: Added.
+        (WebCore):
+        (WebCore::InspectorCounters::counterValue):
+        * inspector/InspectorCounters.h: Added.
+        (WebCore):
+        (InspectorCounters):
+        (WebCore::InspectorCounters::incrementCounter):
+        (WebCore::InspectorCounters::decrementCounter):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCallFunction):
+        (WebCore::InspectorTimelineAgent::didDispatchEvent):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::create):
+        (InspectorTimelineAgent):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics):
+        (WebInspector.MemoryStatistics.prototype.addTimlineEvent):
+        (WebInspector.MemoryStatistics.prototype._draw.getDocumentCount):
+        (WebInspector.MemoryStatistics.prototype._refreshCurrentValues):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+
+2012-02-16  Cris Neckar  <cdn@chromium.org>
+
+        Correct a misleading comment regarding string delimiters in CSS parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=78521
+
+        Reviewed by Zoltan Herczeg.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+
+2012-02-16  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the TextureMapper build for GTK+.
+
+        No new tests. This is just a build fix.
+
+        * GNUmakefile.list.am: Add missing files to the build and change spaces to tabs.
+
+2012-02-16  Daniel Bates  <dbates@webkit.org>
+
+        Add ENABLE(STYLE_SCOPED) around HTMLStyleElement::m_isRegisteredWithScopingNode 
+
+        The instance variable HTMLStyleElement::m_isRegisteredWithScopingNode is only
+        referenced from within ENABLE(STYLE_SCOPED)-guarded code. We should add this
+        guard around its declaration.
+
+        * html/HTMLStyleElement.h:
+        (HTMLStyleElement):
+
+2012-02-16  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [v8] v8 doesn't assume to do 'new WebKitShadowRoot(host)'
+        https://bugs.webkit.org/show_bug.cgi?id=78875
+
+        Reviewed by Kentaro Hara.
+
+        Since v8 does not assume that we do 'new WebkitShadowRoot(host)', a wrapper object for new WebKitShadowRoot(host)
+        was saved in DOMObject storage instead of DOMNode storage.
+
+        CodeGenerator should handle with DOMNode correctly to solve the problem.
+
+        Test: fast/dom/shadow/shadow-root-new.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateConstructorCallback):
+
+2012-02-16  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed rollout r107952 because it broke shadow-boundary-events.html and related-target-focusevent.html on mac.
+        see http://webkit.org/b/78832
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/EventDispatchMediator.cpp:
+        (WebCore::FocusEventDispatchMediator::create):
+        (WebCore):
+        (WebCore::FocusEventDispatchMediator::FocusEventDispatchMediator):
+        (WebCore::FocusEventDispatchMediator::dispatchEvent):
+        (WebCore::BlurEventDispatchMediator::create):
+        (WebCore::BlurEventDispatchMediator::BlurEventDispatchMediator):
+        (WebCore::BlurEventDispatchMediator::dispatchEvent):
+        * dom/EventDispatchMediator.h:
+        (FocusEventDispatchMediator):
+        (WebCore):
+        (BlurEventDispatchMediator):
+        * dom/EventFactory.in:
+        * dom/FocusEvent.cpp: Removed.
+        * dom/FocusEvent.h: Removed.
+        * dom/FocusEvent.idl: Removed.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchFocusInEvent):
+        (WebCore::Node::dispatchFocusOutEvent):
+        * dom/UIEvent.cpp:
+        (WebCore::FocusInEventDispatchMediator::create):
+        (WebCore):
+        (WebCore::FocusInEventDispatchMediator::FocusInEventDispatchMediator):
+        (WebCore::FocusInEventDispatchMediator::dispatchEvent):
+        (WebCore::FocusOutEventDispatchMediator::create):
+        (WebCore::FocusOutEventDispatchMediator::FocusOutEventDispatchMediator):
+        (WebCore::FocusOutEventDispatchMediator::dispatchEvent):
+        * dom/UIEvent.h:
+        (FocusInEventDispatchMediator):
+        (WebCore):
+        (FocusOutEventDispatchMediator):
+        * page/DOMWindow.idl:
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Another fix for viewport tests
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): When we don't parse a number, we could either be 
+        trying to parse junk, which returns NaN, or we could get an empty string, 
+        which returns 0, so we need to account for that in the assert.
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Another build fix for viewport tests
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): We now return NaN instead of 0 when we fail to 
+        parse a number using charactersToFloatIgnoringJunk, so we need to assert that 
+        we have NaN rather than 0.
+
+2012-02-16  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Bundle page scale factor and limits in CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=78762
+
+        Setting page scale factor and its limits in separate methods
+        may cause clamping bugs if one of them makes it to the
+        impl thread before the other.  Change the API to bundle them together,
+        which matches the existing impl-side interface.
+
+        Reviewed by James Robinson.
+
+        No new tests (API change will disallow this type of bug).
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setPageScaleFactorAndLimits):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+
+2012-02-16  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
+
+2012-02-16  Sami Kyostila  <skyostil@chromium.org>
+
+        [chromium] LayerChromium::setNeedsDisplay does not apply contents scale correctly
+        https://bugs.webkit.org/show_bug.cgi?id=77464
+
+        Use bounds() instead of contentBounds() to calculate the region to mark
+        as needing painting in LayerChromium::setNeedsDisplay(). contentBounds()
+        includes contents scale, while bounds() does not.
+
+        Since this change also means that TiledLayerChromium::setNeedsDisplayRect() is
+        given an unscaled rectangle, modify that function to scale the rectangle before
+        using it to invalidate the underlying tiles.
+
+        Reviewed by James Robinson.
+
+        Tests: New tests added to LayerChromium and TiledLayerChromium unit tests.
+
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setNeedsDisplayRect):
+
+2012-02-16  Raymond Liu  <raymond.liu@intel.com>
+
+        Lazy init for DefaultAudioDestinationNode and OfflineAudioDestinationNode
+        https://bugs.webkit.org/show_bug.cgi?id=76509
+
+        Reviewed by Eric Seidel.
+
+        No new tests required.
+
+        * webaudio/AudioDestinationNode.h:
+        * webaudio/AudioNode.h:
+        (WebCore::AudioNode::sampleRate):
+        * webaudio/DefaultAudioDestinationNode.cpp:
+        (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
+        * webaudio/DefaultAudioDestinationNode.h:
+        * webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
+        * webaudio/OfflineAudioDestinationNode.h:
+        (WebCore::OfflineAudioDestinationNode::sampleRate):
+
+2012-02-16  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Refactoring] Remove location from NodeRenderingContext.
+        https://bugs.webkit.org/show_bug.cgi?id=78796
+
+        Reviewed by Hajime Morita.
+
+        This is a simple refactoring to remove m_location from NodeRenderingContext.
+        TreeLocation is merged into AttachPhase like the following.
+            LocationUndertermined -> Calculating
+            LocationNotInTree -> AttachingNotInTree
+            LocationLightChild -> AttachingStraight / AttachingNotDistributed / AttachingDistributed
+            LocationShadowChild -> AttachingStraight / AttachingShadowChild / AttachingFallback
+
+        We have renamed the enum items of AttachPhase, because not only <content> but also
+        <shadow> will use the phases. Basically these words are taken from Shadow DOM spec.
+        'Calculating' means NodeRenderingContext is used not for attaching but for calculating RenderObject.
+
+        No new tests, no change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::parentRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle):
+
+2012-02-16  Kent Tamura  <tkent@chromium.org>
+
+        Run sort-Xcode-project-file.
+
+        * WebCore.xcodeproj/project.pbxproj: Sorted.
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Another build fix for viewport tests
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): We now return NaN instead of 0 when we fail to 
+        parse a number using charactersToFloatIgnoringJunk, so we need to assert that 
+        we have NaN rather than 0.
+
+2012-02-15  Michael Nordman  <michaeln@google.com>
+
+        [chromium] Fix bugs in the implementation of WebDatabase::closeDatabaseImmediately.
+        https://bugs.webkit.org/show_bug.cgi?id=78841
+
+        WebDatabase now delegates this function entirely to DatabaseTracker,
+        a new closeDatabasesImmediately() has been added for that purpose. That
+        method posts tasks to the appropiate context thread for each database
+        instance that should be closed immediately.
+
+        The DatabaseTracker getAllOpenDatabases() method has been removed from
+        the chromium impl because it's unsafe, refs cannot be safely taken on
+        AbstractDatabase instances in the tracker's collection of open databases.
+
+        Add a message to the console log when a database is forcibly closed.
+
+        Transactions initiated on a database instance that has been forcibly
+        closed complete with a transaction error callback.
+        
+        This is part of resolving http://crbug.com/98939
+
+        Reviewed by David Levin.
+
+        No new layout tests, there is no common code way to closeImmediately.
+        We have coverage for this in py automation tests.
+
+        * platform/sql/SQLiteDatabase.cpp:
+        The closeImmediately code path can result in the underlying sqlite3 handle being
+        closed earlier than usual and trip some assertions. Updated the assertions to no
+        longer trigger in this early close case.
+        (WebCore::SQLiteDatabase::close):
+        (WebCore::SQLiteDatabase::setMaximumSize):
+        * platform/sql/SQLiteDatabase.h:
+        (WebCore::SQLiteDatabase::sqlite3Handle):
+
+        * storage/Database.cpp:
+        (WebCore::Database::closeImmediately): Modified to only be called on the context thread and to log a console message.
+        (WebCore::Database::changeVersion): Use the private runTransaction helper method.
+        (WebCore::Database::transaction): Pass a new param required by the runTransaction helper.
+        (WebCore::Database::readTransaction): Ditto.
+        (WebCore::callTransactionErrorCallback): Used to defer invocation of the error callback.
+        (WebCore::Database::runTransaction): Modified to detect when the database has been closed, and
+        to invoke the error callback in that case. This also avoids creating a reference cycle between
+        a newly created transaction and the database that previously existed due to a transction being
+        added and never removed from the Q while in this state.
+        * storage/Database.h:
+        * storage/DatabaseSync.cpp:
+        (WebCore::DatabaseSync::closeImmediately): Modified to only be called on the context thread and to log a console message.
+        * storage/DatabaseTracker.h:
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        Posts tasks to the appropiate context thread for execution without bumping AbstractDatabase refcounts.
+        (DatabaseTracker::CloseOneDatabaseImmediatelyTask):
+        (WebCore::DatabaseTracker::CloseOneDatabaseImmediatelyTask::create):
+        (WebCore::DatabaseTracker::CloseOneDatabaseImmediatelyTask::performTask):
+        (WebCore::DatabaseTracker::CloseOneDatabaseImmediatelyTask::CloseOneDatabaseImmediatelyTask):
+        (WebCore::DatabaseTracker::closeDatabasesImmediately): 
+        (WebCore::DatabaseTracker::closeOneDatabaseImmediately):
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] Occlusion tracking with CSS filters
+        https://bugs.webkit.org/show_bug.cgi?id=77498
+
+        Reviewed by James Robinson.
+
+        The new CSS filter support within the compositor changes how
+        occlusion tracking needs to function. A filter can change the
+        alpha value of pixels, making an otherwise opaque pixel no
+        longer so. Secondly, a filter may move color values around
+        on a surface, which can cause otherwise occluded areas to
+        become visible and require painting.
+
+        New unit tests: CCLayerTreeHostTest.cpp
+
+        Tests: compositing/culling/filter-occlusion-alpha-large.html
+               compositing/culling/filter-occlusion-alpha.html
+               compositing/culling/filter-occlusion-blur-large.html
+               compositing/culling/filter-occlusion-blur.html
+
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::RenderSurfaceChromium):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (WebCore::RenderSurfaceChromium::setFilters):
+        (WebCore::RenderSurfaceChromium::filters):
+        (WebCore::RenderSurfaceChromium::setNearestAncestorThatMovesPixels):
+        (WebCore::RenderSurfaceChromium::nearestAncestorThatMovesPixels):
+        (RenderSurfaceChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::enterTargetRenderSurface):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::subtreeShouldRenderToSeparateSurface):
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        (WebCore::CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::CCRenderSurface):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore::CCRenderSurface::setNearestAncestorThatMovesPixels):
+        (WebCore::CCRenderSurface::nearestAncestorThatMovesPixels):
+        (CCRenderSurface):
+        * platform/graphics/filters/FilterOperation.h:
+        (FilterOperation):
+        (WebCore::FilterOperation::affectsOpacity):
+        (WebCore::FilterOperation::movesPixels):
+        (WebCore::ReferenceFilterOperation::affectsOpacity):
+        (WebCore::ReferenceFilterOperation::movesPixels):
+        (ReferenceFilterOperation):
+        (WebCore::BasicComponentTransferFilterOperation::affectsOpacity):
+        (BasicComponentTransferFilterOperation):
+        (WebCore::BlurFilterOperation::affectsOpacity):
+        (WebCore::BlurFilterOperation::movesPixels):
+        (BlurFilterOperation):
+        (WebCore::DropShadowFilterOperation::affectsOpacity):
+        (DropShadowFilterOperation):
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasFilterThatAffectsOpacity):
+        (WebCore):
+        (WebCore::FilterOperations::hasFilterThatMovesPixels):
+        * platform/graphics/filters/FilterOperations.h:
+        (WebCore::FilterOperations::isEmpty):
+        (FilterOperations):
+
+2012-02-16  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Adapt to the removal of WebStringIml.h
+        https://bugs.webkit.org/show_bug.cgi?id=78784
+
+        Reviewed by Antonio Gomes.
+
+        WebKit/blackberry/WebCoreSupport/WebStringImpl.h which hasn't been upstreamed
+        has been removed internally. We should adapt to this removal for the
+        upstreamed part of the BlackBerry port. Actually WebStringImpl is not necessary
+        because it just inherits from WTF::StringImpl but adding nothing.
+
+        No functionalities changed, no new tests.
+
+        * platform/text/blackberry/StringBlackBerry.cpp:
+        (WTF::String::operator WebString):
+
+2012-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Made Weak<T> single-owner, adding PassWeak<T>
+        https://bugs.webkit.org/show_bug.cgi?id=78740
+
+        Reviewed by Sam Weinig.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringSlowCase): Use PassWeak<T>, as required by our new
+        hash map API.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getCachedWrapper):
+        (WebCore::cacheWrapper): Use PassWeak<T> and raw pointer, as required by
+        our new hash map API.
+
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::setWrapper):
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::setWrapper):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::addRuntimeObject): Use PassWeak<T>, as
+        required by our new hash map and Weak<T> APIs.
+
+2012-02-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in visiblePositionForIndex
+        https://bugs.webkit.org/show_bug.cgi?id=77683
+
+        Reviewed by Eric Seidel.
+
+        Fixed the crash.
+
+        Test: editing/execCommand/applyblockelement-visiblepositionforindex-crash.html
+
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/htmlediting.cpp:
+        (WebCore::indexForVisiblePosition):
+        * editing/htmlediting.h:
+        (WebCore):
+
+2012-02-16  Matthew Delaney  <mdelaney@apple.com>
+
+        ShadowBlur.cpp's cached content matching needs to consider m_layerSize changes
+        https://bugs.webkit.org/show_bug.cgi?id=78765
+
+        Reviewed by Simon Fraser.
+
+        No new tests due to the flaky nature of reproducing the issue.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ScratchBuffer::getScratchBuffer): Make sure to call clearScratchBuffer()
+        when we create a new ImageBuffer in order to invalidate cached values.
+        (WebCore::ScratchBuffer::setCachedShadowValues): Roll together matching and setting
+        of cached values into one method to enforce them being the same.
+        (WebCore::ScratchBuffer::setCachedInsetShadowValues): Ditto.
+
+        Restructure to use new method described above.
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling): 
+        (WebCore::ShadowBlur::drawInsetShadowWithoutTiling):
+        (WebCore::ShadowBlur::drawInsetShadowWithTiling):
+        (WebCore::ShadowBlur::drawRectShadowWithTiling):
+        (WebCore::ShadowBlur::beginShadowLayer):
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Empty divs not transforming overflow correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78850
+
+        Reviewed by James Robinson.
+
+        Test: compositing/overflow/transform-in-empty-container.html
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setSize):
+
+2012-02-16  Emil A Eklund  <eae@chromium.org>
+
+        Fix use of long long in FractionalLayoutUnit::setRawValue
+        https://bugs.webkit.org/show_bug.cgi?id=78835
+
+        Reviewed by Eric Seidel.
+
+        Change setRawValue(long long) to compare against int min and max instead
+        of using abs as not all platforms we support implement a long long
+        version of abs or llabs.
+
+        No new tests.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::setRawValue):
+        Compare against int min/max instead of just max with abs.
+        
+        (WebCore::FractionalLayoutUnit::isInBounds):
+        Fix type mismatch warning.
+        
+        (WebCore::operator==):
+        Fix typo.
+        
+        (WebCore::operator*):
+        Use long long version of setRawValue.
+
+2012-02-15  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Add an internal flag to accept multiple shadow roots for the purpose of tests.
+        https://bugs.webkit.org/show_bug.cgi?id=78453
+
+        Reviewed by Hajime Morita.
+
+        This patch introduces a flag to enable multiple shadow subtrees.
+        This flag is intended to be used for testing purpose for a while.
+        We will remove it later.
+
+        No new tests, no change in behavior.
+
+        * WebCore.exp.in:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::multipleShadowSubtreesEnabled):
+        (WebCore::RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::pushShadowRoot):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setMultipleShadowSubtreesEnabled):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the broken viewport tests
+        https://bugs.webkit.org/show_bug.cgi?id=78774
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): Changed to use the new charactersToFloatWithJunk function(s).
+
+2012-02-16  Cris Neckar  <cdn@chromium.org>
+
+        Very large strings could cause the new quoted string to wrap.
+        https://bugs.webkit.org/show_bug.cgi?id=78387
+
+        Reviewed by Eric Seidel.
+
+        * css/CSSParser.cpp:
+        (WebCore::quoteCSSString):
+
+2012-02-16  Eric Seidel  <eric@webkit.org>
+
+        Add a themeChromiumAndroid.css file for android-specific default styles
+        https://bugs.webkit.org/show_bug.cgi?id=78547
+
+        Reviewed by Adam Barth.
+
+        This includes the themeChromiumAndroid.css file from the Chromium-Android port
+        as well as some addidtional changes they had to html.css.  I believe those
+        changes were made before themeChromiumAndroid was created, but it's now the better place for this CSS.
+
+        * WebCore.gyp/WebCore.gyp:
+        * css/themeChromiumAndroid.css: Added.
+        (select[size][multiple]):
+        (input[type="date"], input[type="datetime"], input[type="datetime-local"], input[type="time"], input[type="month"]):
+        * rendering/RenderThemeChromiumAndroid.cpp:
+        (WebCore::RenderThemeChromiumAndroid::extraDefaultStyleSheet):
+        (WebCore):
+        * rendering/RenderThemeChromiumAndroid.h:
+        (RenderThemeChromiumAndroid):
+        (WebCore::RenderThemeChromiumAndroid::delegatesMenuListRendering):
+        (WebCore::RenderThemeChromiumAndroid::platformTapHighlightColor):
+
+2012-02-16  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/10616280> and https://bugs.webkit.org/show_bug.cgi?id=78767
+        REGRESSION (r90471) - iAd Producer 2.0.1 produces blank pages
+
+        Reviewed by Sam Weinig.
+
+        No new tests. (Subtle API change attached to a specific application)
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::isLoadingInAPISense): Return true if the app needs the quirk
+        and there are outstanding subresource loads.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setNeedsIsLoadingInAPISenseQuirk):
+        (WebCore::Settings::needsIsLoadingInAPISenseQuirk):
+        (Settings):
+
+2012-02-16  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [ConvertScriptString] from FileReaderSync.idl
+        https://bugs.webkit.org/show_bug.cgi?id=78335
+
+        Reviewed by Eric Seidel.
+
+        The spec says that FileReadSync should throw NOT_FOUND_ERR
+        if a given blob is invalid: http://www.w3.org/TR/FileAPI/#FileReaderSync
+
+        By this fix, we can completely remove [ConvertScriptString] from WebKit.
+
+        Tests: fast/files/workers/worker-read-blob-sync.html
+               fast/files/workers/worker-read-file-sync.html
+
+        * fileapi/FileReaderSync.cpp: Modified to throw NOT_FOUND_ERR if a blob is invalid.
+        (WebCore::FileReaderSync::readAsArrayBuffer):
+        (WebCore::FileReaderSync::readAsBinaryString):
+        (WebCore::FileReaderSync::readAsText):
+        (WebCore::FileReaderSync::readAsDataURL):
+        * fileapi/FileReaderSync.idl:
+
+        * bindings/scripts/CodeGeneratorJS.pm: Removed [ConvertScriptString]
+        since no one is using it.
+        (NativeToJSValue):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (NativeToJSValue):
+
+        * bindings/scripts/test/TestObj.idl: Removed a test case for [ConvertScriptString].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clipping/Transforms applied in wrong order in opaque paint tracking
+        https://bugs.webkit.org/show_bug.cgi?id=78775
+
+        Reviewed by Stephen White.
+
+        The clip was being applied in device coordinates, before transforming the painted
+        rect into device coordinates. This made any translations get doubly represented,
+        and gave incorrect paint tracking results.
+
+        Test: compositing/culling/unscrolled-within-boxshadow.html
+
+        Unit test: PlatformContextSkiaTest.cpp
+
+        * platform/graphics/skia/OpaqueRegionSkia.cpp:
+        (WebCore::OpaqueRegionSkia::didDraw):
+
+2012-02-16  Abhishek Arya  <inferno@chromium.org>
+
+        Crash with tables in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78415
+
+        Reviewed by Julien Chaffraix.
+
+        Multi-column code creates anonymous column blocks directly
+        under RenderTable, thereby violating table layout assumption.
+        E.g. Captions in this testcase gets reparented to these anonymous
+        column blocks and when they go away, they are not able to clear
+        themselves from table's m_captions list (since RenderTable::removeChild
+        is not called).
+
+        Test: fast/multicol/span/table-multi-column-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containingColumnsBlock):
+
+2012-02-16  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] File system api build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78479
+
+        Reviewed by Philippe Normand.
+
+        This patch is a small step to support FileSystem API for GTK port.
+        As I know, bug58443 also dealt with it, but it looks like the submitted patch
+        needs to be updated. To do that, I think I need to discuss with the original author.
+        So, I hope to just fix build break issue in this bug.
+
+        No new tests. Implementing the feature is not done yet.
+
+        * GNUmakefile.list.am: Added some missing files.
+        * bindings/js/JSDirectoryEntryCustom.cpp: Added Error.h to use its API.
+        * platform/AsyncFileSystem.cpp:
+        (WebCore):
+        (WebCore::AsyncFileSystem::create): The arguments don't match the declaration in AsyncFileSystem.h.
+        * platform/gtk/AsyncFileSystemGtk.cpp: Added.
+        (WebCore):
+        (WebCore::AsyncFileSystem::isAvailable):
+        (WebCore::AsyncFileSystem::isValidType):
+        (WebCore::AsyncFileSystem::create):
+        (WebCore::AsyncFileSystem::openFileSystem):
+        (WebCore::AsyncFileSystem::crackFileSystemURL):
+        (WebCore::AsyncFileSystemGtk::AsyncFileSystemGtk):
+        (WebCore::AsyncFileSystemGtk::~AsyncFileSystemGtk):
+        (WebCore::AsyncFileSystemGtk::toURL):
+        (WebCore::AsyncFileSystemGtk::move):
+        (WebCore::AsyncFileSystemGtk::copy):
+        (WebCore::AsyncFileSystemGtk::remove):
+        (WebCore::AsyncFileSystemGtk::removeRecursively):
+        (WebCore::AsyncFileSystemGtk::readMetadata):
+        (WebCore::AsyncFileSystemGtk::createFile):
+        (WebCore::AsyncFileSystemGtk::createDirectory):
+        (WebCore::AsyncFileSystemGtk::fileExists):
+        (WebCore::AsyncFileSystemGtk::directoryExists):
+        (WebCore::AsyncFileSystemGtk::readDirectory):
+        (WebCore::AsyncFileSystemGtk::createWriter):
+        * platform/gtk/AsyncFileSystemGtk.h: Added.
+        (WebCore):
+        (AsyncFileSystemGtk):
+
+2012-02-16  Adrienne Walker  <enne@google.com>
+
+        Handle dirty descendant visibility status in RenderLayer::updateLayerPositionsAfterScroll
+        https://bugs.webkit.org/show_bug.cgi?id=78286
+
+        Reviewed by Julien Chaffraix.
+
+        This is an unfortunate bandaid over a corner case where sometimes the
+        visible descendant status dirty flag is true when this function is
+        called from FrameView::repaintFixedElementsAfterScrolling. As it
+        should be cheap to refresh this flag when dirty in most cases (as it
+        early outs after finding any visible descendant), just lazily update
+        the dirty flag here to ensure correctness.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositionsAfterScroll):
+
+2012-02-16  Adam Barth  <abarth@webkit.org>
+
+        Chrome::*Geolocation* are just useless pass-throughs to ChromeClient and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=78844
+
+        Reviewed by Eric Seidel.
+
+        These function serve no useful purpose and should be removed.
+
+        * page/Chrome.cpp:
+        (WebCore):
+        * page/Chrome.h:
+        (Chrome):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::reset):
+        (WebCore::Geolocation::requestPermission):
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from WebKit to
+        WebCore because network stuff will not work as expected without
+        them. Added also out-of-the-box proxy support to WebCore.
+
+        No new tests required as we're just moving stuff from WebKit to
+        WebCore.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-02-16  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        thead in table without tbody causes table height doubling
+        https://bugs.webkit.org/show_bug.cgi?id=37244
+
+        Reviewed by Ojan Vafai.
+
+        Tests: fast/table/double-height-table-no-tbody-expected.html
+               fast/table/double-height-table-no-tbody.html
+
+        The bug is caused by the layout code would wrongly assuming that a
+        table without a <tbody> is an empty table. We would set the logical
+        height to the style's logical height wrongly before inflating the
+        logical height to account for the section(s). This would cause us
+        to increase past our needed size thus the bug.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        A table is empty if it does not have any top section, not just a <tbody>.
+        The test uncovered an issue with height distribution in layoutRows where we
+        would distribute the extra height to the first <tbody> not section.
+
+2012-02-07  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: fixed-table-layout-013 and fixed-table-layout-015 fail
+        https://bugs.webkit.org/show_bug.cgi?id=78027
+
+        Reviewed by Julien Chaffraix.
+
+        Both of these test the (slightly implicit) rule that width set on column-groups cannot
+        affect the width of columns in a fixed layout table: http://www.w3.org/TR/CSS21/tables.html#fixed-table-layout
+        FF, Opera and IE all pass these two tests.
+
+        Tests: css2.1/20110323/fixed-table-layout-013.htm
+               css2.1/20110323/fixed-table-layout-015.htm
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::nextCol): A helper function for finding the next column along.
+        (WebCore::FixedTableLayout::calcWidthArray): Ignore width specified by column groups.
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::isTableColGroup): Convenience function for identifying column groups.
+
+2012-02-16  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r107941.
+        http://trac.webkit.org/changeset/107941
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Broke 23 http tests on GTK
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-02-16  Tom Sepez  <tsepez@chromium.org>
+
+        XSS Auditor bypass with U+2028/2029
+        https://bugs.webkit.org/show_bug.cgi?id=78732
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::isJSNewline):
+        (WebCore::XSSAuditor::snippetForJavaScript):
+
+2012-02-15  Mark Rowe  <mrowe@apple.com>
+
+        NPN_GetValueForURL / NPNURLVProxy returns DIRECT when proxy configured via PAC
+        <http://webkit.org/b/78766> / <rdar://problem/10729283>
+
+        Reviewed by Anders Carlsson.
+
+        * platform/network/cf/ProxyServerCFNet.cpp:
+        (WebCore::proxyAutoConfigurationResultCallback): Stop the runloop, and then process
+        the results that we received.
+        (WebCore::processProxyServers): Processing of array of proxy configuration information
+        moved from addProxyServersForURL. Handling of proxy auto-configuration URLs is now handled
+        by calling CFNetworkExecuteProxyAutoConfigurationURL and waiting synchronously on the result
+        callback. Doing this synchronously is not great, but it's the best we can do without a lot
+        of restructuring of the code that calls this. We arbitrarily time out the execution after five
+        seconds to avoid permanently hanging.
+        (WebCore::addProxyServersForURL): Call in to our helper function.
+
+2012-02-16  Abhishek Arya  <inferno@chromium.org>
+
+        Fix clone() function to handle descendant classes of RenderBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=78273
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/multicol/span/clone-flexbox-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone):
+
+2012-02-16  Raul Hudea  <rhudea@adobe.com>
+
+        [CSSRegions]overflowRegion tests are flaky
+        https://bugs.webkit.org/show_bug.cgi?id=78761
+
+        Reviewed by Tony Chang.
+
+        The overflowRegion tests were updated.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+
+2012-02-16  Raul Hudea  <rhudea@adobe.com>
+
+        [CSS Regions] Repaint issues when changing innerHTML of content
+        https://bugs.webkit.org/show_bug.cgi?id=78787
+
+        Reviewed by David Hyatt.
+
+        The calculation of the clipping rectangle is based on the repaint rectangle,
+        so it needs to be clipped to the current region, because it might spread over multiple ones.
+
+        Test: fast/repaint/region-painting-invalidation.html
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::repaintRectangleInRegions):
+
+2012-02-16  Adam Roben  <aroben@apple.com>
+
+        Roll out r107887
+
+        It broke 32-bit builds due to truncation from "long long" to "int".
+
+        Original bug is <http://webkit.org/b/76571> Add FractionalLayoutPoint/Size/Rect for
+        sub-pixel layout
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::isInBounds):
+        (WebCore::operator==):
+        (WebCore::operator*):
+        * platform/graphics/FloatPoint.cpp:
+        * platform/graphics/FloatPoint.h:
+        (WebCore):
+        (FloatPoint):
+        (WebCore::FloatPoint::move):
+        (WebCore::FloatPoint::moveBy):
+        * platform/graphics/FloatRect.cpp:
+        * platform/graphics/FloatRect.h:
+        (WebCore):
+        * platform/graphics/FloatSize.cpp:
+        * platform/graphics/FloatSize.h:
+        (WebCore):
+        * platform/graphics/FractionalLayoutPoint.h: Removed.
+        * platform/graphics/FractionalLayoutRect.cpp: Removed.
+        * platform/graphics/FractionalLayoutRect.h: Removed.
+        * platform/graphics/FractionalLayoutSize.cpp: Removed.
+        * platform/graphics/FractionalLayoutSize.h: Removed.
+        * platform/graphics/IntRect.cpp:
+        * platform/graphics/IntRect.h:
+        (WebCore):
+        (IntRect):
+
+2012-02-16  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: cache settings values
+        https://bugs.webkit.org/show_bug.cgi?id=78815
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.Setting.prototype.get if):
+        (WebInspector.Setting.prototype):
+        (WebInspector.Setting.prototype.):
+        (WebInspector.Setting.prototype.set this):
+
+2012-02-16  Terry Anderson  <tdanderson@chromium.org>
+
+        WebKit does not support DOM 3 Events FocusEvent
+        https://bugs.webkit.org/show_bug.cgi?id=76216
+
+        Created a new FocusEvent class (extends UIEvent) with a relatedTarget attribute.  Moved
+        the {Focus,Blur,FocusIn,FocusOut}EventDispatchMediator classes inside FocusEvent.  Now when
+        focusin or focusout events are dispatched, a FocusEvent is created with the relatedTarget
+        attribute set accordingly.  No other logic changes have been made besides adding the
+        FocusEvent class.
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/events/related-target-focusevent.html
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+            - Included mention of FocusEvent / JSFocusEvent in the above files to
+              allow the patch to build on the different platforms
+        * dom/EventDispatchMediator.cpp:
+        * dom/EventDispatchMediator.h:
+        * dom/EventFactory.in:
+        * dom/FocusEvent.cpp: Added.
+        (WebCore):
+        (WebCore::FocusEvent::FocusEvent):
+        (WebCore::FocusEvent::~FocusEvent):
+        (WebCore::FocusEvent::initFocusEvent):
+        (WebCore::FocusEvent::interfaceName):
+        (WebCore::FocusInEventDispatchMediator::create):
+        (WebCore::FocusInEventDispatchMediator::FocusInEventDispatchMediator):
+        (WebCore::FocusInEventDispatchMediator::dispatchEvent):
+        (WebCore::FocusInEventDispatchMediator::event):
+        (WebCore::FocusOutEventDispatchMediator::create):
+        (WebCore::FocusOutEventDispatchMediator::FocusOutEventDispatchMediator):
+        (WebCore::FocusOutEventDispatchMediator::dispatchEvent):
+        (WebCore::FocusOutEventDispatchMediator::event):
+        (WebCore::FocusEventDispatchMediator::create):
+        (WebCore::FocusEventDispatchMediator::FocusEventDispatchMediator):
+        (WebCore::FocusEventDispatchMediator::dispatchEvent):
+        (WebCore::BlurEventDispatchMediator::create):
+        (WebCore::BlurEventDispatchMediator::BlurEventDispatchMediator):
+        (WebCore::BlurEventDispatchMediator::dispatchEvent):
+        * dom/FocusEvent.h: Copied from Source/WebCore/dom/EventDispatchMediator.h.
+        (WebCore):
+        (FocusEvent):
+        (WebCore::FocusEvent::create):
+        (WebCore::FocusEvent::relatedTarget):
+        (WebCore::FocusEvent::setRelatedTarget):
+        (FocusInEventDispatchMediator):
+        (FocusOutEventDispatchMediator):
+        (FocusEventDispatchMediator):
+        (BlurEventDispatchMediator):
+        * dom/FocusEvent.idl: Added.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchFocusInEvent):
+        (WebCore::Node::dispatchFocusOutEvent):
+        * dom/UIEvent.cpp:
+        * dom/UIEvent.h:
+        * page/DOMWindow.idl:
+
+2012-02-16  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Improve the way we deal with BGRA extension
+        https://bugs.webkit.org/show_bug.cgi?id=78822
+
+        Swizzle the RGBA manually only in OpenGL ES, and only if the extension is not available.
+        Pass the pixel-format of the images when updating TextureMapperTiledBackingStore.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new behavior.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore):
+        (WebCore::hasExtension):
+        (WebCore::hasBgraExtension):
+        (WebCore::BitmapTextureGL::updateContents):
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
+        (WebCore::TextureMapperTile::updateContents):
+        (WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):
+        (WebCore::TextureMapperTiledBackingStore::updateContents):
+        * platform/graphics/texmap/TextureMapperBackingStore.h:
+        (TextureMapperTile):
+        (TextureMapperTiledBackingStore):
+        (WebCore::TextureMapperTiledBackingStore::updateContents):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::updateBackingStore):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Gtk][Efl][Qt] Move OpenGLShims out of cairo/ subdirectory
+        https://bugs.webkit.org/show_bug.cgi?id=78800
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The file is not specific to Cairo and used in other ports. Move it into
+        common space.
+
+        * GNUmakefile.list.am:
+        * PlatformEfl.cmake:
+        * Target.pri:
+        * platform/graphics/OpenGLShims.cpp: Renamed from Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp.
+        (WebCore):
+        (WebCore::openGLFunctionTable):
+        (WebCore::getProcAddress):
+        (WebCore::lookupOpenGLFunctionAddress):
+        (WebCore::initializeOpenGLShims):
+        * platform/graphics/OpenGLShims.h: Renamed from Source/WebCore/platform/graphics/cairo/OpenGLShims.h.
+        (WebCore):
+        (_OpenGLFunctionTable):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        * platform/graphics/qt/Extensions3DQt.cpp:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+
+2012-02-16  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow opaque tiles
+        https://bugs.webkit.org/show_bug.cgi?id=78809
+
+        Add a supportsAlpha property to TiledBackingStore.
+        We invalidate all the tiles if that property changes, because the buffers need to be
+        recreated in a different format.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No behavior changes.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setSupportsAlpha):
+        (WebCore):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+        (WebCore::TiledBackingStore::supportsAlpha):
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from WebKit to
+        WebCore because network stuff will not work as expected without
+        them. Added also out-of-the-box proxy support to WebCore.
+
+        No new tests required as we're just moving stuff from WebKit to
+        WebCore.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-02-16  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: remove free flow DOM editing experiment.
+        https://bugs.webkit.org/show_bug.cgi?id=78813
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._markRevision):
+
+2012-02-16  Patrick Gansterer  <paroga@webkit.org>
+
+        WinCE build fix after r107453.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::isInBounds): Use fabs() instead of abs().
+
+2012-02-15  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: explicitly mark undoable state from the front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=78716
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::addRule):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setAttributeValue):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::moveTo):
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::redo):
+        * inspector/InspectorHistory.h:
+        (InspectorHistory):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector.callback):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.addRule.callback):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype.setStyleSheetText):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setDisabled.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._markRevision):
+        (WebInspector.DOMAgent.prototype.get markUndoableState):
+
+2012-02-15  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: revert 'modification of DOM upon single click for selected nodes'.
+        https://bugs.webkit.org/show_bug.cgi?id=78717
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.onattach):
+
+2012-02-16  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move style disable checkboxes to the left
+        https://bugs.webkit.org/show_bug.cgi?id=78780
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorDoubleClick):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section.matched-styles .properties):
+        (.styles-section.matched-styles .properties li):
+        (.styles-section .properties li.parent::before):
+        (.styles-section .properties li.parent.expanded::before):
+        (.styles-section.matched-styles .properties li.parent .expand-element):
+        (.styles-section.matched-styles .properties li.parent.expanded .expand-element):
+        (.styles-section.computed-style .properties li.parent::before):
+        (.styles-section.computed-style .properties li.parent.expanded::before):
+        (.styles-section.matched-styles:not(.read-only):hover .properties .enabled-button):
+        (.styles-section.matched-styles:not(.read-only) .properties li.disabled .enabled-button):
+        (.styles-section .properties .enabled-button):
+        (.styles-section.matched-styles .properties ol.expanded):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.treeElementDoubleClicked):
+
+2012-02-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: show memory counter graphics when switching to memory view
+        https://bugs.webkit.org/show_bug.cgi?id=78808
+
+        Switching to memory view in timeline will display memory counters. Counter
+        graphics know show fair data without approximations between sampling points.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._calculateVisibleIndexes):
+        (WebInspector.MemoryStatistics.prototype._calculateXValues):
+        (WebInspector.MemoryStatistics.prototype._drawPolyline):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._timelinesOverviewItemSelected):
+        (WebInspector.TimelinePanel.prototype._memoryOverviewItemSelected):
+
+2012-02-16  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: [heap snapshot] It could be useful to have access to the selected heap object from the console.
+        https://bugs.webkit.org/show_bug.cgi?id=78496
+
+        Reviewed by Yury Semikhatsky.
+
+       * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::InspectableObject::get):
+        (WebCore):
+        (WebCore::InjectedScriptHost::addInspectedObject):
+        (WebCore::InjectedScriptHost::clearInspectedObjects):
+        (WebCore::InjectedScriptHost::inspectedObject):
+        * inspector/InjectedScriptHost.h:
+        (InspectableObject):
+        (WebCore::InjectedScriptHost::InspectableObject::~InspectableObject):
+        (InjectedScriptHost):
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorConsoleAgent.cpp:
+        (InspectableHeapObject):
+        (WebCore::InspectableHeapObject::InspectableHeapObject):
+        (WebCore::InspectableHeapObject::get):
+        (WebCore):
+        (WebCore::InspectorConsoleAgent::addInspectedHeapObject):
+        * inspector/InspectorConsoleAgent.h:
+        (InspectorConsoleAgent):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::resetState):
+        * inspector/PageConsoleAgent.cpp:
+        (InspectableNode):
+        (WebCore::InspectableNode::InspectableNode):
+        (WebCore::InspectableNode::get):
+        (WebCore):
+        (WebCore::PageConsoleAgent::addInspectedNode):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._selectionChanged):
+        (WebInspector.DetailedHeapshotView.prototype._inspectedObjectChanged):
+
+2012-02-16  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add support for unsigned long[] to idl bindings to JSC.
+        https://bugs.webkit.org/show_bug.cgi?id=78210
+
+        Reviewed by Kentaro Hara.
+
+        Add support for unsigned long[] parameter type in idl.
+        This patch adds support just for unsigned long[] parameter type.
+        (support for other types of array should be done in another patch.)
+
+        tests added to TestObj.idl.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::jsUnsignedLongArrayToVector):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (AddIncludesForType):
+        (JSValueToNative):
+        (NativeToJSValue):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongArray):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/TestObj.idl:
+
+2012-02-16  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Add IndexedDB TreeElement to resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=78609
+
+        Reviewed by Yury Semikhatsky.
+
+        Added IndexedDB tree element to resources panel (behind experimental setting).
+        Test is currently disabled, since we don't run tests with experiments enabled.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * inspector/front-end/Images/indexedDB.png: Added.
+        * inspector/front-end/Images/indexedDBIndex.png: Added.
+        * inspector/front-end/Images/indexedDBObjectStore.png: Added.
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel):
+        (WebInspector.IndexedDBModel.prototype.refreshDatabaseNames):
+        (WebInspector.IndexedDBModel.prototype.refreshDatabase):
+        (WebInspector.IndexedDBModel.prototype._reset):
+        (WebInspector.IndexedDBModel.prototype._originAddedToFrame):
+        (WebInspector.IndexedDBModel.prototype._originRemoved):
+        (WebInspector.IndexedDBModel.prototype._databaseAdded):
+        (WebInspector.IndexedDBModel.prototype._databaseRemoved):
+        (WebInspector.IndexedDBModel.prototype._loadDatabaseNamesForFrame):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase.callback):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase):
+        (WebInspector.IndexedDBModel.Frame):
+        (WebInspector.IndexedDBModel.DatabaseId):
+        (WebInspector.IndexedDBModel.DatabaseId.prototype.equals):
+        (WebInspector.IndexedDBModel.Database):
+        (WebInspector.IndexedDBModel.Index):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IndexedDBTreeElement):
+        (WebInspector.IndexedDBTreeElement.prototype.onexpand):
+        (WebInspector.IndexedDBTreeElement.prototype._createIndexedDBModel):
+        (WebInspector.IndexedDBTreeElement.prototype.refreshIndexedDB):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBAdded):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBRemoved):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBLoaded):
+        (WebInspector.IndexedDBTreeElement.prototype._idbDatabaseTreeElement):
+        (WebInspector.IDBDatabaseTreeElement):
+        (WebInspector.IDBDatabaseTreeElement.prototype.update):
+        (WebInspector.IDBDatabaseTreeElement.prototype.onselect):
+        (WebInspector.IDBObjectStoreTreeElement):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.update):
+        (WebInspector.IDBIndexTreeElement):
+        (WebInspector.IDBIndexTreeElement.prototype.update):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/resourcesPanel.css:
+        (.indexed-db-storage-tree-item .icon):
+        (.indexed-db-object-store-storage-tree-item .icon):
+        (.indexed-db-index-storage-tree-item .icon):
+
+2012-02-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        REGRESSION (Safari 5.0.5 - 5.1): No animation on svg-wow.org/text-effects/text-effects.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=65072
+
+        Reviewed by Zoltan Herczeg.
+
+        Fix EMS/EXS length resolving, when the target context has no renderer, eg.
+        <text display="none" dy="1em">ABC</text>, myText.dy.baseVal.getItem(0).value()
+        currently throws, even if <text> has a parent, we could use to resolve the length.
+
+        Always fall-back to parent context, to resolve EMS/EXS units, instead of ignoring it.
+        The current behaviour stays the same, if the target element is not in the document,
+        then we really can't resolve lengths like this.
+
+        Tests: svg/text/ems-display-none.svg
+               svg/text/exs-display-none.svg
+
+        * svg/SVGLengthContext.cpp:
+        (WebCore::renderStyleForLengthResolving):
+        (WebCore::SVGLengthContext::convertValueFromUserUnitsToEMS):
+        (WebCore::SVGLengthContext::convertValueFromEMSToUserUnits):
+        (WebCore::SVGLengthContext::convertValueFromUserUnitsToEXS):
+        (WebCore::SVGLengthContext::convertValueFromEXSToUserUnits):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Build fix for Qt 5 without QtWidgets.
+
+        Reviewed by Tor Arne Vestbø.
+
+        The reason why QGLContext is included in Extensions3DQt.cpp is to
+        achieve an implicit gl.h inclusion (needed for GL_FALSE). This patch
+        replaces the inclusion with the OpenGLShims.h inclusions, which has
+        the necessary #ifdefs in place to pull in gl.h with Qt 5 without QtWidgets.
+
+        * platform/graphics/qt/Extensions3DQt.cpp:
+
+2012-02-16  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: create helper function for complex boolean condition
+        https://bugs.webkit.org/show_bug.cgi?id=78539
+
+        Reviewed by James Robinson.
+
+        This change should introduce no change in behavior, and its
+        expected behavior is already covered by existing tests.
+
+        In calculateDrawTransformsAndVisibility, there is a complex
+        boolean condition that indicates whether we should create a
+        RenderSurface or not. This patch pulls out that boolean logic,
+        and wraps it in a helper function for much better readability.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::layerShouldBeSkipped):
+        (WebCore):
+        (WebCore::subtreeShouldRenderToSeparateSurface):
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+
+2012-02-16  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] move timeline overview sidebar creation to TimelineOverviewPane
+        https://bugs.webkit.org/show_bug.cgi?id=78782
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype.showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+
+2012-02-15  Andreas Kling  <awesomekling@apple.com>
+
+        Share font-family CSS values through CSSValuePool.
+        <http://webkit.org/b/78604>
+
+        Reviewed by Darin Adler.
+
+        Cache and share FontFamilyValue instances in the per-document CSSValuePool.
+        This reduces memory consumption by 248 kB on the Moz page cycler (64-bit)
+        and avoids a bunch of extra work.
+
+        This is a regression from the recent attribute style refactoring; previously
+        the mapped attribute declaration table would ensure that multiple 'font'
+        elements with the same 'face' value would share the same FontFamilyValue.
+
+        We're not yet sharing the entire CSSValueList returned by parseFontFamily()
+        but this is a step on the way there.
+
+        * css/FontFamilyValue.cpp:
+        * css/FontFamilyValue.h:
+
+            Removed appendSpaceSeparated(), making FontFamilyValue immutable.
+
+        * css/CSSParser.cpp:
+        (FontFamilyValueBuilder):
+        (WebCore::FontFamilyValueBuilder::FontFamilyValueBuilder):
+        (WebCore::FontFamilyValueBuilder::add):
+        (WebCore::FontFamilyValueBuilder::commit):
+        (WebCore::CSSParser::parseFontFamily):
+
+            Refactor parseFontFamily() to defer creation of FontFamilyValue until
+            the whole family name is known. Added a little helper class to avoid
+            code duplication.
+
+        * css/CSSValuePool.h:
+        * css/CSSValuePool.cpp:
+        (WebCore::CSSValuePool::createFontFamilyValue):
+
+            Added a FontFamilyValue cache to CSSValuePool. All values are tied to
+            the lifetime of the pool.
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move event conversion functions from WebCore to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78788
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move QtWidgets dependent mouse event constructors out of WebCore
+        into WebKit, similar to the web event conversions of WebKit2.
+
+        * Target.pri:
+        * platform/PlatformMouseEvent.h:
+        (PlatformMouseEvent):
+        * platform/PlatformWheelEvent.h:
+        (PlatformWheelEvent):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed prospective Qt 4.8/Mac build fix.
+
+        Cast the PlatformWidget from QObject* to QWidget* to gain access
+        to QWidget methods.
+
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::invalidateRect):
+
+2012-02-16  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Implement scoped selector matching in the slow path
+        https://bugs.webkit.org/show_bug.cgi?id=77528
+
+        Added scope information to SelectorCheckingContext, SelectorChecker methods and CSSStyleSelector methods.
+        Added matchOptions struct to CSSStyleSelector similar to SelectorCheckingContext in SelectorChecker.
+        Adapted the calling sites.
+
+        Reviewed by Antti Koivisto.
+
+        No new tests. (extended existing tests)
+
+        * css/CSSStyleSelector.cpp:
+        (RuleData):
+        (RuleSet):
+        (WebCore::CSSStyleSelector::determineScopingElement):
+        (WebCore::CSSStyleSelector::collectMatchingRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForRegion):
+        (WebCore::CSSStyleSelector::matchScopedAuthorRules):
+        (WebCore::CSSStyleSelector::matchAuthorRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        (MatchOptions):
+        (WebCore::CSSStyleSelector::MatchOptions::MatchOptions):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector):
+        * css/SelectorChecker.h:
+        (WebCore::SelectorChecker::SelectorCheckingContext::SelectorCheckingContext):
+        (SelectorCheckingContext):
+        (SelectorChecker):
+
+2012-02-15  Patrick Gansterer  <paroga@webkit.org>
+
+        Windows build fix for !ENABLE(CSS_FILTERS) after r106593.
+
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+
+2012-02-15  Antti Koivisto  <antti@apple.com>
+
+        Move the context invalidation code out from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=78589
+
+        Reviewed by Ryosuke Niwa.
+
+        StylePropertySet should be independent of its context so that they can in the future
+        be shared between documents. The context invalidation code should move to the CSSOM wrapper.
+        
+        Parent rule and parent element pointers move to the CSSOM wrapper classes. 
+        
+        The wrapper is responsible of invalidating the element or document style on mutation.
+        In case of internal mutation of style attribute, StyledElement takes care of the 
+        invalidation.
+        
+        The StylePropertySet will still have a pointer to the context stylesheet so the patch
+        doesn't actually reduce memory usage. That pointer will be factored out later.
+
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::~CSSFontFaceRule):
+        * css/CSSFontFaceRule.h:
+        (WebCore::CSSFontFaceRule::style):
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::~CSSPageRule):
+        * css/CSSPageRule.h:
+        (WebCore::CSSPageRule::style):
+        (WebCore::CSSPageRule::setDeclaration):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createKeyframeRule):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::~CSSStyleRule):
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::style):
+        (WebCore::CSSStyleRule::setDeclaration):
+        * css/StylePropertySet.cpp:
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::parentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentRule):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::setNeedsStyleRecalc):
+        (RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::parentRule):
+        (WebCore::RuleCSSStyleDeclaration::clearParentRule):
+        (WebCore):
+        (InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::parentElement):
+        (WebCore::InlineCSSStyleDeclaration::clearParentElement):
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::removeShorthandProperty):
+        (WebCore::StylePropertySet::removeProperty):
+        (WebCore::StylePropertySet::setProperty):
+        (WebCore::StylePropertySet::parseDeclaration):
+        (WebCore::StylePropertySet::addParsedProperties):
+        (WebCore::StylePropertySet::addParsedProperty):
+        (WebCore::StylePropertySet::merge):
+        (WebCore::StylePropertySet::removePropertiesInSet):
+        (WebCore::StylePropertySet::copy):
+        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
+        (WebCore::StylePropertySet::ensureRuleCSSStyleDeclaration):
+        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
+        (WebCore::StylePropertySet::clearParentRule):
+        (WebCore::StylePropertySet::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::RuleCSSStyleDeclaration::setNeedsStyleRecalc):
+        (WebCore::InlineCSSStyleDeclaration::setNeedsStyleRecalc):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::create):
+        (StylePropertySet):
+        (WebCore::StylePropertySet::useStrictParsing):
+        (WebCore::StylePropertySet::contextStyleSheet):
+        (WebCore::StylePropertySet::setContextStyleSheet):
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::WebKitCSSKeyframeRule::~WebKitCSSKeyframeRule):
+        (WebCore::WebKitCSSKeyframeRule::setDeclaration):
+        * css/WebKitCSSKeyframeRule.h:
+        (WebCore::WebKitCSSKeyframeRule::style):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::ensureInlineStyleDecl):
+        (WebCore::ElementAttributeData::destroyInlineStyleDecl):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::insertedIntoDocument):
+        (WebCore):
+        (WebCore::StyledElement::removedFromDocument):
+        (WebCore::StyledElement::parseAttribute):
+        (WebCore::StyledElement::inlineStyleChanged):
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::removeInlineStyleProperty):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (StyledElement):
+        (WebCore::StyledElement::destroyInlineStyleDecl):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        (WebCore::DeleteButtonController::show):
+        (WebCore::DeleteButtonController::hide):
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyEditingStyleToElement):
+        * editing/RemoveCSSPropertyCommand.cpp:
+        (WebCore::RemoveCSSPropertyCommand::doApply):
+        (WebCore::RemoveCSSPropertyCommand::doUnapply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::updateColorSwatch):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocument::resizeImageToFit):
+        (WebCore::ImageDocument::restoreImageSize):
+        (WebCore::ImageDocument::windowSizeChanged):
+        * html/ValidationMessage.cpp:
+        (WebCore::adjustBubblePosition):
+        (WebCore::ValidationMessage::buildBubbleTree):
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::show):
+        (WebCore::MediaControlElement::hide):
+        (WebCore::MediaControlPanelElement::setPosition):
+        (WebCore::MediaControlPanelElement::resetPosition):
+        (WebCore::MediaControlPanelElement::makeOpaque):
+        (WebCore::MediaControlPanelElement::makeTransparent):
+        (WebCore::MediaControlInputElement::show):
+        (WebCore::MediaControlInputElement::hide):
+        (WebCore::MediaControlTextTrackContainerElement::updateSizes):
+        * html/shadow/MeterShadowElement.cpp:
+        (WebCore::MeterValueElement::setWidthPercentage):
+        * html/shadow/ProgressShadowElement.cpp:
+        (WebCore::ProgressValueElement::setWidthPercentage):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::TrackLimiterElement::create):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::SVGFontFaceElement):
+        (WebCore::SVGFontFaceElement::insertedIntoDocument):
+        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
+
+2012-02-15  Daniel Cheng  <dcheng@chromium.org>
+
+        dataTransfer.types (HTML5 drag & drop) should return DOMStringList
+        https://bugs.webkit.org/show_bug.cgi?id=30416
+
+        Reviewed by Eric Seidel.
+
+        This change breaks backwards compatibility; however, since Firefox only supported
+        event.dataTransfer.types.contains, sites already needed to check whether to use contains or
+        indexOf. Therefore, the net compatibility effect of this change should be minimal.
+
+        Test: fast/events/drag-dataTransfer-live-attributes.html
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::hasStringOfType):
+        * dom/Clipboard.h:
+        (WebCore):
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h:
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::mayUpdateItems):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::containsHTML):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::asFragment):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-15  Bear Travis  <betravis@adobe.com>
+
+        Repaint issues on changing 'viewBox' of inner SVG
+        https://bugs.webkit.org/show_bug.cgi?id=77903
+
+        Reviewed by Nikolas Zimmermann.
+
+        Do not update the child viewbox/viewport transform to its parent
+        coordinate system until after layout has stored the old bounds for
+        repainting purposes.
+        
+        Test: svg/repaint/inner-svg-change-viewBox-contract.svg
+
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore):
+        (WebCore::RenderSVGViewportContainer::calculateLocalTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::setNeedsTransformUpdate):
+        (RenderSVGViewportContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2012-02-15  Bear Travis  <betravis@adobe.com>
+
+        Repaint issues on changing 'viewBox' of inner SVG
+        https://bugs.webkit.org/show_bug.cgi?id=77903
+
+        Reviewed by Nikolas Zimmermann.
+
+        Do not update the child viewbox/viewport transform to its parent
+        coordinate system until after layout has stored the old bounds for
+        repainting purposes.
+        
+        Test: svg/repaint/inner-svg-change-viewBox-contract.svg
+
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore):
+        (WebCore::RenderSVGViewportContainer::calculateLocalTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::setNeedsTransformUpdate):
+        (RenderSVGViewportContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2012-02-15  Daniel Cheng  <dcheng@chromium.org>
+
+        dataTransfer.types (HTML5 drag & drop) should return DOMStringList
+        https://bugs.webkit.org/show_bug.cgi?id=30416
+
+        Reviewed by Eric Seidel.
+
+        This change breaks backwards compatibility; however, since Firefox only supported
+        event.dataTransfer.types.contains, sites already needed to check whether to use contains or
+        indexOf. Therefore, the net compatibility effect of this change should be minimal.
+
+        Test: fast/events/drag-dataTransfer-live-attributes.html
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::hasStringOfType):
+        * dom/Clipboard.h:
+        (WebCore):
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h:
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::mayUpdateItems):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::containsHTML):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::asFragment):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-15  Bear Travis  <betravis@adobe.com>
+
+        Repaint issues on changing 'viewBox' of inner SVG
+        https://bugs.webkit.org/show_bug.cgi?id=77903
+
+        Reviewed by Nikolas Zimmermann.
+
+        Do not update the child viewbox/viewport transform to its parent
+        coordinate system until after layout has stored the old bounds for
+        repainting purposes.
+        
+        Test: svg/repaint/inner-svg-change-viewBox-contract.svg
+
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore):
+        (WebCore::RenderSVGViewportContainer::calculateLocalTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::setNeedsTransformUpdate):
+        (RenderSVGViewportContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Fix unused parameter warnings.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+
+2012-02-15  Emil A Eklund  <eae@chromium.org>
+
+        Convert RenderFrameSet to LayoutUnits in preparation for turning on subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78526
+
+        Reviewed by Eric Seidel.
+
+        Revert paintColumnBorder and paintRowBorder to IntRect and pixel snap in
+        paint before calling them. This way the rounding logic is contained in a
+        single place (in paint).
+
+        No new tests, no new functionality.
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        (WebCore::RenderFrameSet::paint):
+        (WebCore::RenderFrameSet::getCursor):
+        * rendering/RenderFrameSet.h:
+        (RenderFrameSet):
+
+2012-02-15  Emil A Eklund  <eae@chromium.org> and Levi Weintraub  <leviw@chromium.org>
+
+        Add FractionalLayoutPoint/Size/Rect for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=76571
+
+        Reviewed by Eric Seidel.
+
+        Add fixed point versions of the Point, Size and Rect classes using
+        the new FractionalLayoutPoint type and.
+
+        FractionalLayoutPoint, FractionalLayoutSize and FractionalLayoutRect are
+        Point, Size and Rect implementations respectively using this new type.
+
+        No new tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/FractionalLayoutUnit.h:
+        Fixed a couple of typos and signed/unsigned bugs.
+
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::FloatPoint):
+        Add explicit FloatPoint(FractionalLayoutPoint) constructor.
+        
+        (WebCore::FloatPoint::move):
+        Add move(FractionalLayoutSize) implementation.
+        
+        (WebCore::FloatPoint::moveBy):
+        Add moveBy(FractionalLayoutPoint) implementation.
+
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::FloatRect):
+        Add explicit FloatRectFractionalLayoutRect) constructor.
+        
+        * platform/graphics/FloatRect.h:
+        (WebCore):
+        (FloatRect):
+        * platform/graphics/FloatSize.cpp:
+        (WebCore::FloatSize::FloatSize):
+        Add explicit FloatSize(FractionalLayoutSize) constructor.
+
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FractionalLayoutPoint.h: Added.
+        * platform/graphics/FractionalLayoutRect.cpp: Added.
+        * platform/graphics/FractionalLayoutRect.h: Added.
+        * platform/graphics/FractionalLayoutSize.cpp: Added.
+        * platform/graphics/FractionalLayoutSize.h: Added.
+        * platform/graphics/IntRect.cpp:
+        (WebCore::IntRect::IntRect):
+        Add explicit IntRect(FractionalLayoutRect) constructor.
+
+        * platform/graphics/IntRect.h:
+
+2012-02-15  Kentaro Hara  <haraken@chromium.org>
+
+        [Mac] PasteboardMac.mm build fails
+        https://bugs.webkit.org/show_bug.cgi?id=78655
+
+        Reviewed by Enrica Casucci.
+
+        This patch fixes the code to make a plain text for pasted file names.
+        The code should return a string of concatenated file names.
+
+        Test: editing/pasteboard/drag-files-to-editable-element.html
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::plainText):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Another attempt at fixing the Snow Leopard build.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setContentsScale):
+
+2012-02-15  Pablo Flouret  <pablof@motorola.com>
+
+        Add support for the translate attribute in html elements.
+        https://bugs.webkit.org/show_bug.cgi?id=78751
+
+        Reviewed by Adam Barth.
+
+        The translate attribute is used to specify whether an element's
+        attribute values and the values of its Text node children are to be
+        translated when the page is localized, or whether to leave them
+        unchanged.
+
+        Details at http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#attr-translate
+
+        Test: fast/dom/HTMLElement/translate.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::translateAttributeMode):
+        (WebCore):
+        (WebCore::HTMLElement::translate):
+        (WebCore::HTMLElement::setTranslate):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLElement.idl:
+
+2012-02-15  Sami Kyostila  <skyostil@google.com>
+
+        Add -webkit-overflow-scrolling CSS property
+        https://bugs.webkit.org/show_bug.cgi?id=78664
+
+        Reviewed by Eric Seidel.
+
+        Add a CSS property indicating that an element with overflow scrolling
+        should follow the platform's behavior for touch scrollable user
+        interface objects. For instance, this property could enable momentum
+        scrolling for the element if that is the platform convention.
+
+        The property has two possible values: auto (default) and touch. The
+        former does not alter overflow scrolling behavior, while the latter
+        activates touch scrolling.
+
+        As a side effect, enabling touch scrolling also causes an element to
+        gain a stacking context. This is to allow the implementation to promote
+        the scrolling contents into a render layer, which can be translated more
+        efficiently.
+
+        This property was introduced with iOS 5 WebKit. Another implementation
+        is in Chrome for Android.
+
+        Test: platform/chromium/compositing/overflow/overflow-scrolling-touch-stacking-context.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+
+2012-02-15  Levi Weintraub  <leviw@chromium.org>
+
+        Add zeroLayoutUnit constant.
+        https://bugs.webkit.org/show_bug.cgi?id=78747
+
+        Reviewed by Eric Seidel.
+
+        Converting call sites where LayoutUnits and raw zeros are in ternary operations
+        and templatized function calls (like std::max and min) to use a new zeroLayoutUnit
+        constant instead of the raw zero.
+
+        No new tests. No change in behavior.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::addBorderOutsetVisualOverflow):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        (WebCore::InlineFlowBox::computeOverAnnotationAdjustment):
+        * rendering/LayoutTypes.h:
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::adjustFloatingBlock):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::nextFloatLogicalBottomBelow):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::paginationStrut):
+        (WebCore::RenderBlock::pageLogicalOffset):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineLayoutState::updateRepaintRangeFromBox):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::minYVisualOverflow):
+        (WebCore::RenderBox::minXVisualOverflow):
+        (RenderBox):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::offsetLeft):
+        (WebCore::RenderBoxModelObject::offsetTop):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::nodeWidth):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::layout):
+        (WebCore::RenderFlowThread::computeLogicalWidth):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::listIndexAtOffset):
+        (WebCore::RenderListBox::verticalScrollbarWidth):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computePreferredLogicalWidths):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::bordersPaddingAndSpacingInRowDirection):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::layout):
+
+2012-02-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Crash after trying to use FileReader in a document with null origin string
+        https://bugs.webkit.org/show_bug.cgi?id=78649
+
+        Reviewed by Enrica Casucci.
+
+        Test: fast/files/null-origin-string.html
+
+        * fileapi/FileReaderLoader.cpp: (WebCore::FileReaderLoader::~FileReaderLoader):
+        HashMaps don't like empty keys, and they don't like removing keys that have never been added.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Attempt to fix the Snow Leopard build.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::createTileLayer):
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+
+2012-02-15  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r107836): fast/box-shadow/spread.html and fast/writing-mode/box-shadow-*.html tests failing
+        https://bugs.webkit.org/show_bug.cgi?id=78759
+
+        Reviewed by Simon Fraser.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::boxShadowCanBeAppliedToBackground): Added. Returns false if
+        paintFillLayer() would push a clip before painting the layer, thus preventing it from casting
+        its own shadow.
+        (WebCore::InlineFlowBox::paintBoxDecorations): Pass this as an additional parameter to
+        boxShadowShouldBeAppliedToBackground().
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Pass the InlineFlowBox along to
+        boxShadowShouldBeAppliedToBackground().
+        (WebCore::RenderBoxModelObject::boxShadowShouldBeAppliedToBackground): Added an InlineFlowBox
+        parameter. If non-0, check boxShadowCanBeAppliedToBackground(). Also check for shadow spread,
+        and for the case of border radius with a background image, in which paintFillLayerExtended uses
+        clipping. Finally, fixed a bug in the for() loop for finding the last background layer which
+        was noticed by Tony Chang.
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::boxShadowShouldBeAppliedToBackground):
+        * rendering/RenderTableCell.h:
+
+2012-02-15  Erik Arvidsson  <arv@chromium.org>
+
+        Expose Window constructor
+        https://bugs.webkit.org/show_bug.cgi?id=78722
+
+        Reviewed by Adam Barth.
+
+        Test: fast/dom/Window/window-constructor-presence.html
+
+        * page/DOMWindow.idl:
+
+2012-02-15  Kelly Norton  <knorton@google.com>
+
+        fill-opacity does not render properly only on Chromium Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=78624
+
+        Reviewed by Stephen White.
+
+        Test: svg/text/text-fill-opacity.svg
+
+        * platform/graphics/skia/FontSkia.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2012-02-15  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream WebPageClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=78660
+
+        Reviewed by Antonio Gomes.
+
+        Header inclusion fix, no new test.
+
+        * plugins/blackberry/PluginViewPrivateBlackBerry.h:
+        Add #include <BlackBerryPlatformIntRectRegion.h>
+        and #include <BlackBerryPlatformGraphics.h> because they
+        are being removed from WebKit/blackberry/Api/WebPageClient.h.
+
+2012-02-15  Tim Horton  <timothy_horton@apple.com>
+
+        REGRESSION(r105057): Dynamically changing <tspan> offsets is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78385
+        <rdar://problem/10832932>
+
+        Reviewed by Simon Fraser.
+
+        Don't short-circuit buildLayoutAttributesIfNeeded if m_textPositions is already full;
+        we can't skip rebuilding the layout attributes, just walking the tree to acquire the
+        positioning lists (invalidation of positioning lists is already covered by textDOMChanged).
+
+        Test: svg/text/tspan-dynamic-positioning.svg
+
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesIfNeeded):
+
+2012-02-15  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Removing SecurityContext from the embedder API
+        https://bugs.webkit.org/show_bug.cgi?id=73816
+
+        Reviewed by Darin Fisher.
+
+        Tests for the Media Stream API will be provided by the bug 56587, pending enough landed code.
+
+        * mediastream/PeerConnection.cpp:
+        (WebCore::PeerConnection::PeerConnection):
+        * platform/mediastream/PeerConnectionHandler.h:
+        (WebCore):
+        (PeerConnectionHandler):
+        * platform/mediastream/gstreamer/PeerConnectionHandler.cpp:
+        (WebCore::PeerConnectionHandler::create):
+        (WebCore::PeerConnectionHandler::PeerConnectionHandler):
+
+2012-02-15  Nate Chapin  <japhet@chromium.org>
+
+        Fix test regressons from r107672.
+        https://bugs.webkit.org/show_bug.cgi?id=76564
+
+        Move setting CachedRawResource::m_identifer from
+        data() to setResponse(). WorkerScriptLoader depends
+        on the identifier being set correctly during setResponse()
+        in order to correctly mark itself as a ScriptResource in
+        the inspector.
+
+        Reviewed by Adam Barth.
+
+        Fixes several worker script loading tests.
+
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::data):
+        (WebCore::CachedRawResource::setResponse):
+
+2012-02-15  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION: "Copy image" fails...copies image URL instead.
+        https://bugs.webkit.org/show_bug.cgi?id=78723
+        <rdar://problem/10869104>
+
+        During the refactoring of the Pasteboard class some code was lost.
+        When placing an NSImage in the NSPasteboard as NSTIFFPboardType, we need
+        to use the its TIFF representation.
+        
+        Reviewed by Andy Estes.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+
+2012-01-31  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [soup] Add support for multiple SoupSessions.
+        https://bugs.webkit.org/show_bug.cgi?id=77341
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Make the libsoup network backend support multiple SoupSessions. This is
+        accomplished by using the NetworkingContext classes, which now have a
+        `soupSession()' method when the libsoup backend is being used.
+
+        libsoup's ResourceHandle implementation now retrieves the SoupSession
+        via the NetworkingContext it receives instead of relying on
+        defaultSession(). defaultSession() is still used when a null
+        NetworkingContext is passed to ResourceHandle::start (for example, via
+        webkit_download_start).
+
+        The CookieJar implementation retrieves the SoupSession from the
+        NetworkingContext as much as possible as well -- the functions used by
+        WebKit2 could not be converted, though, as they seem to assume there is
+        only one shared cookie jar.
+
+        No new tests, covered by the existing ones.
+
+        * platform/network/NetworkingContext.h:
+        (NetworkingContext): Add soupSession() method if USE(SOUP) is set.
+        * platform/network/ResourceHandleInternal.h:
+        (ResourceHandleInternal):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::cookieJarForDocument):
+        (WebCore):
+        (WebCore::defaultCookieJar):
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+        (WebCore::cookiesEnabled):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::soupSession): Add method to retrieve
+        a SoupSession from a NetworkingContext and fallback to defaultSession()
+        if there's no valid NetworkingContext.
+        (WebCore):
+        (WebCore::ensureSessionIsInitialized): Only change or use the default
+        cookie jar if the SoupSession being changed is the default one.
+        (WebCore::sendRequestCallback):
+        (WebCore::startHTTPRequest):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::startNonHTTPRequest):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        The TileCache object should be deallocated on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=78757
+        <rdar://problem/10866161>
+
+        Reviewed by Sam Weinig.
+
+        Since the WebTileCacheLayer can be deleted on the scrolling thread, we need to make sure that the underlying
+        TileCache object is actually destroyed on the main thread.
+
+        * platform/graphics/ca/mac/TileCache.h:
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::~TileCache):
+        Assert that this object is being destroyed on the main thread.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer dealloc]):
+        If dealloc is being called from a non-main thread, make sure to delete the tile cache object on the main thread.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Scrolling Coordinator must be deleted on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=78756
+        <rdar://problem/10866167>
+
+        Reviewed by Sam Weinig.
+
+        ScrollingTree::invalidate will finish breaking the cycle between the scrolling coordinator and the
+        scrolling tree by dereffing the scrolling coordinator. We need to make sure that this happens on the main
+        thread because the scrolling coordinator expects to be destroyed from there.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::derefScrollingCoordinator):
+        (WebCore):
+        (WebCore::ScrollingTree::invalidate):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Scrolling coordinator should handle pages being restored from the page cache
+        https://bugs.webkit.org/show_bug.cgi?id=78753
+        <rdar://problem/10866171>
+
+        Reviewed by Sam Weinig.
+
+        Replace ScrollingCoordinator::frameViewScrollLayerDidChange with a new member function,
+        ScrollingCoordinator::frameViewRootLayerDidChange which is called whenever the root layer
+        of the frame view changes (which happens on back/forward navigation as well).
+
+        In this function, reset the scrolling tree state from the frame view.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::scrollLayerForFrameView):
+        Add a helper function.
+
+        (WebCore::ScrollingCoordinator::frameViewRootLayerDidChange):
+        Reset the entire scrolling tree state.
+
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        Call the newly added helper function.
+
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        Remove frameViewScrollLayerDidChange.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootLayer):
+        Remove call to ScrollingCoordinator::frameViewScrollLayerDidChange.
+
+        (WebCore::RenderLayerCompositor::attachRootLayer):
+        Call ScrollingCoordinator::frameViewRootLayerDidChange.
+
+2012-02-15  Enrica Casucci  <enrica@apple.com>
+
+        Refactor ClipboardMac class to use PlatformStrategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78554
+
+        Reviewed by Anders Carlsson.
+
+        No new tests. No change in behavior.
+
+        * WebCore.exp.in: Added new exported methods of the PlatformPasteboard class
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::newGeneralClipboard): Use name based pasteboard references.
+        * page/DragClient.h:
+        (WebCore::DragClient::declareAndWriteDragImage): Ditto.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::createDraggingClipboard): Ditto.
+        * platform/PasteboardStrategy.h: Added new methods to get a unique pasteboard name
+        and the pasteboard change count.
+        * platform/PlatformPasteboard.h: Ditto.
+        * platform/mac/ClipboardMac.h:
+        (WebCore::ClipboardMac::create): Using name based pasteboard.
+        (WebCore::ClipboardMac::pasteboardName): Replacing the old pasteboard() method.
+        * platform/mac/ClipboardMac.mm: All the methods below have been modified to avoid
+        using Objective-C types and direct access to NSPasteboard object.
+        (WebCore::Clipboard::create):
+        (WebCore::ClipboardMac::ClipboardMac):
+        (WebCore::ClipboardMac::hasData):
+        (WebCore::cocoaTypeFromHTMLClipboardType):
+        (WebCore::utiTypeFromCocoaType):
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::clearData):
+        (WebCore::ClipboardMac::clearAllData):
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::getData):
+        (WebCore::ClipboardMac::setData):
+        (WebCore::ClipboardMac::types):
+        (WebCore::ClipboardMac::files):
+        (WebCore::ClipboardMac::setDragImage):
+        (WebCore::ClipboardMac::writeRange):
+        (WebCore::ClipboardMac::writePlainText):
+        (WebCore::ClipboardMac::writeURL):
+        (WebCore::ClipboardMac::declareAndWriteDragImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeClipboard): Using name based pasteboard reference.
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::getPathnamesForType): Fixed to support NSArray and NString content.
+        (WebCore::PlatformPasteboard::changeCount): Added.
+        (WebCore::PlatformPasteboard::uniqueName): Added.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        TileCache needs to support setting the contents scale
+        https://bugs.webkit.org/show_bug.cgi?id=78741
+        <rdar://problem/10710773>
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/mac/TileCache.h:
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setContentsScale):
+        Update the contents scale of all the tiles and then revalidate the tile cache since tiles
+        might have come and gone as a result of setting the contents scale.
+        
+        (WebCore::TileCache::createTileLayer):
+        Set the contents scale of the tile layer.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+        Call TileCache::setContentsScale.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Chromium build and remove a snarky comment in the process.
+
+        * platform/chromium/PopupListBox.cpp:
+        (WebCore::PopupListBox::handleWheelEvent):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Wheel events should be re-dispatched to the scrolling thread
+        https://bugs.webkit.org/show_bug.cgi?id=78731
+        <rdar://problem/10866144>
+
+        Reviewed by Sam Weinig.
+
+        When threaded scrolling is enabled, all the state is assumed to be kept in the scrolling tree,
+        on the scrolling thread. This means that even if we do end up processing an event on the main thread
+        (because of wheel event handlers for example), we still have to dispatch the wheel event back to the
+        scrolling thread.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::wheelEvent):
+        Move wheelEvent from ScrollView and ask the scrolling coordinator to handle the wheel event.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::handleWheelEvent):
+        Dispatch the event to the scrolling thread, unless it will start a gesture. In that case we'll return false
+        so that information will be passed back to the UI process.
+        
+        (ScrollingCoordinator):
+        * platform/ScrollView.cpp:
+        * platform/ScrollView.h:
+        Move wheelEvent to FrameView.
+
+2012-02-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        RootObject::finalize can cause a crash in object->invalidate()
+        https://bugs.webkit.org/show_bug.cgi?id=78645
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::finalize): Added a stack-allocated RefPtr to protect the RootObject
+        during the call to invalidate().
+
+2012-02-15  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10870238> Box shadow drawing takes an unnecessarily slow code path in some single-shadow, opaque-background cases
+        https://bugs.webkit.org/show_bug.cgi?id=78728
+
+        In some cases, when there is only one normal box shadow, and the box has an opaque background,
+        it is possible to draw the box shadow by having the background cast it directly. This appears
+        to be faster than the generic code path that uses a separate drawing pass to cast the shadow,
+        clipping out the border box and the shadow-casting box.
+
+        Reviewed by Dave Hyatt.
+
+        No new tests, because behavior is unchanged.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintBoxDecorations): Changed to not paint normal box shadows if
+        they are going to be cast by the background.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations): Ditto.
+        * rendering/RenderBox.h: Made determineBackgroundBleedAvoidance() protected.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::applyBoxShadowForBackground): Added this helper function, which applies the first
+        normal shadow from the given RenderStyle to the given GraphicsContext.
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Added calls to
+        applyBoxShadowForBackground() before drawing the background color when needed.
+        (WebCore::RenderBoxModelObject::boxShadowShouldBeAppliedToBackground): Added. Returns true
+        in some of the cases where the box shadow can be cast by the background directly.
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Changed to not paint normal box shadows if
+        they are going to be cast by the background.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::boxShadowShouldBeAppliedToBackground): Added this override that
+        always returns false, because table cells sometimes apply a clip before drawing the background.
+        * rendering/RenderTableCell.h:
+
+2012-02-15  Ojan Vafai  <ojan@chromium.org>
+
+        getComputedStyle of flex-item-align:auto should resolve to it's parent's flex-align value
+        https://bugs.webkit.org/show_bug.cgi?id=76326
+
+        Reviewed by Tony Chang.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        Keep a count of the number of touch-event handlers and notify the
+        embedder when the count changes. Depending on the count, the embedder
+        can decide whether or not to dispatch touch events to webkit.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::didAddTouchEventHandler):
+        (WebCore):
+        (WebCore::Document::didRemoveTouchEventHandler):
+        * dom/Document.h:
+        (WebCore::Document::touchEventHandlerCount):
+        (Document):
+        * dom/Node.cpp:
+        (WebCore::isTouchEventType):
+        (WebCore::tryAddEventListener):
+        (WebCore::tryRemoveEventListener):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::numTouchEventHandlersChanged):
+        * page/ChromeClient.h:
+        (ChromeClient):
+        * page/Frame.cpp:
+        (WebCore::Frame::notifyChromeClientWheelEventHandlerCountChanged):
+        (WebCore::Frame::notifyChromeClientTouchEventHandlerCountChanged):
+        (WebCore):
+        * page/Frame.h:
+        (Frame):
+
+2012-02-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Unset the active flag when TextTrackCues go away
+        https://bugs.webkit.org/show_bug.cgi?id=72552
+
+        Reviewed by Maciej Stachowiak.
+
+        Test: media/track/track-active-cues.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadTimerFired): Configure new text tracks before preparing to load
+            so we know about all tracks when resource selection begins.
+        (WebCore::HTMLMediaElement::prepareForLoad): Call updateActiveTextTrackCues after setting
+            to m_readyState is HAVE_NOTHING so all cues get deactivated. Don't build list of 
+            available text tracks because resource selection won't actually start until after the load timer fires.
+        (WebCore::HTMLMediaElement::loadInternal): Build list of non-disabled tracks.
+        (WebCore::HTMLMediaElement::updateActiveTextTrackCues):  Clear the active flag on all cues
+            when m_readyState is HAVE_NOTHING or m_player is 0.
+        (WebCore::HTMLMediaElement::setReadyState): Don't update m_readyState when tracks which haven't
+            loaded yet will prevent events from firing. Call updateActiveTextTrackCues to ensure that the
+            first cue(s) are shown as soon as possible.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Call updateActiveTextTrackCues when when m_readyState 
+            is HAVE_NOTHING so all cues get deactivated.
+
+2012-02-15  Jessie Berlin  <jberlin@apple.com>
+
+        WebCore build exceeds address space on 32-bit Windows builders (again).
+        https://bugs.webkit.org/show_bug.cgi?id=78724
+
+        Reviewed by Jon Honeycutt.
+
+        Add the rest of the inspector .cpp files to the InspectorAllInOne.cpp file in Production and
+        Release builds.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        In the process, let VS have its way with this file.
+
+        * inspector/InspectorAllInOne.cpp:
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Remove ScrollableArea::handleGestureEvent
+        https://bugs.webkit.org/show_bug.cgi?id=78661
+
+        Reviewed by Adam Roben.
+
+        ScrollableArea::handleGestureEvent ends up being a no-op so remove it and the related code.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * platform/ScrollAnimator.cpp:
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (ScrollView):
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-14  Stephen White  <senorblanco@chromium.org>
+
+        Fix for incorrect/offset image in CSS filters (non-composited path)
+        https://bugs.webkit.org/show_bug.cgi?id=78626
+
+        Reviewed by Darin Adler.
+
+        Test: css3/filters/multiple-filters-invalidation.html
+
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::prepare):
+        When invalidating results, invalidate all intermediate filter
+        results, not just the last effect's result.
+
+2012-02-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: "Minus" (Delete) button disappears for hovered watch expression in Watches pane
+        https://bugs.webkit.org/show_bug.cgi?id=78714
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype._mouseOut):
+
+2012-02-15  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Move RunLoop to WebCore/platform
+        https://bugs.webkit.org/show_bug.cgi?id=78504
+
+        Reviewed by Adam Roben.
+
+        r105475 moved RunLoop.cpp from WebKit2 to WebCore, but missed the CMake based ports.
+
+        * CMakeLists.txt:
+        * PlatformWinCE.cmake:
+
+2012-02-15  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Remove clipToImageBuffer from SourceAlpha and feComposite
+        https://bugs.webkit.org/show_bug.cgi?id=78355
+
+        Reviewed by Nikolas Zimmermann.
+
+        The implementation of clipToImageBuffer is inefficient on
+        non-mac platforms, so we would benefit if remove it.
+
+        Existing tests cover this feature.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::platformApplySoftware):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::platformApplySoftware):
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace use of QGLWidget/QGLContext with QOpenGLContext and QSurface for Qt 5
+        https://bugs.webkit.org/show_bug.cgi?id=78694
+
+        Reviewed by Noam Rosenthal.
+
+        Typedef PlatformGraphicsContext3D and PlatformGraphicsSurface3D to QOpenGLContext
+        and QSurface for Qt 5. Use these APIs to change the current context and get the
+        procedure addresses. Removed QGraphicsObject inheritance remainder while we're at it,
+        because that code path is obsolete.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/cairo/OpenGLShims.cpp:
+        (WebCore::getProcAddress):
+        * platform/graphics/cairo/OpenGLShims.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext):
+        (WebCore::GraphicsContext3DPrivate::makeCurrentIfNeeded):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move Qt platform specific GL Context/Surface creation out of WebCore into WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78692
+
+        Reviewed by Noam Rosenthal.
+
+        Replace the "glWidget" term in the GraphicsContext with "surface" and delegate
+        the context and surface creation to the page client.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext):
+        (WebCore::GraphicsContext3DPrivate::makeCurrentIfNeeded):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient):
+
+2012-02-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Support filters in TextureMapperImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=76026
+
+        Implement GraphicsLayer::setFilters for TextureMapper, and pass the filters all the way
+        to BitmapTextureImageBuffer. This does not introduce a new filters implementation, but
+        rather uses the non-AC implementation. A complete implementation will be needed in
+        TextureMapperGL, which can use some of the glue in this code.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Unskipped 10 tests in css3/filters.
+
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore):
+        (WebCore::GraphicsLayerTextureMapper::setFilters):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (GraphicsLayerTextureMapper):
+        * platform/graphics/texmap/TextureMapper.h:
+        (BitmapTexture):
+        (WebCore::BitmapTexture::applyFilters):
+        * platform/graphics/texmap/TextureMapperImageBuffer.cpp:
+        (WebCore):
+        (WebCore::BitmapTextureImageBuffer::applyFilters):
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (BitmapTextureImageBuffer):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::shouldPaintToIntermediateSurface):
+        (WebCore):
+        (WebCore::applyFilters):
+        (WebCore::TextureMapperLayer::paintRecursive):
+        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        (State):
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Clean up fallback rendering of GraphicsContext3D to Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=78690
+
+        Reviewed by Noam Rosenthal.
+
+        Use the common paintRenderingResultsToCanvas code to retrieve the
+        pixels from the FBO and use a Qt port specific paintToCanvas
+        implementation to wrap the pixels into a QImage and render it
+        into the graphics context, just like it's done for the other ports.
+
+        This removes the QGraphicsObject based paint, which is an now 
+        obsolete method of rendering.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3D::paintToCanvas):
+
+2012-02-14  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Eliminate first set of QtWidgets dependencies from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=78611
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * bindings/js/ScriptControllerQt.cpp: Remove unused include.
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::tabsToAllFormControls): Replace import
+        of private Qt(Widgets) variable with the default of Qt 5, where
+        it is also not configurable.
+        * platform/ContextMenu.h: Remove unused include.
+        * platform/ContextMenuItem.h: Ditto.
+        * platform/Widget.h: Use QObject as type for PlatformWidget
+        instead of QWidget.
+        * platform/graphics/Icon.h:
+        (Icon): Prefer QImage over QIcon for storage.
+        * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
+        (WebCore): Make it compile with QWindow for Qt 5 and QWidget for Qt 4.
+        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
+        (FullScreenVideoWindow::FullScreenVideoWindow):
+        (FullScreenVideoWindow::keyPressEvent):
+        (FullScreenVideoWindow::event):
+        (FullScreenVideoWindow::showFullScreen):
+        (PlatformVideoWindow::PlatformVideoWindow):
+        * platform/graphics/qt/IconQt.cpp: Revert the implementation of this class
+        back to notImplemented(). It was trying to load the actual file as QIcon
+        instead of trying to find a symbolic icon for the given file. We should
+        probably use the QMimeType API in Qt 5 once it becomes available.
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/qt/ImageQt.cpp:
+        (graphics): Remove use of QStyle for retrieving icons. Code moved to
+        WebCoreSupport instead.
+        * platform/qt/ContextMenuQt.cpp: Removed unused include.
+        * platform/qt/PlatformScreenQt.cpp: Add #ifdefs to use QScreen API
+        with Qt 5.
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/QWebPageClient.h: Add hook for showing/hiding widget.
+        (WebCore):
+        (QWebPageClient):
+        * platform/qt/SoundQt.cpp:
+        (WebCore::systemBeep): Beep is not implemented in Qt 5 and its use is
+        questionable. Move back to notImplemented() until proper QPA API becomes
+        available in Qt 5 (if ever...).
+        * platform/qt/WidgetQt.cpp: Delegate QWidget specific show/hide calls
+        to the PageClient, out of WebCore.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/PluginView.h: Remove unused include.
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::RenderTreeAsText::writeRenderObject): When dumping properties of
+        QWidget, use the QObject property API to retrieve the values instead of
+        QWidget specific API. Removed the mask from the dump as it's not available
+        as property and our layout tests don't seem to use it.
+
+2012-02-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Fix minor design issues in the Spectrum color picker
+        https://bugs.webkit.org/show_bug.cgi?id=78693
+
+        Drive-by: frontend compilability fixes.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/Popover.js:
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum.rgbaToHSVA):
+        (WebInspector.Spectrum.prototype.set color):
+        (WebInspector.Spectrum.prototype.get isVisible):
+        (WebInspector.Spectrum.prototype.toggle):
+        (WebInspector.Spectrum.prototype.show):
+        (WebInspector.Spectrum.prototype.hide):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+        * inspector/front-end/elementsPanel.css:
+        (.spectrum-container):
+        (.spectrum-top):
+        (.spectrum-color):
+        (.spectrum-hue):
+        (.spectrum-fill):
+        (.spectrum-range-container):
+        (.spectrum-range-container *):
+        (.spectrum-range-container label):
+        (.spectrum-range-container input):
+        (.swatch, .spectrum-dragger, .spectrum-slider):
+        (.spectrum-sat):
+        (.spectrum-val):
+        (.spectrum-dragger):
+        (.spectrum-slider):
+        * inspector/front-end/inspector.css:
+        (.custom-popup-vertical-scroll ::-webkit-scrollbar-track-piece:vertical:increment):
+
+2012-02-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Build fix after r107806
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::callFunctionWithEvalEnabled):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+
+2012-02-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: crash when inspecting an element on a page with eval disabled by CSP
+        https://bugs.webkit.org/show_bug.cgi?id=78705
+
+        Inspector functions in injected script may use eval so we need to make sure
+        it is allowed for inspector code on pages where it is prohibited by CSP.
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/elements/resolve-node-blocked.html
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::nodeForObjectId):
+        (WebCore::InjectedScript::wrapCallFrames):
+        (WebCore::InjectedScript::wrapObject):
+        (WebCore::InjectedScript::releaseObjectGroup):
+        (WebCore::InjectedScript::callFunctionWithEvalEnabled):
+        (WebCore):
+        (WebCore::InjectedScript::makeCall):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+
+2012-02-13  Brian Grinstead  <briangrinstead@gmail.com>
+
+        Web Inspector: Add colorpicker functionality to color swatches in Styles Sidebar
+        https://bugs.webkit.org/show_bug.cgi?id=71262
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/Spectrum.js: Added.
+        (WebInspector.Spectrum.hueDrag):
+        (WebInspector.Spectrum.colorDrag):
+        (WebInspector.Spectrum.alphaDrag):
+        (WebInspector.Spectrum):
+        (WebInspector.Spectrum.hsvaToRGBA):
+        (WebInspector.Spectrum.rgbaToHSVA):
+        (WebInspector.Spectrum.draggable.prevent):
+        (WebInspector.Spectrum.draggable.move):
+        (WebInspector.Spectrum.draggable.start):
+        (WebInspector.Spectrum.draggable.stop):
+        (WebInspector.Spectrum.draggable):
+        (WebInspector.Spectrum.prototype.set color):
+        (WebInspector.Spectrum.prototype.get color):
+        (WebInspector.Spectrum.prototype.get outputColorFormat):
+        (WebInspector.Spectrum.prototype.get colorHueOnly):
+        (WebInspector.Spectrum.prototype.set displayText):
+        (WebInspector.Spectrum.prototype._onchange):
+        (WebInspector.Spectrum.prototype._updateHelperLocations):
+        (WebInspector.Spectrum.prototype._updateUI):
+        (WebInspector.Spectrum.prototype.toggle):
+        (WebInspector.Spectrum.prototype.show):
+        (WebInspector.Spectrum.prototype.reposition):
+        (WebInspector.Spectrum.prototype.hide):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (.swatch):
+        (.swatch-inner):
+        (.spectrum-container):
+        (.spectrum-top):
+        (.spectrum-color):
+        (.spectrum-hue):
+        (.spectrum-fill):
+        (.spectrum-range-container):
+        (.spectrum-range-container *):
+        (.spectrum-range-container label):
+        (.spectrum-range-container input):
+        (.swatch, .spectrum-dragger, .spectrum-slider):
+        (.spectrum-sat):
+        (.spectrum-val):
+        (.spectrum-dragger):
+        (.spectrum-slider):
+        * inspector/front-end/inspector.html:
+
+2012-02-15  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Be smarter with tile usages during tiling
+        https://bugs.webkit.org/show_bug.cgi?id=78243
+
+        Reviewed by Simon Hausmann.
+
+        The keep rect used to know what existing tiles to keep around, is now a
+        padding (in tile dimensions) around the usual cover rect. With usual,
+        I mean to point out that we take our panning optimization into account.
+
+        We also do a good effort at keeping the amount of tiles steady, by not
+        simply intersecting our areas with the contentRect, but moving it
+        first into legal bounds and then expanding in opposite direction to
+        cover a similar amount of pixels.
+
+        In the future the cover area should be calculated given available
+        system memory.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore):
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::adjustForContentsRect):
+        (WebCore::TiledBackingStore::computeCoverAndKeepRect):
+        (WebCore::TiledBackingStore::tileRectForCoordinate):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-13  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Pass data entries from object stores and indexes to front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=78503
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector/indexeddb/database-data.html
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::deserializeForInspector):
+        (WebCore):
+        * bindings/js/SerializedScriptValue.h:
+        (SerializedScriptValue):
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::deserializeForInspector):
+        (WebCore):
+        * bindings/v8/SerializedScriptValue.h:
+        (SerializedScriptValue):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapObject):
+        (WebCore::InjectedScript::wrapSerializedObject):
+        (WebCore):
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/Inspector.json:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorIndexedDBAgent::InspectorIndexedDBAgent):
+        (WebCore::assertFrame):
+        (WebCore::assertDocument):
+        (WebCore::InspectorIndexedDBAgent::requestData):
+        * inspector/InspectorIndexedDBAgent.h:
+        (WebCore):
+        (WebCore::InspectorIndexedDBAgent::create):
+        (InspectorIndexedDBAgent):
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.idbKeyFromKey):
+        (WebInspector.IndexedDBModel.keyFromIDBKey):
+        (WebInspector.IndexedDBModel.keyRangeFromIDBKeyRange):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase):
+        (WebInspector.IndexedDBModel.prototype.loadObjectStoreData):
+        (WebInspector.IndexedDBModel.prototype.loadIndexData):
+        (WebInspector.IndexedDBModel.Entry):
+        (WebInspector.IndexedDBRequestManager):
+        (WebInspector.IndexedDBRequestManager.prototype._requestData.innerCallback):
+        (WebInspector.IndexedDBRequestManager.prototype._requestData):
+        (WebInspector.IndexedDBRequestManager.prototype.requestObjectStoreData):
+        (WebInspector.IndexedDBRequestManager.prototype._objectStoreDataLoaded):
+        (WebInspector.IndexedDBRequestManager.prototype.requestIndexData):
+        (WebInspector.IndexedDBRequestManager.prototype._indexDataLoaded):
+        (WebInspector.IndexedDBRequestManager.prototype._frameDetached):
+        (WebInspector.IndexedDBRequestManager.prototype._databaseRemoved):
+        (WebInspector.IndexedDBRequestManager.prototype._reset):
+        (WebInspector.IndexedDBRequestManager.DataRequest):
+        (WebInspector.IndexedDBDispatcher.prototype.databaseLoaded):
+        (WebInspector.IndexedDBDispatcher.prototype.objectStoreDataLoaded):
+        (WebInspector.IndexedDBDispatcher.prototype.indexDataLoaded):
+
+2012-02-15  Hajime Morrita  <morrita@chromium.org>
+
+        REGRESSION(r107518): DeviceOrientationController doesn't remove registered DOMWindows
+        https://bugs.webkit.org/show_bug.cgi?id=78683
+
+        Reviewed by Kentaro Hara.
+        
+        A copy-n-paste disaster. This change fixed it by calling correct methods.
+
+        No new tests. Needs browser side mocking for testing this.
+        A Chromium automated test covers this.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/Page.cpp:
+        (WebCore::Page::provideSupplement):
+        (WebCore::Page::requireSupplement):
+        * page/Page.h: Fix typo.
+        (Page):
+
+2012-02-15  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Unreviewed, quick build fix for 107792
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::RemoveAttributeAction::redo):
+
+2012-02-15  Tony Gentilcore  <tonyg@chromium.org>
+
+        [chromium] Don't use increased FontCache size on Android
+        https://bugs.webkit.org/show_bug.cgi?id=78656
+
+        Reviewed by Adam Barth.
+
+        The chromium port uses a larger font cache size because it increases
+        performance on the intl1 and intl2 page cyclers. However, on Android
+        devices where resources are more constrained, it isn't desireable to
+        allow the FontCache to grow so big.
+
+        No new tests because no testable difference in functionality.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore):
+
+2012-02-15  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Allow <style scoped> as a direct child of a ShadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=77853
+
+        Moved registration code from Element to Node. updated Internals and build files accordingly.
+        Moved registration data members from ElementRareData to NodeRareData.
+        Forward willRemove() from host element into shadow DOM tree.
+
+        Reviewed by Dimitri Glazkov.
+
+        Test: fast/css/style-scoped/registering-shadowroot.html
+
+        * WebCore.exp.in:
+        * dom/Element.cpp:
+        (WebCore::Element::willRemove):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        (WebCore::ElementRareData::ElementRareData):
+        * dom/Node.cpp:
+        (WebCore):
+        (WebCore::Node::hasScopedHTMLStyleChild):
+        (WebCore::Node::numberOfScopedHTMLStyleChildren):
+        (WebCore::Node::registerScopedHTMLStyleChild):
+        (WebCore::Node::unregisterScopedHTMLStyleChild):
+        * dom/Node.h:
+        (Node):
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::NodeRareData):
+        (NodeRareData):
+        (WebCore::NodeRareData::registerScopedHTMLStyleChild):
+        (WebCore::NodeRareData::unregisterScopedHTMLStyleChild):
+        (WebCore::NodeRareData::hasScopedHTMLStyleChild):
+        (WebCore::NodeRareData::numberOfScopedHTMLStyleChildren):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::willRemove):
+        (WebCore):
+        * dom/ShadowRootList.h:
+        (ShadowRootList):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::registerWithScopingNode):
+        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
+        * testing/Internals.cpp:
+        (WebCore::Internals::numberOfScopedHTMLStyleChildren):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: implement redo for DOM actions.
+        https://bugs.webkit.org/show_bug.cgi?id=78601
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::RemoveChildAction::perform):
+        (WebCore::DOMEditor::RemoveChildAction::redo):
+        (DOMEditor::RemoveChildAction):
+        (WebCore::DOMEditor::InsertBeforeAction::redo):
+        (DOMEditor::InsertBeforeAction):
+        (WebCore::DOMEditor::RemoveAttributeAction::perform):
+        (WebCore::DOMEditor::RemoveAttributeAction::redo):
+        (DOMEditor::RemoveAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::perform):
+        (WebCore::DOMEditor::SetAttributeAction::redo):
+        (DOMEditor::SetAttributeAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::redo):
+        (DOMEditor::SetOuterHTMLAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::perform):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::redo):
+        (DOMEditor::ReplaceWholeTextAction):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::perform):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::redo):
+        (DOMEditor::ReplaceChildNodeAction):
+        (WebCore::DOMEditor::SetNodeValueAction::perform):
+        (WebCore::DOMEditor::SetNodeValueAction::redo):
+        (DOMEditor::SetNodeValueAction):
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::redo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::perform):
+        (InspectorCSSAgent::SetPropertyTextAction):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::redo):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::perform):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::redo):
+        (InspectorCSSAgent::TogglePropertyAction):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::perform):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::redo):
+        (InspectorCSSAgent::SetRuleSelectorAction):
+        (WebCore::InspectorCSSAgent::AddRuleAction::perform):
+        (WebCore::InspectorCSSAgent::AddRuleAction::redo):
+        (InspectorCSSAgent::AddRuleAction):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::redo):
+        (WebCore):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::InspectorHistory):
+        (WebCore::InspectorHistory::perform):
+        (WebCore::InspectorHistory::markUndoableState):
+        (WebCore::InspectorHistory::undo):
+        (WebCore::InspectorHistory::redo):
+        (WebCore):
+        * inspector/InspectorHistory.h:
+        (Action):
+        (InspectorHistory):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel):
+        (WebInspector.CSSStyleModel.prototype._undoRedoRequested):
+        (WebInspector.CSSStyleModel.prototype._undoRedoCompleted):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get undo):
+        (WebInspector.DOMAgent.prototype.redo):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-15  Yuta Kitamura  <yutak@chromium.org>
+
+        WebSocket: MessageEvent fired during send() on workers
+        https://bugs.webkit.org/show_bug.cgi?id=76521
+
+        Reviewed by David Levin.
+
+        WebSocket's message event should not be invoked while a synchronous operation
+        (send() and bufferedAmount) is in progress.
+
+        Test: http/tests/websocket/tests/hybi/workers/no-onmessage-in-sync-op.html
+
+        * websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        Added #if ENABLE(WORKERS) because ThreadableWebSocketChannelClientWrapper is not used
+        if Web Workers is not available.
+        Changed access label because private members were declared as protected with no good reason.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        Receive ScriptExecutionContext so we can post a task that should be executed later.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::create):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasksCallback):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::WorkerThreadableWebSocketChannel):
+
+2012-02-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Divide TextureMapperNode.cpp to 3 files.
+        https://bugs.webkit.org/show_bug.cgi?id=76660
+
+        Rename TextureMapperNode to TextureMapperLayer.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new tests.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::notifyChange):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerTextureMapper::setParent):
+        (WebCore::GraphicsLayerTextureMapper::setChildren):
+        (WebCore::GraphicsLayerTextureMapper::addChild):
+        (WebCore::GraphicsLayerTextureMapper::addChildAtIndex):
+        (WebCore::GraphicsLayerTextureMapper::addChildAbove):
+        (WebCore::GraphicsLayerTextureMapper::addChildBelow):
+        (WebCore::GraphicsLayerTextureMapper::replaceChild):
+        (WebCore::GraphicsLayerTextureMapper::removeFromParent):
+        (WebCore::GraphicsLayerTextureMapper::setMaskLayer):
+        (WebCore::GraphicsLayerTextureMapper::setReplicatedByLayer):
+        (WebCore::GraphicsLayerTextureMapper::setPosition):
+        (WebCore::GraphicsLayerTextureMapper::setAnchorPoint):
+        (WebCore::GraphicsLayerTextureMapper::setSize):
+        (WebCore::GraphicsLayerTextureMapper::setTransform):
+        (WebCore::GraphicsLayerTextureMapper::setChildrenTransform):
+        (WebCore::GraphicsLayerTextureMapper::setPreserves3D):
+        (WebCore::GraphicsLayerTextureMapper::setMasksToBounds):
+        (WebCore::GraphicsLayerTextureMapper::setDrawsContent):
+        (WebCore::GraphicsLayerTextureMapper::setContentsOpaque):
+        (WebCore::GraphicsLayerTextureMapper::setBackfaceVisibility):
+        (WebCore::GraphicsLayerTextureMapper::setOpacity):
+        (WebCore::GraphicsLayerTextureMapper::setContentsRect):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToImage):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToMedia):
+        (WebCore::GraphicsLayerTextureMapper::syncCompositingStateForThisLayerOnly):
+        (WebCore::GraphicsLayerTextureMapper::syncCompositingState):
+        (WebCore::GraphicsLayerTextureMapper::addAnimation):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (WebCore):
+        (GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::layer):
+        * platform/graphics/texmap/TextureMapperLayer.cpp: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp.
+        (WebCore):
+        (WebCore::toTextureMapperLayer):
+        (WebCore::TextureMapperLayer::rootLayer):
+        (WebCore::TextureMapperLayer::setTransform):
+        (WebCore::TextureMapperLayer::clearBackingStoresRecursive):
+        (WebCore::TextureMapperLayer::computeTransformsRecursive):
+        (WebCore::TextureMapperLayer::updateBackingStore):
+        (WebCore::TextureMapperLayer::paint):
+        (WebCore::TextureMapperLayer::paintSelf):
+        (WebCore::TextureMapperLayer::compareGraphicsLayersZValue):
+        (WebCore::TextureMapperLayer::sortByZOrder):
+        (WebCore::TextureMapperLayer::paintSelfAndChildren):
+        (WebCore::TextureMapperLayer::intermediateSurfaceRect):
+        (WebCore::TextureMapperLayer::shouldPaintToIntermediateSurface):
+        (WebCore::TextureMapperLayer::isVisible):
+        (WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica):
+        (WebCore::TextureMapperLayer::paintRecursive):
+        (WebCore::TextureMapperLayer::~TextureMapperLayer):
+        (WebCore::TextureMapperLayer::syncCompositingState):
+        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
+        (WebCore::TextureMapperLayer::descendantsOrSelfHaveRunningAnimations):
+        (WebCore::TextureMapperLayer::syncAnimations):
+        (WebCore::TextureMapperLayer::syncAnimationsRecursively):
+        * platform/graphics/texmap/TextureMapperLayer.h: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperNode.h.
+        (WebCore):
+        (TextureMapperPaintOptions):
+        (WebCore::TextureMapperPaintOptions::TextureMapperPaintOptions):
+        (TextureMapperLayer):
+        (WebCore::TextureMapperLayer::TextureMapperLayer):
+        (WebCore::TextureMapperLayer::size):
+        (WebCore::TextureMapperLayer::setOpacity):
+        (WebCore::TextureMapperLayer::setTextureMapper):
+        (WebCore::TextureMapperLayer::setShouldUpdateBackingStoreFromLayer):
+        (WebCore::TextureMapperLayer::setBackingStore):
+        (WebCore::TextureMapperLayer::backingStore):
+        (WebCore::TextureMapperLayer::texture):
+        (WebCore::TextureMapperLayer::layerRect):
+        (State):
+        (WebCore::TextureMapperLayer::State::State):
+
+2012-02-15  Hayato Ito  <hayato@chromium.org>
+
+        ShadowRoot: Remove a public static factory function which doesn't have any callers.
+        https://bugs.webkit.org/show_bug.cgi?id=78668
+
+        Reviewed by Kent Tamura.
+
+        No tests. No change in behavior.
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+
+2012-02-14  Hao Zheng  <zhenghao@chromium.org>
+
+        Cleanup pending transaction queue in Database.
+        https://bugs.webkit.org/show_bug.cgi?id=75048
+
+        Reviewed by David Levin.
+
+        Each SQLTransaction has 3 SQLCallbackWrappers, and each of them
+        holds a ref to WorkerContext. As a result, if the worker thread is
+        stopped before all SQLTransactions are finished, the ASSERT of
+        m_workerContext->hasOneRef() in WorkerThread::workerThread() would fail.
+
+        No new tests.
+        REGRESSION(r103429) fast/workers/storage/use-same-database-in-page-and-workers.html asserts
+
+        * storage/Database.cpp:
+        (WebCore::Database::close): Cleanup pending transaction queue in close().
+        * storage/SQLCallbackWrapper.h:
+        (WebCore::SQLCallbackWrapper::clear):
+        (SafeReleaseTask): Make SafeReleaseTask a cleanup task, which is
+        necessary because at the time of SafeReleaseTask is performed,
+        WorkerRunLoop has been terminated and only runs cleanup tasks.
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::create):
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::performTask):
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::isCleanupTask):
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::SafeReleaseTask):
+
+2012-02-14  Antti Koivisto  <antti@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78662
+        CSSStyleSelector should not rely on parent rule pointer in StylePropertySet
+
+        Reviewed by Andreas Kling.
+
+        Pass the rule pointer down to the style applying so we don't need to rely on
+        StylePropertySet having one.
+
+        To make this easier the patch also refactors the matched properties vector to
+        be part of MatchResult object instead of a member of CSSStyleSelector.
+        
+        Rename Declaration -> Properties.
+        
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::dispatchInvalidationCallbacks):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::sweepMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::addMatchedProperties):
+        (WebCore::CSSStyleSelector::sortAndTransferMatchedRules):
+        (WebCore::CSSStyleSelector::matchScopedAuthorRules):
+        (WebCore::CSSStyleSelector::matchAuthorRules):
+        (WebCore::CSSStyleSelector::matchUserRules):
+        (WebCore::CSSStyleSelector::matchUARules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        (WebCore::CSSStyleSelector::matchAllRules):
+        (WebCore):
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::CSSStyleSelector::matchesRuleSet):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::styleForKeyframe):
+        (WebCore::CSSStyleSelector::pseudoStyleForElement):
+        (WebCore::CSSStyleSelector::styleForPage):
+        (WebCore::CSSStyleSelector::pseudoStyleRulesForElement):
+        (WebCore::isInsideRegionRule):
+        (WebCore::CSSStyleSelector::applyProperties):
+        (WebCore::CSSStyleSelector::applyMatchedProperties):
+        (WebCore::CSSStyleSelector::computeMatchedPropertiesHash):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::CSSStyleSelector::findFromMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::addToMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::invalidateMatchedPropertiesCache):
+        (WebCore::isCacheableInMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::matchPageRules):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        (WebCore::CSSStyleSelector::addMatchedRule):
+        (WebCore::CSSStyleSelector::MatchedProperties::MatchedProperties):
+        (MatchedProperties):
+        (MatchResult):
+        (MatchedPropertiesCacheItem):
+
+2012-02-14  Takashi Toyoshima  <toyoshim@chromium.org>
+
+        WebSocketChannel minor refactoring for code manageability
+        https://bugs.webkit.org/show_bug.cgi?id=78576
+
+        Reviewed by Kent Tamura.
+
+        Change the first argument type of WebSocketChannel
+        from ScriptExecutionContext to Document.
+        WebSocketChannel always assume this ScriptExecutionContext must
+        inherit Document. Then, it results in many static cast.
+        It isn't readable and dangerous against future code changes.
+
+        * websockets/ThreadableWebSocketChannel.cpp: Pass the first argument for WebSocketChannel as Document.
+        (WebCore::ThreadableWebSocketChannel::create):
+        * websockets/WebSocketChannel.cpp: Replace all ScriptExecutionContext* m_context descriptions to Document* m_document.
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::fail):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didOpenSocketStream):
+        (WebCore::WebSocketChannel::didCloseSocketStream):
+        (WebCore::WebSocketChannel::didReceiveSocketStreamData):
+        (WebCore::WebSocketChannel::didFailSocketStream):
+        (WebCore::WebSocketChannel::processBuffer):
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
+        * websockets/WebSocketChannel.h: Change the first argument for construction to Document and hold it as Document m_document.
+        (WebCore):
+        (WebCore::WebSocketChannel::create):
+        (WebSocketChannel):
+        * websockets/WorkerThreadableWebSocketChannel.cpp: Pass the first argument for WebSocketChannel as Document.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
+
+2012-02-14  Noel Gordon  <noel.gordon@gmail.com>
+
+        Unreviewed, rolling out r107774.
+        http://trac.webkit.org/changeset/107774
+        https://bugs.webkit.org/show_bug.cgi?id=78661
+
+        Broke Chromium build
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * platform/ScrollAnimator.cpp:
+        (WebCore):
+        (WebCore::ScrollAnimator::handleGestureEvent):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (ScrollView):
+        * platform/ScrollableArea.cpp:
+        (WebCore):
+        (WebCore::ScrollableArea::handleGestureEvent):
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107766.
+        http://trac.webkit.org/changeset/107766
+        https://bugs.webkit.org/show_bug.cgi?id=78665
+
+        Breaks Chromium Win build (Requested by bashi1 on #webkit).
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets/WebSocketDeflater.cpp: Removed.
+        * websockets/WebSocketDeflater.h: Removed.
+
+2012-02-14  Anders Carlsson  <andersca@apple.com>
+
+        Remove ScrollableArea::handleGestureEvent
+        https://bugs.webkit.org/show_bug.cgi?id=78661
+
+        Reviewed by Sam Weinig.
+
+        ScrollableArea::handleGestureEvent ends up being a no-op so remove it and the related code. 
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * platform/ScrollAnimator.cpp:
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (ScrollView):
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-14  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] Cache the number of non-custom constructor arguments
+        https://bugs.webkit.org/show_bug.cgi?id=78195
+
+        Reviewed by Darin Adler.
+
+        If [ConstructorParameters=] is specified, JSC caches the number of constructor
+        arguments for performance. However, at present, [ConstructorParameters=] is specified
+        on a small part of constructors (It appears that people have forgotten to
+        add [ConstructorParameters=]). Thus, for non-custom constructors, this patch modifies
+        CodeGeneratorJS.pm so that it caches the number of constructor arguments automatically
+        without [ConstructorParameters=] (CodeGeneratorJS.pm can know the number of arguments
+        by the [Constructor=...] signature).
+
+        Test: fast/js/constructor-length.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDefinition):
+
+2012-02-14  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/78658> platformUserPreferredLanguages is leaking all of the language codes
+
+        Reviewed by Darin Adler.
+
+        * platform/mac/Language.mm:
+        (WebCore::httpStyleLanguageCode): Switch to using RetainPtr's for temporaries to make the ownership
+        more explicit. Switch to returning a WTF::String so that the caller doesn't have to worry about
+        ownership at all. Change the name to reflect the lack of transfer of ownership.
+        (WebCore::platformUserPreferredLanguages):
+
+2012-02-14  Kentaro Hara  <haraken@chromium.org>
+
+        [Mac] PasteboardMac.mm build fails
+        https://bugs.webkit.org/show_bug.cgi?id=78655
+
+        Reviewed by Hajime Morita.
+
+        Although the bots have been working fine, PasteboardMac.mm build fails
+        in our local Mac environments due to an uninitialized variable:
+
+            /Users/haraken/WebKit/Source/WebCore/platform/mac/PasteboardMac.mm:322: warning: 'string' may be used uninitialized in this function
+
+        This patch initializes the 'string' to nil to fix the build failure.
+
+        No tests. No change in behavior.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::plainText):
+
+2012-02-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add extension attribute support
+        https://bugs.webkit.org/show_bug.cgi?id=78557
+
+        Implement WebSocket "extensions" attribute that holds a list of
+        extension the server accepted. No change in behavior at this time
+        because we don't send any extension on handshake.
+
+        Reviewed by Kent Tamura.
+
+        No new tests. http/tests/websocket/tests/hybi/extensions.html checks the value of this attribute.
+
+        * websockets/ThreadableWebSocketChannel.h: Add extensions().
+        (ThreadableWebSocketChannel):
+        * websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::extensions): Added.
+        (WebCore):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setExtensions): Added.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * websockets/WebSocket.cpp: Added m_extensions member variable.
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::extensions): Returns m_extensions.
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::extensions): Added.
+        (WebCore):
+        * websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        * websockets/WebSocketExtensionDispatcher.cpp:
+        (WebCore::WebSocketExtensionDispatcher::fail): Added.
+        (WebCore::WebSocketExtensionDispatcher::processHeaderValue): Stores accepted extensions.
+        (WebCore::WebSocketExtensionDispatcher::acceptedExtensions): Added.
+        (WebCore):
+        (WebCore::WebSocketExtensionDispatcher::acceptedExtensions): Added.
+        * websockets/WebSocketExtensionDispatcher.h:
+        (WebSocketExtensionDispatcher):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::acceptedExtensions): Added.
+        (WebCore):
+        * websockets/WebSocketHandshake.h:
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::extensions): Added.
+        (WebCore):
+        (WebCore::workerContextDidConnect): Calls ThreadableWebSocketChannelClientWrapper::setExtensions().
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didConnect): Passes extensions as an argument.
+        * websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel):
+
+2012-02-14  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSGenerateToJS] to [JSGenerateToJSObject]
+        https://bugs.webkit.org/show_bug.cgi?id=78490
+
+        Reviewed by Adam Barth.
+
+        This patch renames [JSGenerateToJS] to [JSGenerateToJSObject],
+        for naming consistency with [CustomToJSObject], [JSCustomToJSObject] and [V8CustomToJSObject].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * dom/WebKitNamedFlow.idl:
+        * fileapi/DirectoryEntry.idl:
+        * fileapi/DirectoryEntrySync.idl:
+        * fileapi/File.idl:
+        * fileapi/FileEntry.idl:
+        * fileapi/FileEntrySync.idl:
+        * html/DOMFormData.idl:
+        * html/DOMSettableTokenList.idl:
+        * html/DOMURL.idl:
+        * html/MediaController.idl:
+        * mediastream/LocalMediaStream.idl:
+        * webaudio/AudioBufferCallback.idl:
+        * webaudio/AudioBufferSourceNode.idl:
+        * webaudio/AudioDestinationNode.idl:
+        * webaudio/AudioGain.idl:
+        * webaudio/AudioGainNode.idl:
+        * webaudio/AudioPannerNode.idl:
+        * webaudio/AudioProcessingEvent.idl:
+        * webaudio/BiquadFilterNode.idl:
+        * webaudio/ConvolverNode.idl:
+        * webaudio/DelayNode.idl:
+        * webaudio/DynamicsCompressorNode.idl:
+        * webaudio/HighPass2FilterNode.idl:
+        * webaudio/JavaScriptAudioNode.idl:
+        * webaudio/LowPass2FilterNode.idl:
+        * webaudio/MediaElementAudioSourceNode.idl:
+        * webaudio/OfflineAudioCompletionEvent.idl:
+        * webaudio/RealtimeAnalyserNode.idl:
+        * webaudio/WaveShaperNode.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
+
+2012-02-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add deflater/inflater classes
+        https://bugs.webkit.org/show_bug.cgi?id=78449
+
+        Add WebSocketDeflater/WebSocketInflater classes which wrap zlib
+        functions. These classes are not used yet, but will be used for
+        supporting WebSocket deflate-frame extension.
+
+        Reviewed by Kent Tamura.
+
+        No new tests except for chromium port. Behavior is unchanged.
+
+        * GNUmakefile.list.am: Added.WebSocketDeflater.(cpp|h).
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketDeflater.cpp: Added.
+        (WebCore):
+        (WebCore::WebSocketDeflater::create):
+        (WebCore::WebSocketDeflater::WebSocketDeflater):
+        (WebCore::WebSocketDeflater::initialize):
+        (WebCore::WebSocketDeflater::~WebSocketDeflater):
+        (WebCore::WebSocketDeflater::addBytes):
+        (WebCore::WebSocketDeflater::finish):
+        (WebCore::WebSocketDeflater::reset):
+        (WebCore::WebSocketInflater::create):
+        (WebCore::WebSocketInflater::WebSocketInflater):
+        (WebCore::WebSocketInflater::initialize):
+        (WebCore::WebSocketInflater::~WebSocketInflater):
+        (WebCore::WebSocketInflater::addBytes):
+        (WebCore::WebSocketInflater::finish):
+        (WebCore::WebSocketInflater::reset):
+        * websockets/WebSocketDeflater.h: Added.
+        (WebCore):
+        (WebSocketDeflater):
+        (WebCore::WebSocketDeflater::data):
+        (WebCore::WebSocketDeflater::size):
+        (WebSocketInflater):
+        (WebCore::WebSocketInflater::data):
+        (WebCore::WebSocketInflater::size):
+
+2012-02-14  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Compare filters on impl thread when setting them, and test setting in unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=78643
+
+        Reviewed by James Robinson.
+
+        Add setFilters() coverage to CCLayerImplTest.cpp
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::setFilters):
+
+2012-02-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in deleteInsignificantText
+        https://bugs.webkit.org/show_bug.cgi?id=78567
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash. Also update layout at the beginning of each call to deleteInsignificantText
+        since the previous call may have mutated the DOM.
+
+        Test: editing/inserting/delete-insignificant-text-crash.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+
+2012-02-14  Levi Weintraub  <leviw@chromium.org>
+
+        Prepare RenderLayerBacking and RenderLayerCompositor for subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78630
+
+        Reviewed by Simon Fraser.
+
+        In our transition to subpixel layout in the render tree, we continue to pass RenderLayerBacking
+        and RenderLayerCompositor integer (pixel) sizes and positions. This patch moves nearly all
+        methods and members on these two classes back to integers, and applies pixel snapping logic to
+        LayoutUnits pulled in.
+
+        No new tests. No change in behavior.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::pixelSnappedLayoutOverflowRect): Convenience function for getting pixel
+        snapped overflow bounds.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore):
+        (WebCore::RenderLayerBacking::updateCompositedBounds): Switch to integers and pixel snapping the
+        clipping bounds.
+        (WebCore::clipBox): Returns a pixel snapped rect.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Using pixelSnappedLayerCoords. Removing
+        pixelSnappedIntRect calls to clipBox since this is now an IntRect.
+        (WebCore::RenderLayerBacking::computeTransformOrigin): Switching to operate on a pixel snapped rect.
+        (WebCore::RenderLayerBacking::computePerspectiveOrigin): Ditto.
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer): Returns a size based on m_compositingBounds,
+        which is now an IntSize.
+        (WebCore::RenderLayerBacking::contentsBox): Switching to use pixel snapped values from the render tree.
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect): This now takes in and outputs integers.
+        (WebCore::RenderLayerBacking::paintIntoLayer): Uses a pixel snapped rect for the dirty rect.
+        (WebCore::paintScrollbar): Scrollbars are Widgets & painted natively, so they should use integers.
+        (WebCore::RenderLayerBacking::paintContents): We now properly take in an integer clip rect, as it's
+        used for the scrollbars. 
+        (WebCore::RenderLayerBacking::startAnimation): Using pixel snapped values for animations and transitions.
+        (WebCore::RenderLayerBacking::startTransition): Ditto.
+        (WebCore::RenderLayerBacking::compositedBounds): Composited bounds are now properly stored as integers.
+        (WebCore::RenderLayerBacking::setCompositedBounds): Ditto.
+        * rendering/RenderLayerBacking.h:
+        (RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds): Composited bounds are pixel snapped, but
+        we use LayoutUnits up until we snap and return.
+        (WebCore::RenderLayerCompositor::addToOverlapMap): Overlap mapping uses our integer positions. Switching
+        it back to operating on them.
+        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive): Ditto.
+        (WebCore::RenderLayerCompositor::overlapsCompositedLayers): Ditto.
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Using integers.
+        (WebCore::RenderLayerCompositor::frameViewDidChangeLocation): FrameViews are on integer bounds. We now
+        properly use these as integers.
+        (WebCore::RenderLayerCompositor::frameViewDidScroll): Ditto.
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect): Switching to use integers and
+        pixelSnappedLayerCoords.
+        (WebCore::RenderLayerCompositor::repaintCompositedLayersAbsoluteRect): Ditto.
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition): Using integer positions, which are what
+        the apis used already returned.
+        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin): Using pixel snapped values.
+        (WebCore::RenderLayerCompositor::requiresCompositingForFrame): Ditto.
+        (WebCore::paintScrollbar): Scrollbars should always use integers.
+        (WebCore::RenderLayerCompositor::paintContents): Switching to use an integer clip rect.
+        (WebCore::RenderLayerCompositor::ensureRootLayer): Using values from new pixelSnappedLayoutOverflowRect
+        method on RenderBox to ensure we're using values that are pixel snapped to the proper location.
+        (WebCore::RenderLayerCompositor::destroyRootLayer): Properly calling scrollbar invalidation methods
+        with integers.
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-02-14  Anders Carlsson  <andersca@apple.com>
+
+        Swipe gestures don't work if main frame has a horizontal scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=78650
+        <rdar://problem/10864993>
+
+        Reviewed by Sam Weinig.
+
+        Change ScrollingTree::tryToHandleWheelEvent so we can indicate that an event was
+        processed by the scrolling tree but that we should indicate back to WebKit that it wasn't handled.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::ScrollingTree):
+        Initialize new member variables.
+
+        (WebCore::ScrollingTree::tryToHandleWheelEvent):
+        If the wheel event will start a swipe gesture, return DidNotHandleEvent.
+
+        (WebCore::ScrollingTree::updateBackForwardState):
+        This can now be called from any thread, so use a mutex.
+
+        (WebCore::ScrollingTree::setMainFramePinState):
+        New function that will set the current main frame pin state.
+
+        (WebCore::ScrollingTree::canGoBack):
+        (WebCore::ScrollingTree::canGoForward):
+        Put locks around these.
+
+        (WebCore::ScrollingTree::willWheelEventStartSwipeGesture):
+        Helper function that returns whether the given wheel event will start a swipe gesture
+        because the main frame is pinned to the left/right and we can go back/forward.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::update):
+        Call updateMainFramePinState if the frame geometry changes.
+
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        Call updateMainFramePinState.
+
+        (WebCore::ScrollingTreeNodeMac::updateMainFramePinState):
+        Compute the main frame pin state and set it on the scrolling tree.
+
+2012-02-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Web Inspector: Add the ability to show the resources panel on launch
+        https://bugs.webkit.org/show_bug.cgi?id=78641
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCore.exp.in: Add a new function to be exported.
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::showResources): Call showResources on load.
+        * inspector/InspectorFrontendClientLocal.h:
+        (InspectorFrontendClientLocal):
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.showResources): Show the resources panel.
+
+2012-02-14  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r107568-r107627): Crash when copying in WebCore::SharedBuffer::hasPlatformData().
+        https://bugs.webkit.org/show_bug.cgi?id=78577
+
+        Reviewed by Dan Bernstein.
+
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::setBufferForType): Missing null check when
+        setting data to the NSPasteboard.
+
+2012-02-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in WebCore::SVGElement::removedFromDocument
+        https://bugs.webkit.org/show_bug.cgi?id=77270
+
+        Reviewed by Adam Barth.
+
+        Add a protector before calling NodeRemovalDispatcher::dispatch since
+        NodeRemovalDispatcher::dispatch may remove the last RefPtr to this node.
+
+        Test: fast/dom/Range/surround-contents-font-face-crash.svg
+
+        * dom/ContainerNodeAlgorithms.h:
+        (WebCore::Private::addChildNodesToDeletionQueue):
+
+2012-02-14  Matt Lilek  <mrl@apple.com>
+
+        Don't ENABLE_DASHBOARD_SUPPORT unconditionally on all Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78629
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-14  Andreas Kling  <awesomekling@apple.com>
+
+        Avoid full style recalc when presentation attributes change.
+        <http://webkit.org/b/78636>
+
+        Reviewed by Antti Koivisto.
+
+        Use setNeedsStyleRecalc(InlineStyleChange) when a presentation attribute changes
+        to reduce the amount of work done in recalcStyle().
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+
+2012-02-14  Ramya Chandrasekaran  <cramya@google.com>
+
+        Last character display for passwords in Android.
+        https://bugs.webkit.org/show_bug.cgi?id=78532
+
+        Reviewed by Adam Barth.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2012-02-14  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Invalid dates should not be valid keys
+        https://bugs.webkit.org/show_bug.cgi?id=78622
+
+        Reviewed by Tony Chang.
+
+        Tests: storage/indexeddb/invalid-keys.html
+               storage/indexeddb/factory-cmp.html
+
+        * bindings/v8/IDBBindingUtilities.cpp: Special case for NaN Dates.
+        (WebCore::createIDBKeyFromValue):
+
+2012-02-14  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from line break iterators in counter content
+        https://bugs.webkit.org/show_bug.cgi?id=72977
+
+        Reviewed by David Hyatt.
+
+        Calculating the width of counter text can sometimes cause the
+        underlying text buffer to change. This patch causes the iterator
+        to reset appropriately when this happens.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
+2012-02-14  Levi Weintraub  <leviw@chromium.org>
+
+        Update usage of LayoutUnits in RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=78511
+
+        Reviewed by Simon Fraser.
+
+        Updating RenderLayer to properly use LayoutUnits. See descriptions below for the rationale behind all
+        the changes. Also adding a roundedIntSize method that takes a LayoutSize.
+
+        No new tests. No change in behavior.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::roundedIntSize): Inline method that currently does nothing, but will round a LayoutSize
+        to an IntSize.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions): Switching repaint and outline boxes to LayoutRects, as
+        it's important to keep the precision of these rects until handing off to the embedder (in FrameView).
+        (WebCore::RenderLayer::computeRepaintRects): Repaint rects should be preserved in subpixel units until
+        being passed to the embedding layer. This prevents needless repaints.
+        (WebCore::RenderLayer::convertToPixelSnappedLayerCoords): Convenience function to return pixel snapped rects
+        (WebCore):
+        (WebCore::RenderLayer::convertToLayerCoords): Fixing a style flaw.
+        (WebCore::RenderLayer::scrollRectToVisible): Pixel snapping the rect when handing off to the embedder.
+        (WebCore::RenderLayer::maximumScrollPosition): Scroll offsets are rounded.
+        (WebCore::RenderLayer::scrollCornerRect): Scrollbars are drawn natively and should be positioned on pixel
+        boundaries.
+        (WebCore::RenderLayer::scrollCornerAndResizerRect): Resize corner doesn't influence the size/position of
+        render objects. It is only painted and hit tested. Therefor it should use integers.
+        (WebCore::RenderLayer::offsetFromResizeCorner): Ditto.
+        (WebCore::RenderLayer::positionOverflowControls): Overflow controls are drawn natively and should be
+        positioned on integer boundaries.
+        (WebCore::RenderLayer::paintOverflowControls): Ditto.
+        (WebCore::RenderLayer::paintScrollCorner): Ditto.
+        (WebCore::RenderLayer::drawPlatformResizerImage): Ditto.
+        (WebCore::RenderLayer::paintResizer): Ditto.
+        (WebCore::RenderLayer::hitTestOverflowControls): Hit testing & overflow controls both use integers.
+        (WebCore::RenderLayer::clipToRect): Clipping to actual painted (pixel snapped) layer bounds in the
+        graphics context.
+        (WebCore::RenderLayer::paintLayerContents): Calling paintOverflowControls at pixel bounds.
+        (WebCore::RenderLayer::hitTest): Intersecting the hit test area with pixel snapped boundaries.
+        (WebCore::RenderLayer::setBackingNeedsRepaintInRect): Sending pixelSnapped rects to the backing
+        store, which only cares about pixels, and hence integers.
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrolledContentOffset): RenderLayer's scroll offsets are used in platform
+        code, so we need to return them as integers. Rounding the scroll overflow before adding it to the
+        scroll offset, which was already stored in integers.
+        (RenderLayer):
+
+2012-02-14  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in NavigationScheduler::schedule.
+        https://bugs.webkit.org/show_bug.cgi?id=78297
+
+        Reviewed by Adam Barth.
+
+        Protect frame pointer and navigation scheduler when we stop the
+        load (when redirect is scheduled during a load). Also, dont fire
+        the navigation scheduler timer when we know that frameloader is
+        going away.
+
+        Test: http/tests/navigation/navigation-redirect-schedule-crash.html
+
+        * loader/NavigationScheduler.cpp:
+        (WebCore::NavigationScheduler::schedule):
+
+2012-02-14  Alexis Menard  <alexis.menard@openbossa.org>
+
+        font shorthand with inherit keyword incorrectly parsed and rendered
+        https://bugs.webkit.org/show_bug.cgi?id=20181
+
+        Reviewed by Tony Chang.
+
+        As stated in http://www.w3.org/TR/CSS21/changes.html#q142
+        if the inherit (and also by extension initial) is encountered in the
+        middle of the shorthand then the property becomes invalid.
+
+        Test: fast/css/font-shorthand-mix-inherit.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFont):
+        (WebCore::CSSParser::parseFontFamily):
+
+2012-02-14  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to incorrect firing of mutation event during class attribute parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=78537
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/dom/class-attr-change-double-mutation-fire.html
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged):
+
+2012-02-14  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: add isZero implementations to catch divide by zero
+        https://bugs.webkit.org/show_bug.cgi?id=78603
+
+        Reviewed by Ojan Vafai.
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcPrimitiveValue::isZero):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcBinaryOperation::isZero):
+        (CSSCalcBinaryOperation):
+        * css/CSSCalculationValue.h:
+        (CSSCalcExpressionNode):
+
+2012-02-12  Timothy Hatcher  <timothy@apple.com>
+
+        Don't include CachedResources that haven't downloaded when populating the Web Inspector on load.
+
+        https://webkit.org/b/78447
+        rdar://problem/10843542
+
+        Reviewed by Brian Weinstein.
+
+        Test: inspector/protocol/page-agent.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::cachedResourcesForFrame): Skip CachedFonts and CachedImages that
+        return true for stillNeedsLoad.
+        * loader/cache/CachedFont.h:
+        (WebCore::CachedFont::stillNeedsLoad): Added.
+
+2012-02-12  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: include failed and canceled in FrameResourceTree.
+
+        https://webkit.org/b/78445
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/protocol/page-agent.html
+
+        * WebCore.xcodeproj/project.pbxproj: Added Inspector.json, Inspector-0.1.json and Inspector-1.0.json
+        for quick access and easy editing.
+        * inspector/Inspector.json: Added failed and canceled as optional properties to the object for resources in FrameResourceTree.
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::buildObjectForFrameTree): Set those properties.
+
+2012-02-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Typo fix after r107707.
+
+        * platform/graphics/texmap/TextureMapperNode.cpp:
+        (WebCore::TextureMapperNode::updateBackingStore):
+
+2012-02-14  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] extract TimelineOverviewWindow from TimelineOverviewPanel
+        https://bugs.webkit.org/show_bug.cgi?id=78599
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype.scrollWindow):
+        (WebInspector.TimelineOverviewWindow):
+        (WebInspector.TimelineOverviewWindow.prototype.reset):
+        (WebInspector.TimelineOverviewWindow.prototype.scrollWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._windowResizeDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._dragWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._windowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._windowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._resizeWindowRight):
+        (WebInspector.TimelineOverviewWindow.prototype._resizeWindowMaximum):
+        (WebInspector.TimelineOverviewWindow.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowDragging):
+        (WebInspector.TimelinePanel.WindowSelector):
+
+2012-02-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Make ScriptsNavigator default file selector.
+        https://bugs.webkit.org/show_bug.cgi?id=78349
+
+        Reviewed by Pavel Feldman.
+
+        Moved ScriptsNavigator out of experiments.
+        Introduced new setting "useScriptsNavigator" with true as default value.
+        Updated scripts panel tests related to file selector.
+
+        Tests: inspector/debugger/scripts-combobox-file-selector-history.html
+               inspector/debugger/scripts-file-selector.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._updateExecutionLine):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+
+2012-02-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][Texmap] Refactor backing-store code in TextureMapper
+        https://bugs.webkit.org/show_bug.cgi?id=78305
+
+        Instead of dealing with tiling inside of TextureMapperNode, we now deal with that in a new
+        TextureMapperBackingStore class. Since the class is abstract, WebKit2 can overload it to
+        support remotely-managed tiles.
+        The backing-store for directly composited images is handled separately, in a new class
+        TextureMapperCompositedImage. The TextureMapper implementation decides the dimension of
+        the tiles, for example 2000 in the case of OpenGL.
+        Also, directly composited content is now handled correctly, by painting it after the regular
+        content and not as part of the same texture.
+
+        To make this work, the functions in TextureMapperPlatformLayers had to become non-const,
+        thus the changes to that file and GraphicsContext3DQt.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new functionality, no new tests.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/opengl/TextureMapperGL.h:
+        (WebCore::TextureMapperGL::maxTextureDimension):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::didSynchronize):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerTextureMapper::addChildBelow):
+        (WebCore):
+        (WebCore::GraphicsLayerTextureMapper::getContentsLayer):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToImage):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToMedia):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::platformLayer):
+        (WebCore::GraphicsLayerTextureMapper::needsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::needsDisplayRect):
+        * platform/graphics/texmap/TextureMapper.cpp:
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::TextureMapper::maxTextureDimension):
+        (TextureMapper):
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp: Added.
+        * platform/graphics/texmap/TextureMapperBackingStore.h: Added.
+        * platform/graphics/texmap/TextureMapperNode.cpp:
+        (WebCore::TextureMapperNode::backingStore):
+        (WebCore::TextureMapperNode::updateBackingStore):
+        (WebCore::TextureMapperNode::paint):
+        (WebCore::TextureMapperNode::paintSelf):
+        (WebCore::TextureMapperNode::intermediateSurfaceRect):
+        (WebCore::TextureMapperNode::paintRecursive):
+        (WebCore::TextureMapperNode::syncCompositingStateSelf):
+        (WebCore::TextureMapperNode::syncCompositingState):
+        * platform/graphics/texmap/TextureMapperNode.h:
+        (TextureMapperPaintOptions):
+        (WebCore::TextureMapperPaintOptions::TextureMapperPaintOptions):
+        (WebCore::TextureMapperNode::TextureMapperNode):
+        (TextureMapperNode):
+        (WebCore::TextureMapperNode::setBackingStore):
+        (WebCore::TextureMapperNode::texture):
+        (WebCore::TextureMapperNode::layerRect):
+        (WebCore::TextureMapperNode::createBackingStore):
+        (State):
+        (WebCore::TextureMapperNode::State::State):
+        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
+        (TextureMapperPlatformLayer):
+        (WebCore::TextureMapperPlatformLayer::swapBuffers):
+
+2012-02-14  Shinya Kawanaka  <shinyak@google.com>
+
+        Use youngestShadowRoot and oldestShadowRoot instead of Element::shadowRoot().
+        https://bugs.webkit.org/show_bug.cgi?id=78455
+
+        Reviewed by Hajime Morita.
+
+        Element::shadowRoot() was used for these 3 purposes.
+        1. checks a shadow root exists.
+        2. gets author shadow root.
+        3. gets user agent shadow root.
+
+        We have to distinguish them when implementing multiple shadow subtrees.
+
+        Calling for (1), (2), and (3) are convered to hasShadowRoot(),
+        ShadowRootList()->youngestShadowRoot(), and ShadowRootList()->oldestShadowRoot() respectively.
+
+        No new tests, no change in behavior.
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::buildAccessKeyMap):
+        * dom/Element.cpp:
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::insertedIntoTree):
+        (WebCore::Element::removedFromTree):
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::ensureShadowRoot):
+        (WebCore::Element::childrenChanged):
+        (WebCore::Element::focus):
+        * dom/Element.h:
+        (Element):
+        * dom/EventDispatcher.cpp:
+        (WebCore::isShadowHost):
+        * dom/Node.cpp:
+        (WebCore::shadowRoot):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::insertedIntoDocument):
+        (WebCore):
+        (WebCore::ShadowRootList::removedFromDocument):
+        (WebCore::ShadowRootList::insertedIntoTree):
+        (WebCore::ShadowRootList::removedFromTree):
+        (WebCore::ShadowRootList::hostChildrenChanged):
+        (WebCore::ShadowRootList::attach):
+        (WebCore::ShadowRootList::detach):
+        * dom/ShadowRootList.h:
+        (ShadowRootList):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::shadowRootFor):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::createShadowSubtree):
+        (WebCore::FileInputType::multipleAttributeChanged):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::createShadowSubtree):
+        (WebCore::HTMLDetailsElement::findMainSummary):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::createShadowSubtree):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        (WebCore::HTMLKeygenElement::shadowSelect):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaControls):
+        (WebCore::HTMLMediaElement::hasMediaControls):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::createShadowSubtree):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::createShadowSubtree):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::createShadowSubtree):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::createShadowSubtree):
+        (WebCore::HTMLTextAreaElement::innerTextElement):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderText):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::handleMouseDownEvent):
+        (WebCore::RangeInputType::createShadowSubtree):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::createShadowSubtree):
+        (WebCore::TextFieldInputType::updatePlaceholderText):
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::deleteBubbleTree):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::sliderThumbElementOf):
+        (WebCore::RenderSliderContainer::layout):
+        (WebCore::trackLimiterElementOf):
+        * page/FocusController.cpp:
+        (WebCore::shadowRoot):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::uploadButton):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::updateReferencedText):
+        * testing/Internals.cpp:
+        (WebCore::Internals::ensureShadowRoot):
+        (WebCore::Internals::shadowRoot):
+        (WebCore):
+        (WebCore::Internals::youngestShadowRoot):
+        (WebCore::Internals::oldestShadowRoot):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Elements panel needs to be able to preview images
+        https://bugs.webkit.org/show_bug.cgi?id=21570
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.willHide):
+        (WebInspector.ElementsPanel.prototype._getPopoverAnchor):
+        (WebInspector.ElementsPanel.prototype._loadDimensionsForNode.resolvedNode.dimensions):
+        (WebInspector.ElementsPanel.prototype._loadDimensionsForNode.resolvedNode):
+        (WebInspector.ElementsPanel.prototype._loadDimensionsForNode):
+        (WebInspector.ElementsPanel.prototype._showPopover.dimensionsCallback):
+        (WebInspector.ElementsPanel.prototype._showPopover.showPopover):
+        (WebInspector.ElementsPanel.prototype._showPopover.buildPopoverContents):
+        (WebInspector.ElementsPanel.prototype._showPopover):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.get g):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+        * inspector/front-end/elementsPanel.css:
+        (.image-preview-container):
+        (.image-preview-container img):
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: List expansion arrows is pointing down even
+        when the list of eventListeners are hidden in the Elements tab
+        https://bugs.webkit.org/show_bug.cgi?id=78360
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/elementsPanel.css:
+        (.section .event-bar .header):
+        (.section .event-bars .event-bar .header .title):
+        (.section .event-bar .header .subtitle):
+        (.section .event-bar .header::before):
+        (.section .event-bar.expanded .header::before):
+
+2012-02-14  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRoot.nodeType return DOCUMENT_FRAGMENT_NODE.
+        https://bugs.webkit.org/show_bug.cgi?id=77514
+
+        Reviewed by Dimitri Glazkov.
+
+        NodeType.SHADOW_ROOT_NODE type is finally gone.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/objc/DOM.mm:
+        (kitClass):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+        (WebCore::ContainerNode::replaceChild):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        (WebCore::Document::childTypeAllowed):
+        (WebCore::Document::canReplaceChild):
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupPrefix):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::appendTextContent):
+        (WebCore::Node::setTextContent):
+        * dom/Node.h:
+        * dom/Range.cpp:
+        (WebCore::lengthOfContentsInNode):
+        (WebCore::Range::processContentsBetweenOffsets):
+        (WebCore::Range::insertNode):
+        (WebCore::Range::checkNodeWOffset):
+        (WebCore::Range::checkNodeBA):
+        (WebCore::Range::selectNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::Range::surroundContents):
+        * dom/ShadowRoot.cpp:
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::toShadowRoot):
+        * editing/FrameSelection.cpp:
+        (WebCore::nodeIsDetachedFromDocument):
+        (WebCore):
+        (WebCore::FrameSelection::textWillBeReplaced):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLElementStack::pushRootNode):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * xml/XPathUtil.cpp:
+        (WebCore::XPath::isValidContextNode):
+
+2012-02-14  Andreas Kling  <awesomekling@apple.com>
+
+        StylePropertySet: Try to find a CSSValuePool for identifier values.
+        <http://webkit.org/b/78590>
+
+        Reviewed by Antti Koivisto.
+
+        For StylePropertySets with a parent element (inline and attribute style),
+        grab at the parentElement()->document() to locate a CSSValuePool.
+        This code will change soon in the CSSOM refactoring and moreso once we
+        figure out how to have a global CSSValuePool, but I'm hoping it will buy
+        us some perf back in the meantime.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::setProperty):
+
+2012-02-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Hajime Morita.
+
+        Fix last-minute typo in clearTimesWithDynamicOrigins, leading to assertions browsing the W3C SVG animation tests.
+        Covered by existing tests in svg/animations.
+
+        * svg/SVGAnimationElement.cpp: Remove unused endedActiveInterval.
+        * svg/SVGAnimationElement.h: Ditto.
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::clearTimesWithDynamicOrigins): Fix order of walking the times list.
+        (WebCore::SVGSMILElement::reset): Move calls to clearTimesWithDynamicOrigins into endedActiveInterval.
+        (WebCore::SVGSMILElement::endedActiveInterval):
+        * svg/animation/SVGSMILElement.h:
+        (SVGSMILElement): Devirtualize endedActiveInterval.
+
+2012-02-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107661.
+        http://trac.webkit.org/changeset/107661
+        https://bugs.webkit.org/show_bug.cgi?id=78591
+
+        crash on lion/qt bots (Requested by hayato on #webkit).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/objc/DOM.mm:
+        (kitClass):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+        (WebCore::ContainerNode::replaceChild):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        (WebCore::Document::childTypeAllowed):
+        (WebCore::Document::canReplaceChild):
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupPrefix):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::appendTextContent):
+        (WebCore::Node::setTextContent):
+        * dom/Node.h:
+        * dom/Range.cpp:
+        (WebCore::lengthOfContentsInNode):
+        (WebCore::Range::processContentsBetweenOffsets):
+        (WebCore::Range::insertNode):
+        (WebCore::Range::checkNodeWOffset):
+        (WebCore::Range::checkNodeBA):
+        (WebCore::Range::selectNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::Range::surroundContents):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::nodeType):
+        (WebCore):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::toShadowRoot):
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::textWillBeReplaced):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLElementStack::pushRootNode):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * xml/XPathUtil.cpp:
+        (WebCore::XPath::isValidContextNode):
+
+2012-02-14  Hayato Ito  <hayato@chromium.org>
+
+        Fix typo. HTMLContentSeleciton -> HTMLContentSelection.
+        https://bugs.webkit.org/show_bug.cgi?id=78571
+
+        Reviewed by Hajime Morita.
+
+        No tests. No change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::nextRendererOf):
+        (WebCore::previousRendererOf):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertionPointFor):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelection::append):
+        (WebCore::HTMLContentSelection::unlink):
+        (WebCore::HTMLContentSelectionList::find):
+        (WebCore::HTMLContentSelectionList::append):
+        (WebCore::HTMLContentSelector::select):
+        (WebCore::HTMLContentSelector::unselect):
+        (WebCore::HTMLContentSelector::findFor):
+        * html/shadow/HTMLContentSelector.h:
+        (HTMLContentSelection):
+        (WebCore::HTMLContentSelection::next):
+        (WebCore::HTMLContentSelection::previous):
+        (WebCore::HTMLContentSelection::HTMLContentSelection):
+        (WebCore::HTMLContentSelection::create):
+        (WebCore::HTMLContentSelectionList::first):
+        (WebCore::HTMLContentSelectionList::last):
+        (HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionSet::add):
+        (WebCore::HTMLContentSelectionSet::remove):
+        (HTMLContentSelectionSet):
+        (WebCore::HTMLContentSelectionSet::Translator::equal):
+        (WebCore::HTMLContentSelectionSet::Hash::hash):
+        (WebCore::HTMLContentSelectionSet::Hash::equal):
+        (WebCore::HTMLContentSelectionSet::find):
+        (HTMLContentSelector):
+
+2012-02-14  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: embed calc expressions in CSSPrimitiveValue
+        https://bugs.webkit.org/show_bug.cgi?id=78446
+
+        Reviewed by Ojan Vafai.
+        
+        Adds calc expressions to CSSPrimitiveValue. This enables simple (ie no mixing of
+        percents with numbers/lengths) expressions to be evaluated on most properties.
+
+        Tests: css3/calc/block-mask-overlay-image-outset-expected.html
+               css3/calc/css3-radial-gradients-expected.html
+               css3/calc/gradient-color-stops-expected.html
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcValue::computeLengthPx):
+        (WebCore):
+        (WebCore::CSSCalcPrimitiveValue::doubleValue):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
+        (CSSCalcBinaryOperation):
+        (WebCore::CSSCalcBinaryOperation::computeLengthPx):
+        * css/CSSCalculationValue.h:
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createPrimitiveNumericValue):
+        (WebCore::CSSParser::parseValidPrimitive):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::isValidCSSUnitTypeForDoubleConversion):
+        (WebCore::CSSPrimitiveValue::primitiveType):
+        (WebCore::CSSPrimitiveValue::init):
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::cleanup):
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        (WebCore::CSSPrimitiveValue::getDoubleValue):
+        (WebCore::CSSPrimitiveValue::getDoubleValueInternal):
+        (WebCore::CSSPrimitiveValue::customCssText):
+        * css/CSSPrimitiveValue.h:
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::isLength):
+        (WebCore::CSSPrimitiveValue::isNumber):
+        (WebCore::CSSPrimitiveValue::isPercentage):
+        (WebCore::CSSPrimitiveValue::isPx):
+        (WebCore::CSSPrimitiveValue::isCalculated):
+        (WebCore::CSSPrimitiveValue::isCalculatedPercentageNumber):
+        (WebCore::CSSPrimitiveValue::isCalculatedPercentageLength):
+        (CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::getValue):
+        (WebCore::CSSPrimitiveValue::cssCalcValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyBorderRadius::applyValue):
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up to r107683: protect inspector sidebar from updating
+        while inserting new rule.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.successCallback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+
+2012-02-14  Rick Byers  <rbyers@.com>
+
+        Extend Chromium V8 tracing to cover more cases
+        https://bugs.webkit.org/show_bug.cgi?id=78507
+
+        Reviewed by Eric Seidel.
+
+        No tests modified because this affects only chrome tracing which we
+        currently don't try to validate with automated tests.
+
+        * bindings/v8/V8EventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::instrumentedCallFunction):
+        (WebCore::V8Proxy::newInstance):
+
+2012-02-14  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: fire stylesheet changed event upon CSS modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=78500
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::mergeId):
+        (InspectorCSSAgent::SetStyleSheetTextAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::merge):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::bindStyleSheet):
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::styleSheetChanged):
+        (WebCore):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::create):
+        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::reparseStyleSheet):
+        (WebCore::InspectorStyleSheet::setRuleSelector):
+        (WebCore::InspectorStyleSheet::addRule):
+        (WebCore::InspectorStyleSheet::deleteRule):
+        (WebCore::InspectorStyleSheet::setPropertyText):
+        (WebCore::InspectorStyleSheet::toggleProperty):
+        (WebCore::InspectorStyleSheet::fireStyleSheetChanged):
+        (WebCore):
+        (WebCore::InspectorStyleSheetForInlineStyle::create):
+        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
+        * inspector/InspectorStyleSheet.h:
+        (WebCore::InspectorStyleSheet::Listener::~Listener):
+        (Listener):
+        (InspectorStyleSheet):
+        (InspectorStyleSheetForInlineStyle):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector.callback):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype.addRule.callback):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype.setStyleSheetText):
+        (WebInspector.CSSStyleModel.prototype._undoRequested):
+        (WebInspector.CSSStyleModel.prototype._undoCompleted):
+        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        (WebInspector.CSSDispatcher.prototype.mediaQueryResultChanged):
+        (WebInspector.CSSDispatcher.prototype.styleSheetChanged):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._emulateTouchEventsChanged):
+        (WebInspector.DOMAgent.prototype.get undo):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Switch the svg/animations tests to use SVGSVGElement.setCurrentTime to drive the animation timeline.
+        This should fix all flakiness we previously had with these tests - and as nice side-effect we're now
+        using the standard SVG methods to drive the timeline, and thus have more coverage for these methods.
+        It already exposed several SMIL bugs, that had to be fixed, before this worked:
+
+        - beginElement()/endElement() modify the begin/end times of a SVGSMILElement. When beginElement() is
+          called a new begin time is added to the list - and the same happens for endElement() with the end list.
+          Unfortunately the begin/end times never get removed again, leading to incorrect instance time resolving
+          when begin/endElement is called repeatedly, combined with moving the timeline through setCurrentTime.
+
+          SMIL3 specifically demands that all 'dynamic' times in the begin/endTimes list, such that got inserted
+          via beginElement/endElement - get removed if the begin/endTimes list is updated. Why?
+          When calling beginElement, then endElement, then beginElement again, the begin/endTimes lists should be
+          identical, w/o leftovers from any previous begin/endElement call.
+
+          To keep track of that introduce SMILTimeWithOrigin, which holds a SMILTime and an Origin enum,
+          which determines whether this SMILTime was created by the parser or dynamically created via
+          beginElement/endElement.
+
+        - SMILTimeContainer::setElapsed() (called by SVGSVGElement::setCurrentTime) forgot to update the
+          animation state, when it was not paused.
+
+        - document.getElementsByTagName('animateMotion')[0], always returned 'object SVGElement', instead of
+          SVGAnimateMotion element making it impossible to query the animation start time, as the interfaces
+          from SVGAnimationElement were not available. Fix that by removing the last hacks from svgtags.in,
+          now that all IDLs are available.
+
+        Now that we use SVGSVGElement::setCurrentTime to drive the animation testing, we can remove
+        the DRT specific sampleSVGAnimationAtTime functionality, and its code springled all over WebCore.
+
+        Covered by all existing tests in svg/animations.
+
+        * WebCore.exp.in: Remove sampleAnimationAtTime() symbols.
+        * WebCore.order: Ditto.
+        * svg/SVGAnimationElement.cpp: Add a flag to begin/endElement, SMILTimeWithOrigin::ScriptOrigin, to indicate that these are dynamic SMILTimes, added by a script. 
+        (WebCore::SVGAnimationElement::beginElementAt):
+        (WebCore::SVGAnimationElement::endElementAt):
+        * svg/SVGDocumentExtensions.cpp: Remove sampleAnimationAtTime.
+        * svg/SVGDocumentExtensions.h: Ditto.
+        * svg/animation/SMILTime.h: Add SMILTimeWithOrigin helper.
+        (SMILTimeWithOrigin): Needs a SMILTime and an Origin enum entry.
+        (WebCore::SMILTimeWithOrigin::SMILTimeWithOrigin):
+        (WebCore::SMILTimeWithOrigin::time): Returns the SMILTime.
+        (WebCore::SMILTimeWithOrigin::originIsScript): Determines if this SMILTime got added by a script.
+        (WebCore::operator<): Used by std::sort.
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::setElapsed): Always call updateAnimations, even if the animation is not paused. Use the right elpased time value, to seek precisely to the desired position.
+        (WebCore::SMILTimeContainer::timerFired): Cleanup code, no need for a local variable 'elapsed'.
+        (WebCore::SMILTimeContainer::updateAnimations): Remove DRT specific sampling code, which is no longer needed.
+        * svg/animation/SMILTimeContainer.h: Remove sampleAnimationAtTime.
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::SVGSMILElement): Only call resolveFirstInterval, not reset, from the constructor - it wastes unnecessary time, as everything is already initialized.
+        (WebCore::clearTimesWithDynamicOrigins): Helper function to clear all SMILTimes from the begin/endTimes list, that are dynamic.
+        (WebCore::SVGSMILElement::reset): Clear begin/endTimes lists, on any reset() call (when driving the animation timeline through setElapsed).
+        (WebCore::SVGSMILElement::insertedIntoDocument): m_beginTimes now stores SMILTimeWithOrigins, adapt the code.
+        (WebCore::sortTimeList): Ditto.
+        (WebCore::SVGSMILElement::parseBeginOrEnd): Ditto.
+        (WebCore::SVGSMILElement::addBeginTime): Ditto.
+        (WebCore::SVGSMILElement::addEndTime): Ditto.
+        (WebCore::extractTimeFromVector): Ditto.
+        (WebCore::SVGSMILElement::findInstanceTime): Ditto.
+        * svg/animation/SVGSMILElement.h: 
+        * svg/svgtags.in: Enable animateMotion/hkern/mpath JS interfaces, which were not enabled, despite their IDLs existed.
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: [REGRESSION] Copy Stack Trace is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78583
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/debugger/copy-stack-trace.html
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype._copyStackTrace):
+
+2012-02-14  Eric Seidel  <eric@webkit.org>
+
+        Upstream Android's support for SK_B32_SHIFT to JPEGImageEncoder
+        https://bugs.webkit.org/show_bug.cgi?id=78540
+
+        Reviewed by Adam Barth.
+
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::encodePixels):
+
+2012-02-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        [Qt] inspector/styles/undo-add-new-rule.html crashes
+        https://bugs.webkit.org/show_bug.cgi?id=78502
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::deleteRule):
+
+2012-02-13  Nate Chapin  <japhet@chromium.org>
+
+        Reuse CachedRawResources (e.g., XHRs) that are stored
+        in the MemoryCache when appropriate.
+        https://bugs.webkit.org/show_bug.cgi?id=76564
+
+        Reviewed by Antti Koivisto.
+
+        No new tests, expected behavior covered by existing tests.
+
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::revokeObjectURL): Objects shouldn't remain in the
+            MemoryCache if revokeObjectURL is called on them.
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::cachedResourceContent): Add CachedRawResource support.
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setCacheDisabled): Immediately
+            evict resources, rather than waiting for navigation, since XHRs
+            should hit the cache if it has been disabled.
+        * loader/cache/CachedRawResource.cpp:
+        (CachedRawResourceCallback): Encapsulates the async callback for
+            a cache hit for CachedRawResources.
+        (WebCore::CachedRawResource::sendCallbacks): Do the work defered in didAddClient.
+        (WebCore::CachedRawResource::didAddClient): Scheduled a CachedRawResourceCallback if
+            we already have a response, since async XHRs may not play nicely with receiving
+            their data synchronously.
+        (WebCore::CachedRawResource::removeClient): Ensure we cancel a callback to a client if
+            it removes itself.
+        (WebCore::CachedRawResource::canReuse): Provide some basic rules for when a
+            CachedRawResource can be reused.
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::determineRevalidationPolicy): Don't automatically reload
+            CachedRawResources, and add a check for whether this request has already been
+            made conditional.
+        * xml/XMLHttpRequest.cpp:
+
+2012-02-13  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Set opaque flag on SkBitmap in per-tile layer updater
+        https://bugs.webkit.org/show_bug.cgi?id=78498
+
+        Reviewed by Stephen White.
+
+        No new tests.
+
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
+        (SkPictureCanvasLayerTextureUpdater):
+        (WebCore::SkPictureCanvasLayerTextureUpdater::layerIsOpaque):
+
+2012-02-13  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Remove obsolete zoom animation pathway.
+        https://bugs.webkit.org/show_bug.cgi?id=78359
+
+        Reviewed by James Robinson.
+
+        Tests for existing pathways should not be broken. Tests for removed pathway removed previously.
+
+        This patch removes dead code from the previous incarnation of zoom animation for chromium.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        (FrameView):
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::ScrollAnimator):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::ScrollAnimatorNone):
+        (WebCore::ScrollAnimatorNone::animationTimerFired):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+        * testing/InternalSettings.cpp:
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+        * testing/Internals.cpp:
+
+2012-02-13  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Regression] r107650 broke the windows build.
+        https://bugs.webkit.org/show_bug.cgi?id=78569
+
+        Build fix, Unreviewed.
+
+        The variable defined in switch statement should not escape from the switch statement.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+
+2012-02-13  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] Mutation Observers build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78433
+
+        Reviewed by Martin Robinson.
+
+        Added some files missed.
+
+        No new tests since no new feature.
+
+        * GNUmakefile.list.am:
+
+2012-02-13  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRoot.nodeType return DOCUMENT_FRAGMENT_NODE.
+        https://bugs.webkit.org/show_bug.cgi?id=77514
+
+        Reviewed by Dimitri Glazkov.
+
+        NodeType.SHADOW_ROOT_NODE type is finally gone.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/objc/DOM.mm:
+        (kitClass):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+        (WebCore::ContainerNode::replaceChild):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        (WebCore::Document::childTypeAllowed):
+        (WebCore::Document::canReplaceChild):
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupPrefix):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::appendTextContent):
+        (WebCore::Node::setTextContent):
+        * dom/Node.h:
+        * dom/Range.cpp:
+        (WebCore::lengthOfContentsInNode):
+        (WebCore::Range::processContentsBetweenOffsets):
+        (WebCore::Range::insertNode):
+        (WebCore::Range::checkNodeWOffset):
+        (WebCore::Range::checkNodeBA):
+        (WebCore::Range::selectNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::Range::surroundContents):
+        * dom/ShadowRoot.cpp:
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::toShadowRoot):
+        * editing/FrameSelection.cpp:
+        (WebCore::nodeIsDetachedFromDocument):
+        (WebCore):
+        (WebCore::FrameSelection::textWillBeReplaced):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLElementStack::pushRootNode):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * xml/XPathUtil.cpp:
+        (WebCore::XPath::isValidContextNode):
+
+2012-02-13  Ojan Vafai  <ojan@chromium.org>
+
+        rtl + flex-direction:column is positioning elements incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=78555
+
+        Reviewed by Tony Chang.
+
+        Do the y-axis flipping after we have adjusted the y-position for
+        flex-align instead of before.
+
+        Tests: css3/flexbox/flex-align-baseline.html
+               css3/flexbox/flex-align-end.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::alignChildren):
+        The amount we adjust by also needs to be flipped for rtl+column,
+        so the flipping needs to be done after we align the flex items.
+
+2012-02-09  Ojan Vafai  <ojan@chromium.org>
+
+        nesting horizontal flexboxes is broken
+        https://bugs.webkit.org/show_bug.cgi?id=76867
+
+        Reviewed by David Hyatt.
+
+        This is copied from RenderDeprecatedFlexibleBox and updated
+        for RenderFlexibleBox and to handle vertical writing mode.
+
+        Tests: css3/flexbox/preferred-widths-orthogonal.html
+               css3/flexbox/preferred-widths.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::marginWidthForChild):
+        (WebCore):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        The tile cache layer should have its background set to the page background
+        https://bugs.webkit.org/show_bug.cgi?id=78560
+        <rdar://problem/10857472>
+
+        Reviewed by Sam Weinig.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::recalculateScrollbarOverlayStyle):
+        Inform the RenderLayerCompositor that the background color has changed.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateLayerBackgroundColor):
+        For tile cache layers we don't need a separate contents layer for the background color so
+        just set the background color on the layer directly.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::documentBackgroundColorDidChange):
+        If the root render layer is using a tile cache layer, update its background color.
+
+2012-02-13  Raul Hudea  <rhudea@adobe.com>
+
+        Implement Element.webkitRegionOverflow
+
+        [CSSRegions][CSSOM] Implement Element.regionOverflow
+        https://bugs.webkit.org/show_bug.cgi?id=77863
+
+        Reviewed by David Hyatt.
+
+        On each layout, compute the overflowState for each region belonging to the flow thread
+
+        Tests: fast/regions/element-region-overflow-state-vertical-rl.html
+               fast/regions/element-region-overflow-state.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+        (WebCore):
+        * dom/Element.h:
+        * dom/Element.idl:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeOverflow):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
+        (WebCore):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::RenderRegion):
+        * rendering/RenderRegion.h:
+        (RenderRegion):
+        (WebCore::RenderRegion::regionState):
+        (WebCore::RenderRegion::setRegionState):
+
+2012-02-13  Alexey Proskuryakov  <ap@apple.com>
+
+        File API IDLs are incorrect in Xcode project
+        https://bugs.webkit.org/show_bug.cgi?id=78551
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebCore.xcodeproj/project.pbxproj: Corrected paths, and added missing files.
+
+2012-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        SharedBuffer::getSomeData() can potentially return a pointer past the data
+        https://bugs.webkit.org/show_bug.cgi?id=77799
+
+        Reviewed by David Kilzer.
+
+        The expected behavior from SharedBuffer::getSomeData() is to return a size and pointer of value 0
+        if position is past the data.
+
+        However, the code handling the memory mapped data is before the code ensuring the aforementioned
+        condition. It is possible to return a pointer past the data, and a non-null size.
+
+        This patch aims at preventing such invalid memory access by checking position is in the boundaries
+        before any attempt is made to return the data.
+
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::getSomeData):
+
+2012-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        SharedBuffer::getSomeData() must support m_dataArray if NETWORK_CFDATA_ARRAY_CALLBACK is defined
+        https://bugs.webkit.org/show_bug.cgi?id=77718
+
+        Reviewed by David Kilzer.
+
+        Previously, the last part of SharedBuffer::getSomeData() was systematically accessing
+        the data from the segments. When NETWORK_CFDATA_ARRAY_CALLBACK is defined, there can
+        be data in m_dataArray past the segment.
+
+        The previous code was making invalid memory access pass the segment vector. This patch
+        adds support for getting the data out of m_dataArray to make SharedBuffer::getSomeData()
+        works with NETWORK_CFDATA_ARRAY_CALLBACK.
+
+        This is covered by existing tests when NETWORK_CFDATA_ARRAY_CALLBACK is defined.
+        The test 'fast/events/constructors/track-event-constructor.html' is a reliable test
+        for this.
+
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::getSomeData):
+        * platform/SharedBuffer.h:
+        (SharedBuffer):
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore):
+        (WebCore::SharedBuffer::copySomeDataFromDataArray):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        Force slow-scrolling mode when there are position:fixed elements on a page
+        https://bugs.webkit.org/show_bug.cgi?id=78553
+        <rdar://problem/10247934>
+
+        Reviewed by Dan Bernstein.
+
+        Eventually, the scrolling tree will know about fixed positioning layers so their position can be updated
+        when the scroll layer position is updated. For now we'll take the simple route however.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        Inform the scrolling coordinator when the number of fixed objects changes between 0 and 1.
+
+        * page/FrameView.h:
+        (WebCore::FrameView::hasFixedObjects):
+        Make this public.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange):
+        Call updateShouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingCoordinator::frameViewHasFixedObjectsDidChange):
+        Call updateShouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        Make sure to update compositing layers here. Normally, they will be updated by layout but doing a layout
+        here is too intrusive since it could potentially change the size of the page.
+
+        (WebCore::ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread):
+        If we have fixed objects or slow repaint objects we need to update the scroll layer position on the main thread.
+
+2012-02-13  Adrienne Walker  <enne@google.com>
+
+        [chromium] Use HashMap<..., OwnPtr<Tile>> for compositor tilemap
+        https://bugs.webkit.org/show_bug.cgi?id=74154
+
+        Reviewed by James Robinson.
+
+        Covered by the compositing/ layout tests.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::UpdatableTile::create):
+        (WebCore::UpdatableTile::UpdatableTile):
+        (WebCore::TiledLayerChromium::createTile):
+        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
+        (WebCore::CCLayerTilingData::addTile):
+        (WebCore::CCLayerTilingData::takeTile):
+        (WebCore::CCLayerTilingData::tileAt):
+        * platform/graphics/chromium/cc/CCLayerTilingData.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::DrawableTile::create):
+        (WebCore::DrawableTile::DrawableTile):
+        (WebCore::CCTiledLayerImpl::createTile):
+
+2012-02-13  Kentaro Hara  <haraken@chromium.org>
+
+        Add [CustomToJSObject] to interfaces which have custom toJS() and toV8()
+        https://bugs.webkit.org/show_bug.cgi?id=78489
+
+        Reviewed by Adam Barth.
+
+        This is the final step to remove hard-coding from HasCustomToV8Implementation()
+        in CodeGeneratorV8.pm. This patch replaces [JSCustomToJS] with [CustomToJSObject]
+        for interfaces which have custom toJS() and custom toV8().
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+
+        * bindings/scripts/test/TestTypedArray.idl:
+        * css/CSSRule.idl:
+        * css/CSSValue.idl:
+        * css/StyleSheet.idl:
+        * dom/Document.idl:
+        * dom/Event.idl:
+        * dom/Node.idl:
+        * fileapi/Blob.idl:
+        * fileapi/Entry.idl:
+        * fileapi/EntrySync.idl:
+        * html/HTMLCollection.idl:
+        * html/ImageData.idl:
+        * html/canvas/ArrayBufferView.idl:
+        * html/canvas/DataView.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * storage/IDBAny.idl:
+        * storage/IDBKey.idl:
+        * svg/SVGPathSeg.idl:
+
+2012-02-13  Arun Patole  <bmf834@motorola.com>
+
+        Chrome crashes when attempting to add cue to track element
+        https://bugs.webkit.org/show_bug.cgi?id=77951
+
+        Reviewed by Eric Carlson.
+
+        Allocate text track's text track list of cues before using it.
+
+        * html/TextTrack.cpp:
+        (WebCore::TextTrack::cues):
+        (WebCore::TextTrack::addCue):
+        (WebCore::TextTrack::removeCue): return if text track list of cues is not allocated.
+        (WebCore::TextTrack::ensureTextTrackCueList):Added.
+        * html/TextTrack.h:
+        (TextTrack):
+
+2012-02-13  Andy Estes  <aestes@apple.com>
+
+        Fix the Windows build.
+
+        * platform/PlatformPasteboard.h:
+        (PlatformPasteboard):
+
+2012-02-13  Abhishek Arya  <inferno@chromium.org>
+
+        Crash with button in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78378
+
+        Reviewed by David Hyatt.
+
+        Button creates an anonymous wrapper and expects that new children
+        be added to its m_inner anonymous block. However, splitBlock code
+        incorrectly creates column blocks directly under the button.
+
+        Test: fast/multicol/span/split-flow-anonymous-wrapper-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containingColumnsBlock):
+        (WebCore::RenderBlock::columnsBlockForSpanningElement):
+
+2012-02-09  Ojan Vafai  <ojan@chromium.org>
+
+        nesting horizontal flexboxes is broken
+        https://bugs.webkit.org/show_bug.cgi?id=76867
+
+        Reviewed by David Hyatt.
+
+        This is copied from RenderDeprecatedFlexibleBox and updated
+        for RenderFlexibleBox and to handle vertical writing mode.
+
+        Tests: css3/flexbox/preferred-widths-orthogonal.html
+               css3/flexbox/preferred-widths.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::marginWidthForChild):
+        (WebCore):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-13  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Crash in RenderFlowThread::setRegionBoxesRegionStyle
+        https://bugs.webkit.org/show_bug.cgi?id=78298
+
+        Reviewed by David Hyatt.
+
+        Test: fast/regions/set-box-style-in-region-crash.html
+
+        We have to make sure that anonymous block objects get their information in RenderFlowThread
+        removed properly.
+
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        Correct a comment.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseAnonymousBoxChild):
+        Remove the information for anonymous block from render flow thread.
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::removeFlowChildInfo):
+        (WebCore):
+        (WebCore::RenderFlowThread::setRegionRangeForBox):
+        Do not set region range if the flow thread does not have regions.
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willBeDestroyed):
+        Add an assert to make sure that after we remove an object, there is no remaining info
+        in any render flow thread.
+
+2012-02-13  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r107582.
+        http://trac.webkit.org/changeset/107582
+        https://bugs.webkit.org/show_bug.cgi?id=78349
+
+        Broke three inspector interactive_ui_tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode.get while):
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype._updateExecutionLine):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+
+2012-02-13  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect children placement in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78160
+
+        Reviewed by David Hyatt.
+
+        Test: fast/multicol/span/clone-before-after-content-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone): no longer need to take care of making
+        children noninline (remove fix r105769) since moveChild functions take
+        care of adding the child properly if type of children differ. this
+        function just makes sure to set the right value of childrenInline property.
+        (WebCore::RenderBlock::splitBlocks): similar to moveChild functions below.
+        (WebCore::RenderBlock::moveChildTo): when child is fullRemoveInsert (across
+        different parents, e.g clones), we should use addChild function to make sure
+        it handles the case of different type of children between fromBlock and
+        toBlock correctly (specifically making children non-inline/wrapping inline
+        children under anonymous blocks.).
+        (WebCore::RenderBlock::moveChildrenTo):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        (WebCore::RenderBlock::moveAllChildrenTo): Rename to->toBlock.
+        (WebCore::RenderBlock::moveChildrenTo): Rename to->toBlock.
+
+2012-02-13  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Implement Brightness and Contrast filters on composited
+        layers.  Fix Saturation filter.
+        https://bugs.webkit.org/show_bug.cgi?id=78527
+
+        Reviewed by Kenneth Russell.
+
+        Will be covered by existing tests in css3/filters, when enabled.
+
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+        (WebCore::CCRenderSurfaceFilters::apply):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        Turn off edge antialiasing for tile cache tile layers
+        https://bugs.webkit.org/show_bug.cgi?id=78533
+        <rdar://problem/10710798>
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::createTileLayer):
+
+2012-02-13  Enrica Casucci  <enrica@apple.com>
+
+        Build fix. Unreviewed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-02-13  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/7196487> and https://bugs.webkit.org/show_bug.cgi?id=26777
+        Add https pages to the page cache in some cases
+
+        Reviewed by Anders Carlsson.
+
+        Test: http/tests/navigation/https-in-page-cache.html
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::canCachePageContainingThisFrame): Allow HTTPS pages that do not specify cache-control: no-cache
+          or cache-control: no-store into the page cache. This will match Firefox's behavior for HTTPS in their bfcache.
+
+2012-02-10  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+        now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+        WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+        class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+        interface but this one more step in the direction of removing access to NSPasteboard from
+        the WebProcess.
+        As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+
+        Reviewed by Anders Carlsson.
+
+        No new tests. No change in behavior, just code refactoring.
+
+        * WebCore.exp.in: Added exported class PlatformPasteboard.
+        * WebCore.xcodeproj/project.pbxproj: Added new files to the build.
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::writeSelectionToPasteboard): New method signature that doesn't use OBJ-C types.
+        * platform/Pasteboard.h:
+
+        * platform/PasteboardStrategy.h: Added PasteboardStrategy abstract class.
+        * platform/PlatformPasteboard.h: Added. This class implements access to NSPasteboard.
+        * platform/PlatformStrategies.h:
+        (WebCore::PlatformStrategies::pasteboardStrategy): Added.
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::insertablePasteboardTypes): 
+        (WebCore::DragData::asURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::selectionPasteboardTypes): Changed to use Vector<String> instead of NSArray.
+        (WebCore::writableTypesForURL): Ditto.
+        (WebCore::createWritableTypesForImage): Ditto.
+        (WebCore::writableTypesForImage): Ditto.
+        (WebCore::Pasteboard::Pasteboard): Removed access to NSPasteboard.
+        (WebCore::Pasteboard::clear): Modified to use platformStrategies()->pasteboardStrategy().
+        (WebCore::Pasteboard::writeSelectionForTypes): Ditto.
+        (WebCore::Pasteboard::writePlainText): Ditto.
+        (WebCore::Pasteboard::writeSelection): Ditto.
+        (WebCore::writeURLForTypes): Ditto.
+        (WebCore::Pasteboard::writeURL): Ditto.
+        (WebCore::writeFileWrapperAsRTFDAttachment): Ditto.
+        (WebCore::Pasteboard::writeImage): Ditto.
+        (WebCore::Pasteboard::writeClipboard): Ditto.
+        (WebCore::Pasteboard::canSmartReplace): Ditto.
+        (WebCore::Pasteboard::plainText): Ditto.
+        (WebCore::documentFragmentWithRTF): Ditto.
+        (WebCore::Pasteboard::documentFragment): Ditto.
+        * platform/mac/PlatformPasteboardMac.mm: Added.
+        (WebCore::PlatformPasteboard::PlatformPasteboard):
+        (WebCore::PlatformPasteboard::getTypes):
+        (WebCore::PlatformPasteboard::bufferForType):
+        (WebCore::PlatformPasteboard::getPathnamesForType):
+        (WebCore::PlatformPasteboard::stringForType):
+        (WebCore::PlatformPasteboard::copy):
+        (WebCore::PlatformPasteboard::setTypes):
+        (WebCore::PlatformPasteboard::setBufferForType):
+        (WebCore::PlatformPasteboard::setPathnamesForType):
+        (WebCore::PlatformPasteboard::setStringForType):
+
+2012-02-13  Raul Hudea  <rhudea@adobe.com>
+
+        [CSS Regions] Inconsistent text selection behavior in regions
+        https://bugs.webkit.org/show_bug.cgi?id=76456
+
+        Reviewed by David Hyatt.
+
+        Use the proper bounding rect when doing hit testing on flow threads.
+        Based on initial patch by Alexandru Chiculita.
+
+        Test: fast/regions/hit-test-region.html
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::hitTestRegion):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::nodeAtPoint):
+
+2012-02-12  Andy Estes  <aestes@apple.com>
+
+        [Windows] Add API to enable inverted color drawing on a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=77382
+
+        Reviewed by Adam Roben.
+
+        Implement CACFLayerTreeHost::setShouldInvertColors(), which instructs
+        the layer tree host to render composited content with inverted colors.
+
+        Test: platform/win/inverted-colors/non-composited.html
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::setShouldInvertColors):
+        (WebCore):
+        * platform/graphics/ca/win/CACFLayerTreeHost.h:
+        (CACFLayerTreeHost):
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp: Use
+        SOFT_LINK_OPTIONAL since WKCACFViewSetShouldInvertColors might not
+        exist in older versions of WebKitQuartzCoreAdditions.
+        (WebCore::WKCACFViewLayerTreeHost::setShouldInvertColors):
+        (WebCore):
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:
+        (WKCACFViewLayerTreeHost):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        The scrolling tree needs to know about the back forward state of the page
+        https://bugs.webkit.org/show_bug.cgi?id=78523
+        <rdar://problem/10756548>
+
+        Reviewed by Sam Weinig.
+
+        In order to know if a page should rubber-band in the horizontal direction, the scrolling tree
+        needs to know about the back/forward state of the page.
+
+        * WebCore.exp.in:
+        Export new symbols.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::ScrollingTree):
+        Initialize m_canGoBack and m_canGoForward.
+
+        (WebCore::ScrollingTree::updateBackForwardState):
+        Update m_canGoBack and m_canGoForward.
+
+        * page/scrolling/ScrollingTree.h:
+        (WebCore::ScrollingTree::canGoBack):
+        (WebCore::ScrollingTree::canGoForward):
+        Add getters.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::shouldRubberBandInDirection):
+        Implement this, using canGoBack and canGoForward.
+
+2012-02-13  Brady Eidson  <beidson@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78520
+        Cleanup PageCache::canCachePageContainingThisFrame readability
+
+        Reviewed by Anders Carlsson.
+
+        No new tests. (Code cleanup, no change in behavior)
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::canCachePageContainingThisFrame): Store three commonly
+          getter-accessed variables in local variables for readability.
+
+2012-02-13  Timothy Hatcher  <timothy@apple.com>
+
+        Don't include a separator before the "Inspect Element" context menu item when the context menu is empty.
+
+        https://webkit.org/b/78312
+
+        Reviewed by Brian Weinstein.
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::addInspectElementItem): Check itemCount before appending the separator.
+        * platform/gtk/ContextMenuGtk.cpp:
+        (WebCore::ContextMenu::itemCount): Added. Implement so this builds on GTK.
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Define HWND_MESSAGE if not done already
+        https://bugs.webkit.org/show_bug.cgi?id=78341
+
+        Reviewed by Adam Roben.
+
+        HWND_MESSAGE is not defined on WinCE.
+        Set it to 0 when not defined to avoid #ifdefs.
+
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        * platform/win/WindowsExtras.h:
+        (WebCore):
+
+2012-02-13  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: <mark> element should be exposed through attributes
+        https://bugs.webkit.org/show_bug.cgi?id=75727
+
+        Reviewed by Beth Dakin.
+
+        Exposes an attribute indicating that an element has highlighting through attributedStringForRange.
+        Also allows the search mechanism to find elements with this style.
+
+        Test: platform/mac/accessibility/attributed-string-includes-highlighting.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isAccessibilityObjectSearchMatch):
+        (WebCore::AccessibilityObject::hasHighlighting):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (createAccessibilitySearchKeyMap):
+        (AXAttributeStringSetStyle):
+
+2012-02-13  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: the web area should report that focus can be set to itself
+        https://bugs.webkit.org/show_bug.cgi?id=78272
+
+        Reviewed by Beth Dakin.
+
+        Test: platform/mac/accessibility/webarea-can-set-focus.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isDataTable):
+           Fixed erroneous comment.
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Port RunLoop to WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=76781
+
+        Reviewed by Adam Roben.
+
+        * platform/win/RunLoopWin.cpp:
+        (WebCore::RunLoop::registerRunLoopMessageWindowClass):
+
+2012-02-10  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Make ScriptsNavigator default file selector.
+        https://bugs.webkit.org/show_bug.cgi?id=78349
+
+        Reviewed by Pavel Feldman.
+
+        Moved ScriptsNavigator out of experiments.
+        Introduced new setting "useScriptsNavigator" with true as default value.
+        Updated scripts panel tests related to file selector.
+
+        Tests: inspector/debugger/scripts-combobox-file-selector-history.html
+               inspector/debugger/scripts-file-selector.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._updateExecutionLine):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Make HTMLTableCaptionElement inherit from HTMLElement.
+        <http://webkit.org/b/78505>
+
+        Reviewed by Antti Koivisto.
+
+        HTMLTableCaptionElement was already bypassing its base class (HTMLTablePartElement)
+        and calling up to HTMLElement in all its overrides. Just make it an HTMLElement
+        instead since it doesn't use anything from HTMLTablePartElement.
+        Remove parseAttribute() overload since it's no longer needed.
+
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::HTMLTableCaptionElement):
+        (WebCore::HTMLTableCaptionElement::isPresentationAttribute):
+        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
+        * html/HTMLTableCaptionElement.h:
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLMarqueeElement: Don't cache presence of truespeed attribute.
+        <http://webkit.org/b/78483>
+
+        Reviewed by Antti Koivisto.
+
+        Out-of-line minimumDelay() and look up the "truespeed" attribute there instead
+        of caching the minimum delay in parseAttribute().
+        Remove HTMLMarqueeElement::parseAttribute() as it's no longer needed.
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::HTMLMarqueeElement):
+        (WebCore::HTMLMarqueeElement::minimumDelay):
+        * html/HTMLMarqueeElement.h:
+        (HTMLMarqueeElement):
+
+2012-02-13  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] factor common timeline UI state into TimelinePresentationModel
+        https://bugs.webkit.org/show_bug.cgi?id=78501
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._onCategoryVisibilityChanged):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewPane.prototype.scrollWindow):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createTopPane):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._createTimelineCategoryStatusBarCheckbox):
+        (WebInspector.TimelinePanel.prototype._onCategoryCheckboxClicked):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype._updateBoundaries):
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.get categories):
+        (WebInspector.TimelinePresentationModel.prototype.addCategory):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowPosition):
+        (WebInspector.TimelinePresentationModel.prototype.setCategoryVisibility):
+
+2012-02-13  Joel Webber  <jgw@google.com>
+
+        Use requestAnimationFrame callbacks to pump CSS animations
+        https://bugs.webkit.org/show_bug.cgi?id=64591
+
+        Reviewed by James Robinson.
+
+        No new tests needed (covered by tests in animations/*).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::serviceScriptedAnimations):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimations):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle):
+        (WebCore::AnimationControllerPrivate::animationFrameCallbackFired):
+        (WebCore::AnimationController::updateAnimations):
+        (WebCore::AnimationController::serviceAnimations):
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h:
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Add WindowsExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=78340
+
+        Reviewed by Adam Roben.
+
+        Add a new file to share common code for Win32/WinCE differences.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::PopupMenuWndProc):
+        * platform/win/RunLoopWin.cpp:
+        (WebCore::RunLoop::RunLoopWndProc):
+        * platform/win/WindowsExtras.h: Added.
+        (WebCore):
+        (WebCore::getWindowPointer):
+        (WebCore::setWindowPointer):
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Don't mark element for style recalc when modifying its attribute style.
+        <http://webkit.org/b/78497>
+
+        Reviewed by Antti Koivisto.
+
+        StylePropertySet::setNeedsStyleRecalc() shouldn't do anything for attribute styles.
+        Their invalidation is handled exclusively by StyledElement::attributeChanged().
+        Elements with presentation attributes were being marked for style recalc twice,
+        once when the attribute changed, and again during attribute style update, below the
+        call to collectStyleForAttribute().
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::setNeedsStyleRecalc):
+
+2012-02-13  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Move attribute storage from NamedNodeMap to ElementAttributeData
+        https://bugs.webkit.org/show_bug.cgi?id=77674
+
+        Reviewed by Andreas Kling.
+
+        Move m_attributes vector from NamedNodeMap to ElementAttributeData. Make the
+        remaining callsites interact with ElementAttributeData if possible. The parsing
+        code is still interacting with NamedNodeMap, so some functions remained as
+        wrappers there. A next change will it use ElementAttributeData instead.
+
+        The code for DOM exported functions remained in NamedNodeMap. This implementation
+        should move to Element in a next change, too.
+
+        * dom/Attr.h:
+        (Attr):
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::parserSetAttributeMap):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        (WebCore::Element::normalizeAttributes):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::ensureUpdatedAttributes):
+        (WebCore::Element::ensureAttributeData):
+        (WebCore):
+        (WebCore::Element::updatedAttributeData):
+        (WebCore::Element::ensureUpdatedAttributeData):
+        These *AttributeData functions are the correct correct way for callers to touch
+        the details of attribute storage. The "updated" variants will update invalid
+        attributes before return.
+
+        (WebCore::Element::setAttributesFromElement):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::~ElementAttributeData):
+        (WebCore):
+        (WebCore::ElementAttributeData::ensureInlineStyleDecl):
+        (WebCore::ElementAttributeData::addAttribute):
+        (WebCore::ElementAttributeData::removeAttribute):
+        (WebCore::ElementAttributeData::detachAttributesFromElement):
+        (WebCore::ElementAttributeData::copyAttributesToVector):
+        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
+        (WebCore::ElementAttributeData::setAttributes): Make use of the assumption that
+        this will only be called with a valid Element, since the only call site is an
+        Element method.
+        (WebCore::ElementAttributeData::clearAttributes):
+        (WebCore::ElementAttributeData::replaceAttribute): Make use of the assumption
+        this will only be called with a valid Element, since the only call site return
+        early if there's no Element.
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::length):
+        (WebCore::ElementAttributeData::isEmpty):
+        (WebCore::ElementAttributeData::attributeItem):
+        (WebCore::ElementAttributeData::removeAttribute):
+        (WebCore):
+        (WebCore::ElementAttributeData::getAttributeItem):
+        (WebCore::ElementAttributeData::getAttributeItemIndex):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::item):
+        (WebCore::NamedNodeMap::detachFromElement):
+        * dom/NamedNodeMap.h:
+        (WebCore::NamedNodeMap::length):
+        (WebCore::NamedNodeMap::isEmpty):
+        (WebCore::NamedNodeMap::attributeItem):
+        (WebCore::NamedNodeMap::getAttributeItem):
+        (WebCore::NamedNodeMap::getAttributeItemIndex):
+        (WebCore::NamedNodeMap::shrinkToLength):
+        (WebCore::NamedNodeMap::reserveInitialCapacity):
+        (WebCore::NamedNodeMap::addAttribute):
+        (WebCore::NamedNodeMap::removeAttribute):
+        (NamedNodeMap):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::ensureInlineStyleDecl):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateType):
+        * svg/properties/SVGAnimatedPropertySynchronizer.h:
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+
+2012-02-13  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: wrong percent calculations for empty snapshot.
+        https://bugs.webkit.org/show_bug.cgi?id=78329
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype._createValueCell):
+
+2012-02-13  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: add class filter to heap profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=78362
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype._performSorting):
+        (WebInspector.HeapSnapshotConstructorsDataGrid):
+        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._nameFilterChanged):
+        (WebInspector.DetailedHeapshotView.prototype._changeNameFilter):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .constructors-view-grid):
+        (.detailed-heapshot-view .constructors-view-toolbar):
+        (.detailed-heapshot-view .constructors-view-toolbar input.constructors-view-filter):
+
+2012-02-13  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: In Inspector.json PropertyDescriptor.writable should be declared optional
+        https://bugs.webkit.org/show_bug.cgi?id=77917
+
+        Reviewed by Pavel Feldman.
+
+        Property descriptor is fixed in Inspector.json. Also retroactively in
+        0.1 and 1.0.
+        Injected script in instructed to never return null property values.
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector-0.1.json:
+        * inspector/Inspector-1.0.json:
+        * inspector/Inspector.json:
+
+2012-02-13  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] Revise configuration for MHTML
+        https://bugs.webkit.org/show_bug.cgi?id=78364
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added mhtml directory and removed target files duplicated to build when enabling mhtml.
+        Archive.cpp, ArchiveFactory.cpp & their headers are included at the above line.
+        This duplication has caused build-break if mhtml is enabled.
+
+        No new tests, since no new features.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        No new tests, just some dependency plumbing.
+
+        * PlatformEfl.cmake: Build the glib/soup source files
+        unconditionally.
+        * platform/efl/FileSystemEfl.cpp: Remove ENABLE(GLIB_SUPPORT) check.
+
+2012-02-13  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: wrap settings selector text and adding a rule with undoable actions.
+        https://bugs.webkit.org/show_bug.cgi?id=78482
+
+        Reviewed by Yury Semikhatsky.
+
+        Tests: inspector/styles/undo-add-new-rule.html
+               inspector/styles/undo-set-selector-text.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::StyleSheetAction::StyleSheetAction):
+        (InspectorCSSAgent::StyleSheetAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::SetStyleSheetTextAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::SetPropertyTextAction):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::mergeId):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::TogglePropertyAction):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::perform):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::undo):
+        (InspectorCSSAgent::SetRuleSelectorAction):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::SetRuleSelectorAction):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::perform):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::undo):
+        (WebCore):
+        (InspectorCSSAgent::AddRuleAction):
+        (WebCore::InspectorCSSAgent::AddRuleAction::AddRuleAction):
+        (WebCore::InspectorCSSAgent::AddRuleAction::perform):
+        (WebCore::InspectorCSSAgent::AddRuleAction::undo):
+        (WebCore::InspectorCSSAgent::AddRuleAction::newRuleId):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::addRule):
+        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::bindStyleSheet):
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::styleSheetChanged):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::create):
+        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::reparseStyleSheet):
+        (WebCore::InspectorStyleSheet::ruleSelector):
+        (WebCore):
+        (WebCore::InspectorStyleSheet::setRuleSelector):
+        (WebCore::InspectorStyleSheet::addRule):
+        (WebCore::InspectorStyleSheet::deleteRule):
+        (WebCore::InspectorStyleSheet::setPropertyText):
+        (WebCore::InspectorStyleSheet::toggleProperty):
+        (WebCore::InspectorStyleSheet::fireStyleSheetChanged):
+        (WebCore::InspectorStyleSheetForInlineStyle::create):
+        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
+        * inspector/InspectorStyleSheet.h:
+        (InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::styleId):
+        (InspectorStyleSheetForInlineStyle):
+
+2012-02-13  Hayato Ito  <hayato@chromium.org>
+
+        Rename names defined in ContentInclutionSelector to more intuitive names.
+        https://bugs.webkit.org/show_bug.cgi?id=78333
+
+        Reviewed by Hajime Morita.
+
+        This is just refactoring, renaming non-intuitive names to more intuitive names
+        so that they match the terms in the spec.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::nextRendererOf):
+        (WebCore::previousRendererOf):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::insertionPoint):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertionPointFor):
+        (WebCore::ShadowRoot::isSelectorActive):
+        (WebCore::ShadowRoot::attach):
+        (WebCore::ShadowRoot::selector):
+        (WebCore::ShadowRoot::ensureSelector):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (ShadowRoot):
+        * html/shadow/ContentInclusionSelector.h: Removed.
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::HTMLContentElement):
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentElement.h:
+        (WebCore):
+        (WebCore::HTMLContentElement::selections):
+        (WebCore::HTMLContentElement::hasSelection):
+        (HTMLContentElement):
+        * html/shadow/HTMLContentSelector.cpp: Renamed from Source/WebCore/html/shadow/ContentInclusionSelector.cpp.
+        (WebCore):
+        (WebCore::HTMLContentSeleciton::append):
+        (WebCore::HTMLContentSeleciton::unlink):
+        (WebCore::HTMLContentSelectionList::HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionList::~HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionList::find):
+        (WebCore::HTMLContentSelectionList::clear):
+        (WebCore::HTMLContentSelectionList::append):
+        (WebCore::HTMLContentSelector::HTMLContentSelector):
+        (WebCore::HTMLContentSelector::~HTMLContentSelector):
+        (WebCore::HTMLContentSelector::select):
+        (WebCore::HTMLContentSelector::unselect):
+        (WebCore::HTMLContentSelector::findFor):
+        (WebCore::HTMLContentSelector::didSelect):
+        (WebCore::HTMLContentSelector::willSelectOver):
+        * html/shadow/HTMLContentSelector.h: Added.
+        (WebCore):
+        (HTMLContentSeleciton):
+        (WebCore::HTMLContentSeleciton::insertionPoint):
+        (WebCore::HTMLContentSeleciton::node):
+        (WebCore::HTMLContentSeleciton::next):
+        (WebCore::HTMLContentSeleciton::previous):
+        (WebCore::HTMLContentSeleciton::HTMLContentSeleciton):
+        (WebCore::HTMLContentSeleciton::create):
+        (HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionList::first):
+        (WebCore::HTMLContentSelectionList::last):
+        (WebCore::HTMLContentSelectionList::isEmpty):
+        (HTMLContentSelectionSet):
+        (WebCore::HTMLContentSelectionSet::add):
+        (WebCore::HTMLContentSelectionSet::remove):
+        (WebCore::HTMLContentSelectionSet::isEmpty):
+        (Translator):
+        (WebCore::HTMLContentSelectionSet::Translator::hash):
+        (WebCore::HTMLContentSelectionSet::Translator::equal):
+        (WebCore::HTMLContentSelectionSet::Hash::hash):
+        (WebCore::HTMLContentSelectionSet::Hash::equal):
+        (Hash):
+        (WebCore::HTMLContentSelectionSet::find):
+        (HTMLContentSelector):
+        (WebCore::HTMLContentSelector::hasCandidates):
+        * testing/Internals.cpp:
+        (WebCore::Internals::includerFor):
+
+2012-02-13  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] morphing-cubes animation appears too close when clicking the button
+        https://bugs.webkit.org/show_bug.cgi?id=78476
+
+        Fixed bug in TextureMapperAnimation that made transform animations that go to/from identity
+        to not work.
+
+        Reviewed by Simon Hausmann.
+
+        No behavior changes.
+
+        * platform/graphics/texmap/TextureMapperAnimation.cpp:
+        (WebCore::applyTransformAnimation):
+
+2012-02-13  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Use enum instead of bool for HTMLInputElement::setValue
+        https://bugs.webkit.org/show_bug.cgi?id=75217
+
+        Reviewed by Kent Tamura.
+
+        Use TextFieldEventBehavior enum instead of sendChangeEvent bool
+        parameter for HTMLInputElement::setValue method. This new enum
+        parameter will be extended to dispatch input and change events
+        when user agent populates input field as specified in
+        "Common events behavior" of HTML5 standard.
+
+        This patch is required for fixing bug 75067 "[Forms] Spin buttons
+        of number input type should fire both input and change event."
+
+        No new tests. Existing tests cover this patch.
+
+        * html/BaseButtonInputType.cpp:
+        (WebCore::BaseButtonInputType::setValue):
+        * html/BaseButtonInputType.h:
+        * html/BaseCheckableInputType.cpp:
+        (WebCore::BaseCheckableInputType::setValue):
+        * html/BaseCheckableInputType.h:
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::setValueAsNumber):
+        * html/BaseDateAndTimeInputType.h:
+        * html/CheckboxInputType.cpp:
+        (WebCore::CheckboxInputType::willDispatchClick):
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::setValue):
+        * html/ColorInputType.h:
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::setValue):
+        * html/FileInputType.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::applyStep):
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setValueForUser):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueInternal):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::stepUpFromRenderer):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextFormControlElement.h:
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::setValue):
+        * html/HiddenInputType.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::setValueAsNumber):
+        (WebCore::InputType::setValue):
+        * html/InputType.h:
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::setValueAsNumber):
+        * html/NumberInputType.h:
+        * html/RadioInputType.cpp:
+        (WebCore::RadioInputType::willDispatchClick):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::setValueAsNumber):
+        (WebCore::RangeInputType::handleKeydownEvent):
+        (WebCore::RangeInputType::setValue):
+        * html/RangeInputType.h:
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::setValue):
+        * html/TextFieldInputType.h:
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Move attribute style invalidation to attributeChanged().
+        <http://webkit.org/b/78461>
+
+        Reviewed by Antti Koivisto.
+
+        Moved attribute style invalidation out of the parseAttribute() overloads
+        and added an "isPresentationAttribute(Attribute*) virtual to StyledElement.
+        Returning true for a given Attribute will cause attribute style invalidation
+        when that attribute passes through attributeChanged().
+
+        Removed a couple of parseAttribute() overloads whose only remaining purpose
+        was invalidating attribute style.
+
+        For form elements that deliberately don't map the "align" attribute, added
+        short-circuits in isPresentationAttribute instead of falling back to the
+        respective base class (which may othweise then map "align")
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::isPresentationAttribute):
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::isPresentationAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::isPresentationAttribute):
+        (WebCore::HTMLBodyElement::collectStyleForAttribute):
+        (WebCore::HTMLBodyElement::parseAttribute):
+        * html/HTMLBodyElement.h:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::isPresentationAttribute):
+        (WebCore::HTMLButtonElement::parseAttribute):
+        * html/HTMLButtonElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::isPresentationAttribute):
+        * html/HTMLDivElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::isPresentationAttribute):
+        (WebCore::HTMLElement::parseAttribute):
+        * html/HTMLElement.h:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::isPresentationAttribute):
+        (WebCore::HTMLEmbedElement::parseAttribute):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::isPresentationAttribute):
+        * html/HTMLFontElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::isPresentationAttribute):
+        (WebCore::HTMLFrameSetElement::parseAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::isPresentationAttribute):
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLHRElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::isPresentationAttribute):
+        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
+        (WebCore::HTMLIFrameElement::parseAttribute):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::isPresentationAttribute):
+        (WebCore::HTMLImageElement::collectStyleForAttribute):
+        (WebCore::HTMLImageElement::parseAttribute):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isPresentationAttribute):
+        (WebCore::HTMLInputElement::collectStyleForAttribute):
+        (WebCore::HTMLInputElement::parseAttribute):
+        * html/HTMLInputElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::isPresentationAttribute):
+        (WebCore::HTMLLIElement::parseAttribute):
+        * html/HTMLLIElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::isPresentationAttribute):
+        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
+        (WebCore::HTMLMarqueeElement::parseAttribute):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::isPresentationAttribute):
+        (WebCore::HTMLOListElement::parseAttribute):
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::isPresentationAttribute):
+        (WebCore::HTMLObjectElement::parseAttribute):
+        * html/HTMLObjectElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::isPresentationAttribute):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::isPresentationAttribute):
+        (WebCore::HTMLPlugInElement::collectStyleForAttribute):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        (WebCore::HTMLPreElement::isPresentationAttribute):
+        (WebCore::HTMLPreElement::collectStyleForAttribute):
+        * html/HTMLPreElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::isPresentationAttribute):
+        (WebCore::HTMLSelectElement::parseAttribute):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::isPresentationAttribute):
+        (WebCore::HTMLTableCaptionElement::parseAttribute):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::isPresentationAttribute):
+        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
+        (WebCore::HTMLTableCellElement::parseAttribute):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::isPresentationAttribute):
+        (WebCore::HTMLTableColElement::parseAttribute):
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::isPresentationAttribute):
+        (WebCore::HTMLTableElement::parseAttribute):
+        * html/HTMLTableElement.h:
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::isPresentationAttribute):
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::isPresentationAttribute):
+        (WebCore::HTMLTextAreaElement::parseAttribute):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::isPresentationAttribute):
+        (WebCore::HTMLUListElement::collectStyleForAttribute):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::isPresentationAttribute):
+        (WebCore::HTMLVideoElement::parseAttribute):
+        * html/HTMLVideoElement.h:
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::isPresentationAttribute):
+        (WebCore::MathMLElement::collectStyleForAttribute):
+        * mathml/MathMLElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::isPresentationAttribute):
+        (WebCore::SVGImageElement::parseAttribute):
+        * svg/SVGImageElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::isPresentationAttribute):
+        (WebCore::SVGStyledElement::parseAttribute):
+        * svg/SVGStyledElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::isPresentationAttribute):
+        (WebCore::SVGTextContentElement::parseAttribute):
+        * svg/SVGTextContentElement.h:
+
+2012-02-13  Kentaro Hara  <haraken@chromium.org>
+
+        Add [JSCustomToJSObject] IDL attribute to interfaces that have
+        custom toJS() but do not have custom toV8()
+        https://bugs.webkit.org/show_bug.cgi?id=78466
+
+        Reviewed by Adam Barth.
+
+        This is the second step to remove hard-coding in HasCustomToV8Implementation()
+        in CodeGeneratorV8.pm. This patch replaces [JSCustomToJS] with [JSCustomToJSObject]
+        for interfaces which have custom toJS() but do not have custom toV8().
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (HasCustomToV8Implementation): I found that AbstractWorker and CanvasRenderingContext
+        are the only IDL files to which I need to add [JSCustomToJSObject].
+        Other IDL files which had been listed here do not have [JSCustomToJS].
+        * html/canvas/CanvasRenderingContext.idl:
+        * workers/AbstractWorker.idl:
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Avoid unnecessary work when evaluating style sharing candidates.
+        <http://webkit.org/b/78220>
+
+        Reviewed by Antti Koivisto.
+
+        Do the cheap checks (bitfields, pointers) before calling virtuals and doing hash lookups.
+        Remove comparison of attributes that are reflected in the attribute styles (cellpadding.)
+        Moved comparison of "type" and "readonly" attributes into the more specific
+        canShareStyleWithControl() since they are only relevant for input elements. Don't bother
+        calling isFormControlElement() on both elements as they already have the same tagQName().
+
+        Altogether this knocks off ~8ms worth of samples per cycle of the "Moz" page cycler test.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithControl):
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::isCommonAttributeSelectorAttribute):
+
+2012-02-13  Arko Saha  <arko@motorola.com>
+
+        <summary> is not keyboard accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=75478
+
+        Reviewed by Hajime Morita.
+
+        Toggle the content of <details> element on pressing Enter or Spacebar
+        key on a focused <summary> element.
+
+        Test: fast/html/details-keyboard-show-hide.html
+
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::supportsFocus):
+        (WebCore):
+        (WebCore::HTMLSummaryElement::defaultEventHandler):
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+
+2012-02-13  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78434
+        Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore):
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+
+2012-02-13  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: get rid of cycles in containment view of an object.
+        https://bugs.webkit.org/show_bug.cgi?id=78462
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotObjectNode.prototype.updateHasChildren):
+        (WebInspector.HeapSnapshotObjectNode.prototype._prefixObjectCell):
+
+2012-02-12  Adam Barth  <abarth@webkit.org>
+
+        Remove ENABLE(MEDIA_STREAM) from Navigator.h
+        https://bugs.webkit.org/show_bug.cgi?id=78467
+
+        Reviewed by Kentaro Hara.
+
+        Navigator.webkitGetUser media doesn't really have anything to do with
+        Navigator.cpp.  This patch moves it into the mediastream directory and
+        removes the ENABLE(MEDIA_STREAM) ifdefs in Navigator.h and
+        Navigator.cpp.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * mediastream/NavigatorMediaStream.cpp: Added.
+        (WebCore):
+        (WebCore::NavigatorMediaStream::NavigatorMediaStream):
+        (WebCore::NavigatorMediaStream::~NavigatorMediaStream):
+        (WebCore::NavigatorMediaStream::webkitGetUserMedia):
+        * mediastream/NavigatorMediaStream.h: Added.
+        (WebCore):
+        (NavigatorMediaStream):
+        * mediastream/NavigatorMediaStream.idl: Added.
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (WebCore):
+        (Navigator):
+        * page/Navigator.idl:
+
+2012-02-12  Adam Barth  <abarth@webkit.org>
+
+        Navigator.webkitGetUserMedia doesn't need to be custom
+        https://bugs.webkit.org/show_bug.cgi?id=78464
+
+        Reviewed by Eric Seidel.
+
+        The code generator has gotten smarter since this function was added.
+
+        * GNUmakefile.list.am:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/js/JSNavigatorCustom.cpp: Removed.
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Removed.
+        * page/Navigator.idl:
+
+2012-02-12  Adam Barth  <abarth@webkit.org>
+
+        Move ENABLE(GAMEPAD) logic out of Navigator.h/cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78457
+
+        Reviewed by Hajime Morita.
+
+        This patch moves GAMEPAD-specific logic out of Navigator by introducing
+        the concept of a NavigatorSupplement, analogous to the recently
+        introduced PageSupplement.
+
+        * Modules/gamepad/NavigatorGamepad.cpp:
+        (WebCore::NavigatorGamepad::from):
+        (WebCore):
+        (WebCore::NavigatorGamepad::webkitGamepads):
+        (WebCore::NavigatorGamepad::gamepads):
+        * Modules/gamepad/NavigatorGamepad.h:
+        (NavigatorGamepad):
+        * WebCore.gypi:
+        * dom/DeviceMotionController.cpp:
+        (WebCore::DeviceMotionController::supplementName):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::provideSupplement):
+        (WebCore):
+        (WebCore::Navigator::requireSupplement):
+        * page/Navigator.h:
+        (Navigator):
+        * page/Page.h:
+        (Page):
+        * page/PageSupplement.h:
+            - This patch cleans up some nits in PageSupplement.
+        (WebCore):
+        (PageSupplement):
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Add a [V8CustomToJSObject] IDL attribute
+        https://bugs.webkit.org/show_bug.cgi?id=78450
+
+        Reviewed by Adam Barth.
+
+        This is the first step to remove hard-coding in HasCustomToV8Implementation()
+        in CodeGeneratorV8.pm. This patch adds [V8CustomToJSObject]
+        to interfaces which have custom toV8() but do not have custom toJS().
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Replaced hard-coding with [V8CustomToJSObject].
+        (HasCustomToV8Implementation):
+
+        * css/CSSStyleSheet.idl: Added [V8CustomToJSObject].
+        * dom/DOMStringMap.idl:
+        * dom/Element.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * inspector/ScriptProfile.idl:
+        * inspector/ScriptProfileNode.idl:
+        * page/DOMWindow.idl:
+        * page/Location.idl:
+        * svg/SVGDocument.idl:
+        * svg/SVGElement.idl:
+        * workers/WorkerContext.idl:
+
+2012-02-12  David Barr  <davidbarr@chromium.org>
+
+        CSS3 currentColor on outline-color gets treated as inherit
+        https://bugs.webkit.org/show_bug.cgi?id=73180
+
+        Reviewed by Antti Koivisto.
+
+        The CSS2 and CSS3 UI modules state that outline-color
+        is not inherited. Make it so.
+        http://www.w3.org/TR/CSS2/ui.html#propdef-outline-color
+        http://www.w3.org/TR/css3-ui/#outline-color
+
+        Test: fast/css/outline-currentcolor.html
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+
+2012-02-12  Antti Koivisto  <antti@apple.com>
+
+        CSSPageRule should inherit from CSSRule instead of CSSStyleRule
+        https://bugs.webkit.org/show_bug.cgi?id=78452
+
+        Reviewed by Anders Carlsson.
+
+        This matches CSSOM and eliminates the only subclass of CSSStyleRule, enabling further refactoring.
+
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::CSSPageRule):
+        (WebCore::CSSPageRule::~CSSPageRule):
+        (WebCore):
+        (WebCore::CSSPageRule::selectorText):
+        (WebCore::CSSPageRule::setSelectorText):
+        (WebCore::CSSPageRule::cssText):
+        * css/CSSPageRule.h:
+        (CSSPageRule):
+        (WebCore::CSSPageRule::style):
+        (WebCore::CSSPageRule::selector):
+        (WebCore::CSSPageRule::properties):
+        (WebCore::CSSPageRule::adoptSelectorVector):
+        (WebCore::CSSPageRule::setDeclaration):
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::cssText):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::generateSelectorText):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleSet::pageRules):
+        (RuleSet):
+        (WebCore::RuleSet::addPageRule):
+        (WebCore::comparePageRules):
+        (WebCore::CSSStyleSelector::matchPageRules):
+        (WebCore::CSSStyleSelector::matchPageRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        Introduce ShadowRootList.
+        https://bugs.webkit.org/show_bug.cgi?id=78069
+
+        Reviewed by Hajime Morita.
+
+        This is a step to implement multiple shadow subtrees.
+
+        This patch introduces a shadow root list. ShadowRootList is a doubly linked list,
+        and each shadow root now has a younger shadow root and older shadow root,
+        which are a previous element and a next element respectively.
+        Since a visual tree traversal, which will be introduced in coming patches, will need a older shadow root,
+        we make a shadow root list a doubly linked list.
+
+        However, ShadowRootList does not have more than one shadow root now.
+        This will be changed in a series of coming patches.
+
+        Element::shadowRoot(), setShadowRoot(), ensureShadowRoot(), and removeShadowRoot() are
+        emulated using ShadowRootList for a while. These API will be replaced to ShadowRootList API later.
+
+        No new tests, no change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/Element.cpp:
+        (WebCore::Element::hasShadowRoot):
+          Retruns true if an element has a shadowRoot.
+        (WebCore::Element::shadowRootList):
+          Gets shadow root list if any.
+        (WebCore::Element::shadowRoot):
+          Gets the first shadow root from the shadow root list.
+        (WebCore::Element::setShadowRoot):
+          Sets the first shadow root to the shadow root list.
+        (WebCore::Element::removeShadowRoot):
+          Removes all the shadow roots in the shadow root list.
+        * dom/Element.h:
+        (WebCore):
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        (WebCore::ElementRareData::ElementRareData):
+          Has shadow root lists instead of shadow root.
+        (WebCore::ElementRareData::~ElementRareData):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::~ShadowRoot):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::ShadowRoot::youngerShadowRoot):
+        (WebCore::ShadowRoot::olderShadowRoot):
+        * dom/ShadowRootList.cpp: Added.
+        (WebCore):
+        (WebCore::ShadowRootList::ShadowRootList):
+        (WebCore::ShadowRootList::~ShadowRootList):
+        (WebCore::ShadowRootList::pushShadowRoot):
+          Adds a shadow root into the list. Currently we limit the list can have only one shadow root.
+        (WebCore::ShadowRootList::popShadowRoot):
+          Removes and returns the youngest shadow root if any.
+        * dom/ShadowRootList.h: Added.
+        (WebCore):
+        (ShadowRootList):
+        (WebCore::ShadowRootList::hasShadowRoot):
+        (WebCore::ShadowRootList::youngestShadowRoot):
+        (WebCore::ShadowRootList::oldestShadowRoot):
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        INPUT shouldn't create ShadowRoot dynamically.
+        https://bugs.webkit.org/show_bug.cgi?id=77930
+
+        Reviewed by Dimitri Glazkov.
+
+        When input type is changed, ShadowRoot was being re-created. This makes it difficult to
+        support multiple shadow subtrees. This patch makes input re-use the existing shadow root
+        instead of re-creating a shaow root. A shadow root should be created when an element is created.
+
+        Since media control elements are implemented using input elements, these elements should also
+        create a shadow root in their construction phase.
+
+        Test: fast/dom/shadow/input-shadow-nochange.html
+        Tests related to media controls should be covered by existing tests.
+
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::createShadowSubtree):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::createShadowSubtree):
+        (WebCore::FileInputType::multipleAttributeChanged):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::createShadowSubtree):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::createShadowSubtree):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::createShadowSubtree):
+        * html/shadow/MediaControlElements.cpp:
+          Creates a shadow tree in the construction phase.
+        (WebCore::MediaControlPanelMuteButtonElement::create):
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::create):
+        (WebCore::MediaControlPlayButtonElement::create):
+        (WebCore::MediaControlSeekForwardButtonElement::create):
+        (WebCore::MediaControlSeekBackButtonElement::create):
+        (WebCore::MediaControlRewindButtonElement::create):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::create):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::create):
+        (WebCore::MediaControlTimelineElement::create):
+        (WebCore::MediaControlVolumeSliderElement::create):
+        (WebCore::MediaControlFullscreenVolumeSliderElement::create):
+        (WebCore::MediaControlFullscreenButtonElement::create):
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::create):
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::create):
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        SVGTRefElement shouldn't create a shadow root dynamically.
+        https://bugs.webkit.org/show_bug.cgi?id=77938
+
+        Reviewed by Hajime Morita.
+
+        SVGTRefElement creates a shadow root dynamically. This will cause a problem to support
+        multiple shadow subtrees. So it should be created in a constructor phase.
+
+        Test: svg/custom/tref-shadowdom.html
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::create):
+        (WebCore::SVGTRefElement::createShadowSubtree):
+        (WebCore):
+        (WebCore::SVGTRefElement::updateReferencedText):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/JS/JSFloat64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore):
+        (WebCore::JSTestActiveDOMObject::destroy):
+        (WebCore::JSTestActiveDOMObject::~JSTestActiveDOMObject):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
+        (JSTestActiveDOMObject):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore):
+        (WebCore::JSTestCustomNamedGetter::destroy):
+        (WebCore::JSTestCustomNamedGetter::~JSTestCustomNamedGetter):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
+        (JSTestCustomNamedGetter):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore):
+        (WebCore::JSTestEventConstructor::destroy):
+        (WebCore::JSTestEventConstructor::~JSTestEventConstructor):
+        * bindings/scripts/test/JS/JSTestEventConstructor.h:
+        (JSTestEventConstructor):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore):
+        (WebCore::JSTestEventTarget::destroy):
+        (WebCore::JSTestEventTarget::~JSTestEventTarget):
+        * bindings/scripts/test/JS/JSTestEventTarget.h:
+        (JSTestEventTarget):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore):
+        (WebCore::JSTestInterface::destroy):
+        (WebCore::JSTestInterface::~JSTestInterface):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (JSTestInterface):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore):
+        (WebCore::JSTestMediaQueryListListener::destroy):
+        (WebCore::JSTestMediaQueryListListener::~JSTestMediaQueryListListener):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        (JSTestMediaQueryListListener):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore):
+        (WebCore::JSTestNamedConstructor::destroy):
+        (WebCore::JSTestNamedConstructor::~JSTestNamedConstructor):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
+        (JSTestNamedConstructor):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::JSTestObj::destroy):
+        (WebCore::JSTestObj::~JSTestObj):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (JSTestObj):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        (WebCore::JSTestSerializedScriptValueInterface::destroy):
+        (WebCore::JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        (JSTestSerializedScriptValueInterface):
+
+2012-02-12  Abhishek Arya  <inferno@chromium.org>
+
+        Regression (r104528): Crash when moving nodes across documents.
+        https://bugs.webkit.org/show_bug.cgi?id=78432
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/dom/node-move-to-new-document-crash-main.html
+
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        (WebCore::TreeScopeAdopter::moveTreeToNewDocument):
+        (WebCore::TreeScopeAdopter::moveNodeToNewDocument):
+
+2012-02-12  Hajime Morrita  <morrita@chromium.org>
+
+        Page should have less intrusive way to associate API implementation objects.
+        https://bugs.webkit.org/show_bug.cgi?id=78085
+
+        Reviewed by Adam Barth.
+
+        Introducing PageSupplement interface to attach behind-the-flag-ish
+        objects to Page instances.
+
+        This change aims to improve modularity of Modules/ entries. With
+        PageSupplement mechinary, we can eliminate ifdef conditionals from
+        Page.h/Page.cpp and are able to add Modules/ entries without
+        touching non-Module WebCore files. WebKit API classes like WebPage
+        can "provide" these objects dynamically during the Page setup phase.
+
+        In this change, DeviceMotionController and
+        DeviceOrientationController is updated to adopt PageSupplement
+        inteface for an illustrative purpose because they are going to
+        move into Modules/ shortly. Other Page associated API backing
+        objects also should be transformed to PageSupplement family.
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavior change.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceMotionClient.h:
+        (WebCore):
+        * dom/DeviceMotionController.cpp:
+        (WebCore::DeviceMotionController::supplementName):
+        (WebCore):
+        (WebCore::DeviceMotionController::isActiveAt):
+        (WebCore::provideDeviceMotionTo):
+        * dom/DeviceMotionController.h:
+        (DeviceMotionController):
+        (WebCore::DeviceMotionController::from):
+        * dom/DeviceOrientationClient.h:
+        (WebCore):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::supplementName):
+        (WebCore):
+        (WebCore::DeviceOrientationController::isActiveAt):
+        (WebCore::provideDeviceOrientationTo):
+        * dom/DeviceOrientationController.h:
+        (DeviceOrientationController):
+        (WebCore::DeviceOrientationController::from):
+        * dom/Document.cpp:
+        (WebCore::Document::suspendActiveDOMObjects):
+        (WebCore::Document::resumeActiveDOMObjects):
+        * history/PageCache.cpp:
+        (WebCore::logCanCachePageDecision):
+        (WebCore::PageCache::canCache):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/PageSupplement.cpp:
+        (WebCore::PageSupplement::~PageSupplement):
+        (WebCore::PageSupplement::provideTo):
+        (WebCore::PageSupplement::from):
+        * page/PageSupplement.h:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        (WebCore::Page::provideSupplement):
+        (WebCore):
+        (WebCore::Page::requireSupplement):
+        (WebCore::Page::notifyDestroyedToSupplements):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2012-02-12  Nico Weber  <nicolasweber@gmx.de>
+
+        [chromium/mac] Change the type of webkit_system_interface from static_library to none
+        https://bugs.webkit.org/show_bug.cgi?id=78441
+
+        This target exists only run an action and to add a dependency to the
+        action's output to targets depending on webkit_system_interface.
+        This is what target type 'none' is for. With this, no dummy source
+        file is needed, and no empty libwebkit_system_interface.a is created.
+        This also fixes this (harmless) libtool warning:
+
+        libtool: warning for library: libwebkit_system_interface.a the table
+        of contents is empty (no object file members in the library define
+        global symbols)
+
+        Reviewed by Adam Barth.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac/Empty.cpp: Removed.
+
+2012-02-12  Kenichi Ishibashi  <bashi@chromium.org>
+
+        If @font-face does not provide an explicit italic/bold variant, regular is used.
+        https://bugs.webkit.org/show_bug.cgi?id=34147
+
+        Reviewed by Dan Bernstein.
+
+        Update @font-face handling code so that it matches @font-face behavior to the current draft of CSS3 Font spec. The original patch was written by yusukes@chromium.org.
+        - Drops support for "bolder", "lighter", and "all" value. These are no longer allowed.
+        - Only allows one value for font-style and font-weight.
+
+        Tests: fast/css/font-face-synthetic-bold-italic.html
+               fast/css/font-face-weight-matching.html
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule): Removed "all", "lighter", "bolder" handling code.
+        (WebCore::compareFontFaces):Updated the weight matching algortihm.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Replaced parseFontStyle() call with checking primitive values.
+        (WebCore::CSSParser::parseFontWeight): Changed to allow only primitive values.
+        (WebCore::CSSParser::createFontFaceRule): Removed checks for font-weight and font-style.
+        (WebCore::CSSParser::deleteFontFaceOnlyValues): Ditto.
+        * css/CSSParser.h: Removed parseFontStyle().
+
+2012-02-12  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Avoid unnecessary memset in per-tile layer updater.
+        https://bugs.webkit.org/show_bug.cgi?id=78426
+
+        Reviewed by Stephen White.
+
+        Use our own SkBitmap and call SkBitmap::allocPixels() instead of
+        letting SkDevice construct a SkBitmap. This avoids an unnecessary
+        memset otherwise done by SkDevice.
+
+        No new tests.
+
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect):
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        (Texture):
+
+2012-02-12  Joe Thomas  <joethomas@motorola.com>
+
+        Add toText and isTextNode helpers in Text class.
+        https://bugs.webkit.org/show_bug.cgi?id=78140
+
+        Added a new helper function toText() in dom/Text.h which does the type casting operation to Text object.
+        Modified the code to make use of this helper function.
+
+        Reviewed by Adam Barth.
+
+        No new tests.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::accessibleNameForNode):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+        * dom/Attr.cpp:
+        (WebCore::Attr::childrenChanged):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::normalize):
+        * dom/Position.cpp:
+        (WebCore::Position::containerText):
+        (WebCore::Position::leadingWhitespacePosition):
+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::scriptContent):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::recalcShadowTreeStyle):
+        * dom/Text.h: Added new helper function toText.
+        (WebCore::toText): new helper function which does the type casting operation to Text object.
+        (WebCore):
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::isNewLineAtPosition):
+        (WebCore::ApplyBlockElementCommand::endOfNextParagrahSplittingTextNodesIfNeeded):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::splitTextAtEnd):
+        (WebCore::ApplyStyleCommand::splitTextElementAtEnd):
+        (WebCore::ApplyStyleCommand::joinChildTextNodes):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::canRebalance):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit):
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::removePlaceholderAt):
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::fixupWhitespace):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setComposition):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
+        (WebCore::ReplaceSelectionCommand::addSpacesForSmartReplace):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
+        (WebCore::ReplaceSelectionCommand::performTrivialReplace):
+        * editing/htmlediting.cpp:
+        (WebCore::lineBreakExistsAtPosition):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        * html/HTMLElement.cpp:
+        (WebCore::replaceChildrenWithFragment):
+        (WebCore::replaceChildrenWithText):
+        (WebCore::mergeWithNextTextNode):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::hasFallbackContent):
+        (WebCore::HTMLObjectElement::updateDocNamedItem):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::setText):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultValue):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::innerTextValue):
+        (WebCore::HTMLTextFormControlElement::valueWithHardLineBreaks):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::text):
+        (WebCore::HTMLTitleElement::setText):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText):
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText):
+        (WebCore::RenderTextFragment::previousCharacter):
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [CPPCustom] from CodeGeneratorCPP.pm
+        https://bugs.webkit.org/show_bug.cgi?id=78342
+
+        Reviewed by Adam Barth.
+
+        This patch removes [CPPCustom].
+
+        [CPPCustom] has been used in DOMWindow.location only to indicate that
+        DOMWindow.location should be ignored in CPP. However, there are many
+        other attributes and methods that CPP does not support (e.g. [CallWith=...],
+        [CustomSetter], etc), and they are not yet marked with [CPPCustom].
+        CPP just generates "meaningless" code for those unsupported attributes
+        and methods. Ideally we can mark all unsupported attributes and methods
+        with [CPPCustom], but it would not be so practical. Otherwise, removing
+        [CPPCustom] would make sense. The side effect of removing [CPPCustom]
+        is just that CPP will generate "meaningless" code for DOMWindow.location.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (ShouldSkipType):
+        * page/DOMWindow.idl:
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSCustomPrototypeDefineOwnProperty] to [JSCustomDefineOwnPropertyOnPrototype]
+        https://bugs.webkit.org/show_bug.cgi?id=78354
+
+        Reviewed by Adam Barth.
+
+        This patch renames [JSCustomPrototypeDefineOwnProperty] to
+        [JSCustomDefineOwnPropertyOnPrototype], for naming consistency with
+        [JSCustomDefineOwnProperty] and [JSCustomNamedGetterOnPrototype].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        * page/Location.idl:
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to send all JSC debug logging to a file
+        https://bugs.webkit.org/show_bug.cgi?id=78418
+
+        Reviewed by Sam Weinig.
+        
+        Introduced wtf/DataLog, which defines WTF::dataFile, WTF::dataLog,
+        and WTF::dataLogV. Changed all debugging- and profiling-related printfs
+        to use WTF::dataLog() or one of its friends. By default, debug logging
+        goes to stderr, unless you change the setting in wtf/DataLog.cpp.
+
+        No new tests because behavior is unchanged.
+
+        * ForwardingHeaders/wtf/DataLog.h: Added.
+
+2012-02-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+        (WebCore):
+            - expose allowsAccessFrom check to JSC.
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+            - expose allowsAccessFrom check to JSC.
+
+2012-02-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of WebCore::URLString
+        https://bugs.webkit.org/show_bug.cgi?id=78429
+
+        Reviewed by Adam Barth.
+
+        URLString is unused, remove the class.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/KURL.cpp:
+        * platform/KURL.h:
+        (KURL):
+        * platform/URLString.h: Removed.
+
+2012-02-11  Sam Weinig  <sam@webkit.org>
+
+        Fix the windows build.
+
+        Since Windows uses an all-in-one file to compile, the isRespectedPresentationAttribute()
+        functions all need unique names.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLHRElement.cpp:
+        * html/HTMLIFrameElement.cpp:
+        * html/HTMLImageElement.cpp:
+        * html/HTMLInputElement.cpp:
+        * html/HTMLMarqueeElement.cpp:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTablePartElement.cpp:
+        * mathml/MathMLElement.cpp:
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Overlay scrollbars don't appear when scrolling on the scrolling thread
+        https://bugs.webkit.org/show_bug.cgi?id=78427
+
+        Reviewed by Sam Weinig.
+
+        Add a ScrollAnimator::notifyContentAreaScrolled and call it from ScrollAnimator::notifyContentAreaScrolled.
+        It is then overridden in ScrollAnimatorMac to tickle AppKit so that overlay scrollbars will be shown.
+
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::notifyContentAreaScrolled):
+        (ScrollAnimator):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+        * platform/mac/ScrollAnimatorMac.h:
+        (ScrollAnimatorMac):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::notifyPositionChanged):
+        (WebCore::ScrollAnimatorMac::notifyContentAreaScrolled):
+        (WebCore):
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Implement more ScrollElasticityControllerClient member functions
+        https://bugs.webkit.org/show_bug.cgi?id=78425
+        <rdar://problem/10710727>
+
+        Reviewed by Sam Weinig.
+
+        * page/scrolling/ScrollingTreeNode.h:
+        (ScrollingTreeNode):
+        (WebCore::ScrollingTreeNode::horizontalScrollElasticity):
+        (WebCore::ScrollingTreeNode::verticalScrollElasticity):
+        (WebCore::ScrollingTreeNode::hasEnabledHorizontalScrollbar):
+        (WebCore::ScrollingTreeNode::hasEnabledVerticalScrollbar):
+        Add new getters.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::allowsHorizontalStretching):
+        (WebCore::ScrollingTreeNodeMac::allowsVerticalStretching):
+        (WebCore::ScrollingTreeNodeMac::stretchAmount):
+        (WebCore::ScrollingTreeNodeMac::pinnedInDirection):
+        (WebCore::ScrollingTreeNodeMac::canScrollHorizontally):
+        (WebCore::ScrollingTreeNodeMac::canScrollVertically):
+        (WebCore::ScrollingTreeNodeMac::absoluteScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeNodeMac::startSnapRubberbandTimer):
+        (WebCore::ScrollingTreeNodeMac::stopSnapRubberbandTimer):
+        (WebCore::ScrollingTreeNodeMac::scrollByWithoutContentEdgeConstraints):
+        Implement ScrollElasticityControllerClient member functions.
+
+2012-02-11  Antti Koivisto  <antti@apple.com>
+
+        Add size assert for Length
+        https://bugs.webkit.org/show_bug.cgi?id=78420
+
+        Rubber-stamped by Andreas Kling.
+
+        Length type is memory critical and must not grow.
+
+        * platform/Length.cpp:
+        (SameSizeAsLength):
+        (WebCore):
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Pass wheel events to a scroll elasticity controller on the scrolling thread
+        https://bugs.webkit.org/show_bug.cgi?id=78421
+
+        Reviewed by Sam Weinig.
+
+        Add a ScrollElasticityController to ScrollingTreeNodeMac and pass wheel events to it.
+        Fix ScrollingTreeNodeMac::scrollBy to clamp by the minimum and maximum scroll positions.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::ScrollingTreeNodeMac):
+        (WebCore::ScrollingTreeNodeMac::handleWheelEvent):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollBy):
+        (WebCore::ScrollingTreeNodeMac::setScrollLayerPosition):
+        (WebCore::ScrollingTreeNodeMac::minimumScrollPosition):
+        (WebCore):
+        (WebCore::ScrollingTreeNodeMac::maximumScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::scrollBy):
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        Attribute styles should be created lazily.
+        <http://webkit.org/b/78381>
+
+        Reviewed by Antti Koivisto.
+
+        TL;DR summary: Lazily construct the StyledElement::attributeStyle() instead of
+        moving properties in/out of it in parseAttribute(). This allows us to enable
+        the matched declaration cache for elements with presentation attributes.
+
+        The matched declaration cache has been disabled for elements with presentation
+        attributes because attributeStyle() was mutable, and (simply put) the cache maps
+        a set of StylePropertySet pointers to a resulting RenderStyle. This requires
+        that the StylePropertySets are immutable.
+
+        To make them immutable, we now construct the attribute style lazily by adding
+        a flag (to Node) that gets set in parseAttribute() when a presentation attribute
+        respected by the element changes. A subsequent call to attributeStyle() checks
+        the flag and rebuilds the style by looping over the attributes and calling the
+        new virtual StyledElement::collectStyleForAttribute() on each one. Any dangling
+        references to the previous attribute style will be garbage collected by the
+        cache in CSSStyleSelector::sweepMatchedDeclarationCache().
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchAllRules):
+
+            Enable matched declaration cache for elements with attribute style.
+
+        * dom/Node.h:
+        (WebCore::Node::attributeStyleDirty):
+        (WebCore::Node::setAttributeStyleDirty):
+        (WebCore::Node::clearAttributeStyleDirty):
+
+            Add a Node flag to signify that a presentation attribute has changed and
+            the attribute style needs to be rebuilt.
+
+        * dom/ElementAttributeData.h:
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::setAttributeStyle):
+
+            Added a setter for the attribute style, called by updateAttributeStyle().
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addHTMLLengthToStyle):
+        (WebCore::StyledElement::addHTMLColorToStyle):
+
+            Moved and renamed two of the old addCSS* helpers from StyledElement.
+
+        (WebCore::StyledElement::updateAttributeStyle):
+
+            Called by attributeStyle() in case the "attribute style dirty" flag is
+            set. Rebuilds the attribute style from scratch by looping over the
+            attribute map and calling collectStyleForAttribute() on each attribute.
+
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::collectStyleForAttribute):
+        (WebCore::StyledElement::attributeStyle):
+        (WebCore::StyledElement::setNeedsAttributeStyleUpdate):
+
+            Helper, sets the attribute style dirty flag and marks the element for
+            full style recalc. This is what parseAttribute() calls in subclasses
+            when they encounter a presentation attribute.
+
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::collectStyleForAttribute):
+        (WebCore::HTMLBRElement::parseAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLBodyElement::collectStyleForAttribute):
+        (WebCore::HTMLBodyElement::parseAttribute):
+        * html/HTMLBodyElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::collectStyleForAttribute):
+        (WebCore::HTMLDivElement::parseAttribute):
+        * html/HTMLDivElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::applyBorderAttributeToStyle):
+        (WebCore::HTMLElement::mapLanguageAttributeToLocale):
+        (WebCore::HTMLElement::collectStyleForAttribute):
+        (WebCore::HTMLElement::parseAttribute):
+        (WebCore::HTMLElement::applyAlignmentAttributeToStyle):
+        * html/HTMLElement.h:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::collectStyleForAttribute):
+        (WebCore::HTMLEmbedElement::parseAttribute):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::collectStyleForAttribute):
+        (WebCore::HTMLFontElement::parseAttribute):
+        * html/HTMLFontElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::collectStyleForAttribute):
+        (WebCore::HTMLFrameSetElement::parseAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        (WebCore::HTMLHRElement::parseAttribute):
+        * html/HTMLHRElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
+        (WebCore::HTMLIFrameElement::parseAttribute):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLImageElement::collectStyleForAttribute):
+        (WebCore::HTMLImageElement::parseAttribute):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLInputElement::collectStyleForAttribute):
+        (WebCore::HTMLInputElement::parseAttribute):
+        * html/HTMLInputElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::collectStyleForAttribute):
+        (WebCore::HTMLLIElement::parseAttribute):
+        * html/HTMLLIElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
+        (WebCore::HTMLMarqueeElement::parseAttribute):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::collectStyleForAttribute):
+        (WebCore::HTMLOListElement::parseAttribute):
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::collectStyleForAttribute):
+        (WebCore::HTMLObjectElement::parseAttribute):
+        * html/HTMLObjectElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::collectStyleForAttribute):
+        (WebCore::HTMLParagraphElement::parseAttribute):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLPlugInElement::collectStyleForAttribute):
+        (WebCore::HTMLPlugInElement::parseAttribute):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        (WebCore::HTMLPreElement::collectStyleForAttribute):
+        (WebCore::HTMLPreElement::parseAttribute):
+        * html/HTMLPreElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
+        (WebCore::HTMLTableCaptionElement::parseAttribute):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
+        (WebCore::HTMLTableCellElement::parseAttribute):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::collectStyleForAttribute):
+        (WebCore::HTMLTableColElement::parseAttribute):
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::getBordersFromFrameAttributeValue):
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        (WebCore::HTMLTableElement::parseAttribute):
+        * html/HTMLTableElement.h:
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+        (WebCore::HTMLTablePartElement::parseAttribute):
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::collectStyleForAttribute):
+        (WebCore::HTMLTextAreaElement::parseAttribute):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::collectStyleForAttribute):
+        (WebCore::HTMLUListElement::parseAttribute):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::collectStyleForAttribute):
+        (WebCore::HTMLVideoElement::parseAttribute):
+        * html/HTMLVideoElement.h:
+        * mathml/MathMLElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::MathMLElement::collectStyleForAttribute):
+        (WebCore::MathMLElement::parseAttribute):
+        * mathml/MathMLElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::collectStyleForAttribute):
+        (WebCore::SVGImageElement::parseAttribute):
+        * svg/SVGImageElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::collectStyleForAttribute):
+        (WebCore::SVGStyledElement::parseAttribute):
+        * svg/SVGStyledElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::collectStyleForAttribute):
+        (WebCore::SVGTextContentElement::parseAttribute):
+        * svg/SVGTextContentElement.h:
+
+            Split handling of presentation attributes between parseAttribute() and
+            collectStyleForAttribute() as appropriate. Some minor refactorings here and
+            there (mostly in HTMLTableElement) to avoid excessive code duplication.
+            Also sprinkled FIXMEs about inefficiencies we should clean up.
+
+2012-02-11   Arko Saha  <arko@motorola.com>
+
+        HTML 5: Support click() method on HTMLElement.
+        https://bugs.webkit.org/show_bug.cgi?id=27880
+
+        Reviewed by Timothy Hatcher.
+
+        Test: fast/dom/click-method-on-html-element.html
+
+        * bindings/objc/PublicDOMInterfaces.h: Added click() method in DOMHTMLElement
+        with availability macro AVAILABLE_AFTER_WEBKIT_VERSION_5_1.
+        * html/HTMLButtonElement.idl: Moved click() method under LANGUAGE_OBJECTIVE_C.
+        * html/HTMLElement.idl: Added click() IDL method.
+        * html/HTMLInputElement.idl: Moved click() method under LANGUAGE_OBJECTIVE_C.
+
+2012-02-11  Martin Robinson  <mrobinson@igalia.com>
+
+        [GStreamer] html5test.com says that gstreamer ports do not support WebM for audio
+        https://bugs.webkit.org/show_bug.cgi?id=78244
+
+        Reviewed by Eric Seidel.
+
+        Specifically advertise support for audio/webm when we support the vorbis
+        audio codec. This is necessary because gstreamer doesn't advertise it.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache): Add an override for audio/webm.
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::scrollToRevealSelection):
+
+2012-02-08  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Enable CSS filters on composited layers.
+        https://bugs.webkit.org/show_bug.cgi?id=77266
+
+        Reviewed by James Robinson.
+
+        Will be covered by existing tests in css3/filters (when enabled).
+
+        * WebCore.gypi:
+        Add CCRenderSurfaceFilters.* to the Chromium build.
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setFilters):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        Override setFilters() virtual from GraphicsLayer.
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setFilters):
+        Implement setFilters() to cache the filters here...
+        (WebCore::LayerChromium::pushPropertiesTo):
+        ... and push them to the CCLayerImpl at commit time.
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::filters):
+        Implement accessor.
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (WebCore::RenderSurfaceChromium::setFilters):
+        Implement stub version of setFilters(), to satisfy the templates.
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::setFilters):
+        Implement setter to receive filters at commit time.
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::filters):
+        Implement member var and accessor for filters.
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        Add another clause here to force creation of a RenderSurface when
+        filters are present, and to forward them from the layer to the
+        RenderSurface.
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::draw):
+        (WebCore::CCRenderSurface::drawLayer):
+        Check for filters at draw time, apply them, and forward the result
+        through the drawing traversal.
+        (WebCore::CCRenderSurface::drawSurface):
+        If filter bitmap is present, bind it instead of the normal
+        RenderSurface texture.
+        (WebCore::CCRenderSurface::applyFilters):
+        Apply filters to the render surface texture, and return the result.
+        This function is a no-op for the threaded compositor, due to use
+        of the SharedGraphicsContext3D.
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore::CCRenderSurface::setFilters):
+        (WebCore::CCRenderSurface::filters):
+        (CCRenderSurface):
+        Filters getters and setters.
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp: Added.
+        (WebCore::CCRenderSurfaceFilters::apply):
+        External interface for this (static) class.  All internal
+        implementation and helper functions are in the unnamed namespace.
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.h: Added.
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        Node.isEqualNode() compares attributes twice.
+        <http://webkit.org/b/78414>
+
+        Reviewed by Anders Carlsson.
+
+        A single pass across the attribute maps should be enough for anyone.
+
+        Added a test verifying correct behavior of Node.isEqualNode() when comparing
+        two elements, one of which has had attributes that were all removed,
+        resulting in an empty but non-null NamedNodeMap hanging off of the element.
+        Note that this change is not fixing a regression, I'm just adding the test
+        since I came close to introducing a bug here.
+
+        Test: fast/dom/isEqualNode-after-removeAttribute.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::isEqualNode):
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLTablePartElement: Add helper method to find parent table.
+        <http://webkit.org/b/78413>
+
+        Reviewed by Anders Carlsson.
+
+        Add HTMLTablePartElement::findParentTable() and use that in subclasses instead
+        of duplicating the code.
+
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::additionalAttributeStyle):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::additionalAttributeStyle):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::findParentTable):
+        (WebCore):
+        * html/HTMLTablePartElement.h:
+        (WebCore):
+        (HTMLTablePartElement):
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::additionalAttributeStyle):
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        Use Element's hasName/hasID flags to avoid unnecessary work when looking up name/id attributes.
+        <http://webkit.org/b/77845>
+
+        Reviewed by Anders Carlsson.
+
+        Have Element::getIdAttribute() check the hasID() flag before looking up the attribute.
+        Add an Element::getNameAttribute() to do the same thing with hasName().
+        Update call sites to make use of these helpers whenever possible.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * dom/DocumentOrderedMap.cpp:
+        (WebCore::keyMatchesId):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::getIdAttribute):
+        (WebCore):
+        (WebCore::Element::getNameAttribute):
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::nodeMatches):
+        * dom/StaticHashSetNodeList.cpp:
+        (WebCore::StaticHashSetNodeList::itemWithName):
+        * dom/StaticNodeList.cpp:
+        (WebCore::StaticNodeList::itemWithName):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::name):
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::checkForNameMatch):
+        (WebCore::HTMLCollection::updateNameCache):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::updateNameCache):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formControlName):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::name):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::name):
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::itemAfter):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        (WebCore::HTMLObjectElement::updateDocNamedItem):
+        (WebCore::HTMLObjectElement::containsJavaApplet):
+        (WebCore::HTMLObjectElement::formControlName):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::buildObjectForFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::matchLabelsAgainstElement):
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getElementById):
+
+2012-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107435.
+        http://trac.webkit.org/changeset/107435
+        https://bugs.webkit.org/show_bug.cgi?id=78410
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::writeSelectionToPasteboard):
+        * platform/Pasteboard.h:
+        (WebCore):
+        (Pasteboard):
+        * platform/PasteboardStrategy.h: Removed.
+        * platform/PlatformPasteboard.h: Removed.
+        * platform/PlatformStrategies.h:
+        (WebCore):
+        (WebCore::PlatformStrategies::PlatformStrategies):
+        (PlatformStrategies):
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::insertablePasteboardTypes):
+        (WebCore::DragData::asURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore):
+        (WebCore::selectionPasteboardTypes):
+        (WebCore::writableTypesForURL):
+        (WebCore::createWritableTypesForImage):
+        (WebCore::writableTypesForImage):
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::clear):
+        (WebCore::Pasteboard::writeSelectionForTypes):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::writeURLForTypes):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::writeFileWrapperAsRTFDAttachment):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::writeClipboard):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::documentFragmentWithRTF):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/mac/PlatformPasteboardMac.mm: Removed.
+
+2012-02-10  Antti Koivisto  <antti@apple.com>
+
+        Move CSSOM wrapper pointer out of StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=78406
+
+        Reviewed by Andreas Kling.
+        
+        Most StylePropertySet instances never have CSSOM wrappers so having a pointer to one in
+        each and and every object makes no sense.
+
+        Move the PropertySetCSSStyleDeclaration instances to a global HashMap. This shrinks
+        StylePropertySet by a pointer.
+        
+        Added COMPILE_ASSERT for StylePropertySet size.
+
+        * css/StylePropertySet.cpp:
+        (WebCore):
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::~StylePropertySet):
+        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+
+2012-02-10  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - use createXXX() function naming, ASSERT()s
+        https://bugs.webkit.org/show_bug.cgi?id=78384
+
+        Reviewed by Eric Seidel.
+
+        Standard RefPtr function naming uses "createXXX" instead of "makeXXX".
+        I also added a couple of ASSERT()s.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::createBlockStyle):
+        * rendering/mathml/RenderMathMLBlock.h:
+        (RenderMathMLBlock):
+        * rendering/mathml/RenderMathMLFenced.cpp:
+        (WebCore::RenderMathMLFenced::createOperatorStyle):
+        (WebCore::RenderMathMLFenced::makeFences):
+        (WebCore::RenderMathMLFenced::addChild):
+        * rendering/mathml/RenderMathMLFenced.h:
+        (RenderMathMLFenced):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::addChild):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::addChild):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
+        (WebCore::RenderMathMLUnderOver::addChild):
+
+2012-02-10  Dan Bernstein  <mitz@apple.com>
+
+        Non-threaded scrolling build fix.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::requestScrollPositionUpdate):
+
+2012-02-10  Edward O'Connor  <eoconnor@apple.com>
+
+        Change values for WEBKIT_KEYFRAMES_RULE, WEBKIT_KEYFRAME_RULE
+        https://bugs.webkit.org/show_bug.cgi?id=71293
+
+        Reviewed by Chris Marrin.
+
+        Tests: animations/animation-css-rule-types.html
+
+        * css/CSSRule.h: Change WEBKIT_KEYFRAMES_RULE to 7 and
+        WEBKIT_KEYFRAME_RULE to 8.
+        * css/CSSRule.idl: Ditto.
+
+2012-02-10  Eric Seidel  <eric@webkit.org>
+
+        AtomicMarkupTokenBase::initializeAttributes should not create a StringImpl if it doesn't need to
+        https://bugs.webkit.org/show_bug.cgi?id=78394
+
+        Reviewed by Adam Barth.
+
+        On the very next line is passes value to Attribute::create which takes
+        an AtomicString, so this code was just allocating a StringImpl (every time)
+        only to (much of the time) just release that StringImpl on the next line
+        when it got the AtomicString instead.
+
+        I discovered this while looking at DOM/Events.html, but it's unclear
+        if this fix actually makes that benchmark faster.
+
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::::initializeAttributes):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Always update the scroll position through the scrolling coordinator
+        https://bugs.webkit.org/show_bug.cgi?id=78403
+
+        Reviewed by Sam Weinig.
+
+        To get correct behavior, we always want to update the scrolling layer position
+        on the scrolling thread. Do this by allowing the scrolling coordinator to intercept
+        scroll position update requests and send them to the scrolling tree.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::requestScrollPositionUpdate):
+        Let the scrolling coordinator have a go at updating the scroll position for this frame view.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::requestScrollPositionUpdate):
+        If it's a frame view we're coordinating scrolling for, tell the scrolling tree to update 
+        the scroll position.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::setMainFrameScrollPosition):
+        Call through to the scrolling tree node.
+
+        * page/scrolling/ScrollingTreeNode.h:
+        Add a new pure virtual setScrollPosition member function.
+
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        Move most of the code from scrollBy here.
+
+        (WebCore::ScrollingTreeNodeMac::setScrollLayerPosition):
+        Rename this member function from setScrollPosition to avoid conflicts.
+
+        (WebCore::ScrollingTreeNodeMac::scrollBy):
+        Just call setScsrollPosition.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
+        Call requestScrollPositionUpdate, which allows subclasses of scrollable area to intercept
+        the scroll operation and call it asynchronously.
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        ScrollableArea should have a function for noting that the scroll position changed
+        https://bugs.webkit.org/show_bug.cgi?id=78402
+
+        Reviewed by Sam Weinig.
+
+        The scrolling coordinator needs a specialized function to call whenever the main frame
+        scrolling position has changed, so add ScrollableArea::notifyScrollPositionChanged and
+        call it from the scrolling coordinator.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPosition):
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+        New function.
+
+        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
+        Call ScrollableArea::notifyScrollPositionChanged.
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Unreviewed build fix.
+
+        Fixing the build by removing a duplicate definition of pixelSnappedIntRect in LayoutTypes.h and
+        removing conflict markers from the changelog.
+
+        * rendering/LayoutTypes.h:
+        (pixelSnappedIntRect):
+        * ChangeLog:
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Add pixelSnappedIntRect method
+        https://bugs.webkit.org/show_bug.cgi?id=78054
+
+        Reviewed by Eric Seidel.
+
+        This patch introduces a pixelSnappedIntRect method that will snap a sub-pixel LayoutRect to
+        pixel boundaries. These pixel snapped forms are what is used to communicate with the graphics
+        engine (to paint at whole pixel boundaries) and the embedding app (so they don't need to 
+        understand we're using sub-pixel units).
+
+        No new tests. No change in behavior.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isOffScreen):
+        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::doDeferredRepaints):
+        (WebCore::FrameView::windowClipRectForLayer):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::selectionGaps):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::pushContentsClip):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::paint):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        (WebCore::RenderFrameSet::positionFramesWithFlattening):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::paintScrollbar):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::addPDFURLRect):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::showPopup):
+        (WebCore::RenderTextControlSingleLine::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getRoundedBorderFor):
+        (WebCore::RenderStyle::getRoundedInnerBorderFor):
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Add pixelSnappedIntRect method
+        https://bugs.webkit.org/show_bug.cgi?id=78054
+
+        Reviewed by Eric Seidel.
+
+        This patch introduces a pixelSnappedIntRect method that will snap a sub-pixel LayoutRect to
+        pixel boundaries. These pixel snapped forms are what is used to communicate with the graphics
+        engine (to paint at whole pixel boundaries) and the embedding app (so they don't need to 
+        understand we're using sub-pixel units).
+
+        No new tests. No change in behavior.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isOffScreen):
+        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::doDeferredRepaints):
+        (WebCore::FrameView::windowClipRectForLayer):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::selectionGaps):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::pushContentsClip):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::paint):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        (WebCore::RenderFrameSet::positionFramesWithFlattening):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+                * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::paintScrollbar):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::addPDFURLRect):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::showPopup):
+        (WebCore::RenderTextControlSingleLine::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getRoundedBorderFor):
+        (WebCore::RenderStyle::getRoundedInnerBorderFor):
+
+2012-02-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Web Inspector: Add the ability to jump to the source for a given frame
+        https://bugs.webkit.org/show_bug.cgi?id=78396
+
+        Reviewed by Tim Hatcher.
+
+        * WebCore.exp.in: Add a new exported function.
+        * inspector/InspectorController.cpp: Add and expose the InspectorPageAgent.
+        (WebCore::InspectorController::InspectorController): Set m_pageAgent.
+        * inspector/InspectorController.h: Add m_pageAgent.
+        (WebCore::InspectorController::pageAgent): Return m_pageAgent.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::showMainResourceForFrame): Get the inspector's frame ID
+            of the frame that was passed in, and add a call to evaluate on load.
+        * inspector/InspectorFrontendClientLocal.h:
+
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.showMainResourceForFrame): Add a FIXME to show the source code for the main
+            resource of the given frame.
+
+2012-02-10  Vineet Chaudhary  <rgf748@motorola.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=72756
+        DOMHTMLElement’s accessKey property is declared as available in WebKit version that didn’t have it. 
+
+        Reviewed by Timothy Hatcher.
+
+        No new tests.
+
+        * bindings/objc/PublicDOMInterfaces.h: Moving accessKey property to DOMHTMLElement
+          with an appropriate availability macro AVAILABLE_AFTER_WEBKIT_VERSION_5_1.
+          Also Moving accessKey property to HTMLAnchorElement, HTMLAreaElement, HTMLButtonElement,
+          HTMLInputElement, HTMLLabelElement, HTMLLegendElement  and HTMLTextAreaElement idls
+          with an availability macro AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1.
+        * html/HTMLAnchorElement.idl: Adding accessKey entries back to idls under LANGUAGE_OBJECTIVE_C.
+        * html/HTMLAreaElement.idl: Ditto.
+        * html/HTMLButtonElement.idl: Ditto.
+        * html/HTMLInputElement.idl: Ditto.
+        * html/HTMLLabelElement.idl: Ditto.
+        * html/HTMLLegendElement.idl: Ditto.
+        * html/HTMLTextAreaElement.idl: Ditto.
+
+2012-02-10  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::scrollToRevealSelection):
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * UseV8.cmake: Add some previously-missing files.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * bindings/js/JSBindingsAllInOne.cpp: ditto.
+        * dom/DOMAllInOne.cpp: ditto.
+
+2012-02-10  Emil A Eklund  <eae@chromium.org> and Levi Weintraub  <leviw@chromium.org>
+
+        Add FractionalLayoutUnit type for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=77485
+
+        Reviewed by Eric Seidel.
+
+        Add fixed point implementation (FractionalLayoutUnit).
+
+        FractionalLayoutUnit represents values as multiples of 1/60th pixel. This allows us
+        to represent sub-pixel values using integer math and avoids floating point precision
+        problems.
+
+        No new tests.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/FractionalLayoutUnit.h: Added.
+
+2012-02-10  Adam Langley  <agl@chromium.org>
+
+        Don't lowercase ping URLs.
+
+        Previously, ping URLs would be lowercased when splitting them apart.
+        URLs are not, however, case-insensitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=78371
+
+        Reviewed by Tony Chang.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::sendPings): Don't lowercase URL.
+
+2012-02-10  Ojan Vafai  <ojan@chromium.org>
+
+        flex-pack:center and flex-item-align:center should do true centering
+        https://bugs.webkit.org/show_bug.cgi?id=77385
+
+        Reviewed by Tony Chang.
+
+        Also, removed passing totalPositiveFlexibility around. We don't
+        need to know about positive/negative flex once we run the flexing algorithm.
+        We used to need to know this in order to flex margins, but margins can
+        no longer be flexed.
+
+        Test: css3/flexbox/true-centering.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        (WebCore::initialPackingOffset):
+        (WebCore::packingSpaceBetweenChildren):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+        (WebCore::RenderFlexibleBox::layoutColumnReverse):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Split MarkedSpace into destructor and destructor-free subspaces
+        https://bugs.webkit.org/show_bug.cgi?id=77761
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        * bindings/js/JSDOMWindowShell.cpp: Removed old operator new, which was just used in the create
+        function so that we can use allocateCell instead.
+        (WebCore):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::create):
+        (JSDOMWindowShell):
+        * bindings/scripts/CodeGeneratorJS.pm: Added destructor back to root JS DOM nodes (e.g. JSNode, etc)
+        because their destroy functions need to be called, so we don't want the NeedsDestructor struct to 
+        think they don't need destruction due to having empty/trivial destructors.
+        Removed ASSERT_HAS_TRIVIAL_DESTRUCTOR from all JS DOM wrapper auto-generated objects because their 
+        ancestors now have non-trivial destructors. 
+        (GenerateHeader):
+        (GenerateImplementation):
+        (GenerateConstructorDefinition):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Remove a bunch of unused ScrollableArea member functions
+        https://bugs.webkit.org/show_bug.cgi?id=78388
+
+        Reviewed by Beth Dakin.
+
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+
+2012-02-10  Pavel Podivilov  <podivilov@chromium.org>
+
+        Fix a few typos in IDL exception names.
+        https://bugs.webkit.org/show_bug.cgi?id=78356
+
+        Reviewed by Adam Barth.
+
+        * dom/Node.idl:
+        * notifications/NotificationCenter.idl:
+        * page/Navigator.idl:
+
+2012-02-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        DefaultLocalizationStrategy::htmlSelectMultipleItems() should use size_t instead of int
+        https://bugs.webkit.org/show_bug.cgi?id=78374
+
+        Reviewed by Joseph Pecoraro.
+
+        The value comes from size_t and is converted to int for no good reason. We should use
+        size_t.
+
+        * platform/DefaultLocalizationStrategy.cpp:
+        (WebCore::DefaultLocalizationStrategy::htmlSelectMultipleItems):
+        * platform/DefaultLocalizationStrategy.h:
+        (DefaultLocalizationStrategy):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        More ScrollableArea cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78383
+
+        Reviewed by Beth Dakin.
+
+        Get rid of setScrollOriginX and setScrollOriginY. Make ScrollableArea::setScrollOrigin private.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::setScrollOrigin):
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSCustomPrototypePutDelegate] to [JSCustomNamedGetterOnPrototype]
+        https://bugs.webkit.org/show_bug.cgi?id=78353
+
+        Reviewed by Adam Barth.
+
+        [JSCustomPrototypePutDelegate] is used to write custom code for named
+        getters on a prototype interface. "PutDelegate" is just a method name
+        in implementation and not so descriptive. This patch renames it to
+        [JSCustomNamedGetterOnPrototype]. This is also for naming consistency
+        with [CustomNamedGetter].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * page/Location.idl:
+
+2012-02-10  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+        now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+        WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+        class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+        interface but this one more step in the direction of removing access to NSPasteboard from
+        the WebProcess.
+        As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+        
+        Reviewed by Anders Carlsson.
+
+        No new tests. No change in behavior, just code refactoring.
+
+        * WebCore.exp.in: Added exported class PlatformPasteboard.
+        * WebCore.xcodeproj/project.pbxproj: Added new files to the build.
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::writeSelectionToPasteboard): New method signature that doesn't use OBJ-C types.
+        * platform/Pasteboard.h:
+
+        * platform/PasteboardStrategy.h: Added PasteboardStrategy abstract class.
+        * platform/PlatformPasteboard.h: Added. This class implements access to NSPasteboard.
+        * platform/PlatformStrategies.h:
+        (WebCore::PlatformStrategies::pasteboardStrategy): Added.
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::insertablePasteboardTypes): 
+        (WebCore::DragData::asURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::selectionPasteboardTypes): Changed to use Vector<String> instead of NSArray.
+        (WebCore::writableTypesForURL): Ditto.
+        (WebCore::createWritableTypesForImage): Ditto.
+        (WebCore::writableTypesForImage): Ditto.
+        (WebCore::Pasteboard::Pasteboard): Removed access to NSPasteboard.
+        (WebCore::Pasteboard::clear): Modified to use platformStrategies()->pasteboardStrategy().
+        (WebCore::Pasteboard::writeSelectionForTypes): Ditto.
+        (WebCore::Pasteboard::writePlainText): Ditto.
+        (WebCore::Pasteboard::writeSelection): Ditto.
+        (WebCore::writeURLForTypes): Ditto.
+        (WebCore::Pasteboard::writeURL): Ditto.
+        (WebCore::writeFileWrapperAsRTFDAttachment): Ditto.
+        (WebCore::Pasteboard::writeImage): Ditto.
+        (WebCore::Pasteboard::writeClipboard): Ditto.
+        (WebCore::Pasteboard::canSmartReplace): Ditto.
+        (WebCore::Pasteboard::plainText): Ditto.
+        (WebCore::documentFragmentWithRTF): Ditto.
+        (WebCore::Pasteboard::documentFragment): Ditto.
+        * platform/mac/PlatformPasteboardMac.mm: Added.
+        (WebCore::PlatformPasteboard::PlatformPasteboard):
+        (WebCore::PlatformPasteboard::getTypes):
+        (WebCore::PlatformPasteboard::bufferForType):
+        (WebCore::PlatformPasteboard::getPathnamesForType):
+        (WebCore::PlatformPasteboard::stringForType):
+        (WebCore::PlatformPasteboard::copy):
+        (WebCore::PlatformPasteboard::setTypes):
+        (WebCore::PlatformPasteboard::setBufferForType):
+        (WebCore::PlatformPasteboard::setPathnamesForType):
+        (WebCore::PlatformPasteboard::setStringForType):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSCustomGetOwnPropertySlotDelegate] to [JSCustomGetOwnPropertySlotAndDescriptor]
+        https://bugs.webkit.org/show_bug.cgi?id=78352
+
+        Reviewed by Adam Barth.
+
+        [JSCustomGetOwnPropertySlotDelegate] is used for "flexibly customizable"
+        named getter. It allows us to write custom code for getOwnPropertySlotDelegate()
+        and getOwnPropertyDescriptorDelegate(). To clarify that, we can rename
+        [JSCustomGetOwnPropertySlotDelegate] to [JSCustomGetOwnPropertySlotAndDescriptor].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GenerateHeader):
+        (GenerateImplementation):
+
+        * html/HTMLAppletElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLObjectElement.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * workers/WorkerContext.idl:
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Minor ScrollAnimatorMac cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78375
+
+        Reviewed by Beth Dakin.
+
+        Get rid of adjustScrollXPositionIfNecessary and adjustScrollYPositionIfNecessary.
+        Also, reduce nesting in willAdd/didAdd functions by using early returns.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        (ScrollAnimatorMac):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveHorizontalScrollbar):
+        (WebCore::ScrollAnimatorMac::immediateScrollBy):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Minor ScrollableArea cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78372
+
+        Reviewed by Beth Dakin.
+
+        Get rid of scrollToXOffsetWithoutAnimation and scrollToYOffsetWithoutAnimation.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::scrollToOffsetWithoutAnimation):
+        * platform/ScrollableArea.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::computeLogicalHeight):
+        (WebCore::RenderListBox::scrollToRevealElementAtListIndex):
+        (WebCore::RenderListBox::setScrollTop):
+
+2012-02-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] DYLIB_INSTALL_NAME_BASE should not be prefixed by the SDKROOT
+        https://bugs.webkit.org/show_bug.cgi?id=78320
+
+        Reviewed by Joseph Pecoraro.
+
+        <rdar://problem/10839750>
+
+        * Configurations/WebCore.xcconfig:
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Update the non-fast-scrollable region for subframe layout as well
+        https://bugs.webkit.org/show_bug.cgi?id=78366
+        <rdar://problem/10844064>
+
+        Reviewed by Beth Dakin.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::computeNonFastScrollableRegion):
+        Move the non-fast-scrollable region computation out into a new function.
+
+        (WebCore::ScrollingCoordinator::frameViewLayoutUpdated):
+        Always recompute the non-fast-scrollable region whenever a frame view's layout is updated,
+        not just the main frame.
+
+2012-02-09  Chris Marrin  <cmarrin@apple.com>
+
+        Implement hardware animation of CSS filters
+        https://bugs.webkit.org/show_bug.cgi?id=78155
+
+        Added logic to PlatformCAAnimation to return enough information
+        to GraphicsLayerCA to be able to construct a keyPath animation
+        for each filter property. Some filters need to animate multiple
+        properties per filter, so PlatformCAAnimation also returns the number
+        of properties per filter and then an animation is constructed for 
+        each one. Also added all the support logic to handle hardware filter
+        animation in the higher level logic, just like we do for transforms and
+        opacity.
+
+        Also stubbed out new PlatformCAAnimation functions for Windows. We don't yet
+        support hardware filters on Windows.
+
+        Reviewed by Dean Jackson.
+
+        Tests: css3/filters/filter-animation-from-none-hw.html
+               css3/filters/filter-animation-from-none-multi-hw.html
+               css3/filters/filter-animation-from-none-multi.html
+               css3/filters/filter-animation-hw.html
+               css3/filters/filter-animation-multi-hw.html
+               css3/filters/filter-animation-multi.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore):
+        (PropertyWrapperAcceleratedFilter):
+        (WebCore::PropertyWrapperAcceleratedFilter::PropertyWrapperAcceleratedFilter):
+        (WebCore::PropertyWrapperAcceleratedFilter::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedFilter::blend):
+        (WebCore::AnimationBase::ensurePropertyMap):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore):
+        (WebCore::filterOperationsAt):
+        (WebCore::GraphicsLayer::validateFilterOperations):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore):
+        (FilterAnimationValue):
+        (WebCore::FilterAnimationValue::FilterAnimationValue):
+        (WebCore::FilterAnimationValue::clone):
+        (WebCore::FilterAnimationValue::value):
+        (GraphicsLayer):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::propertyIdToString):
+        (WebCore::GraphicsLayerCA::moveOrCopyAnimations):
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
+        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
+        (WebCore):
+        (WebCore::GraphicsLayerCA::createFilterAnimationsFromKeyframes):
+        (WebCore::GraphicsLayerCA::createBasicAnimation):
+        (WebCore::GraphicsLayerCA::createKeyframeAnimation):
+        (WebCore::GraphicsLayerCA::setFilterAnimationEndpoints):
+        (WebCore::GraphicsLayerCA::setFilterAnimationKeyframes):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::cloneLayer):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * platform/graphics/ca/PlatformCAAnimation.h:
+        (PlatformCAAnimation):
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (PlatformCAAnimation::setFromValue):
+        (PlatformCAAnimation::setToValue):
+        (PlatformCAAnimation::setValues):
+        (PlatformCAAnimation::numAnimatedFilterProperties):
+        (PlatformCAAnimation::animatedFilterPropertyName):
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+        (PlatformCAAnimation::setFromValue):
+        (PlatformCAAnimation::setToValue):
+        (PlatformCAAnimation::setValues):
+        (PlatformCAAnimation::numAnimatedFilterProperties):
+        (PlatformCAAnimation::animatedFilterPropertyName):
+        * platform/graphics/filters/FilterOperation.h:
+        (FilterOperation):
+        (WebCore::FilterOperation::isDefault):
+        (DefaultFilterOperation):
+        (WebCore::DefaultFilterOperation::create):
+        (WebCore::DefaultFilterOperation::operator==):
+        (WebCore::DefaultFilterOperation::isDefault):
+        (WebCore::DefaultFilterOperation::DefaultFilterOperation):
+        (WebCore):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasFilter):
+        (RenderLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        (WebCore::RenderLayerBacking::graphicsLayerToCSSProperty):
+        (WebCore::RenderLayerBacking::cssToGraphicsLayerProperty):
+
+2012-02-10  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: CodeGeneratorInspector.py: properly resolve output types of commands
+        https://bugs.webkit.org/show_bug.cgi?id=78025
+
+        Reviewed by Vsevolod Vlasov.
+
+        Code for generating ad-hoc types is added. It was reused from event
+        generator part.
+
+        * inspector/CodeGeneratorInspector.py:
+        (Generator.process_event):
+        (Generator.process_command):
+        (Generator.resolve_type_and_generate_ad_hoc):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.get_type_name_fix):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.get_type_name_fix.NameFix):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.get_type_name_fix.NameFix.output_comment):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.add_type):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceForwardListener):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceForwardListener.add_type_data):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceResolveContext):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceGenerateContext):
+        (Generator):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [CustomPropertyNames] to [CustomEnumerateProperty]
+        https://bugs.webkit.org/show_bug.cgi?id=78351
+
+        Reviewed by Adam Barth.
+
+        This patch renames [CustomPropertyNames] to [CustomEnumerateProperty],
+        for clarification and for naming consistency with [CustomDeleteProperty].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeaderNamedAndIndexedPropertyAccessors):
+        (GenerateImplementationNamedPropertyGetter):
+
+        * css/CSSStyleDeclaration.idl:
+        * dom/DOMStringMap.idl:
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * storage/Storage.idl:
+
+2012-02-09  Antti Koivisto  <antti@apple.com>
+
+        Use underlying property set to refcount PropertySetCSSStyleDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=78257
+
+        Reviewed by Andreas Kling.
+
+        Clean up the PropertySetCSSStyleDeclaration refcounting. PropertySetCSSStyleDeclaration now
+        forwards the ref/deref to the underlying StylePropertySet.
+
+        Also made CSSComputedStyleDeclaration construction use the standard create() pattern.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::ref):
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::deref):
+        * css/CSSComputedStyleDeclaration.h:
+        (WebCore::CSSComputedStyleDeclaration::create):
+        (CSSComputedStyleDeclaration):
+        (WebCore):
+        * css/CSSStyleDeclaration.h:
+        (CSSStyleDeclaration):
+        * css/StylePropertySet.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::PropertySetCSSStyleDeclaration):
+        (WebCore):
+        (WebCore::StylePropertySet::~StylePropertySet):
+        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        * css/StylePropertySet.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::highestEmbeddingAncestor):
+        (WebCore::ApplyStyleCommand::computedFontSize):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::init):
+        (WebCore::EditingStyle::removeStyleAddedByNode):
+        (WebCore::EditingStyle::removeStyleConflictingWithStyleOfNode):
+        (WebCore::EditingStyle::triStateOfStyle):
+        (WebCore::EditingStyle::styleIsPresentInComputedStyleOfNode):
+        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):
+        (WebCore::backgroundColorInEffect):
+        * editing/Editor.cpp:
+        (WebCore::Editor::textDirectionForSelection):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::getComputedStyle):
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::getPropertyValue):
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::baseValueFor):
+
+2012-02-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [TextPrompt] TAB should complete suggestions up to their common prefix in Console
+        https://bugs.webkit.org/show_bug.cgi?id=78236
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+        (WebInspector.TextPrompt.prototype._completeCommonPrefix):
+        (WebInspector.TextPrompt.prototype.acceptSuggestion):
+        (WebInspector.TextPrompt.prototype.tabKeyPressed):
+
+2012-02-10  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: implement undo for setOuterHTML via undo-ing nested primitive commands.
+        https://bugs.webkit.org/show_bug.cgi?id=78346
+
+        Reviewed by Yury Semikhatsky.
+
+        Tests: inspector/elements/undo-set-outer-html-2.html
+               inspector/elements/undo-set-outer-html.html
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::RemoveChildAction::RemoveChildAction):
+        (WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
+        (WebCore::DOMEditor::InsertBeforeAction::undo):
+        (WebCore::DOMEditor::RemoveAttributeAction::RemoveAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::SetAttributeAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::SetOuterHTMLAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::perform):
+        (WebCore::DOMEditor::SetOuterHTMLAction::undo):
+        (DOMEditor::SetOuterHTMLAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::ReplaceWholeTextAction):
+        (DOMEditor::ReplaceChildNodeAction):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::ReplaceChildNodeAction):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::perform):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::undo):
+        (WebCore):
+        (DOMEditor::SetNodeValueAction):
+        (WebCore::DOMEditor::SetNodeValueAction::SetNodeValueAction):
+        (WebCore::DOMEditor::SetNodeValueAction::perform):
+        (WebCore::DOMEditor::SetNodeValueAction::undo):
+        (WebCore::DOMEditor::insertBefore):
+        (WebCore::DOMEditor::removeChild):
+        (WebCore::DOMEditor::setAttribute):
+        (WebCore::DOMEditor::removeAttribute):
+        (WebCore::DOMEditor::setOuterHTML):
+        (WebCore::DOMEditor::replaceWholeText):
+        (WebCore::DOMEditor::replaceChild):
+        (WebCore::DOMEditor::setNodeValue):
+        (WebCore::populateErrorString):
+        * inspector/DOMEditor.h:
+        (DOMEditor):
+        * inspector/DOMPatchSupport.cpp:
+        (WebCore::DOMPatchSupport::patchDocument):
+        (WebCore):
+        (WebCore::DOMPatchSupport::DOMPatchSupport):
+        (WebCore::DOMPatchSupport::patchNode):
+        (WebCore::DOMPatchSupport::innerPatchNode):
+        (WebCore::DOMPatchSupport::innerPatchChildren):
+        (WebCore::DOMPatchSupport::insertBeforeAndMarkAsUsed):
+        (WebCore::DOMPatchSupport::removeChildAndMoveToNew):
+        * inspector/DOMPatchSupport.h:
+        (WebCore):
+        (DOMPatchSupport):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::StyleSheetAction::perform):
+        (WebCore::InspectorCSSAgent::StyleSheetAction::undo):
+        (InspectorCSSAgent::StyleSheetAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::undo):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::perform):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::undo):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::assertStyleSheetForId):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::toErrorString):
+        (WebCore):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::undo):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::perform):
+        (WebCore::InspectorHistory::undo):
+        * inspector/InspectorHistory.h:
+        (WebCore):
+        (Action):
+        (InspectorHistory):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::setDocumentContent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::setPropertyText):
+        (WebCore::InspectorStyle::toggleProperty):
+        (WebCore::InspectorStyleSheet::setPropertyText):
+        (WebCore::InspectorStyleSheet::toggleProperty):
+        * inspector/InspectorStyleSheet.h:
+        (InspectorStyle):
+        (InspectorStyleSheet):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack]
+        https://bugs.webkit.org/show_bug.cgi?id=78327
+
+        Reviewed by Adam Barth.
+
+        This patch replaces [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack],
+        and removes [CustomArgumentHandling].
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified to replace
+        [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack].
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateCallWith):
+        * bindings/scripts/CodeGeneratorGObject.pm: Ditto.
+        (SkipFunction):
+        (GenerateFunction):
+        * bindings/scripts/CodeGeneratorCPP.pm: Simply removed [CustomArgumentHandling]
+        from the skipped list. By this fix, CodeGeneratorCPP.pm will generate
+        meaningless code for attributes or methods which was previously marked as
+        [CustomArgumentHandling], but this change will be harmless.
+        (ShouldSkipType):
+
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Changed the argument order.
+        (WebCore::V8Console::assertCallback):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        * page/Console.h: Ditto.
+        (Console):
+
+        * bindings/scripts/test/TestObj.idl: Added test cases for [CallWith=ScriptArguments|CallStack].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::withScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::setWithScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::withScriptArgumentsAndCallStack):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_with_script_arguments_and_call_stack):
+        (webkit_dom_test_obj_get_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_set_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj withScriptArgumentsAndCallStackAttribute]):
+        (-[DOMTestObj setWithScriptArgumentsAndCallStackAttribute:]):
+        (-[DOMTestObj withScriptArgumentsAndCallStack]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrGetter):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackCallback):
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+
+2012-02-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] KURL::fileSystemPath() doesn't work if uri contains #
+        https://bugs.webkit.org/show_bug.cgi?id=78339
+
+        Reviewed by Philippe Normand.
+
+        * platform/gtk/KURLGtk.cpp:
+        (WebCore::KURL::fileSystemPath): Use GFile API instead of
+        g_filename_from_uri() to convert the uri to a local
+        path. g_file_get_path() removes the anchor from the uri and
+        returns a valid path instead of NULL.
+
+2012-02-10  Pablo Flouret  <pablof@motorola.com>
+
+        CodeGeneratorJS doesn't always generate visitChildren() implementation when required
+        https://bugs.webkit.org/show_bug.cgi?id=78336
+
+        Reviewed by Kentaro Hara.
+        
+        In an IDL for an interface that declares no functions, but has
+        attributes with [CachedAttribute], the implementation of visitChildren()
+        is not generated by the JSC code generator.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterface::visitChildren):
+        (WebCore):
+
+2012-02-10  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Increase JPEG decoding performance some more
+        https://bugs.webkit.org/show_bug.cgi?id=78323
+
+        Reviewed by Adam Barth.
+
+        Increase JPEG image decoding speed by another 9% (avg) according to libjpeg-turbo tjbench.
+
+        No new tests. Covered by many existing tests, all requiring subsequent rebaselines.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (dctMethod): Fast decode on the jpeg-turbo using ports (Chrome Android, Chrome, Chromium).
+        (WebCore::JPEGImageReader::decode): Select DCT method via a helper routine.
+
+2012-02-10  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: FileSelector should not depend on DebuggerPresentationModel.
+        https://bugs.webkit.org/show_bug.cgi?id=78337
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        (WebInspector.ScriptsNavigator.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._reset):
+        (WebInspector.ScriptsPanel.FileSelector.prototype.replaceUISourceCodes):
+        (WebInspector.ScriptsPanel.FileSelector.prototype.reset):
+        (WebInspector.ScriptsPanel.ComboBoxFileSelector):
+        (WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype.reset):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [ConvertingNullStringTo] from CloseEvent.idl
+        https://bugs.webkit.org/show_bug.cgi?id=78328
+
+        Reviewed by Adam Barth.
+
+        In CloseEvent.idl, [ConvertingNullStringTo] is a typo of [ConvertNullStringTo],
+        (although in bug 78108, [ConvertNullStringTo] was renamed to [TreatReturnedNullStringAs]).
+
+        Anyway, the spec says that "The reason attribute must return the value it was
+        initialized to. When the object is created, this attribute must be initialized to empty string."
+        http://dev.w3.org/html5/websockets/#event-definitions
+        Thus, this patch removes [ConvertingNullStringTo] from CloseEvent.idl.
+
+        Test: fast/events/constructors/close-event-constructor.html
+
+        * websockets/CloseEvent.idl:
+
+2012-02-10  Pavel Feldman  <pfeldman@google.com>
+
+        [Qt] REGRESSION(r107242): It made 5 inspector tests crash in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=78330
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/DOMPatchSupport.cpp:
+        (WebCore::DOMPatchSupport::innerPatchChildren):
+
+2012-02-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] TimelineModel should not depend on TimelinePanel
+        https://bugs.webkit.org/show_bug.cgi?id=78254
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._loadFromFile):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelinePanel.prototype._onRecordsCleared):
+        (WebInspector.TimelineModel):
+        (WebInspector.TimelineModel.prototype.startRecord):
+        (WebInspector.TimelineModel.prototype.stopRecord):
+        (WebInspector.TimelineModel.prototype._onRecordAdded):
+        (WebInspector.TimelineModel.prototype._addRecord):
+        (WebInspector.TimelineModel.prototype._loadNextChunk):
+        (WebInspector.TimelineModel.prototype._loadFromFile):
+        (WebInspector.TimelineModel.prototype._reset):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r107368.
+        http://trac.webkit.org/changeset/107368
+        https://bugs.webkit.org/show_bug.cgi?id=78327
+
+        break GTK build
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (ShouldSkipType):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (SkipFunction):
+        (GenerateFunction):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateFunctionCallback):
+        (GenerateCallWith):
+        (GenerateFunctionCallString):
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionCustomArgsAndException):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj customArgsAndException:]):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::customArgsAndExceptionCallback):
+        (TestObjInternal):
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        (WebCore::V8Console::assertCallback):
+        * page/Console.cpp:
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        * page/Console.h:
+        (Console):
+        * page/Console.idl:
+
+2012-02-09  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Heap-buffer-overflow in WebCore::CSSParser::lex
+        https://bugs.webkit.org/show_bug.cgi?id=77402
+
+        Reviewed by Antti Koivisto.
+
+        Comments should check only a single \0 terminator.
+
+        Test: fast/css/parsing-css-comment.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack]
+        https://bugs.webkit.org/show_bug.cgi?id=78327
+
+        Reviewed by Adam Barth.
+
+        This patch replaces [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack],
+        and removes [CustomArgumentHandling].
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified to replace
+        [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack].
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateCallWith):
+        * bindings/scripts/CodeGeneratorCPP.pm: Simply removed [CustomArgumentHandling]
+        from the skipped list. By this fix, CodeGeneratorCPP.pm will generate
+        meaningless code for attributes or methods which was previously marked as
+        [CustomArgumentHandling], but this change will be harmless.
+        (ShouldSkipType):
+        * bindings/scripts/CodeGeneratorGObject.pm: Ditto.
+        (SkipFunction):
+        (GenerateFunction):
+
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Changed the argument order.
+        (WebCore::V8Console::assertCallback):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        * page/Console.h: Ditto.
+        (Console):
+
+        * bindings/scripts/test/TestObj.idl: Added test cases for [CallWith=ScriptArguments|CallStack].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::withScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::setWithScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::withScriptArgumentsAndCallStack):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_with_script_arguments_and_call_stack):
+        (webkit_dom_test_obj_get_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_set_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj withScriptArgumentsAndCallStackAttribute]):
+        (-[DOMTestObj setWithScriptArgumentsAndCallStackAttribute:]):
+        (-[DOMTestObj withScriptArgumentsAndCallStack]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrGetter):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackCallback):
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+
+2012-02-09  Adam Barth  <abarth@webkit.org>
+
+        Dromaeo/dom-traverse.html should go fast
+        https://bugs.webkit.org/show_bug.cgi?id=78307
+
+        Reviewed by Eric Seidel.
+
+        This patch improves Dromaeo/dom-traverse.html by roughly 2.5% by
+        removing a branch.  Previously, we null-checked the result of
+        V8DOMWrapper::getWrapper in a hot code path, but the only case where we
+        return a non-empty wrapper comes from a cold code path.  By pushing the
+        null check into the cold codepath, we eliminate the branch from the
+        hot code path.
+
+        This patch also annotates the branches in the hot code path with their
+        likely outcome.  I didn't measure a statistically significant
+        improvement with that aspect of the change, but it seems worthwhile.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::getExistingWrapperInline):
+        (WebCore):
+        (WebCore::V8DOMWrapper::getExistingWrapperSlow):
+        (WebCore::V8DOMWrapper::getWrapperSlow):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getExistingWrapper):
+        (V8DOMWrapper):
+        (WebCore::V8DOMWrapper::getWrapper):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+
+2012-02-09  Emil A Eklund  <eae@chromium.org>
+
+        Convert Frame/FrameView to LayoutUnits in preparation for turning on subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78311
+
+        Reviewed by Eric Seidel.
+
+        No new tests, no new functionality.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        Pixel snap painting rect for image to ensure that it is painted aligned
+        to device pixels. This avoids avoid unwanted anti-aliasing.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::windowClipRectForLayer):
+        Pixel snap clip rects as all window coordinates and sizes are exposed as
+        integers.
+
+        * page/GestureTapHighlighter.cpp:
+        * page/Page.cpp:
+        (WebCore::Page::addRelevantRepaintedObject):
+        As the painting is done aligned on pixel boundaries we need to pixel snap
+        the view rect when checking if it intersects the objects paint rect.
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::snapshotDragImage):
+        (WebCore::Frame::nodeImage):
+        Pixel snap painting rect for image to ensure that it is painted aligned
+        to device pixels. This avoids avoid unwanted anti-aliasing.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::Frame::nodeImage):
+        Pixel snap painting rect for image to ensure that it is painted aligned
+        to device pixels. This avoids avoid unwanted anti-aliasing.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        No-op implementation of pixelSnappedIntRect for now.
+
+2012-02-09  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Add WebSocket extension support
+        https://bugs.webkit.org/show_bug.cgi?id=78079
+
+        This patch introduces WebSocketExtensionDispatcher class, which creates client's
+        Sec-WebSocket-Extensions header field and parses the server response.
+        This patch doesn't add any actual extension, so no changes in behavior.
+
+        Reviewed by Kent Tamura.
+
+        No new tests except for chromium port.
+
+        * CMakeLists.txt: Added WebSocketExtensionDispatcher.(cpp|h) and WebSocketExtensionProcessor.h.
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketExtensionDispatcher.cpp: Added.
+        (WebCore):
+        (ExtensionParser):
+        (WebCore::ExtensionParser::ExtensionParser):
+        (WebCore::ExtensionParser::currentToken):
+        (WebCore::ExtensionParser::finished):
+        (WebCore::ExtensionParser::parsedSuccessfully):
+        (WebCore::isTokenCharacter):
+        (WebCore::isSeparator):
+        (WebCore::ExtensionParser::skipSpaces):
+        (WebCore::ExtensionParser::consumeToken):
+        (WebCore::ExtensionParser::consumeQuotedString):
+        (WebCore::ExtensionParser::consumeQuotedStringOrToken):
+        (WebCore::ExtensionParser::consumeCharacter):
+        (WebCore::WebSocketExtensionDispatcher::reset):
+        (WebCore::WebSocketExtensionDispatcher::addProcessor):
+        (WebCore::WebSocketExtensionDispatcher::createHeaderValue):
+        (WebCore::WebSocketExtensionDispatcher::processHeaderValue):
+        (WebCore::WebSocketExtensionDispatcher::failureReason):
+        * websockets/WebSocketExtensionDispatcher.h: Added.
+        (WebCore):
+        (WebSocketExtensionDispatcher):
+        (WebCore::WebSocketExtensionDispatcher::WebSocketExtensionDispatcher):
+        * websockets/WebSocketExtensionProcessor.h: Added.
+        (WebCore):
+        (WebSocketExtensionProcessor):
+        (WebCore::WebSocketExtensionProcessor::~WebSocketExtensionProcessor):
+        (WebCore::WebSocketExtensionProcessor::extensionToken):
+        (WebCore::WebSocketExtensionProcessor::failureReason):
+        (WebCore::WebSocketExtensionProcessor::WebSocketExtensionProcessor):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage): Adds extension header value if exists.
+        (WebCore::WebSocketHandshake::clientHandshakeRequest): Ditto.
+        (WebCore::WebSocketHandshake::reset): Resets WebSocketExtensionDispatcher object.
+        (WebCore::WebSocketHandshake::serverHandshakeResponse): Removed.
+        (WebCore::WebSocketHandshake::addExtensionProcessor): Added.
+        (WebCore::WebSocketHandshake::readHTTPHeaders): Parses and checks every time Sec-WebSocket-Extensions header appears.
+        (WebCore::WebSocketHandshake::checkResponseHeaders): Removed the check of Sec-WebSocket-Extensions.
+        * websockets/WebSocketHandshake.h: Removed serverHandshakeResponse().
+
+2012-02-09  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Avoid compositing invisible fixed positioned elements
+        https://bugs.webkit.org/show_bug.cgi?id=78186
+
+        Reviewed by James Robinson.
+
+        Test: compositing/layer-creation/fixed-position-out-of-view.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
+
+2012-02-09  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent attaching when inspecting the Web Inspector.
+
+        https://webkit.org/b/78304
+
+        Reviewed by Brian Weinstein.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::canAttachWindow): Prevent attaching when the page is an inspector page.
+
+2012-02-09  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] Assertion failure minX <= maxX in Region.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78038
+
+        Reviewed by James Robinson.
+
+        Covered by existing tests (should make them stop asserting).
+
+        Clamp sizes for composited layers coming out of WebCore to make sure they are valid non-negative values.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setSize):
+
+2012-02-09  Gregg Tavares  <gman@google.com>
+
+        Make WebGLRenderingContext::printWarningToConsole safer
+        https://bugs.webkit.org/show_bug.cgi?id=78284
+
+        Reviewed by Kenneth Russell.
+
+        No new tests because no change in functionality.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::printWarningToConsole):
+
+2012-02-09  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add support for starting page/scale animations on CC impl thread from WebViewImpl
+        https://bugs.webkit.org/show_bug.cgi?id=77872
+
+        Reviewed by James Robinson.
+
+        Added unit test.
+
+        Provides a pathway to invoke CCLayerTreeHostImpl::startPageScaleAnimation() from
+        WebViewImpl. This is intended to support scale and scroll animations, such as WebInputEvent::GestureDoubleTap.
+
+        * platform/CrossThreadCopier.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::startPageScaleAnimation):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::startPageScaleAnimation):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::startPageScaleAnimation):
+        (WebCore):
+        (WebCore::CCThreadProxy::requestStartPageScaleAnimationOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-02-09  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium] TiledLayerChromium::protectVisibleTileTextures() should only protect the visible textures
+        https://bugs.webkit.org/show_bug.cgi?id=78249
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::protectVisibleTileTextures):
+
+2012-02-09  Hayato Ito  <hayato@chromium.org>
+
+        Add Node::isShadowElement() member function.
+        https://bugs.webkit.org/show_bug.cgi?id=78201
+
+        Reviewed by Dimitri Glazkov.
+
+        No tests. No change in behavior. An upcoming change requires this to detect HTMLShadowElement.
+
+        * dom/Node.h:
+        (Node):
+        (WebCore::Node::isShadowElement):
+        * html/shadow/HTMLShadowElement.h:
+        (WebCore::HTMLShadowElement::isShadowElement):
+
+2012-02-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        CachedResourceLoader is destroyed before CSSFontSelector is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=77817
+
+        Reviewed by Adam Barth.
+
+        Explicitly clear style selector before destorying the cached resource loader.
+
+        No new tests but PerformanceTests/Parser/html5-full-render.html was crashing
+        on performance bots due to this bug.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        Update the scroll layer position on the main thread when we have slow repaint objects
+        https://bugs.webkit.org/show_bug.cgi?id=78300
+        <rdar://problem/10710754>
+
+        Reviewed by Dan Bernstein.
+
+        When we have slow repaint objects (background-attachment: fixed), we need to update the
+        scroll layer position on the main thread, otherwise the web page will appear to jiggle.
+    
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        Call ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange if needed.
+
+        * page/FrameView.h:
+        (WebCore::FrameView::hasSlowRepaintObjects):
+        Add new getter.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange):
+        Call ScrollingTreeNode::shouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        New function that will update both the main frame scroll position and the scroll layer position.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition):
+        Dispatch a call to ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition on the main thread.
+
+        * page/scrolling/ScrollingTreeNode.cpp:
+        (WebCore::ScrollingTreeNode::ScrollingTreeNode):
+        Initialize m_shouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingTreeNode::update):
+        Set m_shouldUpdateScrollLayerPositionOnMainThread.
+
+        * page/scrolling/ScrollingTreeState.cpp:
+        (WebCore::ScrollingTreeState::ScrollingTreeState):
+        Initialize m_shouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingTreeState::setShouldUpdateScrollLayerPositionOnMainThread):
+        Update m_shouldUpdateScrollLayerPositionOnMainThread if needed.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        Assert that we're not supposed to update the scroll layer position on the main thread.
+
+        (WebCore::ScrollingTreeNodeMac::scrollBy):
+        If we're supposed to update the scroll layer position on the main thread, 
+        call ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll):
+        If the frame view has its scrolling coordinated by a scrolling coordinator, don't update the scroll layer position.
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        FrameView::addSlowRepaintObject() doesn't update m_canBlitOnScroll correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78291
+
+        Reviewed by Dan Bernstein.
+
+        m_slowRepaintObjectCount needs to be incremented before calling updateCanBlitOnScrollRecursively(),
+        because otherwise useSlowRepaints() will return false even though we have to use slow repaints.
+
+        I was unable to make a layout test for this because it requires that updateCanBlitOnScrollRecursively() isn't
+        called again after m_slowRepaintObjectCount has been incremented.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addSlowRepaintObject):
+
+2012-02-09  Ojan Vafai  <ojan@chromium.org>
+
+        Remove TreeOrderIterator and iterate over the child boxes directly.
+        https://bugs.webkit.org/show_bug.cgi?id=78294
+
+        Reviewed by Tony Chang.
+
+        No new tests. This is purely a refactor. No change in behavior. 
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+        (FlexOrderHashTraits):
+        (WebCore::RenderFlexibleBox::FlexOrderHashTraits::emptyValue):
+        (WebCore::RenderFlexibleBox::FlexOrderHashTraits::constructDeletedValue):
+        (WebCore::RenderFlexibleBox::FlexOrderHashTraits::isDeletedValue):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Code generators should support multiple values for the [CallWith=] attribute
+        https://bugs.webkit.org/show_bug.cgi?id=78224
+
+        Reviewed by Adam Barth.
+
+        Currently we can specify only one value for one [CallWith=],
+        like [CallWith=ScriptExecutionContext] or [CallWith=ScriptState].
+        To reduce redundant IDL attributes, we are planning to support multiple
+        values for [CallWith=], like [CallWith=ScriptExecutionContext|ScriptArguments|CallStack].
+        This patch makes a change on code generators to support it.
+
+        Test: bindings/scripts/test/TestObj.idl
+        No change in WebKit behavior since IDL files have not yet used [CallWith=X|Y|Z].
+
+        * bindings/scripts/CodeGenerator.pm: Modified to support [CallWith=X|Y|Z].
+        (ExtendedAttributeContains):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        (GenerateImplementationFunctionCall):
+        (GenerateConstructorDeclaration):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (GenerateNormalAttrSetter):
+        (GenerateCallWith):
+        (GenerateFunctionCallString):
+
+        * bindings/scripts/test/TestObj.idl: Added test cases for [CallWith=X|Y|Z].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateAttribute):
+        (WebDOMTestObj::setWithScriptExecutionContextAndScriptStateAttribute):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebDOMTestObj::setWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebDOMTestObj::setWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptState):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateObjException):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateWithSpaces):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_with_script_execution_context_and_script_state):
+        (webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception):
+        (webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces):
+        (webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute):
+        (webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute):
+        (webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises):
+        (webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises):
+        (webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute):
+        (webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute):
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateAttribute]):
+        (-[DOMTestObj setWithScriptExecutionContextAndScriptStateAttribute:]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateAttributeRaises]):
+        (-[DOMTestObj setWithScriptExecutionContextAndScriptStateAttributeRaises:]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateWithSpacesAttribute]):
+        (-[DOMTestObj setWithScriptExecutionContextAndScriptStateWithSpacesAttribute:]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptState]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateObjException]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateWithSpaces]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrGetter):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateCallback):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateObjExceptionCallback):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesCallback):
+        (WebCore):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [ConvertNullStringTo=] to [TreatReturnedNullStringAs=]
+        https://bugs.webkit.org/show_bug.cgi?id=78108
+
+        Reviewed by Adam Barth.
+
+        [ConvertNullStringTo=] is not descriptive. To clarify that it specifies
+        the behavior when the null string is returned by WebCore, this patch renames
+        [ConvertNullStringTo=] to [TreatReturnedNullStringAs=]. This change is also
+        for naming consistency with [TreatNullAs] and [TreatUndefinedAs].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (NativeToJSValue):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementationIndexer):
+        (NativeToJSValue):
+        * bindings/scripts/test/TestObj.idl:
+        * css/CSSCharsetRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSRule.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSValue.idl:
+        * css/MediaList.idl:
+        * css/StyleSheet.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * dom/Attr.idl:
+        * dom/CharacterData.idl:
+        * dom/Clipboard.idl:
+        * dom/DOMStringList.idl:
+        * dom/Document.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/MutationRecord.idl:
+        * dom/Node.idl:
+        * dom/Notation.idl:
+        * dom/ProcessingInstruction.idl:
+        * html/DOMTokenList.idl:
+        * html/DOMURL.idl:
+        * html/HTMLMediaElement.idl:
+        * html/canvas/WebGLDebugShaders.idl:
+        * html/canvas/WebGLRenderingContext.idl:
+        * page/DOMWindow.idl:
+        * storage/IDBObjectStore.idl:
+        * storage/IDBRequest.idl:
+        * storage/Storage.idl:
+        * storage/StorageEvent.idl:
+        * websockets/WebSocket.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XSLTProcessor.idl:
+
+2012-02-09  Tony Chang  <tony@chromium.org>
+
+        more refactoring of RenderFlexibleBox in preparation for multiline
+        https://bugs.webkit.org/show_bug.cgi?id=78281
+
+        Reviewed by Ojan Vafai.
+
+        Previously, we were creating Vector of each flex item's preferred size in document order,
+        but for multiline, we need to break the lines in the flex order.  I just removed this code
+        since it was the wrong order.
+
+        Instead, have 2 funtions, computeMainAxisPreferredSizes which only does the necessary
+        layouts and margin computations to compute preferred sizes and computeFlexOrder which
+        does the work of computing the flex order, preferred sizes, positive/negative flex.
+
+        For multiline, we will have computeFlexOrder drive a while loop and it will return the
+        flex items, preferred size, and positive/negative flex values for each line.
+
+        No new tests, just refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Only layout auto sized children and set margins.
+        (WebCore::RenderFlexibleBox::computeFlexOrder): Compute flex order, preferred size, positive/negative flex.
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithm): Use the precomputed flex order.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Use the precomputed flex order.
+        (WebCore::RenderFlexibleBox::layoutColumnReverse): Use the precomputed flex order.
+        (WebCore::RenderFlexibleBox::alignChildren): Use the precomputed flex order.
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [Optional=CallWithDefaultValue] and [Optional=CallWithNullValue]
+        https://bugs.webkit.org/show_bug.cgi?id=78200
+
+        Reviewed by Adam Barth.
+
+        [Optional=CallWithDefaultValue] and [Optional=CallWithNullValue] are confusing.
+
+        - [Optional=CallWithDefaultValue] indicates that a missing value should be treated
+        as if the JavaScript undefined is passed.
+        - [Optional=CallWithNullValue] indicates that a missing value should be treated as
+        the WebKit null value (i.e. JSValue() or v8::Local<v8::Value>()).
+        - Actually, the difference between [Optional=CallWithDefaultValue] and
+        [Optional=CallWithNullValue] will appear only when the type of the missing value
+        is DOMString. In case of [Optional=CallWithDefaultValue], the missing value is
+        converted to the string "undefined". On the other hand, in case of
+        [Optional=CallWithNullValue], the missing value is converted to the WebKit null string.
+
+        With these observations, this patch renames as follows:
+
+        - Rename [Optional=CallWithDefaultValue] to [Optional=DefaultIsUndefined].
+        - Rename [Optional=CallWithNullValue] to [Optional=DefaultIsNullString].
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/js/JSDOMBinding.h: Renamed MissingIsEmpty to DefaultIsNullString,
+        renamed MissingIsUndefined to DefaultIsUndefined.
+        * bindings/v8/V8Binding.h: Ditto.
+        * bindings/v8/custom/V8BindingMacros.h: Ditto.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified to support the renaming.
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateParametersCheck):
+        (RequiresCustomSignature):
+
+        * bindings/scripts/test/TestObj.idl: Renamed [Optional=...] as described above.
+        * bindings/scripts/test/TestInterface.idl: Ditto.
+        * bindings/scripts/test/TestNamedConstructor.idl: Ditto.
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::methodWithOptionalString):
+        (WebDOMTestObj::methodWithOptionalStringIsUndefinedString):
+        (WebDOMTestObj::methodWithOptionalStringIsNullString):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_method_with_optional_string):
+        (webkit_dom_test_obj_method_with_optional_string_is_undefined_string):
+        (webkit_dom_test_obj_method_with_optional_string_is_null_string):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorNamedConstructor::constructJSTestNamedConstructor):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefinedString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj methodWithOptionalString:]):
+        (-[DOMTestObj methodWithOptionalStringIsUndefinedString:]):
+        (-[DOMTestObj methodWithOptionalStringIsNullString:]):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructorCallback):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::methodWithOptionalStringCallback):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::methodWithOptionalStringIsUndefinedStringCallback):
+        (WebCore::TestObjInternal::methodWithOptionalStringIsNullStringCallback):
+        (WebCore):
+
+        * Modules/gamepad/GamepadList.idl: Renamed [Optional=...] as described above.
+        * Modules/intents/Intent.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSValueList.idl:
+        * css/MediaList.idl:
+        * css/MediaQueryList.idl:
+        * css/MediaQueryListListener.idl:
+        * css/StyleMedia.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/CharacterData.idl:
+        * dom/ClientRectList.idl:
+        * dom/CompositionEvent.idl:
+        * dom/CustomEvent.idl:
+        * dom/DOMImplementation.idl:
+        * dom/DOMStringList.idl:
+        * dom/DataTransferItem.idl:
+        * dom/DataTransferItemList.idl:
+        * dom/DeviceMotionEvent.idl:
+        * dom/DeviceOrientationEvent.idl:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Event.idl:
+        * dom/HashChangeEvent.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessageEvent.idl:
+        * dom/MouseEvent.idl:
+        * dom/MutationEvent.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeFilter.idl:
+        * dom/NodeList.idl:
+        * dom/OverflowEvent.idl:
+        * dom/Range.idl:
+        * dom/ShadowRoot.idl:
+        * dom/Text.idl:
+        * dom/TextEvent.idl:
+        * dom/TouchEvent.idl:
+        * dom/UIEvent.idl:
+        * dom/WheelEvent.idl:
+        * html/DOMFormData.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/TextTrackCue.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/OESVertexArrayObject.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * page/Console.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * plugins/DOMMimeTypeArray.idl:
+        * plugins/DOMPlugin.idl:
+        * plugins/DOMPluginArray.idl:
+        * storage/IDBDatabase.idl:
+        * storage/StorageEvent.idl:
+        * svg/ElementTimeControl.idl:
+        * svg/SVGDocument.idl:
+        * svg/SVGElementInstanceList.idl:
+        * svg/SVGFEDropShadowElement.idl:
+        * svg/SVGFEGaussianBlurElement.idl:
+        * svg/SVGFEMorphologyElement.idl:
+        * svg/SVGFilterElement.idl:
+        * svg/SVGLocatable.idl:
+        * svg/SVGMarkerElement.idl:
+        * svg/SVGPathElement.idl:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGStylable.idl:
+        * svg/SVGTests.idl:
+        * svg/SVGTextContentElement.idl:
+        * webaudio/AudioNode.idl:
+        * workers/SharedWorker.idl:
+        * workers/WorkerContext.idl:
+        * xml/DOMParser.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XPathResult.idl:
+
+2012-02-09  Matthew Delaney  <mdelaney@apple.com>
+
+        getComputedStyle() returns different values for different zoom levels
+        https://bugs.webkit.org/show_bug.cgi?id=32230
+
+        Reviewed by Beth Dakin.
+
+        Test: fast/css/getComputedStyle/getComputedStyle-zoom-and-background-size.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillSizeToCSSValue): Pass down the RenderStyle for use in adjusting
+        values to account for zoom.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Adjust additional
+        properties that are affected by zoom.
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [Return] to [CustomReturn]
+        https://bugs.webkit.org/show_bug.cgi?id=78225
+
+        Reviewed by Adam Barth.
+
+        [Return] is used to handle custom code for a returned value.
+        To clarify it, this patch renames [Return] to [CustomReturn].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateFunction):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateImplementation):
+        * dom/Node.idl:
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Add roundedIntPoint method for LayoutPoints
+        https://bugs.webkit.org/show_bug.cgi?id=78262
+
+        Reviewed by Eric Seidel.
+
+        Adding a roundedIntPoint method that operates on a LayoutPoint. Currently, this does
+        nothing as LayoutPoint is a typedef to IntPoint. When we enable sub-pixel LayoutUnits,
+        this is a critical part in our pixel snapping strategy, where we round the logical top-
+        left point, then snap the right and bottom edges.
+
+        Also using this new method where we wish to convert LayoutPoints to IntPoints, which
+        we're currently doing implicitly (since they're the same thing).
+
+        No new tests. No change in functionality.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        (WebCore::AccessibilityRenderObject::accessibilityHitTest):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::selectCursor):
+        * rendering/LayoutTypes.h:
+        (WebCore::roundedIntPoint):
+        (WebCore):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::getCursor):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::offsetFromResizeCorner):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::paintLayerContents):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::paintContents):
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::paint):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::paint):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::paint):
+        * rendering/mathml/RenderMathMLSquareRoot.cpp:
+        (WebCore::RenderMathMLSquareRoot::paint):
+
+2012-02-09  John Bates  <jbates@google.com>
+
+        [Chromium] Add chromium-style tracing support
+        https://bugs.webkit.org/show_bug.cgi?id=76885
+
+        Reviewed by Darin Fisher.
+
+        This code enables WebKit trace events to pass through more data to the
+        chromium platform tracing API and generally to use the full tracing
+        API provided by chromium.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate): Replace old tracing API.
+        * page/Console.cpp:
+        (WebCore::Console::time): Replace old tracing API.
+        (WebCore::Console::timeEnd): Replace old tracing API.
+        * platform/chromium/PlatformSupport.h:
+        * platform/chromium/TraceEvent.h:
+        (WebCore::TraceEvent::TraceID::TraceID):
+        (WebCore::TraceEvent::TraceID::data):
+        (WebCore::TraceEvent::TraceStringWithCopy::TraceStringWithCopy):
+        (WebCore::TraceEvent::TraceStringWithCopy::operator const char* ):
+        (WebCore::TraceEvent::setTraceValue):
+        (WebCore::TraceEvent::addTraceEvent):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::TraceEndOnScopeClose):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::~TraceEndOnScopeClose):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::initialize):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::addEventIfEnabled):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::TraceEndOnScopeCloseThreshold):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::~TraceEndOnScopeCloseThreshold):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::initialize):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::addEventIfEnabled):
+
+2012-02-09  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78256
+        
+        Rename line-grid-snap to line-snap so that it matches the draft proposal for the
+        property.
+
+        Reviewed by Dan Bernstein.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator LineSnap):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+        (WebCore::RootInlineBox::lineSnapAdjustment):
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+
+2012-02-09  Benjamin Poulain  <bpoulain@apple.com>
+
+        The localization of htmlSelectMultipleItems() needs better support of pluralization
+        https://bugs.webkit.org/show_bug.cgi?id=78197
+
+        Reviewed by Joseph Pecoraro.
+
+        For translation, the localization of 0 and 1 depends on the language.
+
+        * English.lproj/Localizable.strings:
+        * platform/DefaultLocalizationStrategy.cpp:
+        (WebCore::DefaultLocalizationStrategy::htmlSelectMultipleItems):
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        ScrollingTreeNodeMac should implement ScrollElasticityController
+        https://bugs.webkit.org/show_bug.cgi?id=78277
+
+        Reviewed by Andreas Kling.
+
+        Add stubbed out implementations of the ScrollElasticityController member functions.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::allowsHorizontalStretching):
+        (WebCore):
+        (WebCore::ScrollingTreeNodeMac::allowsVerticalStretching):
+        (WebCore::ScrollingTreeNodeMac::stretchAmount):
+        (WebCore::ScrollingTreeNodeMac::pinnedInDirection):
+        (WebCore::ScrollingTreeNodeMac::canScrollHorizontally):
+        (WebCore::ScrollingTreeNodeMac::canScrollVertically):
+        (WebCore::ScrollingTreeNodeMac::shouldRubberBandInDirection):
+        (WebCore::ScrollingTreeNodeMac::absoluteScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollBy):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeNodeMac::startSnapRubberbandTimer):
+        (WebCore::ScrollingTreeNodeMac::stopSnapRubberbandTimer):
+
+2012-02-09  Adrienne Walker  <enne@google.com>
+
+        [chromium] Correct potential double reserveTextures() in CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=78258
+
+        Reviewed by James Robinson.
+
+        This isn't a problem currently, because scrollbar layers don't create
+        render surfaces. However, if this ever got used for other layers, we
+        could call reserve on them twice needlessly. It's also just bad form
+        to have an iterator doing the wrong thing.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::reserveTextures):
+
+2012-02-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107261.
+        http://trac.webkit.org/changeset/107261
+        https://bugs.webkit.org/show_bug.cgi?id=78274
+
+        It has regressed svg/W3C-SVG-1.1/styling-css-05-b.svg (using
+        lang() selectors) (Requested by jchaffraix on #webkit).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithControl):
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::isCommonAttributeSelectorAttribute):
+
+2012-02-09  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: IDBVersionChangeRequest V8 wrapper not generated as ActiveDOMObject
+        https://bugs.webkit.org/show_bug.cgi?id=78167
+
+        Add ActiveDOMObject annotation to IDBVersionChangeRequest.idl; it is not
+        automagically inherited from IDBRequest.idl.
+
+        Reviewed by Adam Barth.
+
+        Test: storage/indexeddb/versionchangerequest-activedomobject.html
+
+        * storage/IDBVersionChangeRequest.idl:
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        The scrolling tree should know more about the scrollbar state
+        https://bugs.webkit.org/show_bug.cgi?id=78268
+
+        Reviewed by Andreas Kling.
+
+        With this change, the scroll tree now keeps track of the horizontal scroll elasticity,
+        the vertical scroll elasticity and whether the page has enabled scrollbars.
+
+        This is needed in order to make rubber-banding work correctly when doing fast scrolling.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewLayoutUpdated):
+        * page/scrolling/ScrollingTreeNode.cpp:
+        (WebCore::ScrollingTreeNode::ScrollingTreeNode):
+        (WebCore::ScrollingTreeNode::update):
+        * page/scrolling/ScrollingTreeNode.h:
+        (ScrollingTreeNode):
+        * page/scrolling/ScrollingTreeState.cpp:
+        (WebCore::ScrollingTreeState::ScrollingTreeState):
+        (WebCore::ScrollingTreeState::setHorizontalScrollElasticity):
+        (WebCore):
+        (WebCore::ScrollingTreeState::setVerticalScrollElasticity):
+        (WebCore::ScrollingTreeState::setHasEnabledHorizontalScrollbar):
+        (WebCore::ScrollingTreeState::setHasEnabledVerticalScrollbar):
+        * page/scrolling/ScrollingTreeState.h:
+        (WebCore::ScrollingTreeState::horizontalScrollElasticity):
+        (ScrollingTreeState):
+        (WebCore::ScrollingTreeState::verticalScrollElasticity):
+        (WebCore::ScrollingTreeState::hasEnabledHorizontalScrollbar):
+        (WebCore::ScrollingTreeState::hasEnabledVerticalScrollbar):
+
+2012-02-09  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Unnecessary and incorrect invalidation about composited fixed-position layers
+        https://bugs.webkit.org/show_bug.cgi?id=75638
+
+        When a FrameView scrolls, composited fixed-position layers should
+        not contribute to the invalidation rect of the root layer.
+
+        Reviewed by Simon Fraser.
+
+        No new tests. Haven't found a good way to test this programatically.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-02-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107035.
+        http://trac.webkit.org/changeset/107035
+        https://bugs.webkit.org/show_bug.cgi?id=78253
+
+        Regressed DOMDivWalk (Requested by arv on #webkit).
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (HasCustomToV8Implementation):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+
+2012-02-09  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals for bug 52444 fix - type checking, PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=78180
+
+        Reviewed by Eric Seidel.
+        
+        static_cast<Element*>(node()) is done in methods in RenderMathMLFenced.cpp and a few
+        other files. It is more type-safe if the RenderMathMLFenced() or other constructor only
+        accepts an Element*, not a Node*. Also a couple functions were changed to return a
+        PassRefPtr instead of a RefPtr.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLFenced.cpp:
+        (WebCore::RenderMathMLFenced::RenderMathMLFenced):
+        (WebCore::RenderMathMLFenced::updateFromElement):
+        (WebCore::RenderMathMLFenced::makeOperatorStyle):
+        (WebCore::RenderMathMLFenced::makeFences):
+        (WebCore::RenderMathMLFenced::addChild):
+        * rendering/mathml/RenderMathMLFenced.h:
+        (RenderMathMLFenced):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
+        * rendering/mathml/RenderMathMLFraction.h:
+        (RenderMathMLFraction):
+        * rendering/mathml/RenderMathMLMath.cpp:
+        (WebCore::RenderMathMLMath::RenderMathMLMath):
+        * rendering/mathml/RenderMathMLMath.h:
+        (RenderMathMLMath):
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
+        (WebCore::RenderMathMLOperator::updateFromElement):
+        (WebCore::RenderMathMLOperator::createStackableStyle):
+        (WebCore::RenderMathMLOperator::createGlyph):
+        * rendering/mathml/RenderMathMLOperator.h:
+        (RenderMathMLOperator):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::RenderMathMLRoot):
+        (WebCore::RenderMathMLRoot::layout):
+        * rendering/mathml/RenderMathMLRoot.h:
+        (RenderMathMLRoot):
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::RenderMathMLRow):
+        * rendering/mathml/RenderMathMLRow.h:
+        (RenderMathMLRow):
+        * rendering/mathml/RenderMathMLSquareRoot.cpp:
+        (WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot):
+        * rendering/mathml/RenderMathMLSquareRoot.h:
+        (RenderMathMLSquareRoot):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::addChild):
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
+        * rendering/mathml/RenderMathMLUnderOver.h:
+        (RenderMathMLUnderOver):
+
+2012-02-09  Andreas Kling  <awesomekling@apple.com>
+
+        Avoid unnecessary work when evaluating style sharing candidates.
+        <http://webkit.org/b/78220>
+
+        Reviewed by Antti Koivisto.
+
+        Do the cheap checks (bitfields, pointers) before calling virtuals and doing hash lookups.
+        Remove comparison of attributes that are reflected in the attribute styles (cellpadding,
+        lang and xml:lang.) Moved comparison of "type" and "readonly" attributes into the more
+        specific canShareStyleWithControl() since they are only relevant for input elements.
+        Don't bother calling isFormControlElement() on both elements since we already know they
+        have the same tagQName().
+
+        Altogether this knocks off 8-9ms worth of samples per cycle of the "Moz" page cycler test.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithControl):
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::isCommonAttributeSelectorAttribute):
+
+2012-02-09  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc() - remove mod
+        https://bugs.webkit.org/show_bug.cgi?id=78226
+
+        mod has been removed from the spec for calc().
+
+        Reviewed by Ojan Vafai.
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcBinaryOperation::create):
+        (WebCore::CSSCalcBinaryOperation::evaluate):
+        (WebCore::CSSCalcExpressionNodeParser::parseValueMultiplicativeExpression):
+        * css/CSSGrammar.y:
+        * platform/CalculationValue.h:
+
+2012-02-09  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: rename DOMEditor to DOMPatchSupport, move undoable actions from
+        InspectorDOMAgent to the new DOMEditor.
+        https://bugs.webkit.org/show_bug.cgi?id=78245
+
+        Reviewed by Yury Semikhatsky.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMEditor.cpp:
+        (DOMEditor::DOMAction):
+        (WebCore::DOMEditor::DOMAction::DOMAction):
+        (WebCore::DOMEditor::DOMAction::perform):
+        (WebCore::DOMEditor::DOMAction::undo):
+        (DOMEditor::RemoveChildAction):
+        (WebCore::DOMEditor::RemoveChildAction::RemoveChildAction):
+        (WebCore::DOMEditor::RemoveChildAction::perform):
+        (WebCore::DOMEditor::RemoveChildAction::undo):
+        (DOMEditor::InsertBeforeAction):
+        (WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
+        (WebCore::DOMEditor::InsertBeforeAction::perform):
+        (WebCore::DOMEditor::InsertBeforeAction::undo):
+        (DOMEditor::RemoveAttributeAction):
+        (WebCore::DOMEditor::RemoveAttributeAction::RemoveAttributeAction):
+        (WebCore::DOMEditor::RemoveAttributeAction::perform):
+        (WebCore::DOMEditor::RemoveAttributeAction::undo):
+        (DOMEditor::SetAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::SetAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::perform):
+        (WebCore::DOMEditor::SetAttributeAction::undo):
+        (DOMEditor::SetOuterHTMLAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::SetOuterHTMLAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::perform):
+        (WebCore::DOMEditor::SetOuterHTMLAction::undo):
+        (WebCore::DOMEditor::SetOuterHTMLAction::newNode):
+        (DOMEditor::ReplaceWholeTextAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::ReplaceWholeTextAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::perform):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::undo):
+        (WebCore::DOMEditor::DOMEditor):
+        (WebCore):
+        (WebCore::DOMEditor::~DOMEditor):
+        (WebCore::DOMEditor::insertBefore):
+        (WebCore::DOMEditor::removeChild):
+        (WebCore::DOMEditor::setAttribute):
+        (WebCore::DOMEditor::removeAttribute):
+        (WebCore::DOMEditor::setOuterHTML):
+        (WebCore::DOMEditor::replaceWholeText):
+        * inspector/DOMEditor.h:
+        (WebCore):
+        (DOMEditor):
+        * inspector/DOMPatchSupport.cpp: Copied from Source/WebCore/inspector/DOMEditor.cpp.
+        (WebCore::DOMPatchSupport::DOMPatchSupport):
+        (WebCore::DOMPatchSupport::~DOMPatchSupport):
+        (WebCore::DOMPatchSupport::patchDocument):
+        (WebCore::DOMPatchSupport::patchNode):
+        (WebCore::DOMPatchSupport::innerPatchNode):
+        (WebCore):
+        (WebCore::DOMPatchSupport::diff):
+        (WebCore::DOMPatchSupport::innerPatchChildren):
+        (WebCore::DOMPatchSupport::createDigest):
+        (WebCore::DOMPatchSupport::insertBefore):
+        (WebCore::DOMPatchSupport::removeChild):
+        (WebCore::DOMPatchSupport::markNodeAsUsed):
+        (WebCore::DOMPatchSupport::dumpMap):
+        * inspector/DOMPatchSupport.h: Copied from Source/WebCore/inspector/DOMEditor.h.
+        (DOMPatchSupport):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::setFrontend):
+        (WebCore::InspectorDOMAgent::clearFrontend):
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::setAttributeValue):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::moveTo):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore):
+        (InspectorDOMAgent):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::setDocumentContent):
+
+2012-02-09  Mark Rowe  <mrowe@apple.com>
+
+        REGRESSION (r104746): iframes load PDFs as media documents
+        <http://webkit.org/b/77079> / <rdar://problem/10757933>
+
+        Roll out r104746 since it completely broke support for loading PDF documents in subframes.
+
+        Reviewed by Adam Treat.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+
+2012-02-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] take _showShortEvents out of timeline calculator
+        https://bugs.webkit.org/show_bug.cgi?id=78230
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleFilterButtonClicked):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+
+2012-02-08  Dan Vrátil  <dvratil@redhat.com>, Milan Crha <mcrha@redhat.com>
+
+        [GTK] Embedded GtkWidgets are not drawn
+        https://bugs.webkit.org/show_bug.cgi?id=63451
+
+        Remove widget from it's parent container when GtkPluginWidget is destroyed.
+        Remove paint() method because real expose even is used for drawing child widgets now.
+
+        Reviewed by Martin Robinson.
+
+        * platform/gtk/GtkPluginWidget.cpp:
+        (WebCore::GtkPluginWidget::~GtkPluginWidget):
+        (WebCore):
+        * platform/gtk/GtkPluginWidget.h:
+        (GtkPluginWidget):
+
+2012-02-09  Arun Patole  <arun.patole@motorola.com>
+
+        Setting media element 'src' attribute to "" should trigger load
+        https://bugs.webkit.org/show_bug.cgi?id=47907
+
+        Reviewed by Eric Carlson.
+
+        Test: media/video-src-empty.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::attributeChanged):Trigger a load, as long as the 'src' attribute is present.
+
+2012-02-09  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Add setNeedsRedraw to WebWidget
+        https://bugs.webkit.org/show_bug.cgi?id=77555
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setFullRootLayerDamage):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::setFullRootLayerDamageOnImplThread):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-02-09  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: fix setOuterHTML for the case that adds / removes duplicate.
+        https://bugs.webkit.org/show_bug.cgi?id=78235
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::diff):
+        (WebCore::DOMEditor::innerPatchChildren):
+        (WebCore):
+        (WebCore::nodeName):
+        (WebCore::DOMEditor::dumpMap):
+        * inspector/DOMEditor.h:
+        (DOMEditor):
+
+2012-02-09  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Ensure timers and other active DOM objects do not fire in suspended documents.
+        https://bugs.webkit.org/show_bug.cgi?id=53733
+
+        ScriptExecutionContext now remembers it has suspended active DOM objects
+        and suspends all newly installed active DOM objects as well.
+
+        All create-calls active DOM objects now calls the post constructor method
+        suspendIfNeeded that updates the suspend state. It is post constructor
+        because the suspend/resume functions are virtual and thus can not be called
+        from constructors.
+
+        Reviewed by Mihai Parparita.
+
+        Test: fast/events/suspend-timers.html
+
+        * Modules/intents/IntentRequest.cpp:
+        (WebCore::IntentRequest::create):
+        * bindings/generic/ActiveDOMCallback.cpp:
+        (WebCore::ActiveDOMCallback::ActiveDOMCallback):
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ActiveDOMObject::ActiveDOMObject):
+        (WebCore::ActiveDOMObject::~ActiveDOMObject):
+        (WebCore::ActiveDOMObject::suspendIfNeeded):
+        * dom/ActiveDOMObject.h:
+        (WebCore::ActiveDOMObject::suspendIfNeededCalled):
+        * dom/DocumentEventQueue.cpp:
+        (WebCore::DocumentEventQueue::DocumentEventQueue):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjectIfNeeded):
+        * dom/ScriptExecutionContext.h:
+        (ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::activeDOMObjectsAreSuspended):
+        * fileapi/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::create):
+        * fileapi/FileReader.cpp:
+        (WebCore::FileReader::create):
+        * fileapi/FileReader.h:
+        * fileapi/FileWriter.cpp:
+        (WebCore::FileWriter::create):
+        * fileapi/FileWriter.h:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::create):
+        (WebCore::HTMLAudioElement::createForJSConstructor):
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::create):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::create):
+        * mediastream/PeerConnection.cpp:
+        (WebCore::PeerConnection::create):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::create):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::create):
+        * notifications/NotificationCenter.h:
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::fired):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::create):
+        * page/SuspendableTimer.cpp:
+        (WebCore::SuspendableTimer::SuspendableTimer):
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::create):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::create):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::create):
+        * storage/IDBVersionChangeRequest.cpp:
+        (WebCore::IDBVersionChangeRequest::create):
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::create):
+        (WebCore::AudioContext::createOfflineContext):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::create):
+        * websockets/WebSocket.h:
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::create):
+        * workers/Worker.cpp:
+        (WebCore::Worker::create):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::create):
+
+2012-02-09  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed followup for r107235.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWillHide):
+
+2012-02-09  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Support hiding scripts panel debug sidebar.
+        https://bugs.webkit.org/show_bug.cgi?id=77543
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/Dialog.js:
+        (WebInspector.Dialog):
+        (WebInspector.DialogDelegate.prototype.show):
+        * inspector/front-end/Images/navigatorPinButton.png: Added.
+        * inspector/front-end/Images/navigatorShowHideButton.png: Added.
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        (WebInspector.ScriptsNavigator.prototype.get view):
+        (WebInspector.ScriptsNavigator.prototype.get element):
+        (WebInspector.ScriptsNavigator.prototype.show):
+        (WebInspector.ScriptsNavigator.prototype.focus):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._fileSelected):
+        (WebInspector.ScriptsPanel.prototype._createDebugToolbar):
+        (WebInspector.ScriptsPanel.prototype._createNavigatorControls):
+        (WebInspector.ScriptsPanel.prototype._createNavigatorControlButton):
+        (WebInspector.ScriptsPanel.prototype._toggleNavigator):
+        (WebInspector.ScriptsPanel.prototype._hidePinnedNavigator):
+        (WebInspector.ScriptsPanel.prototype.set _pinNavigator):
+        (WebInspector.ScriptsPanel.prototype.set _showNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWasShown):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWillHide):
+        * inspector/front-end/SidebarOverlay.js: Added.
+        * inspector/front-end/SplitView.js:
+        (WebInspector.SplitView.prototype.get resizable):
+        (WebInspector.SplitView.prototype.hideMainElement):
+        (WebInspector.SplitView.prototype.showMainElement):
+        (WebInspector.SplitView.prototype.hideSidebarElement):
+        (WebInspector.SplitView.prototype.showSidebarElement):
+        (WebInspector.SplitView.prototype._resizerDragging):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer.prototype.get element):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/dialog.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/scriptsPanel.css:
+
+2012-02-09  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Show percentage by default in heap profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=78103
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype._toPercentString):
+        (WebInspector.HeapSnapshotGridNode.prototype._createValueCell):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get data):
+        (WebInspector.HeapSnapshotConstructorNode.prototype.get data):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.profileCallback):
+        (WebInspector.DetailedHeapshotView):
+        (WebInspector.DetailedHeapshotView.prototype.get statusBarItems):
+        (WebInspector.DetailedHeapshotView.prototype._mouseDownInContentsGrid):
+        (WebInspector.DetailedHeapshotView.prototype._updateFilterOptions):
+        * inspector/front-end/UIUtils.js:
+        (Number.withThousandsSeparator):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .data-grid span.percent-column):
+
 2012-02-09  Ilya Tikhonovsky  <loislo@chromium.org>
 
         Web Inspector: Timeline memory graph would have been more useful if it had used minUsedHeapSize as the lower bound. Currently it uses zero as the lower bound.
diff --git a/Source/WebCore/Configurations/Base.xcconfig b/Source/WebCore/Configurations/Base.xcconfig
index 9e3608de5..6e894c980 100644
--- a/Source/WebCore/Configurations/Base.xcconfig
+++ b/Source/WebCore/Configurations/Base.xcconfig
@@ -69,6 +69,11 @@ WARNING_CFLAGS_macosx_ppc = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_ppc64 = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx_x86_64 = $(WARNING_CFLAGS_BASE);
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index f5bc9cf39..3e2090355 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -37,7 +37,8 @@ ENABLE_BLOB_macosx = ENABLE_BLOB;
 ENABLE_CLIENT_BASED_GEOLOCATION = $(ENABLE_CLIENT_BASED_GEOLOCATION_$(REAL_PLATFORM_NAME));
 ENABLE_CLIENT_BASED_GEOLOCATION_macosx = ENABLE_CLIENT_BASED_GEOLOCATION;
 
-ENABLE_DASHBOARD_SUPPORT = ENABLE_DASHBOARD_SUPPORT;
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 
 ENABLE_DATALIST = $(ENABLE_DATALIST_$(REAL_PLATFORM_NAME));
 ENABLE_DATALIST_macosx = ENABLE_DATALIST;
@@ -95,7 +96,7 @@ ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
-ENABLE_MUTATION_OBSERVERS = ;
+ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 01f343c7a..14e0bdc80 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 535;
-MINOR_VERSION = 20;
+MINOR_VERSION = 23;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index fb2739790..662e99427 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -77,8 +77,8 @@ WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBCORE_FRA
 WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
 NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos);
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
 PRODUCTION_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 70fc74489..828d9b233 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -28,6 +28,7 @@
 
 VPATH = \
     $(WebCore) \
+    $(WebCore)/Modules/geolocation \
     $(WebCore)/bindings/generic \
     $(WebCore)/bindings/js \
     $(WebCore)/bindings/objc \
@@ -53,6 +54,12 @@ VPATH = \
 #
 
 BINDING_IDLS = \
+    $(WebCore)/Modules/geolocation/Geolocation.idl \
+    $(WebCore)/Modules/geolocation/Geoposition.idl \
+    $(WebCore)/Modules/geolocation/NavigatorGeolocation.idl \
+    $(WebCore)/Modules/geolocation/PositionCallback.idl \
+    $(WebCore)/Modules/geolocation/PositionError.idl \
+    $(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
     $(WebCore)/css/CSSCharsetRule.idl \
     $(WebCore)/css/CSSFontFaceRule.idl \
     $(WebCore)/css/CSSImportRule.idl \
@@ -151,6 +158,7 @@ BINDING_IDLS = \
     $(WebCore)/fileapi/Blob.idl \
     $(WebCore)/fileapi/DOMFileSystem.idl \
     $(WebCore)/fileapi/DOMFileSystemSync.idl \
+    $(WebCore)/fileapi/DOMWindowFileSystem.idl \
     $(WebCore)/fileapi/DirectoryEntry.idl \
     $(WebCore)/fileapi/DirectoryEntrySync.idl \
     $(WebCore)/fileapi/DirectoryReader.idl \
@@ -183,6 +191,7 @@ BINDING_IDLS = \
     $(WebCore)/html/DOMSettableTokenList.idl \
     $(WebCore)/html/DOMTokenList.idl \
     $(WebCore)/html/DOMURL.idl \
+    $(WebCore)/html/DOMWindowHTML.idl \
     $(WebCore)/html/HTMLAllCollection.idl \
     $(WebCore)/html/HTMLAnchorElement.idl \
     $(WebCore)/html/HTMLAppletElement.idl \
@@ -260,9 +269,6 @@ BINDING_IDLS = \
     $(WebCore)/html/MediaController.idl \
     $(WebCore)/html/MediaError.idl \
     $(WebCore)/html/TextMetrics.idl \
-    $(WebCore)/html/TextTrack.idl \
-    $(WebCore)/html/TextTrackCue.idl \
-    $(WebCore)/html/TextTrackCueList.idl \
     $(WebCore)/html/TimeRanges.idl \
     $(WebCore)/html/ValidityState.idl \
     $(WebCore)/html/canvas/ArrayBuffer.idl \
@@ -271,6 +277,7 @@ BINDING_IDLS = \
     $(WebCore)/html/canvas/CanvasPattern.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
+    $(WebCore)/html/canvas/DOMWindowWebGL.idl \
     $(WebCore)/html/canvas/DataView.idl \
     $(WebCore)/html/canvas/Float32Array.idl \
     $(WebCore)/html/canvas/Float64Array.idl \
@@ -300,6 +307,9 @@ BINDING_IDLS = \
     $(WebCore)/html/canvas/WebGLVertexArrayObjectOES.idl \
     $(WebCore)/html/shadow/HTMLContentElement.idl \
     $(WebCore)/html/shadow/HTMLShadowElement.idl \
+    $(WebCore)/html/track/TextTrack.idl \
+    $(WebCore)/html/track/TextTrackCue.idl \
+    $(WebCore)/html/track/TextTrackCueList.idl \
     $(WebCore)/html/track/TextTrackList.idl \
     $(WebCore)/html/track/TrackEvent.idl \
     $(WebCore)/inspector/InjectedScriptHost.idl \
@@ -317,8 +327,6 @@ BINDING_IDLS = \
     $(WebCore)/page/DOMSelection.idl \
     $(WebCore)/page/DOMWindow.idl \
     $(WebCore)/page/EventSource.idl \
-    $(WebCore)/page/Geolocation.idl \
-    $(WebCore)/page/Geoposition.idl \
     $(WebCore)/page/History.idl \
     $(WebCore)/page/Location.idl \
     $(WebCore)/page/MemoryInfo.idl \
@@ -326,9 +334,6 @@ BINDING_IDLS = \
     $(WebCore)/page/Performance.idl \
     $(WebCore)/page/PerformanceNavigation.idl \
     $(WebCore)/page/PerformanceTiming.idl \
-    $(WebCore)/page/PositionCallback.idl \
-    $(WebCore)/page/PositionError.idl \
-    $(WebCore)/page/PositionErrorCallback.idl \
     $(WebCore)/page/Screen.idl \
     $(WebCore)/page/SpeechInputEvent.idl \
     $(WebCore)/page/SpeechInputResult.idl \
@@ -374,6 +379,7 @@ BINDING_IDLS = \
     $(WebCore)/storage/StorageInfoErrorCallback.idl \
     $(WebCore)/storage/StorageInfoQuotaCallback.idl \
     $(WebCore)/storage/StorageInfoUsageCallback.idl \
+    $(WebCore)/svg/DOMWindowSVG.idl \
     $(WebCore)/svg/ElementTimeControl.idl \
     $(WebCore)/svg/SVGAElement.idl \
     $(WebCore)/svg/SVGAltGlyphDefElement.idl \
@@ -559,12 +565,14 @@ BINDING_IDLS = \
     $(WebCore)/websockets/DOMWindowWebSocket.idl \
     $(WebCore)/websockets/WebSocket.idl \
     $(WebCore)/workers/AbstractWorker.idl \
+    $(WebCore)/workers/DOMWindowWorker.idl \
     $(WebCore)/workers/DedicatedWorkerContext.idl \
     $(WebCore)/workers/SharedWorker.idl \
     $(WebCore)/workers/SharedWorkerContext.idl \
     $(WebCore)/workers/Worker.idl \
     $(WebCore)/workers/WorkerContext.idl \
     $(WebCore)/workers/WorkerLocation.idl \
+    $(WebCore)/xml/DOMWindowXML.idl \
     $(WebCore)/xml/DOMParser.idl \
     $(WebCore)/xml/XMLHttpRequest.idl \
     $(WebCore)/xml/XMLHttpRequestException.idl \
@@ -911,15 +919,16 @@ JS_BINDINGS_SCRIPTS = $(GENERATE_SCRIPTS) bindings/scripts/CodeGeneratorJS.pm
 SUPPLEMENTAL_DEPENDENCY_FILE = ./supplemental_dependency.tmp
 IDL_FILES_TMP = ./idl_files.tmp
 ADDITIONAL_IDLS = $(WebCore)/inspector/JavaScriptCallFrame.idl
+IDL_ATTRIBUTES_FILE = $(WebCore)/bindings/scripts/IDLAttributes.txt
 
 # The following two lines get a space character stored in a variable.
 # See <http://blog.jgc.org/2007/06/escaping-comma-and-space-in-gnu-make.html>.
 space :=
 space +=
 
-$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(RESOLVE_SUPPLEMENTAL_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS)
+$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(RESOLVE_SUPPLEMENTAL_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS) $(IDL_ATTRIBUTES_FILE)
 	printf "$(subst $(space),,$(patsubst %,%\n,$(BINDING_IDLS) $(ADDITIONAL_IDLS)))" > $(IDL_FILES_TMP)
-	$(call resolve_supplemental_script, $(RESOLVE_SUPPLEMENTAL_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@
+	$(call resolve_supplemental_script, $(RESOLVE_SUPPLEMENTAL_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@ --idlAttributesFile $(IDL_ATTRIBUTES_FILE)
 	rm -f $(IDL_FILES_TMP)
 
 JS%.h : %.idl $(JS_BINDINGS_SCRIPTS) $(SUPPLEMENTAL_DEPENDENCY_FILE)
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index 610cff199..a6976b4cb 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -86,6 +86,12 @@ STYLESHEETS_EMBED = \
     $$PWD/css/mobileThemeQt.css
 
 IDL_BINDINGS += \
+    $$PWD/Modules/geolocation/Geolocation.idl \
+    $$PWD/Modules/geolocation/Geoposition.idl \
+    $$PWD/Modules/geolocation/NavigatorGeolocation.idl \
+    $$PWD/Modules/geolocation/PositionCallback.idl \
+    $$PWD/Modules/geolocation/PositionError.idl \
+    $$PWD/Modules/geolocation/PositionErrorCallback.idl \
     $$PWD/css/Counter.idl \
     $$PWD/css/CSSCharsetRule.idl \
     $$PWD/css/CSSFontFaceRule.idl \
@@ -183,6 +189,7 @@ IDL_BINDINGS += \
     $$PWD/fileapi/DirectoryReaderSync.idl \
     $$PWD/fileapi/DOMFileSystem.idl \
     $$PWD/fileapi/DOMFileSystemSync.idl \
+    $$PWD/fileapi/DOMWindowFileSystem.idl \
     $$PWD/fileapi/EntriesCallback.idl \
     $$PWD/fileapi/Entry.idl \
     $$PWD/fileapi/EntryArray.idl \
@@ -208,6 +215,7 @@ IDL_BINDINGS += \
     $$PWD/fileapi/WebKitBlobBuilder.idl \
     $$PWD/html/canvas/ArrayBufferView.idl \
     $$PWD/html/canvas/ArrayBuffer.idl \
+    $$PWD/html/canvas/DOMWindowWebGL.idl \
     $$PWD/html/canvas/DataView.idl \
     $$PWD/html/canvas/Int8Array.idl \
     $$PWD/html/canvas/Float32Array.idl \
@@ -245,6 +253,7 @@ IDL_BINDINGS += \
     $$PWD/html/DOMSettableTokenList.idl \
     $$PWD/html/DOMTokenList.idl \
     $$PWD/html/DOMURL.idl \
+    $$PWD/html/DOMWindowHTML.idl \
     $$PWD/html/HTMLAllCollection.idl \
     $$PWD/html/HTMLAudioElement.idl \
     $$PWD/html/HTMLAnchorElement.idl \
@@ -342,8 +351,6 @@ IDL_BINDINGS += \
     $$PWD/page/DOMSelection.idl \
     $$PWD/page/DOMWindow.idl \
     $$PWD/page/EventSource.idl \
-    $$PWD/page/Geolocation.idl \
-    $$PWD/page/Geoposition.idl \
     $$PWD/page/History.idl \
     $$PWD/page/Location.idl \
     $$PWD/page/MemoryInfo.idl \
@@ -351,9 +358,6 @@ IDL_BINDINGS += \
     $$PWD/page/Performance.idl \
     $$PWD/page/PerformanceNavigation.idl \
     $$PWD/page/PerformanceTiming.idl \
-    $$PWD/page/PositionCallback.idl \
-    $$PWD/page/PositionError.idl \
-    $$PWD/page/PositionErrorCallback.idl \
     $$PWD/page/Screen.idl \
     $$PWD/page/SpeechInputEvent.idl \
     $$PWD/page/SpeechInputResult.idl \
@@ -426,12 +430,14 @@ IDL_BINDINGS += \
     $$PWD/websockets/DOMWindowWebSocket.idl \
     $$PWD/websockets/WebSocket.idl \
     $$PWD/workers/AbstractWorker.idl \
+    $$PWD/workers/DOMWindowWorker.idl \
     $$PWD/workers/DedicatedWorkerContext.idl \
     $$PWD/workers/SharedWorker.idl \
     $$PWD/workers/SharedWorkerContext.idl \
     $$PWD/workers/Worker.idl \
     $$PWD/workers/WorkerContext.idl \
     $$PWD/workers/WorkerLocation.idl \
+    $$PWD/xml/DOMWindowXML.idl \
     $$PWD/xml/DOMParser.idl \
     $$PWD/xml/XMLHttpRequest.idl \
     $$PWD/xml/XMLHttpRequestException.idl \
@@ -454,6 +460,7 @@ v8 {
 
 contains(DEFINES, ENABLE_SVG=1) {
   IDL_BINDINGS += \
+    $$PWD/svg/DOMWindowSVG.idl \
     $$PWD/svg/SVGZoomEvent.idl \
     $$PWD/svg/SVGAElement.idl \
     $$PWD/svg/SVGAltGlyphDefElement.idl \
@@ -599,9 +606,9 @@ contains(DEFINES, ENABLE_SVG=1) {
 
 contains(DEFINES, ENABLE_VIDEO_TRACK=1) {
   IDL_BINDINGS += \
-    $$PWD/html/TextTrack.idl \
-    $$PWD/html/TextTrackCue.idl \
-    $$PWD/html/TextTrackCueList.idl \
+    $$PWD/html/track/TextTrack.idl \
+    $$PWD/html/track/TextTrackCue.idl \
+    $$PWD/html/track/TextTrackCueList.idl \
     $$PWD/html/track/TextTrackList.idl \
     $$PWD/html/track/TrackEvent.idl \
 }
@@ -659,8 +666,9 @@ GENERATORS += cssvalues
 SUPPLEMENTAL_DEPENDENCY_FILE = supplemental_dependency.tmp
 IDL_FILES_TMP = ${QMAKE_FUNC_FILE_OUT_PATH}/idl_files.tmp
 RESOLVE_SUPPLEMENTAL_SCRIPT = $$PWD/bindings/scripts/resolve-supplemental.pl
+IDL_ATTRIBUTES_FILE = $$PWD/bindings/scripts/IDLAttributes.txt
 
-resolveSupplemental.input = RESOLVE_SUPPLEMENTAL_SCRIPT # dummy input to fire this rule
+resolveSupplemental.input = IDL_ATTRIBUTES_FILE
 resolveSupplemental.script = $$RESOLVE_SUPPLEMENTAL_SCRIPT
 # FIXME : We need to use only perl at some point.
 resolveSupplemental.commands = echo $$IDL_BINDINGS | tr \' \' \'\\n\' > $$IDL_FILES_TMP && \
@@ -668,6 +676,7 @@ resolveSupplemental.commands = echo $$IDL_BINDINGS | tr \' \' \'\\n\' > $$IDL_FI
                                --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                                --idlFilesList $$IDL_FILES_TMP \
                                --supplementalDependencyFile ${QMAKE_FUNC_FILE_OUT_PATH}/$$SUPPLEMENTAL_DEPENDENCY_FILE \
+                               --idlAttributesFile $${IDL_ATTRIBUTES_FILE} \
                                --preprocessor \"$${QMAKE_MOC} -E\"
 resolveSupplemental.output = $$SUPPLEMENTAL_DEPENDENCY_FILE
 resolveSupplemental.add_output_to_sources = false
@@ -682,6 +691,7 @@ else: generator = JS
 generateBindings.commands = perl -I$$PWD/bindings/scripts $$generateBindings.script \
                             --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                             --generator $$generator \
+                            --include $$PWD/Modules/geolocation \
                             --include $$PWD/dom \
                             --include $$PWD/fileapi \
                             --include $$PWD/html \
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index 245dacb04..0c2378a0e 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index a2ddf6763..cadf49ee2 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DataLog.h b/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
new file mode 100644
index 000000000..1be170fcb
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DataLog_h
+#define WebCore_FWD_DataLog_h
+#include <JavaScriptCore/DataLog.h>
+#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index fe5ccb94f..2df6a36d6 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -11,6 +11,7 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/ThirdParty/ANGLE/include \
 	-I$(srcdir)/Source/ThirdParty/ANGLE/include/GLSLANG \
 	-I$(srcdir)/Source/WebCore \
+	-I$(srcdir)/Source/WebCore/Modules/geolocation \
 	-I$(srcdir)/Source/WebCore/accessibility \
 	-I$(srcdir)/Source/WebCore/bindings \
 	-I$(srcdir)/Source/WebCore/bindings/generic \
@@ -42,6 +43,7 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/notifications \
 	-I$(srcdir)/Source/WebCore/page \
 	-I$(srcdir)/Source/WebCore/page/animation \
+	-I$(srcdir)/Source/WebCore/page/scrolling \
 	-I$(srcdir)/Source/WebCore/platform \
 	-I$(srcdir)/Source/WebCore/platform/animation \
 	-I$(srcdir)/Source/WebCore/platform/audio \
@@ -588,7 +590,9 @@ endif  # END USE_CLUTTER
 # ---
 if ENABLE_MHTML
 FEATURE_DEFINES += ENABLE_MHTML=1
-webcore_cppflags += -DENABLE_MHTML=1
+webcore_cppflags += \
+	-DENABLE_MHTML=1 \
+	-I$(srcdir)/Source/WebCore/loader/archive/mhtml
 endif  # END ENABLE_MHTML
 
 # ---
@@ -755,6 +759,7 @@ DerivedSources/ANGLE/glslang_tab.cpp: Source/ThirdParty/ANGLE/src/compiler/glsla
 DerivedSources/ANGLE/glslang_tab.h: DerivedSources/ANGLE/glslang_tab.cpp
 
 IDL_PATH := \
+    $(WebCore)/Modules/geolocation \
     $(WebCore)/bindings/js \
     $(WebCore)/css \
     $(WebCore)/dom \
@@ -780,23 +785,32 @@ IDL_PATH := \
 
 vpath %.idl $(IDL_PATH)
 
-# This does not appear to work correctly with gnumake unless
-# it includes an empty command list (the semicolon).
-DerivedSources/WebCore/JS%.cpp: DerivedSources/WebCore/JS%.h;
-
-SUPPLEMENTAL_DEPENDENCY_FILE = $(top_builddir)/DerivedSources/WebCore/supplemental_dependency.tmp
-IDL_FILES_TMP = $(top_builddir)/DerivedSources/WebCore/idl_files.tmp
+supplemental_dependency_file = $(top_builddir)/DerivedSources/WebCore/idl_supplemental_dependencies
+idl_files_list = $(top_builddir)/DerivedSources/WebCore/idl_files_list
+idl_attributes_file = $(WebCore)/bindings/scripts/IDLAttributes.txt
 
 .SECONDARY:
-$(SUPPLEMENTAL_DEPENDENCY_FILE): $(SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL) $(dom_binding_idls)
+$(supplemental_dependency_file): $(SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL) $(dom_binding_idls) $(idl_attributes_file)
 	$(AM_V_GEN)
-	$(AM_V_at)echo -n > $(IDL_FILES_TMP)
-	$(AM_V_at)($(foreach idl, $(dom_binding_idls), echo $(idl) &&) echo -n) >> $(IDL_FILES_TMP)
-	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/resolve-supplemental.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@
+	$(AM_V_at)echo -n > $(idl_files_list)
+	$(AM_V_at)($(foreach idl, $(dom_binding_idls), echo $(idl) &&) echo -n) >> $(idl_files_list)
+	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/resolve-supplemental.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(idl_files_list) --supplementalDependencyFile $@ --idlAttributesFile $(idl_attributes_file)
+
+# This does not appear to work correctly with gnumake unless
+# it includes an empty command list (the semicolon).
+DerivedSources/WebCore/JS%.cpp: DerivedSources/WebCore/JS%.h;
 
 .SECONDARY:
-DerivedSources/WebCore/JS%.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm $(SUPPLEMENTAL_DEPENDENCY_FILE)
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES_WEBCORE)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator JS --supplementalDependencyFile $(SUPPLEMENTAL_DEPENDENCY_FILE) $<
+DerivedSources/WebCore/JS%.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm $(supplemental_dependency_file)
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES_WEBCORE)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator JS --supplementalDependencyFile $(supplemental_dependency_file) $<
+
+# See https://bugs.webkit.org/show_bug.cgi?id=76388
+# We need to introduce a manual dependency to prevent non-generated sources from 
+# trying to build before the generated ones. This can happen if the supplemental
+# IDL generation takes a long time. The pipe represents an order-only dependency,
+# which means that GNUmake will only try to build the dependencies first, but
+# not rebuild all the targets if the dependencies change.
+$(webkitgtk_sources) $(webkit2_sources) $(webkit2_plugin_process_sources) $(webcore_sources) $(webcoregtk_sources) : | $(supplemental_dependency_file) $(webcore_built_sources)
 
 noinst_LTLIBRARIES += \
 	libWebCore.la
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index c08cb25a8..e5a03cb53 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -388,6 +388,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSMessagePort.h \
 	DerivedSources/WebCore/JSMouseEvent.cpp \
 	DerivedSources/WebCore/JSMouseEvent.h \
+	DerivedSources/WebCore/JSMutationCallback.cpp \
+	DerivedSources/WebCore/JSMutationCallback.h \
 	DerivedSources/WebCore/JSMutationEvent.cpp \
 	DerivedSources/WebCore/JSMutationEvent.h \
 	DerivedSources/WebCore/JSMutationRecord.cpp \
@@ -587,6 +589,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSWebKitCSSRegionRule.h \
 	DerivedSources/WebCore/JSWebKitCSSTransformValue.cpp \
 	DerivedSources/WebCore/JSWebKitCSSTransformValue.h \
+	DerivedSources/WebCore/JSWebKitMutationObserver.cpp \
+	DerivedSources/WebCore/JSWebKitMutationObserver.h \
 	DerivedSources/WebCore/JSWebKitNamedFlow.cpp \
 	DerivedSources/WebCore/JSWebKitNamedFlow.h \
 	DerivedSources/WebCore/JSWebKitPoint.cpp \
@@ -646,6 +650,12 @@ webcore_built_sources += \
 	DerivedSources/WebCore/XPathGrammar.h
 
 dom_binding_idls += \
+	$(WebCore)/Modules/geolocation/Geolocation.idl \
+	$(WebCore)/Modules/geolocation/Geoposition.idl \
+	$(WebCore)/Modules/geolocation/NavigatorGeolocation.idl \
+	$(WebCore)/Modules/geolocation/PositionCallback.idl \
+	$(WebCore)/Modules/geolocation/PositionError.idl \
+	$(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
 	$(WebCore)/css/CSSCharsetRule.idl \
 	$(WebCore)/css/CSSFontFaceRule.idl \
 	$(WebCore)/css/CSSImportRule.idl \
@@ -705,6 +715,7 @@ dom_binding_idls += \
 	$(WebCore)/dom/MessageEvent.idl \
 	$(WebCore)/dom/MessagePort.idl \
 	$(WebCore)/dom/MouseEvent.idl \
+	$(WebCore)/dom/MutationCallback.idl \
 	$(WebCore)/dom/MutationEvent.idl \
 	$(WebCore)/dom/MutationRecord.idl \
 	$(WebCore)/dom/NamedNodeMap.idl \
@@ -729,6 +740,7 @@ dom_binding_idls += \
 	$(WebCore)/dom/TreeWalker.idl \
 	$(WebCore)/dom/UIEvent.idl \
 	$(WebCore)/dom/WebKitAnimationEvent.idl \
+	$(WebCore)/dom/WebKitMutationObserver.idl \
 	$(WebCore)/dom/WebKitNamedFlow.idl \
 	$(WebCore)/dom/WebKitTransitionEvent.idl \
 	$(WebCore)/dom/WheelEvent.idl \
@@ -745,6 +757,7 @@ dom_binding_idls += \
 	$(WebCore)/html/DOMSettableTokenList.idl \
 	$(WebCore)/html/DOMTokenList.idl \
 	$(WebCore)/html/DOMURL.idl \
+	$(WebCore)/html/DOMWindowHTML.idl \
 	$(WebCore)/html/HTMLAllCollection.idl \
 	$(WebCore)/html/HTMLAnchorElement.idl \
 	$(WebCore)/html/HTMLAppletElement.idl \
@@ -822,9 +835,6 @@ dom_binding_idls += \
 	$(WebCore)/html/MediaController.idl \
 	$(WebCore)/html/MediaError.idl \
 	$(WebCore)/html/TextMetrics.idl \
-	$(WebCore)/html/TextTrack.idl \
-	$(WebCore)/html/TextTrackCue.idl \
-	$(WebCore)/html/TextTrackCueList.idl \
 	$(WebCore)/html/TimeRanges.idl \
 	$(WebCore)/html/ValidityState.idl \
 	$(WebCore)/html/VoidCallback.idl \
@@ -834,6 +844,7 @@ dom_binding_idls += \
 	$(WebCore)/html/canvas/CanvasPattern.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
+	$(WebCore)/html/canvas/DOMWindowWebGL.idl \
 	$(WebCore)/html/canvas/DataView.idl \
 	$(WebCore)/html/canvas/Float32Array.idl \
 	$(WebCore)/html/canvas/Float64Array.idl \
@@ -862,6 +873,9 @@ dom_binding_idls += \
 	$(WebCore)/html/canvas/WebGLUniformLocation.idl \
 	$(WebCore)/html/canvas/WebGLVertexArrayObjectOES.idl \
 	$(WebCore)/html/shadow/HTMLContentElement.idl \
+	$(WebCore)/html/track/TextTrack.idl \
+	$(WebCore)/html/track/TextTrackCue.idl \
+	$(WebCore)/html/track/TextTrackCueList.idl \
 	$(WebCore)/html/track/TextTrackList.idl \
 	$(WebCore)/html/track/TrackEvent.idl \
 	$(WebCore)/inspector/InjectedScriptHost.idl \
@@ -870,12 +884,14 @@ dom_binding_idls += \
 	$(WebCore)/inspector/ScriptProfile.idl \
 	$(WebCore)/inspector/ScriptProfileNode.idl \
 	$(WebCore)/loader/appcache/DOMApplicationCache.idl \
+	$(WebCore)/mediastream/DOMWindowMediaStream.idl \
 	$(WebCore)/mediastream/LocalMediaStream.idl \
 	$(WebCore)/mediastream/MediaStream.idl \
 	$(WebCore)/mediastream/MediaStreamEvent.idl \
 	$(WebCore)/mediastream/MediaStreamList.idl \
 	$(WebCore)/mediastream/MediaStreamTrack.idl \
 	$(WebCore)/mediastream/MediaStreamTrackList.idl \
+	$(WebCore)/mediastream/NavigatorMediaStream.idl \
 	$(WebCore)/mediastream/NavigatorUserMediaError.idl \
 	$(WebCore)/mediastream/NavigatorUserMediaErrorCallback.idl \
 	$(WebCore)/mediastream/NavigatorUserMediaSuccessCallback.idl \
@@ -890,8 +906,6 @@ dom_binding_idls += \
 	$(WebCore)/page/DOMSelection.idl \
 	$(WebCore)/page/DOMWindow.idl \
 	$(WebCore)/page/EventSource.idl \
-	$(WebCore)/page/Geolocation.idl \
-	$(WebCore)/page/Geoposition.idl \
 	$(WebCore)/page/History.idl \
 	$(WebCore)/page/Location.idl \
 	$(WebCore)/page/MemoryInfo.idl \
@@ -899,9 +913,6 @@ dom_binding_idls += \
 	$(WebCore)/page/Performance.idl \
 	$(WebCore)/page/PerformanceNavigation.idl \
 	$(WebCore)/page/PerformanceTiming.idl \
-	$(WebCore)/page/PositionCallback.idl \
-	$(WebCore)/page/PositionError.idl \
-	$(WebCore)/page/PositionErrorCallback.idl \
 	$(WebCore)/page/Screen.idl \
 	$(WebCore)/page/SpeechInputEvent.idl \
 	$(WebCore)/page/SpeechInputResult.idl \
@@ -924,12 +935,14 @@ dom_binding_idls += \
 	$(WebCore)/webaudio/DOMWindowWebAudio.idl \
 	$(WebCore)/webaudio/WaveShaperNode.idl \
 	$(WebCore)/workers/AbstractWorker.idl \
+	$(WebCore)/workers/DOMWindowWorker.idl \
 	$(WebCore)/workers/DedicatedWorkerContext.idl \
 	$(WebCore)/workers/SharedWorker.idl \
 	$(WebCore)/workers/SharedWorkerContext.idl \
 	$(WebCore)/workers/Worker.idl \
 	$(WebCore)/workers/WorkerContext.idl \
 	$(WebCore)/workers/WorkerLocation.idl \
+	$(WebCore)/xml/DOMWindowXML.idl \
 	$(WebCore)/xml/DOMParser.idl \
 	$(WebCore)/xml/XMLHttpRequest.idl \
 	$(WebCore)/xml/XMLHttpRequestException.idl \
@@ -944,6 +957,19 @@ dom_binding_idls += \
 	$(WebCore)/xml/XSLTProcessor.idl
 
 webcore_sources += \
+	Source/WebCore/Modules/geolocation/Geolocation.cpp \
+	Source/WebCore/Modules/geolocation/Geolocation.h \
+	Source/WebCore/Modules/geolocation/GeolocationController.cpp \
+	Source/WebCore/Modules/geolocation/GeolocationController.h \
+	Source/WebCore/Modules/geolocation/GeolocationError.h \
+	Source/WebCore/Modules/geolocation/GeolocationPosition.h \
+	Source/WebCore/Modules/geolocation/Geoposition.h \
+	Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp \
+	Source/WebCore/Modules/geolocation/NavigatorGeolocation.h \
+	Source/WebCore/Modules/geolocation/PositionCallback.h \
+	Source/WebCore/Modules/geolocation/PositionError.h \
+	Source/WebCore/Modules/geolocation/PositionErrorCallback.h \
+	Source/WebCore/Modules/geolocation/PositionOptions.h \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.h \
 	Source/WebCore/accessibility/AccessibilityARIAGrid.cpp \
@@ -1135,7 +1161,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSMessagePortCustom.h \
 	Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp \
 	Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
-	Source/WebCore/bindings/js/JSNavigatorCustom.cpp \
 	Source/WebCore/bindings/js/JSNodeCustom.cpp \
 	Source/WebCore/bindings/js/JSNodeCustom.h \
 	Source/WebCore/bindings/js/JSNodeFilterCondition.cpp \
@@ -1382,8 +1407,6 @@ webcore_sources += \
 	Source/WebCore/css/CSSValuePool.cpp \
 	Source/WebCore/css/CSSValuePool.h \
 	Source/WebCore/css/DashboardRegion.h \
-	Source/WebCore/css/FontFamilyValue.cpp \
-	Source/WebCore/css/FontFamilyValue.h \
 	Source/WebCore/css/FontFeatureValue.cpp \
 	Source/WebCore/css/FontFeatureValue.h \
 	Source/WebCore/css/FontValue.cpp \
@@ -1405,6 +1428,8 @@ webcore_sources += \
 	Source/WebCore/css/MediaQueryMatcher.cpp \
 	Source/WebCore/css/MediaQueryMatcher.h \
 	Source/WebCore/css/Pair.h \
+	Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp \
+	Source/WebCore/css/PropertySetCSSStyleDeclaration.h \
 	Source/WebCore/css/Rect.h \
 	Source/WebCore/css/RGBColor.cpp \
 	Source/WebCore/css/RGBColor.h \
@@ -1558,6 +1583,7 @@ webcore_sources += \
 	Source/WebCore/dom/EventTarget.cpp \
 	Source/WebCore/dom/EventTarget.h \
 	Source/WebCore/dom/EventQueue.h \
+	Source/WebCore/dom/EventSender.h \
 	Source/WebCore/dom/ExceptionBase.cpp \
 	Source/WebCore/dom/ExceptionBase.h \
 	Source/WebCore/dom/ExceptionCode.h \
@@ -1659,6 +1685,8 @@ webcore_sources += \
 	Source/WebCore/dom/SelectorQuery.h \
 	Source/WebCore/dom/ShadowRoot.cpp \
 	Source/WebCore/dom/ShadowRoot.h \
+	Source/WebCore/dom/ShadowRootList.cpp \
+	Source/WebCore/dom/ShadowRootList.h \
 	Source/WebCore/dom/SpaceSplitString.cpp \
 	Source/WebCore/dom/SpaceSplitString.h \
 	Source/WebCore/dom/StaticHashSetNodeList.cpp \
@@ -1851,6 +1879,8 @@ webcore_sources += \
 	Source/WebCore/fileapi/DOMFileSystemBase.h \
 	Source/WebCore/fileapi/DOMFileSystemSync.cpp \
 	Source/WebCore/fileapi/DOMFileSystemSync.h \
+	Source/WebCore/fileapi/DOMWindowFileSystem.cpp \
+	Source/WebCore/fileapi/DOMWindowFileSystem.h \
 	Source/WebCore/fileapi/EntriesCallback.h \
 	Source/WebCore/fileapi/Entry.cpp \
 	Source/WebCore/fileapi/Entry.h \
@@ -1858,6 +1888,7 @@ webcore_sources += \
 	Source/WebCore/fileapi/EntryArray.h \
 	Source/WebCore/fileapi/EntryArraySync.cpp \
 	Source/WebCore/fileapi/EntryArraySync.h \
+	Source/WebCore/fileapi/EntryBase.cpp \
 	Source/WebCore/fileapi/EntryBase.h \
 	Source/WebCore/fileapi/EntryCallback.h \
 	Source/WebCore/fileapi/EntrySync.cpp \
@@ -2172,8 +2203,6 @@ webcore_sources += \
 	Source/WebCore/html/LabelsNodeList.h \
 	Source/WebCore/html/LinkRelAttribute.cpp \
 	Source/WebCore/html/LinkRelAttribute.h \
-	Source/WebCore/html/LoadableTextTrack.cpp \
-	Source/WebCore/html/LoadableTextTrack.h \
 	Source/WebCore/html/MediaController.cpp \
 	Source/WebCore/html/MediaController.h \
 	Source/WebCore/html/MediaControllerInterface.h \
@@ -2231,14 +2260,16 @@ webcore_sources += \
 	Source/WebCore/html/parser/TextViewSourceParser.h \
 	Source/WebCore/html/parser/XSSAuditor.cpp \
 	Source/WebCore/html/parser/XSSAuditor.h \
-	Source/WebCore/html/shadow/ContentInclusionSelector.cpp \
-	Source/WebCore/html/shadow/ContentInclusionSelector.h \
 	Source/WebCore/html/shadow/ContentSelectorQuery.cpp \
 	Source/WebCore/html/shadow/ContentSelectorQuery.h \
 	Source/WebCore/html/shadow/DetailsMarkerControl.cpp \
 	Source/WebCore/html/shadow/DetailsMarkerControl.h \
 	Source/WebCore/html/shadow/HTMLContentElement.cpp \
 	Source/WebCore/html/shadow/HTMLContentElement.h \
+	Source/WebCore/html/shadow/HTMLContentSelector.cpp \
+	Source/WebCore/html/shadow/HTMLContentSelector.h \
+	Source/WebCore/html/shadow/InsertionPoint.cpp \
+	Source/WebCore/html/shadow/InsertionPoint.h \
 	Source/WebCore/html/shadow/MediaControls.cpp \
 	Source/WebCore/html/shadow/MediaControls.h \
 	Source/WebCore/html/shadow/MediaControlElements.cpp \
@@ -2279,16 +2310,18 @@ webcore_sources += \
 	Source/WebCore/html/TextInputType.cpp \
 	Source/WebCore/html/TextInputType.h \
 	Source/WebCore/html/TextMetrics.h \
-	Source/WebCore/html/TextTrack.cpp \
-	Source/WebCore/html/TextTrack.h \
-	Source/WebCore/html/TextTrackCue.cpp \
-	Source/WebCore/html/TextTrackCue.h \
-	Source/WebCore/html/TextTrackCueList.cpp \
-	Source/WebCore/html/TextTrackCueList.h \
 	Source/WebCore/html/TimeInputType.cpp \
 	Source/WebCore/html/TimeInputType.h \
 	Source/WebCore/html/TimeRanges.cpp \
 	Source/WebCore/html/TimeRanges.h \
+	Source/WebCore/html/track/LoadableTextTrack.cpp \
+	Source/WebCore/html/track/LoadableTextTrack.h \
+	Source/WebCore/html/track/TextTrack.cpp \
+	Source/WebCore/html/track/TextTrack.h \
+	Source/WebCore/html/track/TextTrackCue.cpp \
+	Source/WebCore/html/track/TextTrackCue.h \
+	Source/WebCore/html/track/TextTrackCueList.cpp \
+	Source/WebCore/html/track/TextTrackCueList.h \
 	Source/WebCore/html/track/TextTrackList.cpp \
 	Source/WebCore/html/track/TextTrackList.h \
 	Source/WebCore/html/track/TrackBase.cpp \
@@ -2344,6 +2377,8 @@ webcore_sources += \
 	Source/WebCore/inspector/DOMEditor.h \
 	Source/WebCore/inspector/DOMNodeHighlighter.cpp \
 	Source/WebCore/inspector/DOMNodeHighlighter.h \
+	Source/WebCore/inspector/DOMPatchSupport.cpp \
+	Source/WebCore/inspector/DOMPatchSupport.h \
 	Source/WebCore/inspector/DOMWrapperVisitor.h \
 	Source/WebCore/inspector/IdentifiersFactory.cpp \
 	Source/WebCore/inspector/IdentifiersFactory.h \
@@ -2366,6 +2401,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorConsoleAgent.cpp \
 	Source/WebCore/inspector/InspectorConsoleAgent.h \
 	Source/WebCore/inspector/InspectorConsoleInstrumentation.h \
+	Source/WebCore/inspector/InspectorCounters.cpp \
+	Source/WebCore/inspector/InspectorCounters.h \
 	Source/WebCore/inspector/InspectorCSSAgent.cpp \
 	Source/WebCore/inspector/InspectorCSSAgent.h \
 	Source/WebCore/inspector/InspectorDatabaseAgent.cpp \
@@ -2495,6 +2532,8 @@ webcore_sources += \
 	Source/WebCore/loader/cache/CachedShader.cpp \
 	Source/WebCore/loader/cache/CachedShader.h \
 	Source/WebCore/loader/cache/CachedStyleSheetClient.h \
+	Source/WebCore/loader/cache/CachedSVGDocument.cpp \
+	Source/WebCore/loader/cache/CachedSVGDocument.h \
 	Source/WebCore/loader/cache/CachedTextTrack.cpp \
 	Source/WebCore/loader/cache/CachedTextTrack.h \
 	Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp \
@@ -2615,6 +2654,8 @@ webcore_sources += \
 	Source/WebCore/mediastream/MediaStreamTrack.h \
 	Source/WebCore/mediastream/MediaStreamTrackList.cpp \
 	Source/WebCore/mediastream/MediaStreamTrackList.h \
+	Source/WebCore/mediastream/NavigatorMediaStream.cpp \
+	Source/WebCore/mediastream/NavigatorMediaStream.h \
 	Source/WebCore/mediastream/NavigatorUserMediaError.h \
 	Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h \
 	Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h \
@@ -2622,6 +2663,8 @@ webcore_sources += \
 	Source/WebCore/mediastream/PeerConnection.h \
 	Source/WebCore/mediastream/SignalingCallback.h \
 	Source/WebCore/mediastream/UserMediaClient.h \
+	Source/WebCore/mediastream/UserMediaController.h \
+	Source/WebCore/mediastream/UserMediaController.cpp \
 	Source/WebCore/mediastream/UserMediaRequest.cpp \
 	Source/WebCore/mediastream/UserMediaRequest.h \
 	Source/WebCore/notifications/NotificationCenter.cpp \
@@ -2693,14 +2736,7 @@ webcore_sources += \
 	Source/WebCore/page/FrameTree.h \
 	Source/WebCore/page/FrameView.cpp \
 	Source/WebCore/page/FrameView.h \
-	Source/WebCore/page/Geolocation.cpp \
-	Source/WebCore/page/Geolocation.h \
 	Source/WebCore/page/GeolocationClient.h \
-	Source/WebCore/page/GeolocationController.cpp \
-	Source/WebCore/page/GeolocationController.h \
-	Source/WebCore/page/GeolocationError.h \
-	Source/WebCore/page/GeolocationPosition.h \
-	Source/WebCore/page/Geoposition.h \
 	Source/WebCore/page/GestureTapHighlighter.cpp \
 	Source/WebCore/page/GestureTapHighlighter.h \
 	Source/WebCore/page/GroupSettings.cpp \
@@ -2718,6 +2754,10 @@ webcore_sources += \
 	Source/WebCore/page/Navigator.h \
 	Source/WebCore/page/NavigatorBase.cpp \
 	Source/WebCore/page/NavigatorBase.h \
+	Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp \
+	Source/WebCore/page/NavigatorRegisterProtocolHandler.h \
+	Source/WebCore/page/NavigatorSupplement.cpp \
+	Source/WebCore/page/NavigatorSupplement.h \
 	Source/WebCore/page/OriginAccessEntry.cpp \
 	Source/WebCore/page/OriginAccessEntry.h \
 	Source/WebCore/page/Page.cpp \
@@ -2728,6 +2768,8 @@ webcore_sources += \
 	Source/WebCore/page/PageGroupLoadDeferrer.h \
 	Source/WebCore/page/PageSerializer.cpp \
 	Source/WebCore/page/PageSerializer.h \
+	Source/WebCore/page/PageSupplement.cpp \
+	Source/WebCore/page/PageSupplement.h \
 	Source/WebCore/page/PageVisibilityState.cpp \
 	Source/WebCore/page/PageVisibilityState.h \
 	Source/WebCore/page/Performance.cpp \
@@ -2739,14 +2781,13 @@ webcore_sources += \
 	Source/WebCore/page/PointerLock.h \
 	Source/WebCore/page/PointerLockController.cpp \
 	Source/WebCore/page/PointerLockController.h \
-	Source/WebCore/page/PositionCallback.h \
-	Source/WebCore/page/PositionError.h \
-	Source/WebCore/page/PositionErrorCallback.h \
-	Source/WebCore/page/PositionOptions.h \
 	Source/WebCore/page/PrintContext.cpp \
 	Source/WebCore/page/PrintContext.h \
 	Source/WebCore/page/Screen.cpp \
 	Source/WebCore/page/Screen.h \
+	Source/WebCore/page/scrolling/ScrollingCoordinator.cpp \
+	Source/WebCore/page/scrolling/ScrollingCoordinator.h \
+	Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp \
 	Source/WebCore/page/SecurityOrigin.cpp \
 	Source/WebCore/page/SecurityOrigin.h \
 	Source/WebCore/page/SecurityOriginHash.h \
@@ -2817,8 +2858,6 @@ webcore_sources += \
 	Source/WebCore/platform/Cursor.h \
 	Source/WebCore/platform/DateComponents.cpp \
 	Source/WebCore/platform/DateComponents.h \
-	Source/WebCore/platform/DefaultLocalizationStrategy.cpp \
-	Source/WebCore/platform/DefaultLocalizationStrategy.h \
 	Source/WebCore/platform/DragData.cpp \
 	Source/WebCore/platform/DragData.h \
 	Source/WebCore/platform/DragImage.cpp \
@@ -2835,6 +2874,7 @@ webcore_sources += \
 	Source/WebCore/platform/FileSystem.cpp \
 	Source/WebCore/platform/FileSystem.h \
 	Source/WebCore/platform/FloatConversion.h \
+	Source/WebCore/platform/FractionalLayoutUnit.h \
 	Source/WebCore/platform/GeolocationService.cpp \
 	Source/WebCore/platform/GeolocationService.h \
 	Source/WebCore/platform/HashTools.h \
@@ -2975,6 +3015,11 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/FontSmoothingMode.h \
 	Source/WebCore/platform/graphics/FontTraitsMask.h \
 	Source/WebCore/platform/graphics/FontWidthVariant.h \
+	Source/WebCore/platform/graphics/FractionalLayoutPoint.h \
+	Source/WebCore/platform/graphics/FractionalLayoutRect.cpp \
+	Source/WebCore/platform/graphics/FractionalLayoutRect.h \
+	Source/WebCore/platform/graphics/FractionalLayoutSize.cpp \
+	Source/WebCore/platform/graphics/FractionalLayoutSize.h \
 	Source/WebCore/platform/graphics/GeneratorGeneratedImage.cpp \
 	Source/WebCore/platform/graphics/GeneratorGeneratedImage.h \
 	Source/WebCore/platform/graphics/GeneratedImage.h \
@@ -3349,7 +3394,6 @@ webcore_sources += \
 	Source/WebCore/platform/Timer.cpp \
 	Source/WebCore/platform/Timer.h \
 	Source/WebCore/platform/TreeShared.h \
-	Source/WebCore/platform/URLString.h \
 	Source/WebCore/platform/UUID.cpp \
 	Source/WebCore/platform/UUID.h \
 	Source/WebCore/platform/Widget.cpp \
@@ -3859,10 +3903,10 @@ webcore_sources += \
 	Source/WebCore/storage/IDBTransaction.h \
 	Source/WebCore/storage/IDBVersionChangeEvent.h \
 	Source/WebCore/storage/IDBVersionChangeRequest.h \
-	Source/WebCore/storage/LocalStorageTask.cpp \
-	Source/WebCore/storage/LocalStorageTask.h \
-	Source/WebCore/storage/LocalStorageThread.cpp \
-	Source/WebCore/storage/LocalStorageThread.h \
+	Source/WebCore/storage/StorageTask.cpp \
+	Source/WebCore/storage/StorageTask.h \
+	Source/WebCore/storage/StorageThread.cpp \
+	Source/WebCore/storage/StorageThread.h \
 	Source/WebCore/storage/OriginQuotaManager.cpp \
 	Source/WebCore/storage/OriginQuotaManager.h \
 	Source/WebCore/storage/OriginUsageRecord.cpp \
@@ -4305,6 +4349,12 @@ webcore_sources += \
 	Source/WebCore/websockets/WebSocketChannel.h \
 	Source/WebCore/websockets/WebSocket.cpp \
 	Source/WebCore/websockets/WebSocket.h \
+	Source/WebCore/websockets/WebSocketDeflater.cpp \
+	Source/WebCore/websockets/WebSocketDeflater.h \
+	Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp \
+	Source/WebCore/websockets/WebSocketExtensionDispatcher.h \
+	Source/WebCore/websockets/WebSocketExtensionProcessor.h \
+	Source/WebCore/websockets/WebSocketFrame.h \
 	Source/WebCore/websockets/WebSocketHandshake.cpp \
 	Source/WebCore/websockets/WebSocketHandshake.h \
 	Source/WebCore/websockets/WebSocketHandshakeRequest.cpp \
@@ -4793,6 +4843,7 @@ webcore_built_sources += \
 dom_binding_idls += \
 	$(WebCore)/fileapi/DOMFileSystem.idl \
 	$(WebCore)/fileapi/DOMFileSystemSync.idl \
+	$(WebCore)/fileapi/DOMWindowFileSystem.idl \
 	$(WebCore)/fileapi/DirectoryEntry.idl \
 	$(WebCore)/fileapi/DirectoryEntrySync.idl \
 	$(WebCore)/fileapi/DirectoryReader.idl \
@@ -4812,8 +4863,11 @@ dom_binding_idls += \
 	$(WebCore)/fileapi/FileWriterCallback.idl \
 	$(WebCore)/fileapi/FileWriterSync.idl \
 	$(WebCore)/fileapi/Metadata.idl \
-	$(WebCore)/fileapi/MetadataCallback.idl \
-	$(WebCore)/fileapi/WebKitFlags.idl
+	$(WebCore)/fileapi/MetadataCallback.idl
+
+webcoregtk_sources += \
+	Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp \
+	Source/WebCore/platform/gtk/AsyncFileSystemGtk.h
 endif # END ENABLE_FILE_SYSTEM
 
 # ----
@@ -5118,6 +5172,7 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSSVGZoomEvent.h
 
 dom_binding_idls += \
+	$(WebCore)/svg/DOMWindowSVG.idl \
 	$(WebCore)/svg/SVGAElement.idl \
 	$(WebCore)/svg/SVGAltGlyphDefElement.idl \
 	$(WebCore)/svg/SVGAltGlyphElement.idl \
@@ -5663,17 +5718,16 @@ webcore_sources += \
 	Source/WebCore/html/canvas/OESVertexArrayObject.h \
 	Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp \
 	Source/WebCore/platform/graphics/ANGLEWebKitBridge.h \
+	Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp \
-	Source/WebCore/platform/graphics/cairo/OpenGLShims.h \
 	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp \
 	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.h \
 	Source/WebCore/platform/graphics/GraphicsContext3D.cpp \
 	Source/WebCore/platform/graphics/GraphicsContext3D.h \
-	Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp \
+	Source/WebCore/platform/graphics/OpenGLShims.cpp \
+	Source/WebCore/platform/graphics/OpenGLShims.h \
 	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp \
 	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h \
 	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp \
@@ -5685,10 +5739,6 @@ endif  # END ENABLE_WEBGL
 # ---
 if ENABLE_MHTML
 webcore_sources += \
-	Source/WebCore/loader/archive/Archive.cpp \
-	Source/WebCore/loader/archive/Archive.h \
-	Source/WebCore/loader/archive/ArchiveFactory.cpp \
-	Source/WebCore/loader/archive/ArchiveFactory.h \
 	Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp \
 	Source/WebCore/loader/archive/mhtml/MHTMLArchive.h \
 	Source/WebCore/loader/archive/mhtml/MHTMLParser.cpp \
@@ -5731,15 +5781,17 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.cpp \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.h \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h \
-        Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp \
-        Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h \
-        Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp \
-        Source/WebCore/platform/graphics/texmap/TextureMapperNode.h \
-        Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h 
 webcoregtk_sources += \
 	Source/WebCore/platform/graphics/cairo/TextureMapperCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/TextureMapperCairo.h
@@ -5747,20 +5799,24 @@ endif  # END USE_TEXTURE_MAPPER_CAIRO
 
 if USE_TEXTURE_MAPPER_GL
 webcore_sources += \
-	Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp \
-	Source/WebCore/platform/graphics/opengl/TextureMapperGL.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperGL.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h \
 	Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp \
 	Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.cpp \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.h \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h \
-	Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp \
-	Source/WebCore/platform/graphics/texmap/TextureMapperNode.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
 webcoregtk_sources += \
 	Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp \
diff --git a/Source/WebCore/Modules/gamepad/GamepadList.idl b/Source/WebCore/Modules/gamepad/GamepadList.idl
index 6189ddc37..4f1e1df9a 100644
--- a/Source/WebCore/Modules/gamepad/GamepadList.idl
+++ b/Source/WebCore/Modules/gamepad/GamepadList.idl
@@ -30,7 +30,7 @@ module dom {
         IndexedGetter
     ] GamepadList {
         readonly attribute unsigned long length;
-        Gamepad item(in [Optional=CallWithDefaultValue] unsigned long index);
+        Gamepad item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
index 4d1d933b8..95cd602a2 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
@@ -28,7 +28,10 @@
 
 #if ENABLE(GAMEPAD)
 
+#include "GamepadList.h"
+#include "Gamepads.h"
 #include "Navigator.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,10 +43,28 @@ NavigatorGamepad::~NavigatorGamepad()
 {
 }
 
+NavigatorGamepad* NavigatorGamepad::from(Navigator* navigator)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGamepad"));
+    NavigatorGamepad* supplement = static_cast<NavigatorGamepad*>(NavigatorSupplement::from(navigator, name));
+    if (!supplement) {
+        supplement = new NavigatorGamepad();
+        provideTo(navigator, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
 GamepadList* NavigatorGamepad::webkitGamepads(Navigator* navigator)
 {
-    // FIXME: We shouldn't need to direct this call to Navigator.
-    return navigator->gamepads();
+    return NavigatorGamepad::from(navigator)->gamepads();
+}
+
+GamepadList* NavigatorGamepad::gamepads()
+{
+    if (!m_gamepads)
+        m_gamepads = GamepadList::create();
+    sampleGamepads(m_gamepads.get());
+    return m_gamepads.get();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
index 2dc125a1e..0ab51b594 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
@@ -28,18 +28,26 @@
 
 #if ENABLE(GAMEPAD)
 
+#include "NavigatorSupplement.h"
+
 namespace WebCore {
 
 class GamepadList;
 class Navigator;
 
-class NavigatorGamepad {
+class NavigatorGamepad : public NavigatorSupplement {
 public:
+    virtual ~NavigatorGamepad();
+    static NavigatorGamepad* from(Navigator*);
+
     static GamepadList* webkitGamepads(Navigator*);
 
+    GamepadList* gamepads();
+
 private:
     NavigatorGamepad();
-    ~NavigatorGamepad();
+
+    RefPtr<GamepadList> m_gamepads;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/Geolocation.cpp b/Source/WebCore/Modules/geolocation/Geolocation.cpp
index 2703bcd1f..ae1f4fcbc 100644
--- a/Source/WebCore/page/Geolocation.cpp
+++ b/Source/WebCore/Modules/geolocation/Geolocation.cpp
@@ -31,6 +31,7 @@
 #if ENABLE(GEOLOCATION)
 
 #include "Chrome.h"
+#include "ChromeClient.h"
 #include "Document.h"
 #include "Frame.h"
 #include "Geoposition.h"
@@ -255,7 +256,7 @@ void Geolocation::reset()
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         page->geolocationController()->cancelPermissionRequest(this);
 #else
-        page->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
+        page->chrome()->client()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
 #endif
     }
     // The frame may be moving to a new page and we want to get the permissions from the new page's client.
@@ -619,7 +620,7 @@ void Geolocation::requestPermission()
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     page->geolocationController()->requestPermission(this);
 #else
-    page->chrome()->requestGeolocationPermissionForFrame(m_frame, this);
+    page->chrome()->client()->requestGeolocationPermissionForFrame(m_frame, this);
 #endif
 }
 
diff --git a/Source/WebCore/page/Geolocation.h b/Source/WebCore/Modules/geolocation/Geolocation.h
index ea55cbf1f..ea55cbf1f 100644
--- a/Source/WebCore/page/Geolocation.h
+++ b/Source/WebCore/Modules/geolocation/Geolocation.h
diff --git a/Source/WebCore/page/Geolocation.idl b/Source/WebCore/Modules/geolocation/Geolocation.idl
index 4f159bcb1..4f159bcb1 100644
--- a/Source/WebCore/page/Geolocation.idl
+++ b/Source/WebCore/Modules/geolocation/Geolocation.idl
diff --git a/Source/WebCore/page/GeolocationController.cpp b/Source/WebCore/Modules/geolocation/GeolocationController.cpp
index 9694a99c4..9694a99c4 100644
--- a/Source/WebCore/page/GeolocationController.cpp
+++ b/Source/WebCore/Modules/geolocation/GeolocationController.cpp
diff --git a/Source/WebCore/page/GeolocationController.h b/Source/WebCore/Modules/geolocation/GeolocationController.h
index 0611dc30b..0611dc30b 100644
--- a/Source/WebCore/page/GeolocationController.h
+++ b/Source/WebCore/Modules/geolocation/GeolocationController.h
diff --git a/Source/WebCore/page/GeolocationError.h b/Source/WebCore/Modules/geolocation/GeolocationError.h
index 2a3bad4a9..2a3bad4a9 100644
--- a/Source/WebCore/page/GeolocationError.h
+++ b/Source/WebCore/Modules/geolocation/GeolocationError.h
diff --git a/Source/WebCore/page/GeolocationPosition.h b/Source/WebCore/Modules/geolocation/GeolocationPosition.h
index 9f25b1147..9f25b1147 100644
--- a/Source/WebCore/page/GeolocationPosition.h
+++ b/Source/WebCore/Modules/geolocation/GeolocationPosition.h
diff --git a/Source/WebCore/page/Geoposition.h b/Source/WebCore/Modules/geolocation/Geoposition.h
index 5386aaaf4..5386aaaf4 100644
--- a/Source/WebCore/page/Geoposition.h
+++ b/Source/WebCore/Modules/geolocation/Geoposition.h
diff --git a/Source/WebCore/page/Geoposition.idl b/Source/WebCore/Modules/geolocation/Geoposition.idl
index cbe728a81..cbe728a81 100644
--- a/Source/WebCore/page/Geoposition.idl
+++ b/Source/WebCore/Modules/geolocation/Geoposition.idl
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
new file mode 100644
index 000000000..b8a47c1f5
--- /dev/null
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorGeolocation.h"
+
+#include "Geolocation.h"
+#include "Navigator.h"
+
+namespace WebCore {
+
+NavigatorGeolocation::NavigatorGeolocation(Frame* frame)
+    : DOMWindowProperty(frame)
+{
+}
+
+NavigatorGeolocation::~NavigatorGeolocation()
+{
+}
+
+void NavigatorGeolocation::willDetachPage()
+{
+    // FIXME: We should ideally allow existing Geolocation activities to continue
+    // when the Geolocation's iframe is reparented. (Assuming we continue to
+    // support reparenting iframes.)
+    // See https://bugs.webkit.org/show_bug.cgi?id=55577
+    // and https://bugs.webkit.org/show_bug.cgi?id=52877
+    if (m_geolocation)
+        m_geolocation->reset();
+}
+
+NavigatorGeolocation* NavigatorGeolocation::from(Navigator* navigator)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGeolocation"));
+    NavigatorGeolocation* supplement = static_cast<NavigatorGeolocation*>(NavigatorSupplement::from(navigator, name));
+    if (!supplement) {
+        supplement = new NavigatorGeolocation(navigator->frame());
+        provideTo(navigator, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
+Geolocation* NavigatorGeolocation::geolocation(Navigator* navigator)
+{
+    return NavigatorGeolocation::from(navigator)->geolocation();
+}
+
+Geolocation* NavigatorGeolocation::geolocation() const
+{
+    if (!m_geolocation)
+        m_geolocation = Geolocation::create(frame());
+    return m_geolocation.get();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
new file mode 100644
index 000000000..b8c92e6a3
--- /dev/null
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef NavigatorGeolocation_h
+#define NavigatorGeolocation_h
+
+#include "DOMWindowProperty.h"
+#include "NavigatorSupplement.h"
+
+namespace WebCore {
+
+class Frame;
+class Geolocation;
+class Navigator;
+
+class NavigatorGeolocation : public NavigatorSupplement, public DOMWindowProperty {
+public:
+    virtual ~NavigatorGeolocation();
+    static NavigatorGeolocation* from(Navigator*);
+
+    static Geolocation* geolocation(Navigator*);
+    Geolocation* geolocation() const;
+
+private:
+    NavigatorGeolocation(Frame*);
+
+    virtual void willDetachPage() OVERRIDE;
+
+    mutable RefPtr<Geolocation> m_geolocation;
+};
+
+} // namespace WebCore
+
+#endif // NavigatorGeolocation_h
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.idl b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.idl
new file mode 100644
index 000000000..e0b8f0ed1
--- /dev/null
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=GEOLOCATION,
+        Supplemental=Navigator
+    ] NavigatorGeolocation {
+        readonly attribute [V8EnabledAtRuntime] Geolocation geolocation;
+    };
+
+}
diff --git a/Source/WebCore/page/PositionCallback.h b/Source/WebCore/Modules/geolocation/PositionCallback.h
index 09d7eb692..09d7eb692 100644
--- a/Source/WebCore/page/PositionCallback.h
+++ b/Source/WebCore/Modules/geolocation/PositionCallback.h
diff --git a/Source/WebCore/page/PositionCallback.idl b/Source/WebCore/Modules/geolocation/PositionCallback.idl
index 6d10c4337..39cfa34eb 100644
--- a/Source/WebCore/page/PositionCallback.idl
+++ b/Source/WebCore/Modules/geolocation/PositionCallback.idl
@@ -25,7 +25,7 @@
 module core {
     interface [
         Conditional=GEOLOCATION,
-        Callback=FunctionOnly
+        Callback
     ] PositionCallback {
         boolean handleEvent(in Geoposition position);
     };
diff --git a/Source/WebCore/page/PositionError.h b/Source/WebCore/Modules/geolocation/PositionError.h
index 146717041..146717041 100644
--- a/Source/WebCore/page/PositionError.h
+++ b/Source/WebCore/Modules/geolocation/PositionError.h
diff --git a/Source/WebCore/page/PositionError.idl b/Source/WebCore/Modules/geolocation/PositionError.idl
index 98e036f7b..98e036f7b 100644
--- a/Source/WebCore/page/PositionError.idl
+++ b/Source/WebCore/Modules/geolocation/PositionError.idl
diff --git a/Source/WebCore/page/PositionErrorCallback.h b/Source/WebCore/Modules/geolocation/PositionErrorCallback.h
index d152785c1..d152785c1 100644
--- a/Source/WebCore/page/PositionErrorCallback.h
+++ b/Source/WebCore/Modules/geolocation/PositionErrorCallback.h
diff --git a/Source/WebCore/page/PositionErrorCallback.idl b/Source/WebCore/Modules/geolocation/PositionErrorCallback.idl
index 32099f94f..a7dc932d5 100644
--- a/Source/WebCore/page/PositionErrorCallback.idl
+++ b/Source/WebCore/Modules/geolocation/PositionErrorCallback.idl
@@ -25,7 +25,7 @@
 module core {
     interface [
         Conditional=GEOLOCATION,
-        Callback=FunctionOnly
+        Callback
     ] PositionErrorCallback {
         boolean handleEvent(in PositionError error);
     };
diff --git a/Source/WebCore/page/PositionOptions.h b/Source/WebCore/Modules/geolocation/PositionOptions.h
index 5cb66f735..5cb66f735 100644
--- a/Source/WebCore/page/PositionOptions.h
+++ b/Source/WebCore/Modules/geolocation/PositionOptions.h
diff --git a/Source/WebCore/Modules/intents/Intent.idl b/Source/WebCore/Modules/intents/Intent.idl
index 33657f4c8..b3e23692c 100644
--- a/Source/WebCore/Modules/intents/Intent.idl
+++ b/Source/WebCore/Modules/intents/Intent.idl
@@ -26,7 +26,7 @@
 module window {
   interface [
       Conditional=WEB_INTENTS,
-      Constructor(in DOMString action, in DOMString type, in [Optional=CallWithNullValue] SerializedScriptValue data),
+      Constructor(in DOMString action, in DOMString type, in [Optional=DefaultIsNullString] SerializedScriptValue data),
       ConstructorRaisesException
   ] Intent {
         readonly attribute DOMString action;
diff --git a/Source/WebCore/Modules/intents/IntentRequest.cpp b/Source/WebCore/Modules/intents/IntentRequest.cpp
index 296f3dd2d..486caefab 100644
--- a/Source/WebCore/Modules/intents/IntentRequest.cpp
+++ b/Source/WebCore/Modules/intents/IntentRequest.cpp
@@ -41,7 +41,9 @@ PassRefPtr<IntentRequest> IntentRequest::create(ScriptExecutionContext* context,
                                                 PassRefPtr<IntentResultCallback> successCallback,
                                                 PassRefPtr<IntentResultCallback> errorCallback)
 {
-    return adoptRef(new IntentRequest(context, intent, successCallback, errorCallback));
+    RefPtr<IntentRequest> intentRequest(adoptRef(new IntentRequest(context, intent, successCallback, errorCallback)));
+    intentRequest->suspendIfNeeded();
+    return intentRequest.release();
 }
 
 IntentRequest::IntentRequest(ScriptExecutionContext* context,
@@ -52,24 +54,26 @@ IntentRequest::IntentRequest(ScriptExecutionContext* context,
     , m_intent(intent)
     , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
+    , m_stopped(false)
 {
 }
 
 void IntentRequest::contextDestroyed()
 {
     ContextDestructionObserver::contextDestroyed();
-    m_successCallback.clear();
-    m_errorCallback.clear();
+    m_stopped = true;
 }
 
 void IntentRequest::stop()
 {
-    m_successCallback.clear();
-    m_errorCallback.clear();
+    m_stopped = true;
 }
 
 void IntentRequest::postResult(SerializedScriptValue* data)
 {
+    if (m_stopped)
+        return;
+
     // Callback could lead to deletion of this.
     RefPtr<IntentRequest> protector(this);
 
@@ -84,6 +88,9 @@ void IntentRequest::postResult(SerializedScriptValue* data)
 
 void IntentRequest::postFailure(SerializedScriptValue* data)
 {
+    if (m_stopped)
+        return;
+
     // Callback could lead to deletion of this.
     RefPtr<IntentRequest> protector(this);
 
diff --git a/Source/WebCore/Modules/intents/IntentRequest.h b/Source/WebCore/Modules/intents/IntentRequest.h
index 7a809a98e..3edc0cedd 100644
--- a/Source/WebCore/Modules/intents/IntentRequest.h
+++ b/Source/WebCore/Modules/intents/IntentRequest.h
@@ -60,6 +60,7 @@ private:
     RefPtr<Intent> m_intent;
     RefPtr<IntentResultCallback> m_successCallback;
     RefPtr<IntentResultCallback> m_errorCallback;
+    bool m_stopped;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/intents/IntentResultCallback.idl b/Source/WebCore/Modules/intents/IntentResultCallback.idl
index feb4a3cc6..0afa2add6 100644
--- a/Source/WebCore/Modules/intents/IntentResultCallback.idl
+++ b/Source/WebCore/Modules/intents/IntentResultCallback.idl
@@ -26,7 +26,7 @@
 module window {
   interface [
       Conditional=WEB_INTENTS,
-      Callback=FunctionOnly
+      Callback
   ] IntentResultCallback {
       boolean handleEvent(in SerializedScriptValue result);
   };
diff --git a/Source/WebCore/Modules/intents/NavigatorIntents.idl b/Source/WebCore/Modules/intents/NavigatorIntents.idl
index 755f58e1a..b39247a3f 100644
--- a/Source/WebCore/Modules/intents/NavigatorIntents.idl
+++ b/Source/WebCore/Modules/intents/NavigatorIntents.idl
@@ -24,8 +24,8 @@ module window {
         Supplemental=Navigator
     ] NavigatorIntents {
         void startActivity(in Intent intent,
-                           in [Callback=FunctionOnly, Optional] IntentResultCallback successCallback,
-                           in [Callback=FunctionOnly, Optional] IntentResultCallback failureCallback)
+                           in [Callback, Optional] IntentResultCallback successCallback,
+                           in [Callback, Optional] IntentResultCallback failureCallback)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.cpp b/Source/WebCore/Modules/vibration/NavigatorVibration.cpp
new file mode 100644
index 000000000..ae46bff9c
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.cpp
@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "NavigatorVibration.h"
+
+#if ENABLE(VIBRATION)
+
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "Page.h"
+#include "Vibration.h"
+#include <wtf/Uint32Array.h>
+
+namespace WebCore {
+
+NavigatorVibration::NavigatorVibration()
+{
+}
+
+NavigatorVibration::~NavigatorVibration()
+{
+}
+
+void NavigatorVibration::webkitVibrate(Navigator* navigator, unsigned long time, ExceptionCode& ec)
+{
+    if (!navigator->frame()->page())
+        return;
+
+#if ENABLE(PAGE_VISIBILITY_API)
+    if (navigator->frame()->page()->visibilityState() == PageVisibilityStateHidden)
+        return;
+#endif
+
+    if (!Vibration::isActive(navigator->frame()->page())) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    Vibration::from(navigator->frame()->page())->vibrate(time);
+}
+
+void NavigatorVibration::webkitVibrate(Navigator* navigator, const VibrationPattern& pattern, ExceptionCode& ec)
+{
+    if (!navigator->frame()->page())
+        return;
+
+#if ENABLE(PAGE_VISIBILITY_API)
+    if (navigator->frame()->page()->visibilityState() == PageVisibilityStateHidden)
+        return;
+#endif
+
+    if (!Vibration::isActive(navigator->frame()->page())) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    Vibration::from(navigator->frame()->page())->vibrate(pattern);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.h b/Source/WebCore/Modules/vibration/NavigatorVibration.h
new file mode 100644
index 000000000..098f6ad5a
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.h
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef NavigatorVibration_h
+#define NavigatorVibration_h
+
+#if ENABLE(VIBRATION)
+
+#include "ExceptionCode.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Navigator;
+class Uint32Array;
+
+class NavigatorVibration {
+public:
+    typedef Vector<unsigned long> VibrationPattern;
+
+    static void webkitVibrate(Navigator*, unsigned long time, ExceptionCode&);
+    static void webkitVibrate(Navigator*, const VibrationPattern&, ExceptionCode&);
+
+private:
+    NavigatorVibration();
+    ~NavigatorVibration();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
+#endif // NavigatorVibration_h
+
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.idl b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
new file mode 100644
index 000000000..624845d81
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
@@ -0,0 +1,30 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=VIBRATION,
+        Supplemental=Navigator
+    ] NavigatorVibration {
+        void webkitVibrate(in unsigned long[] pattern) raises(DOMException);
+        void webkitVibrate(in unsigned long time) raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/Modules/vibration/Vibration.cpp b/Source/WebCore/Modules/vibration/Vibration.cpp
new file mode 100644
index 000000000..9e52c3dfb
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/Vibration.cpp
@@ -0,0 +1,144 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Vibration.h"
+
+#if ENABLE(VIBRATION)
+
+#include "VibrationClient.h"
+
+namespace WebCore {
+
+Vibration::Vibration(VibrationClient* client)
+    : m_vibrationClient(client)
+    , m_timerStart(this, &Vibration::timerStartFired)
+    , m_timerStop(this, &Vibration::timerStopFired)
+    , m_isVibrating(false)
+{
+}
+
+Vibration::~Vibration()
+{
+    m_vibrationClient->vibrationDestroyed();
+}
+
+PassOwnPtr<Vibration> Vibration::create(VibrationClient* client)
+{
+    return adoptPtr(new Vibration(client));
+}
+
+void Vibration::vibrate(const unsigned long& time)
+{
+    if (!time) {
+        cancelVibration();
+        return;
+    }
+    m_pattern.append(time);
+    m_timerStart.startOneShot(0);
+}
+
+void Vibration::vibrate(const VibrationPattern& pattern)
+{
+    int length = pattern.size();
+
+    if (m_isVibrating)
+        cancelVibration();
+
+    if (!length || (length == 1 && !pattern[0]))
+        return;
+
+    if (m_timerStart.isActive())
+        m_timerStart.stop();
+
+    m_pattern = pattern;
+    m_timerStart.startOneShot(0);
+}
+
+void Vibration::cancelVibration()
+{
+    if (m_isVibrating) {
+        m_vibrationClient->cancelVibration();
+        m_isVibrating = false;
+        m_timerStop.stop();
+    }
+}
+
+void Vibration::suspendVibration()
+{
+    if (!m_isVibrating)
+        return;
+
+    m_pattern.insert(0, m_timerStop.nextFireInterval());
+    m_timerStop.stop();
+    cancelVibration();
+}
+
+void Vibration::resumeVibration()
+{
+    m_timerStart.startOneShot(0);
+}
+
+void Vibration::timerStartFired(Timer<Vibration>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_timerStart);
+
+    m_timerStart.stop();
+
+    if (m_pattern.size()) {
+        m_isVibrating = true;
+        m_vibrationClient->vibrate(m_pattern[0]);
+        m_timerStop.startOneShot(m_pattern[0] / 1000.0);
+        m_pattern.remove(0);
+    }
+}
+
+void Vibration::timerStopFired(Timer<Vibration>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_timerStop);
+
+    m_timerStop.stop();
+    m_isVibrating = false;
+
+    if (m_pattern.size()) {
+        m_timerStart.startOneShot(m_pattern[0] / 1000.0);
+        m_pattern.remove(0);
+    }
+}
+
+const AtomicString& Vibration::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("vibration"));
+    return name;
+}
+
+bool Vibration::isActive(Page* page)
+{
+    return static_cast<bool>(Vibration::from(page));
+}
+
+void provideVibrationTo(Page* page, VibrationClient* client)
+{
+    PageSupplement::provideTo(page, Vibration::supplementName(), Vibration::create(client));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
diff --git a/Source/WebCore/Modules/vibration/Vibration.h b/Source/WebCore/Modules/vibration/Vibration.h
new file mode 100644
index 000000000..27e0736be
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/Vibration.h
@@ -0,0 +1,71 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef Vibration_h
+#define Vibration_h
+
+#if ENABLE(VIBRATION)
+
+#include "PageSupplement.h"
+#include "Timer.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class Navigator;
+class Page;
+class VibrationClient;
+
+class Vibration : public PageSupplement {
+public:
+    typedef Vector<unsigned long> VibrationPattern;
+
+    Vibration(VibrationClient*);
+    ~Vibration();
+
+    static PassOwnPtr<Vibration> create(VibrationClient*);
+
+    void vibrate(const unsigned long& time);
+    void vibrate(const VibrationPattern&);
+    void cancelVibration();
+
+    // FIXME : Add suspendVibration() and resumeVibration() to the page visibility feature, when the document.hidden attribute is changed.
+    void suspendVibration();
+    void resumeVibration();
+    void timerStartFired(Timer<Vibration>*);
+    void timerStopFired(Timer<Vibration>*);
+
+    static const AtomicString& supplementName();
+    static Vibration* from(Page* page) { return static_cast<Vibration*>(PageSupplement::from(page, supplementName())); }
+    static bool isActive(Page*);
+
+private:
+    VibrationClient* m_vibrationClient;
+    Timer<Vibration> m_timerStart;
+    Timer<Vibration> m_timerStop;
+    bool m_isVibrating;
+    VibrationPattern m_pattern;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
+#endif // Vibration_h
+
diff --git a/Source/WebCore/Modules/vibration/VibrationClient.h b/Source/WebCore/Modules/vibration/VibrationClient.h
new file mode 100644
index 000000000..ebe688927
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/VibrationClient.h
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef VibrationClient_h
+#define VibrationClient_h
+
+namespace WebCore {
+
+class Page;
+
+class VibrationClient {
+public:
+    virtual ~VibrationClient() { }
+
+    virtual void vibrate(const unsigned long& time) = 0;
+    virtual void cancelVibration() = 0;
+
+    virtual void vibrationDestroyed() = 0;
+};
+
+void provideVibrationTo(Page*, VibrationClient*);
+
+} // namespace WebCore
+
+#endif // VibrationClient_h
+
diff --git a/Source/WebCore/PlatformBlackBerry.cmake b/Source/WebCore/PlatformBlackBerry.cmake
index cec781a42..32524d084 100644
--- a/Source/WebCore/PlatformBlackBerry.cmake
+++ b/Source/WebCore/PlatformBlackBerry.cmake
@@ -45,6 +45,7 @@ LIST(APPEND WebCore_SOURCES
     platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
     platform/graphics/harfbuzz/FontHarfBuzz.cpp
     platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp
+    platform/graphics/harfbuzz/HarfBuzzShaper.cpp
     platform/graphics/harfbuzz/HarfBuzzSkia.cpp
     platform/graphics/skia/FontCacheSkia.cpp
     platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
@@ -164,12 +165,12 @@ LIST(APPEND WebCore_SOURCES
     platform/graphics/blackberry/FloatRectBlackBerry.cpp
     platform/graphics/blackberry/FloatSizeBlackBerry.cpp
     platform/graphics/blackberry/IconBlackBerry.cpp
+    platform/graphics/blackberry/ImageBlackBerry.cpp
     platform/graphics/blackberry/IntPointBlackBerry.cpp
     platform/graphics/blackberry/IntRectBlackBerry.cpp
     platform/graphics/blackberry/IntSizeBlackBerry.cpp
     platform/graphics/blackberry/MMrenderer.cpp
     platform/graphics/blackberry/MediaPlayerPrivateMMrenderer.cpp
-    platform/graphics/blackberry/ResourceBlackBerry.cpp
     platform/text/blackberry/StringBlackBerry.cpp
 )
 
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index 4c877ae0e..5d98c8904 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -9,6 +9,7 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   "${WEBCORE_DIR}/page/efl"
   "${WEBCORE_DIR}/platform/efl"
   "${WEBCORE_DIR}/platform/graphics/efl"
+  "${WEBCORE_DIR}/platform/network/soup"
   "${WEBCORE_DIR}/platform/text/efl"
   "${WEBCORE_DIR}/plugins/efl"
   "${WEBKIT_DIR}/efl/WebCoreSupport"
@@ -71,6 +72,15 @@ LIST(APPEND WebCore_SOURCES
   platform/image-decoders/jpeg/JPEGImageDecoder.cpp
   platform/image-decoders/png/PNGImageDecoder.cpp
   platform/image-decoders/webp/WEBPImageDecoder.cpp
+  platform/network/soup/CookieJarSoup.cpp
+  platform/network/soup/CredentialStorageSoup.cpp
+  platform/network/soup/GOwnPtrSoup.cpp
+  platform/network/soup/ProxyServerSoup.cpp
+  platform/network/soup/ResourceHandleSoup.cpp
+  platform/network/soup/ResourceRequestSoup.cpp
+  platform/network/soup/ResourceResponseSoup.cpp
+  platform/network/soup/SocketStreamHandleSoup.cpp
+  platform/network/soup/SoupURIUtils.cpp
   platform/posix/FileSystemPOSIX.cpp
   platform/text/efl/TextBreakIteratorInternalICUEfl.cpp
 )
@@ -162,41 +172,6 @@ IF (WTF_USE_CAIRO)
   ENDIF ()
 ENDIF ()
 
-IF (WTF_USE_SOUP)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    "${WEBCORE_DIR}/platform/network/soup"
-    "${WEBCORE_DIR}/platform/network/soup/cache"
-    "${WEBCORE_DIR}/platform/network/soup/cache/webkit"
-  )
-  LIST(APPEND WebCore_SOURCES
-    platform/network/soup/CookieJarSoup.cpp
-    platform/network/soup/CredentialStorageSoup.cpp
-    platform/network/soup/GOwnPtrSoup.cpp
-    platform/network/soup/ProxyServerSoup.cpp
-    platform/network/soup/ResourceHandleSoup.cpp
-    platform/network/soup/ResourceRequestSoup.cpp
-    platform/network/soup/ResourceResponseSoup.cpp
-    platform/network/soup/SocketStreamHandleSoup.cpp
-    platform/network/soup/SoupURIUtils.cpp
-  )
-ENDIF ()
-
-IF (WTF_USE_CURL)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    "${WEBCORE_DIR}/platform/network/curl"
-  )
-  LIST(APPEND WebCore_SOURCES
-    platform/network/curl/CookieJarCurl.cpp
-    platform/network/curl/CredentialStorageCurl.cpp
-    platform/network/curl/DNSCurl.cpp
-    platform/network/curl/FormDataStreamCurl.cpp
-    platform/network/curl/ProxyServerCurl.cpp
-    platform/network/curl/ResourceHandleCurl.cpp
-    platform/network/curl/ResourceHandleManager.cpp
-    platform/network/curl/SocketStreamHandleCurl.cpp
-  )
-ENDIF ()
-
 IF (WTF_USE_ICU_UNICODE)
   LIST(APPEND WebCore_SOURCES
     editing/SmartReplaceICU.cpp
@@ -206,12 +181,6 @@ IF (WTF_USE_ICU_UNICODE)
   )
 ENDIF ()
 
-IF (ENABLE_GEOLOCATION)
-  LIST(APPEND WebCore_SOURCES
-    platform/efl/GeolocationServiceEfl.cpp
-  )
-ENDIF()
-
 IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/gstreamer"
@@ -237,20 +206,10 @@ LIST(APPEND WebCore_LIBRARIES
   ${LIBXML2_LIBRARIES}
   ${LIBXSLT_LIBRARIES}
   ${SQLITE_LIBRARIES}
+  ${Glib_LIBRARIES}
+  ${LIBSOUP24_LIBRARIES}
 )
 
-IF (WTF_USE_SOUP)
-  LIST(APPEND WebCore_LIBRARIES
-    ${LIBSOUP24_LIBRARIES}
-  )
-ENDIF ()
-
-IF (WTF_USE_CURL)
-  LIST(APPEND WebCore_LIBRARIES
-    ${CURL_LIBRARIES}
-  )
-ENDIF ()
-
 IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_LIBRARIES
     ${GStreamer-App_LIBRARIES}
@@ -270,6 +229,8 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   ${LIBXML2_INCLUDE_DIR}
   ${LIBXSLT_INCLUDE_DIR}
   ${SQLITE_INCLUDE_DIR}
+  ${Glib_INCLUDE_DIRS}
+  ${LIBSOUP24_INCLUDE_DIRS}
 )
 
 IF (ENABLE_VIDEO)
@@ -281,15 +242,6 @@ IF (ENABLE_VIDEO)
   )
 ENDIF ()
 
-IF (ENABLE_GLIB_SUPPORT)
-  LIST(APPEND WebCore_LIBRARIES
-    ${Glib_LIBRARIES}
-  )
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    ${Glib_INCLUDE_DIRS}
-  )
-ENDIF ()
-
 IF (ENABLE_WEBGL)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     ${OPENGL_INCLUDE_DIR}
@@ -301,28 +253,15 @@ IF (ENABLE_WEBGL)
     ${OPENGL_gl_LIBRARY}
   )
   LIST(APPEND WebCore_SOURCES
+    platform/graphics/cairo/DrawingBufferCairo.cpp
     platform/graphics/cairo/GraphicsContext3DCairo.cpp
-    platform/graphics/cairo/OpenGLShims.cpp
-    platform/graphics/efl/DrawingBufferEfl.cpp
-    platform/graphics/efl/GraphicsContext3DEfl.cpp
     platform/graphics/glx/GraphicsContext3DPrivate.cpp
+    platform/graphics/OpenGLShims.cpp
     platform/graphics/opengl/Extensions3DOpenGL.cpp
     platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
     platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
   )
 ENDIF ()
 
-IF (WTF_USE_SOUP)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    ${LIBSOUP24_INCLUDE_DIRS}
-  )
-ENDIF ()
-
-IF (WTF_USE_CURL)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    ${CURL_INCLUDE_DIRS}
-  )
-ENDIF ()
-
 ADD_DEFINITIONS(-DWTF_USE_CROSS_PLATFORM_CONTEXT_MENUS=1
                 -DDATA_DIR="${CMAKE_INSTALL_PREFIX}/${DATA_INSTALL_DIR}")
diff --git a/Source/WebCore/PlatformWinCE.cmake b/Source/WebCore/PlatformWinCE.cmake
index 48ce75a8e..11bb4b1ec 100644
--- a/Source/WebCore/PlatformWinCE.cmake
+++ b/Source/WebCore/PlatformWinCE.cmake
@@ -32,6 +32,7 @@ LIST(APPEND WebCore_SOURCES
     platform/Cursor.cpp
     platform/LocalizedStrings.cpp
     platform/PlatformStrategies.cpp
+    platform/RunLoop.cpp
     platform/ScrollAnimatorWin.cpp
 
     platform/graphics/ImageSource.cpp
@@ -61,6 +62,7 @@ LIST(APPEND WebCore_SOURCES
     platform/win/PopupMenuWin.cpp
     platform/win/PlatformMouseEventWin.cpp
     platform/win/PlatformScreenWin.cpp
+    platform/win/RunLoopWin.cpp
     platform/win/SSLKeyGeneratorWin.cpp
     platform/win/ScrollbarThemeWin.cpp
     platform/win/SearchPopupMenuWin.cpp
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 758dd4bd2..9f5ce3817 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -34,6 +34,10 @@ include_webinspector {
 }
 
 SOURCES += \
+    Modules/geolocation/Geolocation.cpp \
+    Modules/geolocation/GeolocationController.cpp \
+    Modules/geolocation/NavigatorGeolocation.cpp \
+    \
     accessibility/AccessibilityImageMapLink.cpp \
     accessibility/AccessibilityMediaControls.cpp \
     accessibility/AccessibilityMenuList.cpp \
@@ -158,7 +162,8 @@ v8 {
         bindings/v8/custom/V8InjectedScriptHostCustom.cpp \
         bindings/v8/custom/V8InjectedScriptManager.cpp \
         bindings/v8/custom/V8InspectorFrontendHostCustom.cpp \
-        bindings/v8/custom/V8DOMStringMapCustom.cpp
+        bindings/v8/custom/V8DOMStringMapCustom.cpp \
+        bindings/v8/custom/V8DOMTokenListCustom.cpp
 
     SOURCES += \
         bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp \
@@ -440,7 +445,6 @@ SOURCES += \
     css/CSSValueList.cpp \
     css/CSSValuePool.cpp \
     css/CSSWrapShapes.cpp \
-    css/FontFamilyValue.cpp \
     css/FontFeatureValue.cpp \
     css/FontValue.cpp \
     css/MediaFeatureNames.cpp \
@@ -451,6 +455,7 @@ SOURCES += \
     css/MediaQueryList.cpp \
     css/MediaQueryListListener.cpp \
     css/MediaQueryMatcher.cpp \
+    css/PropertySetCSSStyleDeclaration.cpp \
     css/RGBColor.cpp \
     css/SelectorChecker.cpp \
     css/ShadowValue.cpp \
@@ -565,6 +570,7 @@ SOURCES += \
     dom/SecurityContext.cpp \
     dom/SelectorQuery.cpp \
     dom/ShadowRoot.cpp \
+    dom/ShadowRootList.cpp \
     dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
@@ -650,6 +656,7 @@ SOURCES += \
     fileapi/DOMFileSystem.cpp \
     fileapi/DOMFileSystemBase.cpp \
     fileapi/DOMFileSystemSync.cpp \
+    fileapi/DOMWindowFileSystem.cpp \
     fileapi/DirectoryEntry.cpp \
     fileapi/DirectoryEntrySync.cpp \
     fileapi/DirectoryReader.cpp \
@@ -841,10 +848,11 @@ SOURCES += \
     html/parser/TextViewSourceParser.cpp \
     html/parser/XSSAuditor.cpp \
     html/shadow/ContentSelectorQuery.cpp \
-    html/shadow/ContentInclusionSelector.cpp \
     html/shadow/DetailsMarkerControl.cpp \
     html/shadow/HTMLContentElement.cpp \
+    html/shadow/HTMLContentSelector.cpp \
     html/shadow/HTMLShadowElement.cpp \
+    html/shadow/InsertionPoint.cpp \
     html/shadow/MediaControls.cpp \
     html/shadow/MediaControlRootElement.cpp \
     html/shadow/MeterShadowElement.cpp \
@@ -855,6 +863,7 @@ SOURCES += \
     inspector/ContentSearchUtils.cpp \
     inspector/DOMEditor.cpp \
     inspector/DOMNodeHighlighter.cpp \
+    inspector/DOMPatchSupport.cpp \
     inspector/IdentifiersFactory.cpp \
     inspector/InjectedScript.cpp \
     inspector/InjectedScriptHost.cpp \
@@ -866,6 +875,7 @@ SOURCES += \
     inspector/InspectorClient.cpp \
     inspector/InspectorConsoleAgent.cpp \
     inspector/InspectorController.cpp \
+    inspector/InspectorCounters.cpp \
     inspector/InspectorDatabaseAgent.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDebuggerAgent.cpp \
@@ -919,6 +929,8 @@ SOURCES += \
     loader/cache/CachedResource.cpp \
     loader/cache/CachedScript.cpp \
     loader/cache/CachedShader.cpp \
+    loader/cache/CachedSVGDocument.cpp \
+    loader/cache/CachedSVGDocument.h \
     loader/cache/CachedXSLStyleSheet.cpp \
     loader/CrossOriginAccessControl.cpp \
     loader/CrossOriginPreflightResultCache.cpp \
@@ -984,8 +996,6 @@ SOURCES += \
     page/FrameDestructionObserver.cpp \
     page/FrameTree.cpp \
     page/FrameView.cpp \
-    page/Geolocation.cpp \
-    page/GeolocationController.cpp \
     page/GestureTapHighlighter.cpp \
     page/GroupSettings.cpp \
     page/History.cpp \
@@ -994,16 +1004,21 @@ SOURCES += \
     page/MouseEventWithHitTestResults.cpp \
     page/Navigator.cpp \
     page/NavigatorBase.cpp \
+    page/NavigatorRegisterProtocolHandler.cpp \
+    page/NavigatorSupplement.cpp \
     page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
+    page/PageSupplement.cpp \
     page/PageVisibilityState.cpp \
     page/Performance.cpp \
     page/PerformanceNavigation.cpp \
     page/PerformanceTiming.cpp \
     page/PrintContext.cpp \
     page/Screen.cpp \
+    page/scrolling/ScrollingCoordinator.cpp \
+    page/scrolling/ScrollingCoordinatorNone.cpp \
     page/SecurityOrigin.cpp \
     page/SecurityPolicy.cpp \
     page/Settings.cpp \
@@ -1033,7 +1048,6 @@ SOURCES += \
     platform/ContentType.cpp \
     platform/CrossThreadCopier.cpp \
     platform/DateComponents.cpp \
-    platform/DefaultLocalizationStrategy.cpp \
     platform/DragData.cpp \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
@@ -1167,7 +1181,6 @@ SOURCES += \
     platform/UUID.cpp \
     platform/Widget.cpp \
     platform/PlatformStrategies.cpp \
-    platform/LocalizedStrings.cpp \
     plugins/IFrameShimSupport.cpp \
     plugins/PluginDatabase.cpp \
     plugins/PluginDebug.cpp \
@@ -1290,8 +1303,8 @@ SOURCES += \
     storage/Database.cpp \
     storage/DatabaseAuthorizer.cpp \
     storage/DatabaseSync.cpp \
-    storage/LocalStorageTask.cpp \
-    storage/LocalStorageThread.cpp \
+    storage/StorageTask.cpp \
+    storage/StorageThread.cpp \
     storage/Storage.cpp \
     storage/StorageAreaImpl.cpp \
     storage/StorageAreaSync.cpp \
@@ -1505,6 +1518,16 @@ v8 {
 }
 
 HEADERS += \
+    Modules/geolocation/Geolocation.h \
+    Modules/geolocation/GeolocationController.h \
+    Modules/geolocation/GeolocationError.h \
+    Modules/geolocation/GeolocationPosition.h \
+    Modules/geolocation/Geoposition.h \
+    Modules/geolocation/PositionCallback.h \
+    Modules/geolocation/PositionError.h \
+    Modules/geolocation/PositionErrorCallback.h \
+    Modules/geolocation/PositionOptions.h \
+    \
     css/CSSAspectRatioValue.h \
     css/CSSBorderImageSliceValue.h \
     css/CSSBorderImage.h \
@@ -1554,7 +1577,6 @@ HEADERS += \
     css/CSSValueList.h \
     css/CSSValuePool.h \
     css/CSSWrapShapes.h \
-    css/FontFamilyValue.h \
     css/FontFeatureValue.h \
     css/FontValue.h \
     css/MediaFeatureNames.h \
@@ -1627,6 +1649,7 @@ HEADERS += \
     dom/EventListenerMap.h \
     dom/EventNames.h \
     dom/EventQueue.h \
+    dom/EventSender.h \
     dom/EventTarget.h \
     dom/ExceptionBase.h \
     dom/ExceptionCode.h \
@@ -1667,6 +1690,7 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectorQuery.h \
     dom/ShadowRoot.h \
+    dom/ShadowRootList.h \
     dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
@@ -1873,7 +1897,6 @@ HEADERS += \
     html/ImageDocument.h \
     html/LabelsNodeList.h \
     html/LinkRelAttribute.h \
-    html/LoadableTextTrack.h \
     html/MediaController.h \
     html/MediaDocument.h \
     html/MediaFragmentURIParser.h \
@@ -1882,9 +1905,6 @@ HEADERS += \
     html/PublicURLManager.h \
     html/StepRange.h \
     html/TextDocument.h \
-    html/TextTrack.h \
-    html/TextTrackCue.h \
-    html/TextTrackCueList.h \
     html/TimeRanges.h \
     html/ValidityState.h \
     html/parser/CSSPreloadScanner.h \
@@ -1905,11 +1925,15 @@ HEADERS += \
     html/parser/HTMLViewSourceParser.h \
     html/parser/XSSAuditor.h \
     html/shadow/ContentSelectorQuery.h \
-    html/shadow/ContentInclusionSelector.h \
     html/shadow/HTMLContentElement.h \
+    html/shadow/HTMLContentSelector.h \
     html/shadow/HTMLShadowElement.h \
     html/shadow/MediaControlElements.h \
     html/shadow/DetailsMarkerControl.h \
+    html/track/LoadableTextTrack.h \
+    html/track/TextTrack.h \
+    html/track/TextTrackCue.h \
+    html/track/TextTrackCueList.h \
     html/track/TextTrackList.h \
     html/track/TrackBase.h \
     html/track/TrackEvent.h \
@@ -1920,6 +1944,7 @@ HEADERS += \
     inspector/ContentSearchUtils.h \
     inspector/DOMEditor.h \
     inspector/DOMNodeHighlighter.h \
+    inspector/DOMPatchSupport.h \
     inspector/DOMWrapperVisitor.h \
     inspector/IdentifiersFactory.h \
     inspector/InjectedScript.h \
@@ -1931,6 +1956,7 @@ HEADERS += \
     inspector/InspectorConsoleAgent.h \
     inspector/InspectorConsoleInstrumentation.h \
     inspector/InspectorController.h \
+    inspector/InspectorCounters.h \
     inspector/InspectorCSSAgent.h \
     inspector/InspectorDatabaseAgent.h \
     inspector/InspectorDatabaseInstrumentation.h \
@@ -1982,6 +2008,7 @@ HEADERS += \
     loader/cache/CachedResourceHandle.h \
     loader/cache/CachedScript.h \
     loader/cache/CachedShader.h \
+    loader/cache/CachedSVGDocument.h \
     loader/cache/CachedXSLStyleSheet.h \
     loader/cache/MemoryCache.h \
     loader/CrossOriginAccessControl.h \
@@ -2047,8 +2074,6 @@ HEADERS += \
     page/Frame.h \
     page/FrameTree.h \
     page/FrameView.h \
-    page/Geolocation.h \
-    page/Geoposition.h \
     page/GestureTapHighlighter.h\
     page/GroupSettings.h \
     page/History.h \
@@ -2059,6 +2084,7 @@ HEADERS += \
     page/PageGroup.h \
     page/PageGroupLoadDeferrer.h \
     page/Page.h \
+    page/PageSupplement.h \
     page/PageVisibilityState.h \
     page/PrintContext.h \
     page/Screen.h \
@@ -2087,7 +2113,6 @@ HEADERS += \
     platform/ContextMenu.h \
     platform/CrossThreadCopier.h \
     platform/DateComponents.h \
-    platform/DefaultLocalizationStrategy.h \
     platform/DragData.h \
     platform/DragImage.h \
     platform/FileChooser.h \
@@ -2498,8 +2523,8 @@ HEADERS += \
     storage/DatabaseTask.h \
     storage/DatabaseThread.h \
     storage/DatabaseTracker.h \
-    storage/LocalStorageTask.h \
-    storage/LocalStorageThread.h \
+    storage/StorageTask.h \
+    storage/StorageThread.h \
     storage/OriginQuotaManager.h \
     storage/OriginUsageRecord.h \
     storage/SQLCallbackWrapper.h \
@@ -2820,7 +2845,6 @@ SOURCES += \
     platform/qt/MIMETypeRegistryQt.cpp \
     platform/qt/PasteboardQt.cpp \
     platform/qt/PlatformKeyboardEventQt.cpp \
-    platform/qt/PlatformMouseEventQt.cpp \
     platform/qt/PlatformScreenQt.cpp \
     platform/qt/PlatformTouchEventQt.cpp \
     platform/qt/PlatformTouchPointQt.cpp \
@@ -2832,11 +2856,11 @@ SOURCES += \
     platform/qt/SoundQt.cpp \
     platform/qt/LoggingQt.cpp \
     platform/qt/LanguageQt.cpp \
+    platform/qt/LocalizedStringsQt.cpp \
     platform/qt/TemporaryLinkStubsQt.cpp \
     platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorInternalICUQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
-    platform/qt/WheelEventQt.cpp \
     platform/qt/WidgetQt.cpp
 
 !contains(DEFINES, WTF_USE_LIBXML2=1) {
@@ -2847,8 +2871,7 @@ contains(DEFINES, HAVE_QSTYLE=1) {
     HEADERS += platform/qt/QtStyleOptionWebComboBox.h \
                platform/qt/RenderThemeQStyle.h \
                platform/qt/ScrollbarThemeQt.h
-    SOURCES += platform/qt/RenderThemeQStyle.cpp \
-               platform/qt/ScrollbarQt.cpp
+    SOURCES += platform/qt/RenderThemeQStyle.cpp
 }
 
 contains(DEFINES, ENABLE_SMOOTH_SCROLLING=1) {
@@ -3655,6 +3678,9 @@ contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
         websockets/WebSocket.h \
         websockets/WebSocketChannel.h \
         websockets/WebSocketChannelClient.h \
+        websockets/WebSocketExtensionDispatcher.h \
+        websockets/WebSocketExtensionProcessor.h \
+        websockets/WebSocketFrame.h \
         websockets/WebSocketHandshake.h \
         websockets/WebSocketHandshakeRequest.h \
         websockets/WebSocketHandshakeResponse.h \
@@ -3663,6 +3689,7 @@ contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
     SOURCES += \
         websockets/WebSocket.cpp \
         websockets/WebSocketChannel.cpp \
+        websockets/WebSocketExtensionDispatcher.cpp \
         websockets/WebSocketHandshake.cpp \
         websockets/WebSocketHandshakeRequest.cpp \
         websockets/WebSocketHandshakeResponse.cpp \
@@ -3944,21 +3971,29 @@ contains(CONFIG, texmap) {
         platform/graphics/texmap/LayerTransform.h \
         platform/graphics/texmap/TextureMapper.h \
         platform/graphics/texmap/TextureMapperAnimation.h \
+        platform/graphics/texmap/TextureMapperBackingStore.h \
         platform/graphics/texmap/TextureMapperImageBuffer.h \
-        platform/graphics/texmap/TextureMapperNode.h \
+        platform/graphics/texmap/TextureMapperLayer.h \
         platform/graphics/texmap/TextureMapperPlatformLayer.h
 
     SOURCES += \
         platform/graphics/texmap/LayerTransform.cpp \
         platform/graphics/texmap/TextureMapper.cpp \
         platform/graphics/texmap/TextureMapperAnimation.cpp \
+        platform/graphics/texmap/TextureMapperBackingStore.cpp \
         platform/graphics/texmap/TextureMapperImageBuffer.cpp \
-        platform/graphics/texmap/TextureMapperNode.cpp \
+        platform/graphics/texmap/TextureMapperLayer.cpp \
         platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
 
     !win32-*:contains(QT_CONFIG, opengl) {
-        HEADERS += platform/graphics/opengl/TextureMapperGL.h
-        SOURCES += platform/graphics/opengl/TextureMapperGL.cpp
+        HEADERS += \
+            platform/graphics/texmap/TextureMapperGL.h \
+            platform/graphics/texmap/TextureMapperShaderManager.h
+
+        SOURCES += \
+            platform/graphics/texmap/TextureMapperGL.cpp \
+            platform/graphics/texmap/TextureMapperShaderManager.cpp
+
         CONFIG += opengl-shims
         DEFINES += WTF_USE_TEXTURE_MAPPER_GL
     }
@@ -3968,8 +4003,8 @@ contains(CONFIG, texmap) {
 }
 
 contains(CONFIG, opengl-shims) {
-    HEADERS += platform/graphics/cairo/OpenGLShims.h
-    SOURCES += platform/graphics/cairo/OpenGLShims.cpp
+    HEADERS += platform/graphics/OpenGLShims.h
+    SOURCES += platform/graphics/OpenGLShims.cpp
     DEFINES += QT_OPENGL_SHIMS=1
 }
 
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index 38e67312c..e8a35d1ff 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -267,8 +267,8 @@ FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index 9b0a039b9..befe1c76f 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -81,6 +81,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8CustomXPathNSResolver.cpp
     bindings/v8/custom/V8DOMFormDataCustom.cpp
     bindings/v8/custom/V8DOMStringMapCustom.cpp
+    bindings/v8/custom/V8DOMTokenListCustom.cpp
     bindings/v8/custom/V8DOMWindowCustom.cpp
     bindings/v8/custom/V8DataViewCustom.cpp
     bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
@@ -128,9 +129,9 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8MessageChannelConstructor.cpp
     bindings/v8/custom/V8MessageEventCustom.cpp
     bindings/v8/custom/V8MessagePortCustom.cpp
+    bindings/v8/custom/V8MutationCallbackCustom.cpp
     bindings/v8/custom/V8NamedNodeMapCustom.cpp
     bindings/v8/custom/V8NamedNodesCollection.cpp
-    bindings/v8/custom/V8NavigatorCustom.cpp
     bindings/v8/custom/V8NodeCustom.cpp
     bindings/v8/custom/V8NodeListCustom.cpp
     bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -147,6 +148,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8Uint8ArrayCustom.cpp
     bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
     bindings/v8/custom/V8WebKitAnimationCustom.cpp
+    bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
     bindings/v8/custom/V8WebKitPointConstructor.cpp
     bindings/v8/custom/V8WebSocketCustom.cpp
     bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -251,8 +253,8 @@ FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index d839c53d9..e812ffff6 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -519,7 +519,7 @@ __ZN7WebCore16ScriptController18windowScriptObjectEv
 __ZN7WebCore16ScriptController20executeScriptInWorldEPNS_15DOMWrapperWorldERKN3WTF6StringEb
 __ZN7WebCore16ScriptController21processingUserGestureEv
 __ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
-__ZN7WebCore16StylePropertySet5derefEv
+__ZN7WebCore16StylePropertySetD1Ev
 __ZN7WebCore16ThreadGlobalData10staticDataE
 __ZN7WebCore16ThreadGlobalDataC1Ev
 __ZN7WebCore16ThreadGlobalDataD1Ev
@@ -548,7 +548,19 @@ __ZN7WebCore17RegularExpressionD1Ev
 __ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
 __ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
 __ZN7WebCore18HTMLContentElement6createEPNS_8DocumentE
-__ZN7WebCore18PlatformStrategies26createLocalizationStrategyEv
+__ZN7WebCore18PlatformPasteboard13bufferForTypeERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard13stringForTypeERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard19setPathnamesForTypeERKN3WTF6VectorINS1_6StringELm0EEERKS3_
+__ZN7WebCore18PlatformPasteboard19getPathnamesForTypeERN3WTF6VectorINS1_6StringELm0EEERKS3_
+__ZN7WebCore18PlatformPasteboard8setTypesERKN3WTF6VectorINS1_6StringELm0EEE
+__ZN7WebCore18PlatformPasteboardC1ERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard8getTypesERN3WTF6VectorINS1_6StringELm0EEE
+__ZN7WebCore18PlatformPasteboard4copyERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard16setBufferForTypeEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
+__ZN7WebCore18PlatformPasteboard16setStringForTypeERKN3WTF6StringES4_
+__ZN7WebCore18PlatformPasteboard10uniqueNameEv
+__ZNK7WebCore18PlatformPasteboard11changeCountEv
+__ZN7WebCore18PlatformPasteboard5colorEv
 __ZN7WebCore18SearchPopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore18pluginScriptObjectEPN3JSC9ExecStateEPNS_13JSHTMLElementE
@@ -592,6 +604,11 @@ __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoderC1ERKN3WTF6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoderD1Ev
 __ZN7WebCore19applicationIsSafariEv
+
+#if ENABLE(NOTIFICATIONS)
+__ZN7WebCore19provideNotificationEPNS_4PageEPNS_21NotificationPresenterE
+#endif
+
 __ZN7WebCore20DisplaySleepDisablerC1EPKc
 __ZN7WebCore20DisplaySleepDisablerD1Ev
 __ZN7WebCore20NodeRenderingContextC1EPNS_4NodeE
@@ -660,6 +677,7 @@ __ZN7WebCore24FrameDestructionObserverD2Ev
 __ZN7WebCore24FrameDestructionObserverC2EPNS_5FrameE
 __ZN7WebCore24FrameDestructionObserver12observeFrameEPNS_5FrameE
 __ZN7WebCore24FrameDestructionObserver14frameDestroyedEv
+__ZN7WebCore24FrameDestructionObserver14willDetachPageEv
 __ZN7WebCore24keyIdentifierForKeyEventEP7NSEvent
 __ZN7WebCore24notifyHistoryItemChangedE
 __ZN7WebCore25HistoryPropertyListWriter11releaseDataEv
@@ -829,7 +847,7 @@ __ZN7WebCore6Cursor8fromTypeENS0_4TypeE
 __ZN7WebCore6CursorC1EPNS_5ImageERKNS_8IntPointE
 __ZN7WebCore6CursorD1Ev
 __ZN7WebCore6CursoraSERKS0_
-__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore6Editor10applyStyleEPNS_16StylePropertySetENS_10EditActionE
 __ZN7WebCore6Editor10findStringERKN3WTF6StringEj
 __ZN7WebCore6Editor10insertTextERKN3WTF6StringEPNS_5EventE
 __ZN7WebCore6Editor13canDHTMLPasteEv
@@ -846,11 +864,11 @@ __ZN7WebCore6Editor18confirmCompositionEv
 __ZN7WebCore6Editor19countMatchesForTextERKN3WTF6StringEPNS_5RangeEjjb
 __ZN7WebCore6Editor19deleteWithDirectionENS_18SelectionDirectionENS_15TextGranularityEbb
 __ZN7WebCore6Editor19insertUnorderedListEv
-__ZN7WebCore6Editor21applyStyleToSelectionEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore6Editor21applyStyleToSelectionEPNS_16StylePropertySetENS_10EditActionE
 __ZN7WebCore6Editor21isSelectionMisspelledEv
 __ZN7WebCore6Editor23setBaseWritingDirectionE16WritingDirection
 __ZN7WebCore6Editor24advanceToNextMisspellingEb
-__ZN7WebCore6Editor24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore6Editor24computeAndSetTypingStyleEPNS_16StylePropertySetENS_10EditActionE
 __ZN7WebCore6Editor24isSelectionUngrammaticalEv
 __ZN7WebCore6Editor24replaceSelectionWithTextERKN3WTF6StringEbb
 __ZN7WebCore6Editor26decreaseSelectionListLevelEv
@@ -861,7 +879,6 @@ __ZN7WebCore6Editor27readSelectionFromPasteboardERKN3WTF6StringE
 __ZN7WebCore6Editor28replaceSelectionWithFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbb
 __ZN7WebCore6Editor29canDecreaseSelectionListLevelEv
 __ZN7WebCore6Editor29canIncreaseSelectionListLevelEv
-__ZN7WebCore6Editor30applyParagraphStyleToSelectionEPNS_19CSSStyleDeclarationENS_10EditActionE
 __ZN7WebCore6Editor30deleteSelectionWithSmartDeleteEb
 __ZN7WebCore6Editor30pasteAsPlainTextBypassingDHTMLEv
 __ZN7WebCore6Editor32guessesForUngrammaticalSelectionEv
@@ -1424,8 +1441,9 @@ __ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
 __ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
 __ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore7Element10screenRectEv
-__ZNK7WebCore7Element10shadowRootEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
+__ZNK7WebCore7Element13hasShadowRootEv
+__ZNK7WebCore7Element14shadowRootListEv
 __ZNK7WebCore7IntRect10intersectsERKS0_
 __ZNK7WebCore7IntRect8containsERKS0_
 __ZNK7WebCore7IntRectcv6CGRectEv
@@ -1463,6 +1481,7 @@ __ZNK7WebCore9FrameTree20traverseNextWithWrapEb
 __ZNK7WebCore9FrameTree24traversePreviousWithWrapEb
 __ZNK7WebCore9FrameTree4findERKN3WTF12AtomicStringE
 __ZNK7WebCore9FrameTree6parentEb
+__ZNK7WebCore9FrameTree10childCountEv
 __ZNK7WebCore9FrameView11needsLayoutEv
 __ZNK7WebCore9FrameView13isTransparentEv
 __ZNK7WebCore9FrameView13paintBehaviorEv
@@ -1477,7 +1496,6 @@ __ZNK7WebCore9TreeScope14getElementByIdERKN3WTF12AtomicStringE
 __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FrameLoaderClientE
-__ZTVN7WebCore18PlatformStrategiesE
 __ZTVN7WebCore25HistoryPropertyListWriterE
 __ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE
 _filenameByFixingIllegalCharacters
@@ -1616,7 +1634,6 @@ _wkCreateAXUIElementRef
 
 #if ENABLE(SVG)
 __ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
-__ZN7WebCore21SVGDocumentExtensions21sampleAnimationAtTimeERKN3WTF6StringEPNS_14SVGSMILElementEd
 __ZN7WebCore8Document13svgExtensionsEv
 __ZN7WebCore8Document19accessSVGExtensionsEv
 #endif
@@ -1697,6 +1714,7 @@ __ZN7WebCore19InspectorController5closeEv
 __ZN7WebCore28InspectorFrontendClientLocal11showConsoleEv
 __ZN7WebCore28InspectorFrontendClientLocal12moveWindowByEff
 __ZN7WebCore28InspectorFrontendClientLocal12openInNewTabERKN3WTF6StringE
+__ZN7WebCore28InspectorFrontendClientLocal13showResourcesEv
 __ZN7WebCore28InspectorFrontendClientLocal14frontendLoadedEv
 __ZN7WebCore28InspectorFrontendClientLocal15canAttachWindowEv
 __ZN7WebCore28InspectorFrontendClientLocal17setAttachedWindowEb
@@ -1708,6 +1726,7 @@ __ZN7WebCore28InspectorFrontendClientLocal19windowObjectClearedEv
 __ZN7WebCore28InspectorFrontendClientLocal20sendMessageToBackendERKN3WTF6StringE
 __ZN7WebCore28InspectorFrontendClientLocal21isProfilingJavaScriptEv
 __ZN7WebCore28InspectorFrontendClientLocal23stopProfilingJavaScriptEv
+__ZN7WebCore28InspectorFrontendClientLocal24showMainResourceForFrameEPNS_5FrameE
 __ZN7WebCore28InspectorFrontendClientLocal24startProfilingJavaScriptEv
 __ZN7WebCore28InspectorFrontendClientLocal26changeAttachedWindowHeightEj
 __ZN7WebCore28InspectorFrontendClientLocal26isTimelineProfilingEnabledEv
@@ -2065,15 +2084,20 @@ __ZN7WebCore12NotificationD1Ev
 __ZN7WebCore12Notification17dispatchShowEventEv
 __ZN7WebCore12Notification18dispatchClickEventEv
 __ZN7WebCore12Notification18dispatchCloseEventEv
+__ZN7WebCore12Notification18dispatchErrorEventEv
 #endif
 
 #if ENABLE(THREADED_SCROLLING)
 __ZN7WebCore13ScrollingTree21tryToHandleWheelEventERKNS_18PlatformWheelEventE
+__ZN7WebCore13ScrollingTree22updateBackForwardStateEbb
 __ZN7WebCore13ScrollingTreeD1Ev
+__ZN7WebCore15ScrollingThread8dispatchERKN3WTF8FunctionIFvvEEE
 __ZN7WebCore4Page20scrollingCoordinatorEv
 __ZNK7WebCore20ScrollingCoordinator13scrollingTreeEv
 #endif
 
-#if ENABLE(STYLE_SCOPED)
-__ZNK7WebCore7Element31numberOfScopedHTMLStyleChildrenEv
+__ZNK7WebCore4Node31numberOfScopedHTMLStyleChildrenEv
+
+#if ENABLE(SHADOW_DOM)
+__ZN7WebCore22RuntimeEnabledFeatures32setMultipleShadowSubtreesEnabledEb
 #endif
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index 517f9b1be..25c541336 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -52,6 +52,7 @@
       '../',
       '../..',
       '../Modules/gamepad',
+      '../Modules/geolocation',
       '../Modules/intents',
       '../Modules/indexeddb',
       '../accessibility',
@@ -89,6 +90,7 @@
       '../page',
       '../page/animation',
       '../page/chromium',
+      '../page/scrolling',
       '../platform',
       '../platform/animation',
       '../platform/audio',
@@ -310,18 +312,11 @@
           # static library and rebuilds it with these global symbols
           # transformed to private_extern.
           'target_name': 'webkit_system_interface',
-          'type': 'static_library',
+          'type': 'none',
           'variables': {
             'adjusted_library_path':
                 '<(PRODUCT_DIR)/libWebKitSystemInterfaceLeopardPrivateExtern.a',
           },
-          'sources': [
-            # An empty source file is needed to convince Xcode to produce
-            # output for this target.  The resulting library won't actually
-            # contain anything.  The library at adjusted_library_path will,
-            # and that library is pushed to dependents of this target below.
-            'mac/Empty.cpp',
-          ],
           'actions': [
             {
               'action_name': 'Adjust Visibility',
@@ -484,6 +479,7 @@
           'inputs': [
             '../bindings/scripts/resolve-supplemental.pl',
             '../bindings/scripts/IDLParser.pm',
+            '../bindings/scripts/IDLAttributes.txt',
             '<(idl_files_list)',
             '<!@(cat <(idl_files_list))',
           ],
@@ -501,6 +497,8 @@
             '<(idl_files_list)',
             '--supplementalDependencyFile',
             '<(SHARED_INTERMEDIATE_DIR)/supplemental_dependency.tmp',
+            '--idlAttributesFile',
+            '../bindings/scripts/IDLAttributes.txt',
           ],
           'message': 'Resolving [Supplemental=XXX] dependencies in all IDL files',
         }
@@ -820,6 +818,7 @@
               '../css/quirks.css',
               '../css/view-source.css',
               '../css/themeChromium.css', # Chromium only.
+              '../css/themeChromiumAndroid.css', # Chromium only.
               '../css/themeChromiumLinux.css', # Chromium only.
               '../css/themeChromiumSkia.css',  # Chromium only.
               '../css/themeWin.css',
@@ -1177,6 +1176,7 @@
         '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
         '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
         '<(chromium_src_dir)/third_party/angle/src/build_angle.gyp:translator_glsl',
+        '<(chromium_src_dir)/third_party/zlib/zlib.gyp:zlib',
         '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
         '<(libjpeg_gyp_path):libjpeg',
       ],
@@ -1484,6 +1484,7 @@
             ['include', 'platform/graphics/harfbuzz/FontHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/FontPlatformDataHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/HarfBuzzSkia\\.cpp$'],
+            ['include', 'platform/graphics/harfbuzz/HarfBuzzShaperBase\\.(cpp|h)$'],
             ['include', 'platform/graphics/skia/SimpleFontDataSkia\\.cpp$'],
           ],
         }, { # use_x11==0
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index e4a52271b..bf1e89651 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -3,6 +3,15 @@
         'project_dir': ['.'],
         # These headers are part of WebCore's private API in the Apple Mac build.
         'webcore_privateheader_files': [
+            'Modules/geolocation/Geolocation.h',
+            'Modules/geolocation/GeolocationController.h',
+            'Modules/geolocation/GeolocationError.h',
+            'Modules/geolocation/GeolocationPosition.h',
+            'Modules/geolocation/Geoposition.h',
+            'Modules/geolocation/PositionCallback.h',
+            'Modules/geolocation/PositionError.h',
+            'Modules/geolocation/PositionErrorCallback.h',
+            'Modules/geolocation/PositionOptions.h',
             'accessibility/AXObjectCache.h',
             'accessibility/AccessibilityObject.h',
             'bindings/ScriptControllerBase.h',
@@ -207,23 +216,15 @@
             'page/Frame.h',
             'page/FrameTree.h',
             'page/FrameView.h',
-            'page/Geolocation.h',
             'page/GeolocationClient.h',
-            'page/GeolocationController.h',
-            'page/GeolocationError.h',
-            'page/GeolocationPosition.h',
-            'page/Geoposition.h',
             'page/GroupSettings.h',
             'page/MediaCanStartListener.h',
             'page/MemoryInfo.h',
             'page/Page.h',
             'page/PageGroup.h',
             'page/PageSerializer.h',
+            'page/PageSupplement.h',
             'page/PageVisibilityState.h',
-            'page/PositionCallback.h',
-            'page/PositionError.h',
-            'page/PositionErrorCallback.h',
-            'page/PositionOptions.h',
             'page/PrintContext.h',
             'page/SecurityOrigin.h',
             'page/SecurityOriginHash.h',
@@ -251,7 +252,6 @@
             'platform/CookiesStrategy.h',
             'platform/Cursor.h',
             'platform/DateComponents.h',
-            'platform/DefaultLocalizationStrategy.h',
             'platform/DragData.h',
             'platform/DragImage.h',
             'platform/FileChooser.h',
@@ -267,7 +267,6 @@
             'platform/LengthBox.h',
             'platform/LengthSize.h',
             'platform/LinkHash.h',
-            'platform/LocalizationStrategy.h',
             'platform/LocalizedStrings.h',
             'platform/Logging.h',
             'platform/MemoryPressureHandler.h',
@@ -303,7 +302,6 @@
             'platform/ThreadGlobalData.h',
             'platform/Timer.h',
             'platform/TreeShared.h',
-            'platform/URLString.h',
             'platform/VisitedLinkStrategy.h',
             'platform/Widget.h',
             'platform/WindowsKeyboardCodes.h',
@@ -619,6 +617,7 @@
             'dom/ScriptExecutionContext.h',
             'dom/ScriptRunner.h',
             'dom/ShadowRoot.h',
+            'dom/ShadowRootList.h',
             'dom/SpaceSplitString.h',
             'dom/StyledElement.h',
             'dom/Text.h',
@@ -721,6 +720,12 @@
             'Modules/gamepad/Gamepad.idl',
             'Modules/gamepad/GamepadList.idl',
             'Modules/gamepad/NavigatorGamepad.idl',
+            'Modules/geolocation/Geolocation.idl',
+            'Modules/geolocation/Geoposition.idl',
+            'Modules/geolocation/NavigatorGeolocation.idl',
+            'Modules/geolocation/PositionCallback.idl',
+            'Modules/geolocation/PositionError.idl',
+            'Modules/geolocation/PositionErrorCallback.idl',
             'Modules/indexeddb/DOMWindowIndexedDatabase.idl',
             'Modules/intents/DOMWindowIntents.idl',
             'Modules/intents/Intent.idl',
@@ -827,6 +832,7 @@
             'fileapi/DirectoryReaderSync.idl',
             'fileapi/DOMFileSystem.idl',
             'fileapi/DOMFileSystemSync.idl',
+            'fileapi/DOMWindowFileSystem.idl',
             'fileapi/EntriesCallback.idl',
             'fileapi/Entry.idl',
             'fileapi/EntryArray.idl',
@@ -855,6 +861,7 @@
             'html/DOMSettableTokenList.idl',
             'html/DOMTokenList.idl',
             'html/DOMURL.idl',
+            'html/DOMWindowHTML.idl',
             'html/HTMLAllCollection.idl',
             'html/HTMLAnchorElement.idl',
             'html/HTMLAppletElement.idl',
@@ -932,9 +939,6 @@
             'html/MediaController.idl',
             'html/MediaError.idl',
             'html/TextMetrics.idl',
-            'html/TextTrack.idl',
-            'html/TextTrackCue.idl',
-            'html/TextTrackCueList.idl',
             'html/TimeRanges.idl',
             'html/ValidityState.idl',
             'html/VoidCallback.idl',
@@ -945,6 +949,7 @@
             'html/canvas/CanvasPixelArray.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
+            'html/canvas/DOMWindowWebGL.idl',
             'html/canvas/DataView.idl',
             'html/canvas/Float32Array.idl',
             'html/canvas/Float64Array.idl',
@@ -976,6 +981,9 @@
             'html/canvas/WebGLVertexArrayObjectOES.idl',
             'html/shadow/HTMLContentElement.idl',
             'html/shadow/HTMLShadowElement.idl',
+            'html/track/TextTrack.idl',
+            'html/track/TextTrackCue.idl',
+            'html/track/TextTrackCueList.idl',
             'html/track/TextTrackList.idl',
             'html/track/TrackEvent.idl',
             'inspector/InjectedScriptHost.idl',
@@ -984,12 +992,14 @@
             'inspector/ScriptProfile.idl',
             'inspector/ScriptProfileNode.idl',
             'loader/appcache/DOMApplicationCache.idl',
+            'mediastream/DOMWindowMediaStream.idl',
             'mediastream/LocalMediaStream.idl',
             'mediastream/MediaStream.idl',
             'mediastream/MediaStreamEvent.idl',
             'mediastream/MediaStreamList.idl',
             'mediastream/MediaStreamTrack.idl',
             'mediastream/MediaStreamTrackList.idl',
+            'mediastream/NavigatorMediaStream.idl',
             'mediastream/NavigatorUserMediaError.idl',
             'mediastream/NavigatorUserMediaErrorCallback.idl',
             'mediastream/NavigatorUserMediaSuccessCallback.idl',
@@ -1005,19 +1015,15 @@
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
             'page/EventSource.idl',
-            'page/Geolocation.idl',
-            'page/Geoposition.idl',
             'page/History.idl',
             'page/Location.idl',
             'page/MemoryInfo.idl',
             'page/Navigator.idl',
+            'page/NavigatorRegisterProtocolHandler.idl',
             'page/Performance.idl',
             'page/PerformanceNavigation.idl',
             'page/PerformanceTiming.idl',
             'page/PointerLock.idl',
-            'page/PositionCallback.idl',
-            'page/PositionError.idl',
-            'page/PositionErrorCallback.idl',
             'page/Screen.idl',
             'page/SpeechInputEvent.idl',
             'page/SpeechInputResult.idl',
@@ -1097,12 +1103,14 @@
             'websockets/DOMWindowWebSocket.idl',
             'websockets/WebSocket.idl',
             'workers/AbstractWorker.idl',
+            'workers/DOMWindowWorker.idl',
             'workers/DedicatedWorkerContext.idl',
             'workers/SharedWorker.idl',
             'workers/SharedWorkerContext.idl',
             'workers/Worker.idl',
             'workers/WorkerContext.idl',
             'workers/WorkerLocation.idl',
+            'xml/DOMWindowXML.idl',
             'xml/DOMParser.idl',
             'xml/XMLHttpRequest.idl',
             'xml/XMLHttpRequestException.idl',
@@ -1117,6 +1125,7 @@
             'xml/XSLTProcessor.idl',
         ],
         'webcore_svg_bindings_idl_files': [
+            'svg/DOMWindowSVG.idl',
             'svg/ElementTimeControl.idl',
             'svg/SVGAElement.idl',
             'svg/SVGAltGlyphElement.idl',
@@ -1277,6 +1286,10 @@
             'Modules/gamepad/GamepadList.h',
             'Modules/gamepad/NavigatorGamepad.cpp',
             'Modules/gamepad/NavigatorGamepad.h',
+            'Modules/geolocation/Geolocation.cpp',
+            'Modules/geolocation/GeolocationController.cpp',
+            'Modules/geolocation/NavigatorGeolocation.cpp',
+            'Modules/geolocation/NavigatorGeolocation.h',
             'Modules/indexeddb/DOMWindowIndexedDatabase.cpp',
             'Modules/indexeddb/DOMWindowIndexedDatabase.h',
             'Modules/intents/Intent.cpp',
@@ -1557,7 +1570,6 @@
             'bindings/js/JSMessagePortCustom.h',
             'bindings/js/JSMutationCallbackCustom.cpp',
             'bindings/js/JSNamedNodeMapCustom.cpp',
-            'bindings/js/JSNavigatorCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
             'bindings/js/JSNodeFilterCondition.cpp',
             'bindings/js/JSNodeFilterCondition.h',
@@ -1815,6 +1827,7 @@
             'bindings/v8/custom/V8CustomXPathNSResolver.h',
             'bindings/v8/custom/V8DOMFormDataCustom.cpp',
             'bindings/v8/custom/V8DOMStringMapCustom.cpp',
+            'bindings/v8/custom/V8DOMTokenListCustom.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DataViewCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
@@ -1869,7 +1882,6 @@
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.h',
-            'bindings/v8/custom/V8NavigatorCustom.cpp',
             'bindings/v8/custom/V8NodeCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
             'bindings/v8/custom/V8NotificationCenterCustom.cpp',
@@ -2060,8 +2072,6 @@
             'css/CSSWrapShapes.cpp',
             'css/Counter.h',
             'css/DashboardRegion.h',
-            'css/FontFamilyValue.cpp',
-            'css/FontFamilyValue.h',
             'css/FontFeatureValue.cpp',
             'css/FontFeatureValue.h',
             'css/FontValue.cpp',
@@ -2082,6 +2092,8 @@
             'css/MediaQueryListListener.h',
             'css/MediaQueryMatcher.cpp',
             'css/MediaQueryMatcher.h',
+            'css/PropertySetCSSStyleDeclaration.cpp',
+            'css/PropertySetCSSStyleDeclaration.h',
             'css/RGBColor.cpp',
             'css/RGBColor.h',
             'css/Rect.h',
@@ -2227,6 +2239,8 @@
             'fileapi/DOMFileSystemBase.h',
             'fileapi/DOMFileSystemSync.cpp',
             'fileapi/DOMFileSystemSync.h',
+            'fileapi/DOMWindowFileSystem.cpp',
+            'fileapi/DOMWindowFileSystem.h',
             'fileapi/DirectoryEntry.cpp',
             'fileapi/DirectoryEntry.h',
             'fileapi/DirectoryEntrySync.cpp',
@@ -2343,6 +2357,8 @@
             'inspector/DOMEditor.h',
             'inspector/DOMNodeHighlighter.cpp',
             'inspector/DOMNodeHighlighter.h',
+            'inspector/DOMPatchSupport.cpp',
+            'inspector/DOMPatchSupport.h',
             'inspector/DOMWrapperVisitor.h',
             'inspector/IdentifiersFactory.cpp',
             'inspector/IdentifiersFactory.h',
@@ -2363,6 +2379,8 @@
             'inspector/InspectorConsoleAgent.h',
             'inspector/InspectorConsoleInstrumentation.h',
             'inspector/InspectorController.cpp',
+            'inspector/InspectorCounters.cpp',
+            'inspector/InspectorCounters.h',
             'inspector/InspectorDOMAgent.cpp',
             'inspector/InspectorDOMDebuggerAgent.cpp',
             'inspector/InspectorDOMDebuggerAgent.h',
@@ -2527,6 +2545,8 @@
             'loader/cache/CachedScript.h',
             'loader/cache/CachedShader.cpp',
             'loader/cache/CachedShader.h',
+            'loader/cache/CachedSVGDocument.cpp',
+            'loader/cache/CachedSVGDocument.h',
             'loader/cache/CachedTextTrack.cpp',
             'loader/cache/CachedTextTrack.h',
             'loader/cache/CachedXSLStyleSheet.cpp',
@@ -2574,6 +2594,8 @@
             'mediastream/MediaStreamTrack.h',
             'mediastream/MediaStreamTrackList.cpp',
             'mediastream/MediaStreamTrackList.h',
+            'mediastream/NavigatorMediaStream.cpp',
+            'mediastream/NavigatorMediaStream.h',
             'mediastream/NavigatorUserMediaError.h',
             'mediastream/NavigatorUserMediaErrorCallback.h',
             'mediastream/NavigatorUserMediaSuccessCallback.h',
@@ -2581,6 +2603,8 @@
             'mediastream/PeerConnection.h',
             'mediastream/SignalingCallback.h',
             'mediastream/UserMediaClient.h',
+            'mediastream/UserMediaController.h',
+            'mediastream/UserMediaController.cpp',
             'mediastream/UserMediaRequest.cpp',
             'mediastream/UserMediaRequest.h',
             'notifications/Notification.cpp',
@@ -2618,8 +2642,6 @@
             'page/FrameDestructionObserver.h',
             'page/FrameTree.cpp',
             'page/FrameView.cpp',
-            'page/Geolocation.cpp',
-            'page/GeolocationController.cpp',
             'page/GroupSettings.cpp',
             'page/History.cpp',
             'page/History.h',
@@ -2632,6 +2654,10 @@
             'page/Navigator.h',
             'page/NavigatorBase.cpp',
             'page/NavigatorBase.h',
+            'page/NavigatorRegisterProtocolHandler.cpp',
+            'page/NavigatorRegisterProtocolHandler.h',
+            'page/NavigatorSupplement.cpp',
+            'page/NavigatorSupplement.h',
             'page/OriginAccessEntry.cpp',
             'page/OriginAccessEntry.h',
             'page/Page.cpp',
@@ -2639,6 +2665,7 @@
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
             'page/PageSerializer.cpp',
+            'page/PageSupplement.cpp',
             'page/PageVisibilityState.cpp',
             'page/Performance.cpp',
             'page/Performance.h',
@@ -2702,6 +2729,13 @@
             'page/mac/PageMac.cpp',
             'page/qt/DragControllerQt.cpp',
             'page/qt/EventHandlerQt.cpp',
+            'page/scrolling/ScrollingCoordinator.cpp',
+            'page/scrolling/ScrollingCoordinator.h',
+            'page/scrolling/ScrollingThread.cpp',
+            'page/scrolling/ScrollingThread.h',
+            'page/scrolling/ScrollingTreeNode.cpp',
+            'page/scrolling/ScrollingTreeNode.h',
+            'page/scrolling/chromium/ScrollingCoordinatorChromium.cpp',
             'page/win/DragControllerWin.cpp',
             'page/win/EventHandlerWin.cpp',
             'page/win/FrameCGWin.cpp',
@@ -2729,7 +2763,6 @@
             'platform/CrossThreadCopier.h',
             'platform/Cursor.cpp',
             'platform/DateComponents.cpp',
-            'platform/DefaultLocalizationStrategy.cpp',
             'platform/DragData.cpp',
             'platform/DragImage.cpp',
             'platform/EventLoop.h',
@@ -2753,7 +2786,6 @@
             'platform/Language.cpp',
             'platform/Length.cpp',
             'platform/LinkHash.cpp',
-            'platform/LocalizedStrings.cpp',
             'platform/Logging.cpp',
             'platform/MemoryPressureHandler.cpp',
             'platform/MIMETypeRegistry.cpp',
@@ -3001,6 +3033,7 @@
             'platform/graphics/CrossfadeGeneratedImage.cpp',
             'platform/graphics/CrossfadeGeneratedImage.h',
             'platform/graphics/Extensions3D.h',
+            'platform/graphics/FractionalLayoutSize.cpp',
             'platform/graphics/FloatPoint.cpp',
             'platform/graphics/FloatPoint3D.cpp',
             'platform/graphics/FloatQuad.cpp',
@@ -3222,6 +3255,7 @@
             'platform/graphics/chromium/cc/CCActiveAnimation.h',
             'platform/graphics/chromium/cc/CCAnimationCurve.cpp',
             'platform/graphics/chromium/cc/CCAnimationCurve.h',
+            'platform/graphics/chromium/cc/CCAnimationResults.h',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.h',
             'platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp',
@@ -3239,13 +3273,16 @@
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
             'platform/graphics/chromium/cc/CCInputHandler.h',
+            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp',
+            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h',
+            'platform/graphics/chromium/cc/CCLayerAnimationController.h',
+            'platform/graphics/chromium/cc/CCLayerAnimationController.cpp',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
             'platform/graphics/chromium/cc/CCLayerIterator.cpp',
             'platform/graphics/chromium/cc/CCLayerIterator.h',
-            'platform/graphics/chromium/cc/CCLayerIteratorPosition.h',
             'platform/graphics/chromium/cc/CCLayerQuad.cpp',
             'platform/graphics/chromium/cc/CCLayerQuad.h',
             'platform/graphics/chromium/cc/CCLayerSorter.cpp',
@@ -3258,6 +3295,8 @@
             'platform/graphics/chromium/cc/CCLayerTreeHost.h',
             'platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerTreeHostImpl.h',
+            'platform/graphics/chromium/cc/CCOcclusionTracker.cpp',
+            'platform/graphics/chromium/cc/CCOcclusionTracker.h',
             'platform/graphics/chromium/cc/CCPageScaleAnimation.cpp',
             'platform/graphics/chromium/cc/CCPageScaleAnimation.h',
             'platform/graphics/chromium/cc/CCPluginDrawQuad.cpp',
@@ -3274,6 +3313,8 @@
             'platform/graphics/chromium/cc/CCRenderSurface.h',
             'platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.h',
+            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp',
+            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.h',
             'platform/graphics/chromium/cc/CCScheduler.cpp',
             'platform/graphics/chromium/cc/CCScheduler.h',
             'platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp',
@@ -3436,6 +3477,8 @@
             'platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h',
             'platform/graphics/harfbuzz/HarfBuzzSkia.cpp',
             'platform/graphics/harfbuzz/HarfBuzzSkia.h',
+            'platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp',
+            'platform/graphics/harfbuzz/HarfBuzzShaperBase.h',
             'platform/graphics/mac/ColorMac.mm',
             'platform/graphics/mac/ComplexTextController.cpp',
             'platform/graphics/mac/ComplexTextController.h',
@@ -3472,8 +3515,6 @@
             'platform/graphics/opengl/Extensions3DOpenGL.h',
             'platform/graphics/opengl/GraphicsContext3DOpenGL.cpp',
             'platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp',
-            'platform/graphics/opengl/TextureMapperGL.cpp',
-            'platform/graphics/opengl/TextureMapperGL.h',
             'platform/graphics/opentype/OpenTypeSanitizer.cpp',
             'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
@@ -3576,11 +3617,17 @@
             'platform/graphics/texmap/TextureMapper.h',
             'platform/graphics/texmap/TextureMapperAnimation.cpp',
             'platform/graphics/texmap/TextureMapperAnimation.h',
+            'platform/graphics/texmap/TextureMapperBackingStore.cpp',
+            'platform/graphics/texmap/TextureMapperBackingStore.h',
+            'platform/graphics/texmap/TextureMapperGL.cpp',
+            'platform/graphics/texmap/TextureMapperGL.h',
             'platform/graphics/texmap/TextureMapperImageBuffer.cpp',
             'platform/graphics/texmap/TextureMapperImageBuffer.h',
-            'platform/graphics/texmap/TextureMapperNode.cpp',
-            'platform/graphics/texmap/TextureMapperNode.h',
+            'platform/graphics/texmap/TextureMapperLayer.cpp',
+            'platform/graphics/texmap/TextureMapperLayer.h',
             'platform/graphics/texmap/TextureMapperPlatformLayer.h',
+            'platform/graphics/texmap/TextureMapperShaderManager.cpp',
+            'platform/graphics/texmap/TextureMapperShaderManager.h',
             'platform/graphics/transforms/AffineTransform.cpp',
             'platform/graphics/transforms/IdentityTransformOperation.h',
             'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
@@ -4630,6 +4677,7 @@
             'storage/IDBPendingTransactionMonitor.h',
             'storage/IDBRequest.cpp',
             'storage/IDBRequest.h',
+            'storage/IDBTracing.h',
             'storage/IDBTransaction.cpp',
             'storage/IDBTransaction.h',
             'storage/IDBTransactionBackendImpl.cpp',
@@ -4642,10 +4690,10 @@
             'storage/IDBVersionChangeEvent.h',
             'storage/IDBVersionChangeRequest.cpp',
             'storage/IDBVersionChangeRequest.h',
-            'storage/LocalStorageTask.cpp',
-            'storage/LocalStorageTask.h',
-            'storage/LocalStorageThread.cpp',
-            'storage/LocalStorageThread.h',
+            'storage/StorageTask.cpp',
+            'storage/StorageTask.h',
+            'storage/StorageThread.cpp',
+            'storage/StorageThread.h',
             'storage/OriginQuotaManager.cpp',
             'storage/OriginQuotaManager.h',
             'storage/OriginUsageRecord.cpp',
@@ -4700,8 +4748,8 @@
             'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/wince/DatabaseThreadWinCE.cpp',
             'storage/wince/DatabaseThreadWinCE.h',
-            'storage/wince/LocalStorageThreadWinCE.cpp',
-            'storage/wince/LocalStorageThreadWinCE.h',
+            'storage/wince/StorageThreadWinCE.cpp',
+            'storage/wince/StorageThreadWinCE.h',
             'webaudio/AudioBasicProcessorNode.cpp',
             'webaudio/AudioBasicProcessorNode.h',
             'webaudio/AudioBuffer.cpp',
@@ -4789,6 +4837,12 @@
             'websockets/WebSocketChannel.cpp',
             'websockets/WebSocketChannel.h',
             'websockets/WebSocketChannelClient.h',
+            'websockets/WebSocketDeflater.cpp',
+            'websockets/WebSocketDeflater.h',
+            'websockets/WebSocketExtensionDispatcher.cpp',
+            'websockets/WebSocketExtensionDispatcher.h',
+            'websockets/WebSocketExtensionProcessor.h',
+            'websockets/WebSocketFrame.h',
             'websockets/WebSocketHandshake.cpp',
             'websockets/WebSocketHandshake.h',
             'websockets/WebSocketHandshakeRequest.cpp',
@@ -5008,6 +5062,7 @@
             'dom/EventListenerMap.cpp',
             'dom/EventNames.cpp',
             'dom/EventQueue.h',
+            'dom/EventSender.h',
             'dom/EventTarget.cpp',
             'dom/ExceptionBase.cpp',
             'dom/ExceptionBase.h',
@@ -5092,6 +5147,8 @@
             'dom/SelectorQuery.h',
             'dom/ShadowRoot.cpp',
             'dom/ShadowRoot.h',
+            'dom/ShadowRootList.cpp',
+            'dom/ShadowRootList.h',
             'dom/SpaceSplitString.cpp',
             'dom/StaticHashSetNodeList.cpp',
             'dom/StaticHashSetNodeList.h',
@@ -5354,8 +5411,6 @@
             'html/LabelsNodeList.h',
             'html/LinkRelAttribute.cpp',
             'html/LinkRelAttribute.h',
-            'html/LoadableTextTrack.cpp',
-            'html/LoadableTextTrack.h',
             'html/MediaController.cpp',
             'html/MediaController.h',
             'html/MediaDocument.cpp',
@@ -5395,12 +5450,6 @@
             'html/TextInputType.cpp',
             'html/TextInputType.h',
             'html/TextMetrics.h',
-            'html/TextTrack.cpp',
-            'html/TextTrack.h',
-            'html/TextTrackCue.cpp',
-            'html/TextTrackCue.h',
-            'html/TextTrackCueList.cpp',
-            'html/TextTrackCueList.h',
             'html/TimeInputType.cpp',
             'html/TimeInputType.h',
             'html/TimeRanges.cpp',
@@ -5523,14 +5572,16 @@
             'html/parser/XSSAuditor.h',
             'html/shadow/ContentSelectorQuery.cpp',
             'html/shadow/ContentSelectorQuery.h',
-            'html/shadow/ContentInclusionSelector.cpp',
-            'html/shadow/ContentInclusionSelector.h',
             'html/shadow/DetailsMarkerControl.cpp',
             'html/shadow/DetailsMarkerControl.h',
             'html/shadow/HTMLContentElement.cpp',
             'html/shadow/HTMLContentElement.h',
+            'html/shadow/HTMLContentSelector.cpp',
+            'html/shadow/HTMLContentSelector.h',
             'html/shadow/HTMLShadowElement.cpp',
             'html/shadow/HTMLShadowElement.h',
+            'html/shadow/InsertionPoint.cpp',
+            'html/shadow/InsertionPoint.h',
             'html/shadow/MediaControls.cpp',
             'html/shadow/MediaControls.h',
             'html/shadow/MediaControlElements.cpp',
@@ -5545,6 +5596,14 @@
             'html/shadow/SliderThumbElement.h',
             'html/shadow/TextControlInnerElements.cpp',
             'html/shadow/TextControlInnerElements.h',
+            'html/track/LoadableTextTrack.cpp',
+            'html/track/LoadableTextTrack.h',
+            'html/track/TextTrack.cpp',
+            'html/track/TextTrack.h',
+            'html/track/TextTrackCue.cpp',
+            'html/track/TextTrackCue.h',
+            'html/track/TextTrackCueList.cpp',
+            'html/track/TextTrackCueList.h',
             'html/track/TextTrackList.cpp',
             'html/track/TrackBase.cpp',
             'html/track/TrackEvent.cpp',
@@ -6111,6 +6170,7 @@
             'inspector/front-end/HelpScreen.js',
             'inspector/front-end/ImageView.js',
             'inspector/front-end/IndexedDBModel.js',
+            'inspector/front-end/IndexedDBViews.js',
             'inspector/front-end/InspectorBackend.js',
             'inspector/front-end/InspectorFrontendAPI.js',
             'inspector/front-end/InspectorFrontendHostStub.js',
@@ -6168,6 +6228,7 @@
             'inspector/front-end/ShowMoreDataGridNode.js',
             'inspector/front-end/Section.js',
             'inspector/front-end/Settings.js',
+            'inspector/front-end/SidebarOverlay.js',
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
             'inspector/front-end/SoftContextMenu.js',
@@ -6176,6 +6237,7 @@
             'inspector/front-end/SourceHTMLTokenizer.js',
             'inspector/front-end/SourceJavaScriptTokenizer.js',
             'inspector/front-end/SourceTokenizer.js',
+            'inspector/front-end/Spectrum.js',
             'inspector/front-end/SplitView.js',
             'inspector/front-end/StatusBarButton.js',
             'inspector/front-end/StylesSidebarPane.js',
@@ -6215,6 +6277,7 @@
             'inspector/front-end/elementsPanel.css',
             'inspector/front-end/filteredItemSelectionDialog.css',
             'inspector/front-end/heapProfiler.css',
+            'inspector/front-end/indexedDBViews.css',
             'inspector/front-end/inspectorCommon.css',
             'inspector/front-end/networkLogView.css',
             'inspector/front-end/networkPanel.css',
@@ -6272,7 +6335,12 @@
             'inspector/front-end/Images/goArrow.png',
             'inspector/front-end/Images/graphLabelCalloutLeft.png',
             'inspector/front-end/Images/graphLabelCalloutRight.png',
+            'inspector/front-end/Images/indexedDB.png',
+            'inspector/front-end/Images/indexedDBObjectStore.png',
+            'inspector/front-end/Images/indexedDBIndex.png',
             'inspector/front-end/Images/localStorage.png',
+            'inspector/front-end/Images/navigatorShowHideButton.png',
+            'inspector/front-end/Images/navigatorPinButton.png',
             'inspector/front-end/Images/paneAddButtons.png',
             'inspector/front-end/Images/paneBottomGrow.png',
             'inspector/front-end/Images/paneBottomGrowActive.png',
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index 99ac4d2d9..952c2992b 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -445,23 +445,23 @@ __ZN7WebCore16SQLiteFileSystem24ensureDatabaseFileExistsERKN3WTF6StringEb
 __ZN7WebCore15DatabaseTracker7trackerEv
 __ZN7WebCore15DatabaseTracker9setClientEPNS_21DatabaseTrackerClientE
 __ZN7WebCore14StorageTracker17initializeTrackerERKN3WTF6StringE
-__ZN7WebCore18LocalStorageThread6createEv
+__ZN7WebCore13StorageThread6createEv
 __ZN7WebCore14StorageTracker23setStorageDirectoryPathERKN3WTF6StringE
-__ZN7WebCore18LocalStorageThread5startEv
+__ZN7WebCore13StorageThread5startEv
 __ZN7WebCore14StorageTracker23importOriginIdentifiersEv
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeE
-__ZN7WebCore18LocalStorageThread12scheduleTaskEN3WTF10PassOwnPtrINS_16LocalStorageTaskEEE
-__ZN3WTF5DequeIPN7WebCore16LocalStorageTaskELm0EE14expandCapacityEv
+__ZN7WebCore11StorageTaskC1ENS0_4TypeE
+__ZN7WebCore13StorageThread12scheduleTaskEN3WTF10PassOwnPtrINS_11StorageTaskEEE
+__ZN3WTF5DequeIPN7WebCore11StorageTaskELm0EE14expandCapacityEv
 __ZN7WebCore14StorageTracker7trackerEv
 __ZN7WebCore14StorageTracker9setClientEPNS_20StorageTrackerClientE
 __ZN7WebCore12cacheStorageEv
-__ZN7WebCore18LocalStorageThread24threadEntryPointCallbackEPv
+__ZN7WebCore13StorageThread24threadEntryPointCallbackEPv
 __ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKN3WTF6StringE
-__ZN7WebCore18LocalStorageThread16threadEntryPointEv
-__ZN3WTF12MessageQueueIN7WebCore16LocalStorageTaskEE14waitForMessageEv
-__ZN3WTF12MessageQueueIN7WebCore16LocalStorageTaskEE19alwaysTruePredicateEPS2_
+__ZN7WebCore13StorageThread16threadEntryPointEv
+__ZN3WTF12MessageQueueIN7WebCore11StorageTaskEE14waitForMessageEv
+__ZN3WTF12MessageQueueIN7WebCore11StorageTaskEE19alwaysTruePredicateEPS2_
 __ZN7WebCore21setPlatformStrategiesEPNS_18PlatformStrategiesE
-__ZN7WebCore16LocalStorageTask11performTaskEv
+__ZN7WebCore11StorageTask11performTaskEv
 __ZN7WebCore8Settings29setDefaultMinDOMTimerIntervalEd
 __ZN7WebCore14StorageTracker27syncImportOriginIdentifiersEv
 __ZN7WebCore4Page11PageClientsC1Ev
@@ -471,7 +471,7 @@ __ZN7WebCore13listDirectoryERKN3WTF6StringES3_
 __ZN7WebCore4PageC1ERNS0_11PageClientsE
 __ZN3WTF6VectorINS_6StringELm0EEaSERKS2_
 __ZN7WebCore4PageC2ERNS0_11PageClientsE
-__ZN7WebCore16LocalStorageTaskD1Ev
+__ZN7WebCore11StorageTaskD1Ev
 __ZN7WebCore6ChromeC1EPNS_4PageEPNS_12ChromeClientE
 __ZN7WebCore19DragCaretControllerC1Ev
 __ZN7WebCore14DragControllerC1EPNS_4PageEPNS_10DragClientE
@@ -5329,9 +5329,6 @@ __ZNK7WebCore19AccessibilityObject15isMediaTimelineEv
 -[AccessibilityObjectWrapper roleDescription]
 __ZN7WebCore13AXHeadingTextEv
 __ZN7WebCore21hasPlatformStrategiesEv
-__ZN7WebCore18PlatformStrategies26createLocalizationStrategyEv
-__ZN7WebCore27DefaultLocalizationStrategyC1Ev
-__ZN7WebCore27DefaultLocalizationStrategy13AXHeadingTextEv
 __ZNK7WebCore25AccessibilityRenderObject4sizeEv
 __ZNK7WebCore25AccessibilityRenderObject11elementRectEv
 __ZNK7WebCore19AccessibilityObject13isRadioButtonEv
@@ -6680,7 +6677,6 @@ __ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
 __ZNK7WebCore4KURL17lastPathComponentEv
 __ZN7WebCore24decodeURLEscapeSequencesERKN3WTF6StringE
 __ZN7WebCore10imageTitleERKN3WTF6StringERKNS_7IntSizeE
-__ZN7WebCore27DefaultLocalizationStrategy10imageTitleERKN3WTF6StringERKNS_7IntSizeE
 __ZN7WebCoreL21formatLocalizedStringEN3WTF6StringEz
 __ZN7WebCore8Document8setTitleERKN3WTF6StringE
 __ZN7WebCore8Document4headEv
@@ -6730,7 +6726,6 @@ __ZN7WebCore16JSHTMLPreElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobal
 __ZN7WebCore16JSHTMLPreElementC1EPN3JSC9StructureEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrINS_14HTMLPreElementEEE
 __ZN7WebCore12cacheWrapperINS_14HTMLPreElementEEEvPNS_15DOMWrapperWorldEPT_PNS_12JSDOMWrapperE
 __ZN7WebCore13AXWebAreaTextEv
-__ZN7WebCore27DefaultLocalizationStrategy13AXWebAreaTextEv
 __ZN7WebCore10RenderView13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
 __ZN7WebCore25AccessibilityRenderObject16getDocumentLinksERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
 __ZN7WebCore8Document5linksEv
@@ -6740,7 +6735,6 @@ __ZNK7WebCore25AccessibilityRenderObject11layoutCountEv
 __ZNK7WebCore25AccessibilityRenderObject24estimatedLoadingProgressEv
 __ZNK7WebCore15ProgressTracker17estimatedProgressEv
 __ZN7WebCore10AXLinkTextEv
-__ZN7WebCore27DefaultLocalizationStrategy10AXLinkTextEv
 __ZN7WebCore12RenderInline25culledInlineAbsoluteRectsEPKS0_RN3WTF6VectorINS_7IntRectELm0EEERKNS_7IntSizeE
 __ZNK7WebCore25AccessibilityRenderObject19internalLinkElementEv
 __ZNK7WebCore17HTMLAnchorElement4hrefEv
@@ -6891,9 +6885,7 @@ __ZNK7WebCore13HTMLHRElement23canContainRangeEndPointEv
 __ZNK7WebCore17AccessibilityList13isOrderedListEv
 __ZNK7WebCore17AccessibilityList16isDefinitionListEv
 __ZN7WebCore24AXDefinitionListTermTextEv
-__ZN7WebCore27DefaultLocalizationStrategy24AXDefinitionListTermTextEv
 __ZN7WebCore30AXDefinitionListDefinitionTextEv
-__ZN7WebCore27DefaultLocalizationStrategy30AXDefinitionListDefinitionTextEv
 __ZN7WebCore19HTMLFieldSetElementD0Ev
 __ZN7WebCore17HTMLLegendElementD0Ev
 __ZN7WebCoreL16videoConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
@@ -7182,7 +7174,6 @@ __ZThn120_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11Medi
 __ZN7WebCore11MediaPlayer12networkStateEv
 __ZN7WebCore16HTMLMediaElement15setNetworkStateENS_11MediaPlayer12NetworkStateE
 __ZN7WebCore28mediaElementLoadingStateTextEv
-__ZN7WebCore27DefaultLocalizationStrategy28mediaElementLoadingStateTextEv
 __ZN7WebCore34MediaPlayerPrivateAVFoundationObjC19createAVAssetForURLERKN3WTF6StringE
 __ZN7WebCore30MediaPlayerPrivateAVFoundation17setDelayCallbacksEb
 __ZL38initAVURLAssetReferenceRestrictionsKeyv
@@ -7417,7 +7408,6 @@ __ZNK7WebCore35AccessibilityMediaControlsContainer9roleValueEv
 __ZNK7WebCore35AccessibilityMediaControlsContainer24accessibilityDescriptionEv
 __ZNK7WebCore35AccessibilityMediaControlsContainer15elementTypeNameEv
 __ZN7WebCore34localizedMediaControlElementStringERKN3WTF6StringE
-__ZN7WebCore27DefaultLocalizationStrategy34localizedMediaControlElementStringERKN3WTF6StringE
 __ZN7WebCore15DynamicNodeList15invalidateCacheEv
 __ZNK7WebCore24MediaControlInputElement21isMediaControlElementEv
 __ZNK7WebCore25AccessibilityMediaControl22accessibilityIsIgnoredEv
@@ -7554,14 +7544,12 @@ __ZN7WebCore23RenderFileUploadControl14styleDidChangeENS_15StyleDifferenceEPKNS_
 __ZN7WebCore23RenderFileUploadControl17updateFromElementEv
 __ZN7WebCore18ShadowInputElement6createEPNS_11HTMLElementE
 __ZN7WebCore25fileButtonChooseFileLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy25fileButtonChooseFileLabelEv
 __ZN7WebCore9InputType12valueChangedEv
 __ZN7WebCore22HTMLFormControlElement11setDisabledEb
 __ZN7WebCore23RenderFileUploadControl29computePreferredLogicalWidthsEv
 __ZNK7WebCore13FileInputType12isFileUploadEv
 __ZN7WebCore23RenderFileUploadControl11paintObjectERNS_9PaintInfoEii
 __ZN7WebCore29fileButtonNoFileSelectedLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy29fileButtonNoFileSelectedLabelEv
 __ZN7WebCore12RenderObject23absoluteBoundingBoxRectEb
 __ZN7WebCore11RenderBlock13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
 __ZThn8_N7WebCore19HTMLTextAreaElementD0Ev
@@ -7817,10 +7805,7 @@ __ZN3WTF9HashTableINS_6StringESt4pairIS1_PKN7WebCore21EditorInternalCommandEENS_
 __ZN3WTF9HashTableINS_6StringESt4pairIS1_PKN7WebCore21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS1_EENSC_IS6_EEEESD_E6lookupIS1_NS_22IdentityHashTranslatorIS1_S7_SA_EEEEPS7_RKT_
 __ZN3WTF9HashTableINS_6StringESt4pairIS1_PKN7WebCore21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS1_EENSC_IS6_EEEESD_E6rehashEi
 __ZN7WebCore35contextMenuItemTagShowSubstitutionsEb
-__ZN7WebCore27DefaultLocalizationStrategy6sharedEv
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagShowSubstitutionsEb
 __ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagShowSpellingPanelEb
 __ZN7WebCoreL22centerTruncateToBufferERKN3WTF6StringEjjPt
 __ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
 __ZN7WebCore15SQLiteStatement8bindNullEi
@@ -7917,12 +7902,8 @@ __ZNK7WebCore17CSSPrimitiveValue22getDoubleValueInternalENS0_9UnitTypesEPd
 __ZN7WebCore23HTMLTableCaptionElementD0Ev
 __ZN7WebCore13StyledElement11addCSSColorEPNS_9AttributeEiRKN3WTF6StringE
 __ZN7WebCore16HTMLStyleElement20parseMappedAttributeEPNS_9AttributeE
-__ZN7WebCore15FontFamilyValueC1ERKN3WTF6StringE
-__ZN7WebCore15FontFamilyValueC2ERKN3WTF6StringE
 __ZN7WebCore17CSSPrimitiveValueC2ERKN3WTF6StringENS0_9UnitTypesE
-__ZN7WebCore15FontFamilyValueD0Ev
 __ZN7WebCore17CSSPrimitiveValueD2Ev
-__ZNK7WebCore15FontFamilyValue17isFontFamilyValueEv
 __ZN7WebCore9CSSParser9parseFontEb
 __ZN7WebCore16SharedFontFamilyD1Ev
 __ZNK7WebCore8CSSValue12cssValueTypeEv
@@ -9563,7 +9544,6 @@ __ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27raiseEx
 __ZN3WTF14derefIfNotNullIN7WebCore11BidiContextEEEvPT_
 __ZN7WebCore24CanvasRenderingContext2D10strokeTextERKN3WTF6StringEff
 __ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
-__ZN7WebCore15FontFamilyValue20appendSpaceSeparatedEPKtj
 __ZN7WebCore17CSSInheritedValueD0Ev
 __ZN7WebCore9CSSParser15invalidBlockHitEv
 __ZN7WebCore13JSTextMetrics18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
@@ -11950,7 +11930,6 @@ __ZN7WebCore22jsHTMLCollectionLengthEPN3JSC9ExecStateENS0_7JSValueERKNS0_10Ident
 __ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
 __ZN7WebCore20RenderEmbeddedObject30setShowsMissingPluginIndicatorEv
 __ZN7WebCore17missingPluginTextEv
-__ZN7WebCore27DefaultLocalizationStrategy17missingPluginTextEv
 __ZN7WebCore20RenderEmbeddedObject13paintReplacedERNS_9PaintInfoEii
 __ZN7WebCore20RenderEmbeddedObject26getReplacementTextGeometryEiiRNS_9FloatRectERNS_4PathES2_RNS_4FontERNS_7TextRunERf
 __ZN7WebCore4Path14addRoundedRectERKNS_9FloatRectERKNS_9FloatSizeE
@@ -12370,7 +12349,6 @@ __ZN7WebCore9InputType19altAttributeChangedEv
 __ZN3WTF6String10makeSecureEt
 __ZN7WebCore9InputType27shouldRespectAlignAttributeEv
 __ZN7WebCore19inputElementAltTextEv
-__ZN7WebCore27DefaultLocalizationStrategy19inputElementAltTextEv
 __ZNK7WebCore17RenderTextControl36requiresForcedStyleRecalcPropagationEv
 __ZN7WebCore30jsHTMLInputElementDefaultValueEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZN7WebCore32jsHTMLInputElementDefaultCheckedEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
@@ -13845,7 +13823,6 @@ __ZN7WebCore11RenderStyle9setWidowsEs
 __ZN7WebCore11RenderStyle18setTextStrokeWidthEf
 __ZN7WebCore23ReplaceSelectionCommand16handleStyleSpansEv
 __ZN7WebCore12EditingStyleC1EPKNS_19CSSStyleDeclarationE
-__ZNK7WebCore15FontFamilyValue7cssTextEv
 __ZN7WebCore23ReplaceSelectionCommand19copyStyleToChildrenEPNS_4NodeEPKNS_26CSSMutableStyleDeclarationE
 __ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
 __ZN7WebCore20CompositeEditCommand16setNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS1_12AtomicStringE
@@ -15086,11 +15063,8 @@ __ZN7WebCore17HTMLKeygenElement6createERKNS_13QualifiedNameEPNS_8DocumentEPNS_15
 __ZN7WebCore17HTMLKeygenElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
 __ZN7WebCore20getSupportedKeySizesERN3WTF6VectorINS0_6StringELm0EEE
 __ZN7WebCore18keygenMenuItem2048Ev
-__ZN7WebCore27DefaultLocalizationStrategy18keygenMenuItem2048Ev
 __ZN7WebCore18keygenMenuItem1024Ev
-__ZN7WebCore27DefaultLocalizationStrategy18keygenMenuItem1024Ev
 __ZN7WebCore17keygenMenuItem512Ev
-__ZN7WebCore27DefaultLocalizationStrategy17keygenMenuItem512Ev
 __ZN7WebCore17HTMLSelectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
 __ZN7WebCore17HTMLOptionElement6createEPNS_8DocumentEPNS_15HTMLFormElementE
 __ZN7WebCore13SelectElement13deselectItemsERNS_17SelectElementDataEPNS_7ElementES4_
@@ -15571,60 +15545,34 @@ __ZN7WebCore11ContextMenuC1Ev
 __ZN7WebCore11ContextMenuC2Ev
 __ZN7WebCore21ContextMenuController8populateEv
 __ZN7WebCore26contextMenuItemTagOpenLinkEv
-__ZN7WebCore27DefaultLocalizationStrategy26contextMenuItemTagOpenLinkEv
 __ZN7WebCore15ContextMenuItemC1ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKN3WTF6StringEPNS_11ContextMenuE
 __ZN7WebCore15ContextMenuItemC2ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKN3WTF6StringEPNS_11ContextMenuE
 __ZN7WebCoreL33createPlatformMenuItemDescriptionENS_19ContextMenuItemTypeENS_17ContextMenuActionERKN3WTF6StringEbb
 __ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagOpenLinkInNewWindowEv
 __ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
-__ZN7WebCore27DefaultLocalizationStrategy36contextMenuItemTagDownloadLinkToDiskEv
 __ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagCopyLinkToClipboardEv
 __ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagOpenImageInNewWindowEv
 __ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagDownloadImageToDiskEv
 __ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagCopyImageToClipboardEv
 __ZN7WebCore27contextMenuItemTagMediaPlayEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagMediaPlayEv
 __ZN7WebCore27contextMenuItemTagMediaMuteEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagMediaMuteEv
 __ZN7WebCore37contextMenuItemTagToggleMediaControlsEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagToggleMediaControlsEv
 __ZN7WebCore33contextMenuItemTagToggleMediaLoopEv
-__ZN7WebCore27DefaultLocalizationStrategy33contextMenuItemTagToggleMediaLoopEv
 __ZN7WebCore38contextMenuItemTagEnterVideoFullscreenEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagEnterVideoFullscreenEv
 __ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagSearchInSpotlightEv
 __ZN7WebCore27contextMenuItemTagSearchWebEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagSearchWebEv
 __ZN7WebCore22contextMenuItemTagCopyEv
-__ZN7WebCore27DefaultLocalizationStrategy22contextMenuItemTagCopyEv
 __ZN7WebCore24contextMenuItemTagGoBackEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagGoBackEv
 __ZN7WebCore27contextMenuItemTagGoForwardEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagGoForwardEv
 __ZN7WebCore22contextMenuItemTagStopEv
-__ZN7WebCore27DefaultLocalizationStrategy22contextMenuItemTagStopEv
 __ZN7WebCore24contextMenuItemTagReloadEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagReloadEv
 __ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagOpenFrameInNewWindowEv
 __ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagNoGuessesFoundEv
 __ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagIgnoreSpellingEv
 __ZN7WebCore31contextMenuItemTagLearnSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagLearnSpellingEv
 __ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagIgnoreGrammarEv
 __ZN7WebCore21contextMenuItemTagCutEv
-__ZN7WebCore27DefaultLocalizationStrategy21contextMenuItemTagCutEv
 __ZN7WebCore23contextMenuItemTagPasteEv
-__ZN7WebCore27DefaultLocalizationStrategy23contextMenuItemTagPasteEv
 __ZNK7WebCore13HitTestResult17isContentEditableEv
 __ZNK7WebCore21ContextMenuController21checkOrEnableIfNeededERNS_15ContextMenuItemE
 __ZNK7WebCore15ContextMenuItem4typeEv
@@ -15638,7 +15586,6 @@ __ZNK7WebCore13HitTestResult12mediaElementEv
 __ZN7WebCore15ContextMenuItemD1Ev
 __ZN7WebCore21ContextMenuController21addInspectElementItemEv
 __ZN7WebCore32contextMenuItemTagInspectElementEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagInspectElementEv
 __ZNK7WebCore11ContextMenu19platformDescriptionEv
 __ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
 __ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
@@ -16210,16 +16157,11 @@ __ZNK7WebCore18TextCheckingHelper40guessesForMisspelledOrUngrammaticalRangeEbRbS
 __ZNK7WebCore13HitTestResult14replacedStringEv
 __ZN7WebCoreL29selectionContainsPossibleWordEPNS_5FrameE
 __ZN7WebCore30contextMenuItemTagSpellingMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy30contextMenuItemTagSpellingMenuEv
 __ZN7WebCore21ContextMenuController40createAndAppendSpellingAndGrammarSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore31contextMenuItemTagCheckSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagCheckSpellingEv
 __ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
-__ZN7WebCore27DefaultLocalizationStrategy42contextMenuItemTagCheckSpellingWhileTypingEv
 __ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy42contextMenuItemTagCheckGrammarWithSpellingEv
 __ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
-__ZN7WebCore27DefaultLocalizationStrategy46contextMenuItemTagCorrectSpellingAutomaticallyEv
 __ZN7WebCore6Editor22spellingPanelIsShowingEv
 __ZN7WebCore15ContextMenuItem8setTitleERKN3WTF6StringE
 __ZN7WebCore6Editor24isGrammarCheckingEnabledEv
@@ -16227,66 +16169,41 @@ __ZN7WebCore6Editor36isAutomaticSpellingCorrectionEnabledEv
 __ZN7WebCore15ContextMenuItem10setSubMenuEPNS_11ContextMenuE
 __ZN7WebCore11ContextMenuD1Ev
 __ZN7WebCore35contextMenuItemTagSubstitutionsMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagSubstitutionsMenuEv
 __ZN7WebCore21ContextMenuController35createAndAppendSubstitutionsSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore32contextMenuItemTagSmartCopyPasteEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagSmartCopyPasteEv
 __ZN7WebCore29contextMenuItemTagSmartQuotesEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagSmartQuotesEv
 __ZN7WebCore29contextMenuItemTagSmartDashesEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagSmartDashesEv
 __ZN7WebCore28contextMenuItemTagSmartLinksEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagSmartLinksEv
 __ZN7WebCore33contextMenuItemTagTextReplacementEv
-__ZN7WebCore27DefaultLocalizationStrategy33contextMenuItemTagTextReplacementEv
 __ZN7WebCore6Editor27substitutionsPanelIsShowingEv
 __ZN7WebCore6Editor35isAutomaticQuoteSubstitutionEnabledEv
 __ZN7WebCore6Editor34isAutomaticDashSubstitutionEnabledEv
 __ZN7WebCore6Editor31isAutomaticLinkDetectionEnabledEv
 __ZN7WebCore6Editor33isAutomaticTextReplacementEnabledEv
 __ZN7WebCore37contextMenuItemTagTransformationsMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagTransformationsMenuEv
 __ZN7WebCore21ContextMenuController37createAndAppendTransformationsSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore31contextMenuItemTagMakeUpperCaseEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagMakeUpperCaseEv
 __ZN7WebCore31contextMenuItemTagMakeLowerCaseEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagMakeLowerCaseEv
 __ZN7WebCore28contextMenuItemTagCapitalizeEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagCapitalizeEv
 __ZN7WebCore26contextMenuItemTagFontMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy26contextMenuItemTagFontMenuEv
 __ZN7WebCore21ContextMenuController26createAndAppendFontSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore27contextMenuItemTagShowFontsEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagShowFontsEv
 __ZN7WebCore22contextMenuItemTagBoldEv
-__ZN7WebCore27DefaultLocalizationStrategy22contextMenuItemTagBoldEv
 __ZN7WebCore24contextMenuItemTagItalicEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagItalicEv
 __ZN7WebCore27contextMenuItemTagUnderlineEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagUnderlineEv
 __ZN7WebCore25contextMenuItemTagOutlineEv
-__ZN7WebCore27DefaultLocalizationStrategy25contextMenuItemTagOutlineEv
 __ZN7WebCore24contextMenuItemTagStylesEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagStylesEv
 __ZN7WebCore28contextMenuItemTagShowColorsEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagShowColorsEv
 __ZN7WebCore28contextMenuItemTagSpeechMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagSpeechMenuEv
 __ZN7WebCore21ContextMenuController28createAndAppendSpeechSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore31contextMenuItemTagStartSpeakingEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagStartSpeakingEv
 __ZN7WebCore30contextMenuItemTagStopSpeakingEv
 __ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELm0EEE
-__ZN7WebCore27DefaultLocalizationStrategy30contextMenuItemTagStopSpeakingEv
 __ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagWritingDirectionMenuEv
 __ZN7WebCore21ContextMenuController38createAndAppendWritingDirectionSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore34contextMenuItemTagDefaultDirectionEv
-__ZN7WebCore27DefaultLocalizationStrategy34contextMenuItemTagDefaultDirectionEv
 __ZN7WebCore29contextMenuItemTagLeftToRightEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagLeftToRightEv
 __ZN7WebCore29contextMenuItemTagRightToLeftEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagRightToLeftEv
 __ZNK7WebCore6Editor16hasBidiSelectionEv
 __ZNK7WebCore13KeyboardEvent8charCodeEv
 __ZN7WebCore18jsDOMSelectionTypeEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
@@ -16295,7 +16212,6 @@ __ZNK7WebCore11RenderBlock24containsNonZeroBidiLevelEv
 __ZNK7WebCore19ApplyPropertyLengthILNS_10LengthAutoE1ELNS_15LengthIntrinsicE1ELNS_18LengthMinIntrinsicE1ELNS_10LengthNoneE1ELNS_15LengthUndefinedE1EE10applyValueEPNS_16CSSStyleSelectorEPNS_8CSSValueE
 __ZN7WebCore11RenderStyle11setMaxWidthENS_6LengthE
 __ZN7WebCore36contextMenuItemTagLookUpInDictionaryERKN3WTF6StringE
-__ZN7WebCore27DefaultLocalizationStrategy36contextMenuItemTagLookUpInDictionaryERKN3WTF6StringE
 __ZNK7WebCore19InspectorController26hasInspectorFrontendClientEv
 __ZNK7WebCore21BackForwardController18canGoBackOrForwardEi
 __ZNK7WebCore4Page18canGoBackOrForwardEi
@@ -17063,7 +16979,6 @@ __ZN7WebCore14SVGSMILElement20disconnectConditionsEv
 __ZN7WebCore17SMILTimeContainer10unscheduleEPNS_14SVGSMILElementE
 __ZNK7WebCore17RenderDeprecatedFlexibleBox10renderNameEv
 __ZN7WebCore27searchableIndexIntroductionEv
-__ZN7WebCore27DefaultLocalizationStrategy27searchableIndexIntroductionEv
 __ZN7WebCore14RenderRubyTextC1EPNS_4NodeE
 __ZNK7WebCore13RenderRubyRun11hasRubyTextEv
 __ZNK7WebCore14RenderRubyText10isRubyTextEv
@@ -18969,7 +18884,6 @@ __ZN7WebCore8Location7setHrefERKN3WTF6StringEPNS_9DOMWindowES6_
 __ZN7WebCore17StylePendingImage12removeClientEPNS_12RenderObjectE
 __ZN7WebCore15SubmitInputType12defaultValueEv
 __ZN7WebCore24submitButtonDefaultLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy24submitButtonDefaultLabelEv
 __ZNK7WebCore11RenderTable20firstLineBoxBaselineEv
 __ZNK7WebCore18RenderTableSection20firstLineBoxBaselineEv
 __ZNK7WebCore15RenderWordBreak10renderNameEv
@@ -19455,7 +19369,6 @@ __ZN7WebCoreL22TopGradientInterpolateEPvPKdPd
 __ZN7WebCoreL25BottomGradientInterpolateEPvPKdPd
 __ZN7WebCore14ResetInputType12defaultValueEv
 __ZN7WebCore23resetButtonDefaultLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy23resetButtonDefaultLabelEv
 __ZN7WebCore12URLInputType6createEPNS_16HTMLInputElementE
 __ZNK7WebCore12URLInputType15formControlTypeEv
 __ZN7WebCore14InputTypeNames3urlEv
@@ -20071,7 +19984,7 @@ __ZNK7WebCore14SecurityOrigin18databaseIdentifierEv
 __ZN7WebCore17encodeForFileNameERKN3WTF6StringE
 __ZN7WebCore15StorageAreaSync6createEN3WTF10PassRefPtrINS_18StorageSyncManagerEEENS2_INS_15StorageAreaImplEEERKNS1_6StringE
 __ZN7WebCore18StorageSyncManager14scheduleImportEN3WTF10PassRefPtrINS_15StorageAreaSyncEEE
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEPNS_15StorageAreaSyncE
+__ZN7WebCore11StorageTaskC1ENS0_4TypeEPNS_15StorageAreaSyncE
 __ZN7WebCore15StorageAreaSync13performImportEv
 __ZN7WebCore15StorageAreaSync12openDatabaseENS0_21OpenDatabaseParamTypeE
 __ZN7WebCore18StorageSyncManager20fullDatabaseFilenameERKN3WTF6StringE
@@ -25221,7 +25134,6 @@ __ZN7WebCore13JSEventSourceD1Ev
 __ZN7WebCore11EventSourceD0Ev
 __ZNK3JSC14JSGlobalObject14isGlobalObjectEv
 __ZN7WebCore22multipleFileUploadTextEj
-__ZN7WebCore27DefaultLocalizationStrategy22multipleFileUploadTextEj
 __ZN7WebCore17RenderDeprecatedFlexibleBox22calcVerticalPrefWidthsEv
 __ZN7WebCore11RenderStyle15setBoxFlexGroupEj
 __ZNK7WebCore13RenderListBox10renderNameEv
@@ -25498,7 +25410,6 @@ __ZN7WebCore22HTMLFormControlElement30updateVisibleValidationMessageEv
 __ZNK7WebCore16HTMLInputElement16valueMissingTextEv
 __ZNK7WebCore9InputType16valueMissingTextEv
 __ZN7WebCore33validationMessageValueMissingTextEv
-__ZN7WebCore27DefaultLocalizationStrategy33validationMessageValueMissingTextEv
 __ZN7WebCore17ValidationMessage6createEPNS_21FormAssociatedElementE
 __ZN7WebCore17ValidationMessage10setMessageERKN3WTF6StringE
 __ZN7WebCore5TimerINS_17ValidationMessageEE5firedEv
@@ -25608,11 +25519,9 @@ __ZN7WebCore44validationMessageValueMissingForCheckboxTextEv
 __ZNK7WebCore14RadioInputType16valueMissingTextEv
 __ZN7WebCore41validationMessageValueMissingForRadioTextEv
 __ZN7WebCore36validationMessagePatternMismatchTextEv
-__ZN7WebCore27DefaultLocalizationStrategy36validationMessagePatternMismatchTextEv
 __ZNK7WebCore16HTMLInputElement16typeMismatchTextEv
 __ZNK7WebCore14EmailInputType16typeMismatchTextEv
 __ZN7WebCore41validationMessageTypeMismatchForEmailTextEv
-__ZN7WebCore27DefaultLocalizationStrategy33validationMessageTypeMismatchTextEv
 __ZN7WebCore38jsHTMLFieldSetElementValidationMessageEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZN7WebCore36jsHTMLKeygenElementValidationMessageEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZN7WebCore33jsHTMLFieldSetElementWillValidateEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
@@ -25922,7 +25831,7 @@ __ZN7WebCore15StorageAreaSync11performSyncEv
 __ZN7WebCore15StorageAreaSync4syncEbRKN3WTF7HashMapINS1_6StringES3_NS1_10StringHashENS1_10HashTraitsIS3_EES6_EE
 __ZN7WebCore14StorageTracker20cancelDeletingOriginERKN3WTF6StringE
 __ZN7WebCore14StorageTracker16setOriginDetailsERKN3WTF6StringES4_
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeERKN3WTF6StringES5_
+__ZN7WebCore11StorageTaskC1ENS0_4TypeERKN3WTF6StringES5_
 __ZN7WebCore14StorageTracker12scheduleTaskEPv
 __ZN7WebCore14StorageTracker20syncSetOriginDetailsERKN3WTF6StringES4_
 __ZN7WebCore26setJSDOMWindowOnhashchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
@@ -27510,12 +27419,12 @@ __ZN7WebCore15StorageAreaImpl5closeEv
 __ZN7WebCore15StorageAreaSync17scheduleFinalSyncEv
 __ZN7WebCore18StorageSyncManager27scheduleDeleteEmptyDatabaseEN3WTF10PassRefPtrINS_15StorageAreaSyncEEE
 __ZN7WebCore18StorageSyncManager5closeEv
-__ZN7WebCore18LocalStorageThread9terminateEv
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEPNS_18LocalStorageThreadE
+__ZN7WebCore13StorageThread9terminateEv
+__ZN7WebCore11StorageTaskC1ENS0_4TypeEPNS_13StorageThreadE
 __ZN7WebCore15StorageAreaSync19deleteEmptyDatabaseEv
-__ZN7WebCore18LocalStorageThread16performTerminateEv
-__ZN7WebCore18LocalStorageThreadD1Ev
-__ZN3WTF12MessageQueueIN7WebCore16LocalStorageTaskEED1Ev
+__ZN7WebCore13StorageThread16performTerminateEv
+__ZN7WebCore13StorageThreadD1Ev
+__ZN3WTF12MessageQueueIN7WebCore11StorageTaskEED1Ev
 __ZN7WebCore28InspectorFrontendClientLocalD2Ev
 __ZN7WebCore21InspectorFrontendHost16disconnectClientEv
 __ZN7WebCore23JSInspectorFrontendHostD1Ev
@@ -28611,7 +28520,6 @@ __ZN7WebCore11FrameLoader22findFrameForNavigationERKN3WTF12AtomicStringE
 __ZN3JSC8Bindings13RuntimeObject23throwInvalidAccessErrorEPNS_9ExecStateE
 __ZN7WebCore20RenderEmbeddedObject30setShowsCrashedPluginIndicatorEv
 __ZN7WebCore17crashedPluginTextEv
-__ZN7WebCore27DefaultLocalizationStrategy17crashedPluginTextEv
 __ZN7WebCore16ScriptController11createWorldEv
 __ZN7WebCore9PageGroup20addUserScriptToWorldEPNS_15DOMWrapperWorldERKN3WTF6StringERKNS_4KURLENS3_10PassOwnPtrINS3_6VectorIS4_Lm0EEEEESD_NS_23UserScriptInjectionTimeENS_25UserContentInjectedFramesE
 __ZN7WebCore10UserScriptC2ERKN3WTF6StringERKNS_4KURLENS1_10PassOwnPtrINS1_6VectorIS2_Lm0EEEEESB_NS_23UserScriptInjectionTimeENS_25UserContentInjectedFramesE
@@ -28774,7 +28682,7 @@ __ZN7WebCore14StorageTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore9PageGroup26clearLocalStorageForOriginEPNS_14SecurityOriginE
 __ZN7WebCore20StorageNamespaceImpl22clearOriginForDeletionEPNS_14SecurityOriginE
 __ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_15StorageAreaImplEEENS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS8_IS6_EEE3getEPS3_
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeERKN3WTF6StringE
+__ZN7WebCore11StorageTaskC1ENS0_4TypeERKN3WTF6StringE
 __ZN7WebCore14StorageTracker16syncDeleteOriginERKN3WTF6StringE
 __ZN7WebCore14StorageTracker21databasePathForOriginERKN3WTF6StringE
 __ZN7WebCore14StorageTracker18diskUsageForOriginEPNS_14SecurityOriginE
@@ -29802,8 +29710,6 @@ __ZN7WebCore19JSSVGAnimateElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10I
 __ZN7WebCore12RenderObject16positionForPointERKNS_8IntPointE
 __ZN7WebCore22ConditionEventListener11handleEventEPNS_22ScriptExecutionContextEPNS_5EventE
 __ZN7WebCore14SVGSMILElement20handleConditionEventEPNS_5EventEPNS0_9ConditionE
-__ZN7WebCore21SVGDocumentExtensions21sampleAnimationAtTimeERKN3WTF6StringEPNS_14SVGSMILElementEd
-__ZN7WebCore17SMILTimeContainer21sampleAnimationAtTimeERKN3WTF6StringEd
 __ZN7WebCore50jsSVGAnimationElementPrototypeFunctionBeginElementEPN3JSC9ExecStateE
 __ZN7WebCore19SVGAnimationElement12beginElementEv
 __ZN7WebCore19SVGAnimationElement14beginElementAtEf
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index addd58793..af9941a25 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -18,6 +18,7 @@ WEBCORE_GENERATED_SOURCES_DIR = $${ROOT_BUILD_DIR}/Source/WebCore/$${GENERATED_S
 
 INCLUDEPATH += \
     $$SOURCE_DIR \
+    $$SOURCE_DIR/Modules/geolocation \
     $$SOURCE_DIR/accessibility \
     $$SOURCE_DIR/bindings \
     $$SOURCE_DIR/bindings/generic \
@@ -43,8 +44,9 @@ INCLUDEPATH += \
     $$SOURCE_DIR/mathml \
     $$SOURCE_DIR/notifications \
     $$SOURCE_DIR/page \
-    $$SOURCE_DIR/page/qt \
     $$SOURCE_DIR/page/animation \
+    $$SOURCE_DIR/page/qt \
+    $$SOURCE_DIR/page/scrolling \
     $$SOURCE_DIR/platform \
     $$SOURCE_DIR/platform/animation \
     $$SOURCE_DIR/platform/audio \
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 59c667e92..19106c0e5 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -22564,6 +22564,54 @@
 			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSRegionRule.cpp"
 				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSRegionRule.h"
@@ -24003,6 +24051,66 @@
 			</File>
 		</Filter>
 		<Filter
+			Name="Modules"
+			>
+			<Filter
+				Name="geolocation"
+				>
+				<File
+					RelativePath="..\Modules\geolocation\Geolocation.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\Geolocation.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationController.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationController.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationPosition.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\Geoposition.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\NavigatorGeolocation.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\NavigatorGeolocation.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionErrorCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionOptions.h"
+					>
+				</File>
+			</Filter>
+		</Filter>
+		<Filter
 			Name="accessibility"
 			>
 			<File
@@ -25422,38 +25530,10 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\Geolocation.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\Geolocation.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\GeolocationClient.h"
 				>
 			</File>
 			<File
-				RelativePath="..\page\GeolocationController.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\GeolocationController.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\GeolocationError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\GeolocationPosition.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\Geoposition.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\GroupSettings.cpp"
 				>
 			</File>
@@ -25522,6 +25602,22 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\NavigatorRegisterProtocolHandler.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorRegisterProtocolHandler.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorSupplement.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorSupplement.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\OriginAccessEntry.cpp"
 				>
 			</File>
@@ -25558,6 +25654,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\PageSupplement.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\PageSupplement.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\PageVisibilityState.cpp"
 				>
 			</File>
@@ -25590,22 +25694,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\PositionCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PositionError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PositionErrorCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PositionOptions.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\PrintContext.cpp"
 				>
 			</File>
@@ -25745,6 +25833,18 @@
 				RelativePath="..\page\WorkerNavigator.h"
 				>
 			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinatorNone.cpp"
+				>
+			</File>
 			<Filter
 				Name="win"
 				>
@@ -26409,6 +26509,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\loader\cache\CachedSVGDocument.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\loader\cache\CachedSVGDocument.h"
+					>
+				</File>
+				<File
 					RelativePath="..\loader\cache\CachedXSLStyleSheet.cpp"
 					>
 				</File>
@@ -26542,14 +26650,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\DefaultLocalizationStrategy.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\platform\DefaultLocalizationStrategy.h"
-				>
-			</File>
-			<File
 				RelativePath="..\platform\DragData.cpp"
 				>
 			</File>
@@ -26614,6 +26714,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\FractionalLayoutUnit.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\GeolocationService.cpp"
 				>
 			</File>
@@ -26686,10 +26790,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\LocalizationStrategy.h"
-				>
-			</File>
-			<File
 				RelativePath="..\platform\LocalizedStrings.cpp"
 				>
 			</File>
@@ -27505,6 +27605,26 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutPoint.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\FloatPoint.cpp"
 					>
 				</File>
@@ -33942,62 +34062,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\css\StylePropertySet.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\css\StylePropertySet.h"
-				>
-			</File>
-			<File
 				RelativePath="..\css\CSSNamespace.h"
 				>
 			</File>
@@ -35326,14 +35390,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\css\FontFamilyValue.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\css\FontFamilyValue.h"
-				>
-			</File>
-			<File
 				RelativePath="..\css\FontFeatureValue.cpp"
 				>
 			</File>
@@ -35434,6 +35490,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\PropertySetCSSStyleDeclaration.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\PropertySetCSSStyleDeclaration.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\quirks.css"
 				>
 			</File>
@@ -35474,6 +35538,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\StylePropertySet.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\css\StylePropertySet.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\StyleSheet.cpp"
 				>
 			</File>
@@ -48658,6 +48778,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\EventSender.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\EventTarget.cpp"
 				>
 				<FileConfiguration
@@ -48854,11 +48978,11 @@
 				>
 			</File>
 			<File
-				RelativePath="..\dom\GenericEventQueue.h"
+				RelativePath="..\dom\GenericEventQueue.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\dom\GenericEventQueue.cpp"
+				RelativePath="..\dom\GenericEventQueue.h"
 				>
 			</File>
 			<File
@@ -52118,6 +52242,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\WebKitMutationObserver.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\WebKitMutationObserver.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\WebKitNamedFlow.cpp"
 				>
 				<FileConfiguration
@@ -60489,7 +60669,7 @@
 				RelativePath="..\html\PublicURLManager.h"
 				>
 			</File>
-            <File
+			<File
 				RelativePath="..\html\RadioInputType.cpp"
 				>
 			</File>
@@ -60805,14 +60985,6 @@
 				Name="shadow"
 				>
 				<File
-					RelativePath="..\html\shadow\ContentInclusionSelector.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\html\shadow\ContentInclusionSelector.h"
-					>
-				</File>
-				<File
 					RelativePath="..\html\shadow\ContentSelectorQuery.cpp"
 					>
 				</File>
@@ -60885,6 +61057,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\html\shadow\HTMLContentSelector.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\HTMLContentSelector.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\HTMLShadowElement.cpp"
 					>
 					<FileConfiguration
@@ -60941,6 +61121,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\html\shadow\InsertionPoint.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\InsertionPoint.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\MediaControlElements.cpp"
 					>
 				</File>
@@ -68712,6 +68900,10 @@
 					RelativePath="..\bindings\scripts\resolve-supplemental.pl"
 					>
 				</File>
+				<File
+					RelativePath="..\bindings\scripts\IDLAttributes.txt"
+					>
+				</File>
 			</Filter>
 		</Filter>
 		<Filter
@@ -70742,19 +70934,19 @@
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageTask.cpp"
+				RelativePath="..\storage\StorageTask.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageTask.h"
+				RelativePath="..\storage\StorageTask.h"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageThread.cpp"
+				RelativePath="..\storage\StorageThread.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageThread.h"
+				RelativePath="..\storage\StorageThread.h"
 				>
 			</File>
 			<File
@@ -71124,6 +71316,22 @@
 			<File
 				RelativePath="..\inspector\ConsoleMessage.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ConsoleMessage.h"
@@ -71132,6 +71340,22 @@
 			<File
 				RelativePath="..\inspector\ContentSearchUtils.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ContentSearchUtils.h"
@@ -71140,6 +71364,22 @@
 			<File
 				RelativePath="..\inspector\DOMEditor.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\DOMEditor.h"
@@ -71148,18 +71388,74 @@
 			<File
 				RelativePath="..\inspector\DOMNodeHighlighter.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\DOMNodeHighlighter.h"
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\DOMPatchSupport.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\inspector\DOMPatchSupport.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\DOMWrapperVisitor.h"
 				>
 			</File>
 			<File
 				RelativePath="..\inspector\IdentifiersFactory.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\IdentifiersFactory.h"
@@ -71168,6 +71464,22 @@
 			<File
 				RelativePath="..\inspector\InjectedScript.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InjectedScript.h"
@@ -71176,6 +71488,22 @@
 			<File
 				RelativePath="..\inspector\InjectedScriptHost.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InjectedScriptHost.h"
@@ -71184,6 +71512,22 @@
 			<File
 				RelativePath="..\inspector\InjectedScriptManager.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InjectedScriptManager.h"
@@ -71370,6 +71714,30 @@
 				</FileConfiguration>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorCounters.h"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InspectorCounters.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorController.h"
 				>
 			</File>
@@ -72000,6 +72368,22 @@
 			<File
 				RelativePath="..\inspector\InstrumentingAgents.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InstrumentingAgents.h"
@@ -72008,6 +72392,22 @@
 			<File
 				RelativePath="..\inspector\NetworkResourcesData.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\NetworkResourcesData.h"
@@ -72016,6 +72416,22 @@
 			<File
 				RelativePath="..\inspector\PageConsoleAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\PageConsoleAgent.h"
@@ -72024,6 +72440,22 @@
 			<File
 				RelativePath="..\inspector\PageDebuggerAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\PageDebuggerAgent.h"
@@ -72032,6 +72464,22 @@
 			<File
 				RelativePath="..\inspector\PageRuntimeAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\PageRuntimeAgent.h"
@@ -72040,6 +72488,22 @@
 			<File
 				RelativePath="..\inspector\ScriptArguments.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ScriptArguments.h"
@@ -72052,6 +72516,22 @@
 			<File
 				RelativePath="..\inspector\ScriptCallFrame.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ScriptCallFrame.h"
@@ -72060,6 +72540,22 @@
 			<File
 				RelativePath="..\inspector\ScriptCallStack.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ScriptCallStack.h"
@@ -72072,6 +72568,22 @@
 			<File
 				RelativePath="..\inspector\TimelineRecordFactory.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\TimelineRecordFactory.h"
@@ -72080,6 +72592,22 @@
 			<File
 				RelativePath="..\inspector\WorkerConsoleAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerConsoleAgent.h"
@@ -72088,6 +72616,22 @@
 			<File
 				RelativePath="..\inspector\WorkerDebuggerAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerDebuggerAgent.h"
@@ -72096,6 +72640,22 @@
 			<File
 				RelativePath="..\inspector\WorkerInspectorController.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerInspectorController.h"
@@ -72104,6 +72664,22 @@
 			<File
 				RelativePath="..\inspector\WorkerRuntimeAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerRuntimeAgent.h"
@@ -72409,6 +72985,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\indexedDBViews.css"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\IndexedDBViews.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\InjectedFakeWorker.js"
 					>
 				</File>
@@ -72453,11 +73037,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\JavaScriptFormatter.js"
+					RelativePath="..\inspector\front-end\UglifyJS\JavaScriptFormatter.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\UglifyJS\JavaScriptFormatter.js"
+					RelativePath="..\inspector\front-end\JavaScriptFormatter.js"
 					>
 				</File>
 				<File
@@ -72689,6 +73273,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\SidebarOverlay.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\SidebarPane.js"
 					>
 				</File>
@@ -72721,6 +73309,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\Spectrum.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\splitView.css"
 					>
 				</File>
@@ -72890,6 +73482,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\websockets\WebSocketDeflater.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketDeflater.h"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketExtensionDispatcher.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketExtensionDispatcher.h"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketExtensionProcessor.h"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketFrame.h"
+				>
+			</File>
+			<File
 				RelativePath="..\websockets\WebSocketHandshake.cpp"
 				>
 			</File>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index e95b87c39..838c080a6 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
 		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index 249347394..dfd62b12d 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -19,6 +19,7 @@ mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCoreTestSupport"
 
 xcopy /y /d "%ProjectDir%..\config.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%CONFIGURATIONBUILDDIR%\obj\WebCore\DerivedSources\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\Modules\geolocation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\win\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\inspector\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 0d1c49408..729d53276 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -297,6 +297,11 @@
 		1432E8490C51493F00B1500F /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1432E8480C51493F00B1500F /* GCController.cpp */; };
 		1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */ = {isa = PBXBuildFile; fileRef = 1449E24A107D4A8400B5793F /* JSCallbackData.h */; };
 		1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1449E286107D4DB400B5793F /* JSCallbackData.cpp */; };
+		144FCE5214EC79BC000D17A3 /* FractionalLayoutUnit.h in Headers */ = {isa = PBXBuildFile; fileRef = 144FCE5114EC79BC000D17A3 /* FractionalLayoutUnit.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		144FCE5C14EC79E7000D17A3 /* FractionalLayoutSize.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 144FCE5714EC79E7000D17A3 /* FractionalLayoutSize.cpp */; };
+		144FCE5D14EC79E7000D17A3 /* FractionalLayoutSize.h in Headers */ = {isa = PBXBuildFile; fileRef = 144FCE5814EC79E7000D17A3 /* FractionalLayoutSize.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		144FCFE014EF2509000D17A3 /* FractionalLayoutRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 144FCFDE14EF2509000D17A3 /* FractionalLayoutRect.cpp */; };
+		144FCFE114EF2509000D17A3 /* FractionalLayoutRect.h in Headers */ = {isa = PBXBuildFile; fileRef = 144FCFDF14EF2509000D17A3 /* FractionalLayoutRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1464E06C135EC10600FDB00A /* JSMediaListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1464E06B135EC10600FDB00A /* JSMediaListCustom.cpp */; };
 		1477E7760BF4134A00152872 /* PageCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1477E7740BF4134A00152872 /* PageCache.cpp */; };
 		1477E7770BF4134A00152872 /* PageCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1477E7750BF4134A00152872 /* PageCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -599,7 +604,7 @@
 		1AF62EE814DA22A70041556C /* ScrollingCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF62EE514DA22A70041556C /* ScrollingCoordinator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF62F2414DAFE910041556C /* ScrollingThreadMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AF62F2314DAFE910041556C /* ScrollingThreadMac.mm */; };
 		1AF62F2514DAFE9E0041556C /* ScrollingThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF62F2014DAFE790041556C /* ScrollingThread.cpp */; };
-		1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF62F2114DAFE790041556C /* ScrollingThread.h */; };
+		1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF62F2114DAFE790041556C /* ScrollingThread.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF8E1191256592600230FF7 /* ProxyServer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E13212565A4400230FF7 /* ProxyServer.cpp */; };
 		1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */; };
@@ -984,6 +989,7 @@
 		37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		37FD4298118368460093C029 /* TreeDepthLimit.h in Headers */ = {isa = PBXBuildFile; fileRef = 37FD4297118368460093C029 /* TreeDepthLimit.h */; };
+		3866AF3814F1C17100283D68 /* ScrollingCoordinatorNone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3866AF3714F1C17100283D68 /* ScrollingCoordinatorNone.cpp */; };
 		3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AB02D2812D4F91600FBB694 /* StorageTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */; };
 		3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1361,11 +1367,14 @@
 		4A1E719614E101F900626F9D /* JSHTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */; };
 		4A1E71A514E106AC00626F9D /* JSShadowRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */; };
 		4A1E71A614E106AC00626F9D /* JSShadowRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E71A414E106AC00626F9D /* JSShadowRoot.h */; };
+		4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */; };
 		4A6E9FC313C17D1D0046A7F8 /* FontFeatureValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */; };
 		4A6E9FC413C17D1D0046A7F8 /* FontFeatureValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A6E9FC713C17D570046A7F8 /* FontFeatureSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */; };
 		4A6E9FC813C17D570046A7F8 /* FontFeatureSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A8C96EB0BE69032004EEFF0 /* FrameSelectionMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */; };
+		4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */; };
+		4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */; };
 		4ABDFF0B14DBE385004D117D /* HTMLShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */; };
 		4ABDFF0C14DBE385004D117D /* HTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */; };
 		4ACBC0BE12713CBD0094F9B2 /* ClassList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ACBC0BC12713CBD0094F9B2 /* ClassList.cpp */; };
@@ -1379,6 +1388,9 @@
 		4AD01009127E642A0015035F /* HTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD01006127E642A0015035F /* HTMLOutputElement.h */; };
 		4AD0173C127E82860015035F /* JSHTMLOutputElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */; };
 		4AD0173D127E82860015035F /* JSHTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD0173B127E82860015035F /* JSHTMLOutputElement.h */; };
+		4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */; };
+		4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */; };
+		4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */; };
 		4AF1AD3E13FD23A400AA9590 /* EventDispatchMediator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */; };
 		4AF1AD3F13FD23A400AA9590 /* EventDispatchMediator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
@@ -1461,10 +1473,10 @@
 		5112247810CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */; };
 		5112247A10CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */; };
 		5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 5116D9750CF177BD00C2B84D /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		511F23170DC160DA004F0032 /* LocalStorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* LocalStorageTask.cpp */; };
-		511F23180DC160DA004F0032 /* LocalStorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* LocalStorageTask.h */; };
-		511F23190DC160DA004F0032 /* LocalStorageThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23150DC160DA004F0032 /* LocalStorageThread.cpp */; };
-		511F231A0DC160DA004F0032 /* LocalStorageThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23160DC160DA004F0032 /* LocalStorageThread.h */; };
+		511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* StorageTask.cpp */; };
+		511F23180DC160DA004F0032 /* StorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* StorageTask.h */; };
+		511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23150DC160DA004F0032 /* StorageThread.cpp */; };
+		511F231A0DC160DA004F0032 /* StorageThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23160DC160DA004F0032 /* StorageThread.h */; };
 		5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5126E6B90A2E3B12005C29FA /* IconDatabase.cpp */; };
 		5126E6BC0A2E3B12005C29FA /* IconDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 5126E6BA0A2E3B12005C29FA /* IconDatabase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		512DD8E30D91E2B4000F89EE /* SharedBufferCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 512DD8E20D91E2B4000F89EE /* SharedBufferCF.cpp */; };
@@ -1599,13 +1611,17 @@
 		53C8298E13D8D92700DE2DEB /* RenderFlexibleBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */; };
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 572E92F914E540580087FFBA /* ShadowRootList.cpp */; };
+		572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */ = {isa = PBXBuildFile; fileRef = 572E92FA14E540580087FFBA /* ShadowRootList.h */; };
 		573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */; };
-		57B791A314C6A62900F202D1 /* ContentInclusionSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* ContentInclusionSelector.cpp */; };
-		57B791A414C6A62900F202D1 /* ContentInclusionSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* ContentInclusionSelector.h */; };
+		57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */; };
+		57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* HTMLContentSelector.h */; };
 		57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */; };
 		57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */; };
 		57B791A914C6A63300F202D1 /* HTMLContentElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */; };
 		57B791AA14C6A63300F202D1 /* HTMLContentElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A814C6A63300F202D1 /* HTMLContentElement.h */; };
+		57CF497414EE36D700ECFF14 /* InsertionPoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */; };
+		57CF497514EE36D700ECFF14 /* InsertionPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 57CF497314EE36D700ECFF14 /* InsertionPoint.h */; };
 		5905ADBF1302F3CE00F116DF /* XMLTreeViewer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */; };
 		5905ADC01302F3CE00F116DF /* XMLTreeViewer.h in Headers */ = {isa = PBXBuildFile; fileRef = 5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */; };
 		590E1B4911E4EF4B0069F784 /* DeviceOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = 590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1890,6 +1906,8 @@
 		7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A54857F14E02D51006AE05A /* InspectorHistory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A54857D14E02D51006AE05A /* InspectorHistory.cpp */; };
 		7A54858014E02D51006AE05A /* InspectorHistory.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A54857E14E02D51006AE05A /* InspectorHistory.h */; };
+		7A54881714E432A1006AE05A /* DOMPatchSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A54881514E432A1006AE05A /* DOMPatchSupport.h */; };
+		7A54881814E432A1006AE05A /* DOMPatchSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */; };
 		7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */; };
 		7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */; };
 		7A74ECBA101839A600BF939E /* InspectorDOMStorageAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECB8101839A500BF939E /* InspectorDOMStorageAgent.cpp */; };
@@ -3307,7 +3325,8 @@
 		9705997A107D975200A50A7C /* PolicyChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059976107D975200A50A7C /* PolicyChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		970B728A144FFAC600F00A37 /* EventInterfaces.h in Headers */ = {isa = PBXBuildFile; fileRef = 970B7289144FFAC600F00A37 /* EventInterfaces.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		970B72A6145008EB00F00A37 /* EventHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 970B72A5145008EB00F00A37 /* EventHeaders.h */; };
-		971491DA12FD65E8001BFEB1 /* URLString.h in Headers */ = {isa = PBXBuildFile; fileRef = 971491D912FD65E8001BFEB1 /* URLString.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */; };
+		9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9711460114EF009A00674FD9 /* NavigatorGeolocation.h */; };
 		97205AAF123928CA00B17380 /* FTPDirectoryDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */; };
 		97205AB0123928CA00B17380 /* FTPDirectoryDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */; };
 		97205AB51239291000B17380 /* ImageDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AB11239291000B17380 /* ImageDocument.cpp */; };
@@ -3324,12 +3343,31 @@
 		973DC640145A9409002842C2 /* ExceptionCodeDescription.h in Headers */ = {isa = PBXBuildFile; fileRef = 973DC63E145A9409002842C2 /* ExceptionCodeDescription.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		973E325610883B7C005BC493 /* ResourceLoadNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */; };
 		973E325710883B7C005BC493 /* ResourceLoadNotifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 973E325510883B7C005BC493 /* ResourceLoadNotifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2314F4DDE6003E7A70 /* Geolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9746AF1314F4DDE6003E7A70 /* Geolocation.cpp */; };
+		9746AF2414F4DDE6003E7A70 /* Geolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1414F4DDE6003E7A70 /* Geolocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2614F4DDE6003E7A70 /* GeolocationController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9746AF1614F4DDE6003E7A70 /* GeolocationController.cpp */; };
+		9746AF2714F4DDE6003E7A70 /* GeolocationController.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1714F4DDE6003E7A70 /* GeolocationController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2814F4DDE6003E7A70 /* GeolocationError.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1814F4DDE6003E7A70 /* GeolocationError.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2914F4DDE6003E7A70 /* GeolocationPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1914F4DDE6003E7A70 /* GeolocationPosition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2A14F4DDE6003E7A70 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1A14F4DDE6003E7A70 /* Geoposition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2C14F4DDE6003E7A70 /* PositionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1C14F4DDE6003E7A70 /* PositionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2E14F4DDE6003E7A70 /* PositionError.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1E14F4DDE6003E7A70 /* PositionError.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF3014F4DDE6003E7A70 /* PositionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF2014F4DDE6003E7A70 /* PositionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF3214F4DDE6003E7A70 /* PositionOptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF2214F4DDE6003E7A70 /* PositionOptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		974A862214B7ADBB003FDC76 /* FrameDestructionObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 974A862014B7ADBB003FDC76 /* FrameDestructionObserver.cpp */; };
 		974A862314B7ADBB003FDC76 /* FrameDestructionObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = 974A862114B7ADBB003FDC76 /* FrameDestructionObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		974D2DA4146A535D00D51F8B /* SecurityPolicy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 974D2DA2146A535D00D51F8B /* SecurityPolicy.cpp */; };
 		974D2DA5146A535D00D51F8B /* SecurityPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 974D2DA3146A535D00D51F8B /* SecurityPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9752D38D1413104B003305BD /* JSHTMLSpanElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9752D38B1413104B003305BD /* JSHTMLSpanElement.cpp */; };
 		9752D38E1413104B003305BD /* JSHTMLSpanElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 9752D38C1413104B003305BD /* JSHTMLSpanElement.h */; };
+		9759E93E14EF1CF80026A2DD /* LoadableTextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93414EF1CF80026A2DD /* LoadableTextTrack.cpp */; };
+		9759E93F14EF1CF80026A2DD /* TextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93514EF1CF80026A2DD /* TextTrack.cpp */; };
+		9759E94014EF1CF80026A2DD /* TextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E93614EF1CF80026A2DD /* TextTrack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9759E94214EF1CF80026A2DD /* TextTrackCue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93814EF1CF80026A2DD /* TextTrackCue.cpp */; };
+		9759E94314EF1CF80026A2DD /* TextTrackCue.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E93914EF1CF80026A2DD /* TextTrackCue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9759E94514EF1CF80026A2DD /* TextTrackCueList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93B14EF1CF80026A2DD /* TextTrackCueList.cpp */; };
+		9759E94614EF1CF80026A2DD /* TextTrackCueList.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E93C14EF1CF80026A2DD /* TextTrackCueList.h */; };
+		9759E94914EF1D490026A2DD /* LoadableTextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E94814EF1D490026A2DD /* LoadableTextTrack.h */; };
 		975CA28A130365F800E99AD9 /* Crypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA287130365F800E99AD9 /* Crypto.cpp */; };
 		975CA28B130365F800E99AD9 /* Crypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA288130365F800E99AD9 /* Crypto.h */; };
 		975CA2A11303679D00E99AD9 /* JSCrypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA29F1303679D00E99AD9 /* JSCrypto.cpp */; };
@@ -3424,12 +3462,16 @@
 		97C078501165D5BE003A32EF /* SuffixTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C0784F1165D5BE003A32EF /* SuffixTree.h */; };
 		97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */; };
 		97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */; };
+		97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = 97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97D2AD0314B823A60093DF32 /* DOMWindowProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */; };
 		97D2AD0414B823A60093DF32 /* DOMWindowProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DCE20110807C750057D394 /* HistoryController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DCE1FF10807C750057D394 /* HistoryController.cpp */; };
 		97DCE20210807C750057D394 /* HistoryController.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DCE20010807C750057D394 /* HistoryController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97E4028F13A696ED00913D67 /* IconController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97E4028D13A696ED00913D67 /* IconController.cpp */; };
 		97E4029013A696ED00913D67 /* IconController.h in Headers */ = {isa = PBXBuildFile; fileRef = 97E4028E13A696ED00913D67 /* IconController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97E4A12614F4C5D400870E43 /* NavigatorRegisterProtocolHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */; };
+		97E4A12714F4C5D700870E43 /* NavigatorRegisterProtocolHandler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */; };
 		97EF7DFE107E55B700D7C49C /* ScriptControllerBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */; };
 		984264F112D5280A000D88A4 /* LinkLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 984264EF12D5280A000D88A4 /* LinkLoaderClient.h */; };
 		985BB96D13A94058007A0B69 /* LinkRelAttribute.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */; };
@@ -3479,6 +3521,8 @@
 		A0EE0DF6144F825500F80B0D /* WebGLDebugRendererInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A0EE0DF2144F825500F80B0D /* WebGLDebugRendererInfo.h */; };
 		A0EE0DF7144F825500F80B0D /* WebGLDebugShaders.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A0EE0DF3144F825500F80B0D /* WebGLDebugShaders.cpp */; };
 		A0EE0DF8144F825500F80B0D /* WebGLDebugShaders.h in Headers */ = {isa = PBXBuildFile; fileRef = A0EE0DF4144F825500F80B0D /* WebGLDebugShaders.h */; };
+		A104F24314C71F7A009E2C23 /* CachedSVGDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */; };
+		A104F24414C71F7A009E2C23 /* CachedSVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */; };
 		A10BB5851484E3A700B2E87A /* RenderSVGRect.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5831484E3A700B2E87A /* RenderSVGRect.h */; };
 		A10BB58B1484E3B300B2E87A /* RenderSVGShape.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5891484E3B300B2E87A /* RenderSVGShape.h */; };
 		A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A10DC76814747BAB005E2471 /* StyleGridData.cpp */; };
@@ -3541,6 +3585,8 @@
 		A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */; };
 		A718760E0B2A120100A16ECE /* DragActions.h in Headers */ = {isa = PBXBuildFile; fileRef = A718760D0B2A120100A16ECE /* DragActions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71878900B2D04AC00A16ECE /* DragControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */; };
+		A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71E083514E3CEAF006A4619 /* PageSupplement.cpp */; };
+		A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = A71E083614E3CEAF006A4619 /* PageSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A723F77B1484CA4C008C6DBE /* PlatformExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A73F95FE12C97BFE0031AAF9 /* RoundedRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */; };
 		A73F95FF12C97BFE0031AAF9 /* RoundedRect.h in Headers */ = {isa = PBXBuildFile; fileRef = A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3613,14 +3659,12 @@
 		A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CBE0A1989CA007FB8C5 /* ShadowValue.h */; };
 		A80E6CE90A1989CA007FB8C5 /* CSSValueList.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CBF0A1989CA007FB8C5 /* CSSValueList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A80E6CEB0A1989CA007FB8C5 /* CSSImportRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC10A1989CA007FB8C5 /* CSSImportRule.cpp */; };
-		A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC20A1989CA007FB8C5 /* FontFamilyValue.cpp */; };
 		A80E6CED0A1989CA007FB8C5 /* FontValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC30A1989CA007FB8C5 /* FontValue.h */; };
 		A80E6CEE0A1989CA007FB8C5 /* CSSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC40A1989CA007FB8C5 /* CSSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A80E6CEF0A1989CA007FB8C5 /* CSSStyleRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC50A1989CA007FB8C5 /* CSSStyleRule.cpp */; };
 		A80E6CF00A1989CA007FB8C5 /* CSSInheritedValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC60A1989CA007FB8C5 /* CSSInheritedValue.cpp */; };
 		A80E6CF10A1989CA007FB8C5 /* FontValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */; };
 		A80E6CF20A1989CA007FB8C5 /* CSSRuleList.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC80A1989CA007FB8C5 /* CSSRuleList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A80E6CF30A1989CA007FB8C5 /* FontFamilyValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC90A1989CA007FB8C5 /* FontFamilyValue.h */; };
 		A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CCA0A1989CA007FB8C5 /* ShadowValue.cpp */; };
 		A80E6CF50A1989CA007FB8C5 /* CSSPageRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CCB0A1989CA007FB8C5 /* CSSPageRule.cpp */; };
 		A80E6CF60A1989CA007FB8C5 /* CSSImportRule.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CCC0A1989CA007FB8C5 /* CSSImportRule.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4268,14 +4312,6 @@
 		B10B6981140C174000BC1C26 /* WebVTTTokenizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B10B697E140C174000BC1C26 /* WebVTTTokenizer.cpp */; };
 		B10B6982140C174000BC1C26 /* WebVTTTokenizer.h in Headers */ = {isa = PBXBuildFile; fileRef = B10B697F140C174000BC1C26 /* WebVTTTokenizer.h */; };
 		B1827493134CA4C100B98C2D /* CallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1827492134CA4C100B98C2D /* CallbackFunction.cpp */; };
-		B1AD4E5E13A12A0B00846B27 /* LoadableTextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E4D13A12A0B00846B27 /* LoadableTextTrack.cpp */; };
-		B1AD4E5F13A12A0B00846B27 /* LoadableTextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E4E13A12A0B00846B27 /* LoadableTextTrack.h */; };
-		B1AD4E6613A12A0B00846B27 /* TextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E5513A12A0B00846B27 /* TextTrack.cpp */; };
-		B1AD4E6713A12A0B00846B27 /* TextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E5613A12A0B00846B27 /* TextTrack.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		B1AD4E6813A12A0B00846B27 /* TextTrackCue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E5713A12A0B00846B27 /* TextTrackCue.cpp */; };
-		B1AD4E6913A12A0B00846B27 /* TextTrackCue.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E5813A12A0B00846B27 /* TextTrackCue.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		B1AD4E6A13A12A0B00846B27 /* TextTrackCueList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E5913A12A0B00846B27 /* TextTrackCueList.cpp */; };
-		B1AD4E6B13A12A0B00846B27 /* TextTrackCueList.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E5A13A12A0B00846B27 /* TextTrackCueList.h */; };
 		B1AD4E7313A12A4600846B27 /* TextTrackLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E7113A12A4600846B27 /* TextTrackLoader.cpp */; };
 		B1AD4E7413A12A4600846B27 /* TextTrackLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E7213A12A4600846B27 /* TextTrackLoader.h */; };
 		B1D5ECB5134B58DA0087C78F /* CallbackFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = B1D5ECB4134B58DA0087C78F /* CallbackFunction.h */; };
@@ -5126,11 +5162,7 @@
 		BC53DA601143141A000D817E /* DOMObjectHashTableMap.h in Headers */ = {isa = PBXBuildFile; fileRef = BC53DA5F1143141A000D817E /* DOMObjectHashTableMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC53DA62114314BD000D817E /* DOMObjectHashTableMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC53DA61114314BD000D817E /* DOMObjectHashTableMap.cpp */; };
 		BC53DAC711433064000D817E /* JSDOMWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC53DAC611433064000D817E /* JSDOMWrapper.cpp */; };
-		BC56CB2110D5AC8000A77C64 /* GeolocationController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC56CB1C10D5AC8000A77C64 /* GeolocationController.cpp */; };
-		BC56CB2210D5AC8000A77C64 /* GeolocationController.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB1D10D5AC8000A77C64 /* GeolocationController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC56CB2310D5AC8000A77C64 /* GeolocationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB1E10D5AC8000A77C64 /* GeolocationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC56CB2410D5AC8000A77C64 /* GeolocationError.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB1F10D5AC8000A77C64 /* GeolocationError.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC56CB2510D5AC8000A77C64 /* GeolocationPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB2010D5AC8000A77C64 /* GeolocationPosition.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5823F50C0A98DF0053F1B5 /* JSHTMLElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC5823F40C0A98DF0053F1B5 /* JSHTMLElementCustom.cpp */; };
 		BC5825F30C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */; };
 		BC588AF00BFA6CF900EE679E /* HTMLParserErrorCodes.h in Headers */ = {isa = PBXBuildFile; fileRef = BC588AEF0BFA6CF900EE679E /* HTMLParserErrorCodes.h */; };
@@ -5143,7 +5175,6 @@
 		BC5A86B60C3367E800EEA649 /* JSDOMSelection.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */; };
 		BC5C762A1497FE1400BC4775 /* PlatformEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC5C76281497FE1400BC4775 /* PlatformEvent.cpp */; };
 		BC5C762B1497FE1400BC4775 /* PlatformEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5C76291497FE1400BC4775 /* PlatformEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC5CFCA911F793320099ED09 /* LocalizationStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5CFCA811F793320099ED09 /* LocalizationStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5EB5DB0E81B7EA00B25965 /* BorderValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5EB5DA0E81B7EA00B25965 /* BorderValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5EB5DD0E81B8DD00B25965 /* OutlineValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5EB5DF0E81B9AB00B25965 /* CollapsedBorderValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5EB5DE0E81B9AB00B25965 /* CollapsedBorderValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5347,8 +5378,6 @@
 		BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065840F3CE2A700CD2D87 /* JSClientRect.h */; };
 		BCC065890F3CE2A700CD2D87 /* JSClientRectList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */; };
 		BCC0658A0F3CE2A700CD2D87 /* JSClientRectList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */; };
-		BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */; };
-		BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */; };
 		BCC438780E886CC700533DD5 /* JSHTMLInputElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */; };
 		BCC573350D695BBE006EF517 /* DOMProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC573330D695BBE006EF517 /* DOMProgressEvent.h */; };
 		BCC573360D695BBE006EF517 /* DOMProgressEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */; };
@@ -5567,6 +5596,9 @@
 		C585A6FC11D4FB3D004C3E4B /* IDBFactoryBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */; };
 		C585A6FD11D4FB3D004C3E4B /* IDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */; };
 		C585A6FE11D4FB3D004C3E4B /* IDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */; };
+		C598902E14E9B0F800E8D18B /* PlatformPasteboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */; };
+		C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = C5F765B414E1D414006C899B /* PasteboardStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C598905814E9C29900E8D18B /* PlatformPasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C5D4AA7A116BAFB60069CA93 /* GlyphMetricsMap.h in Headers */ = {isa = PBXBuildFile; fileRef = C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */; };
 		C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */; };
@@ -5855,12 +5887,15 @@
 		E4AFD00E0DAF335500F5F55C /* SMILTimeContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0080DAF335400F5F55C /* SMILTimeContainer.h */; };
 		E4AFD00F0DAF335500F5F55C /* SVGSMILElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0090DAF335400F5F55C /* SVGSMILElement.cpp */; };
 		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E4BBED0E14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */; };
+		E4BBED0F14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h in Headers */ = {isa = PBXBuildFile; fileRef = E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */; };
 		E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C178950EE6903800824D69 /* CSSSelectorList.cpp */; };
 		E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C178960EE6903800824D69 /* CSSSelectorList.h */; };
 		E4C279580CF9741900E97B98 /* RenderMedia.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C279560CF9741900E97B98 /* RenderMedia.cpp */; };
 		E4C279590CF9741900E97B98 /* RenderMedia.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C279570CF9741900E97B98 /* RenderMedia.h */; };
 		E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */; };
 		E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */; };
+		EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */ = {isa = PBXBuildFile; fileRef = EB49DB8E14F46E8B002299D9 /* IDBTracing.h */; };
 		ED2BA83C09A24B91006C0AC4 /* DocumentMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5868,6 +5903,8 @@
 		F316396B1329481A00A649CB /* InjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F31639691329481A00A649CB /* InjectedScriptManager.cpp */; };
 		F316396C1329481A00A649CB /* InjectedScriptManager.h in Headers */ = {isa = PBXBuildFile; fileRef = F316396A1329481A00A649CB /* InjectedScriptManager.h */; };
 		F316396E1329487600A649CB /* JSInjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */; };
+		F325A40A14EE36FA007324E2 /* InspectorCounters.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F325A40814EE36FA007324E2 /* InspectorCounters.cpp */; };
+		F325A40B14EE36FA007324E2 /* InspectorCounters.h in Headers */ = {isa = PBXBuildFile; fileRef = F325A40914EE36FA007324E2 /* InspectorCounters.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F3335BF812E07DC300D33011 /* InspectorConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */; };
 		F3335BF912E07DC300D33011 /* InspectorConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */; };
 		F33F0282120947F200E5743A /* ScriptProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F33F0281120947F200E5743A /* ScriptProfile.cpp */; };
@@ -6210,13 +6247,6 @@
 		FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD48C0F676E9300092873 /* JSCoordinates.h */; };
 		FE700DD10F92D81A008E2BFE /* JSCoordinatesCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */; };
 		FE80D7AB0E9C1ED2000D6F75 /* JSGeolocationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */; };
-		FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */; };
-		FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7B80E9C1F25000D6F75 /* Geolocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7CB0E9C1F25000D6F75 /* PositionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7CD0E9C1F25000D6F75 /* PositionError.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BF0E9C1F25000D6F75 /* PositionError.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7CF0E9C1F25000D6F75 /* PositionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7D10E9C1F25000D6F75 /* PositionOptions.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7C30E9C1F25000D6F75 /* PositionOptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE80DA630E9C4703000D6F75 /* JSGeolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80DA5F0E9C4703000D6F75 /* JSGeolocation.cpp */; };
 		FE80DA640E9C4703000D6F75 /* JSGeolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80DA600E9C4703000D6F75 /* JSGeolocation.h */; };
 		FE80DA650E9C4703000D6F75 /* JSGeoposition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80DA610E9C4703000D6F75 /* JSGeoposition.cpp */; };
@@ -6773,9 +6803,6 @@
 		0707568A142262D600414161 /* HTMLTrackElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLTrackElement.idl; sourceTree = "<group>"; };
 		0707568E1422668C00414161 /* JSTextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTextTrack.cpp; sourceTree = "<group>"; };
 		0707568F1422668C00414161 /* JSTextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTextTrack.h; sourceTree = "<group>"; };
-		0707569C1422979800414161 /* TextTrack.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrack.idl; sourceTree = "<group>"; };
-		0707569D1422979800414161 /* TextTrackCue.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCue.idl; sourceTree = "<group>"; };
-		0707569E1422979800414161 /* TextTrackCueList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCueList.idl; sourceTree = "<group>"; };
 		070756D114239A4E00414161 /* JSHTMLTrackElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTrackElement.cpp; sourceTree = "<group>"; };
 		070756D214239A4E00414161 /* JSHTMLTrackElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLTrackElement.h; sourceTree = "<group>"; };
 		070756D714239B4B00414161 /* JSTextTrackCue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTextTrackCue.cpp; sourceTree = "<group>"; };
@@ -7002,6 +7029,12 @@
 		1432E8480C51493F00B1500F /* GCController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = GCController.cpp; sourceTree = "<group>"; };
 		1449E24A107D4A8400B5793F /* JSCallbackData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackData.h; sourceTree = "<group>"; };
 		1449E286107D4DB400B5793F /* JSCallbackData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackData.cpp; sourceTree = "<group>"; };
+		144FCE5114EC79BC000D17A3 /* FractionalLayoutUnit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutUnit.h; sourceTree = "<group>"; };
+		144FCE5414EC79E7000D17A3 /* FractionalLayoutPoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutPoint.h; sourceTree = "<group>"; };
+		144FCE5714EC79E7000D17A3 /* FractionalLayoutSize.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FractionalLayoutSize.cpp; sourceTree = "<group>"; };
+		144FCE5814EC79E7000D17A3 /* FractionalLayoutSize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutSize.h; sourceTree = "<group>"; };
+		144FCFDE14EF2509000D17A3 /* FractionalLayoutRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FractionalLayoutRect.cpp; sourceTree = "<group>"; };
+		144FCFDF14EF2509000D17A3 /* FractionalLayoutRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutRect.h; sourceTree = "<group>"; };
 		1464E06B135EC10600FDB00A /* JSMediaListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMediaListCustom.cpp; sourceTree = "<group>"; };
 		1477E7740BF4134A00152872 /* PageCache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PageCache.cpp; sourceTree = "<group>"; };
 		1477E7750BF4134A00152872 /* PageCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PageCache.h; sourceTree = "<group>"; };
@@ -7020,10 +7053,10 @@
 		14947FFC12F80CD200A0F631 /* DocumentOrderedMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentOrderedMap.h; sourceTree = "<group>"; };
 		14993BE30B2F2B1C0050497F /* FocusController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FocusController.cpp; sourceTree = "<group>"; };
 		14993BE40B2F2B1C0050497F /* FocusController.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FocusController.h; sourceTree = "<group>"; };
-		14A98E05136386A200C9FED2 /* Blob.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Blob.idl; path = ../../../webkit/Source/WebCore/fileapi/Blob.idl; sourceTree = SOURCE_ROOT; };
-		14BDF5971365392C00148393 /* DOMFileSystem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMFileSystem.idl; path = ../../../webkit/Source/WebCore/fileapi/DOMFileSystem.idl; sourceTree = SOURCE_ROOT; };
-		14BDF59A1365399100148393 /* FileReader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileReader.idl; path = ../../../webkit/Source/WebCore/fileapi/FileReader.idl; sourceTree = SOURCE_ROOT; };
-		14BDF59C136539BE00148393 /* FileWriter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileWriter.idl; path = ../../../webkit/Source/WebCore/fileapi/FileWriter.idl; sourceTree = SOURCE_ROOT; };
+		14A98E05136386A200C9FED2 /* Blob.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Blob.idl; path = fileapi/Blob.idl; sourceTree = SOURCE_ROOT; };
+		14BDF5971365392C00148393 /* DOMFileSystem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMFileSystem.idl; path = fileapi/DOMFileSystem.idl; sourceTree = SOURCE_ROOT; };
+		14BDF59A1365399100148393 /* FileReader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileReader.idl; path = fileapi/FileReader.idl; sourceTree = SOURCE_ROOT; };
+		14BDF59C136539BE00148393 /* FileWriter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileWriter.idl; path = fileapi/FileWriter.idl; sourceTree = SOURCE_ROOT; };
 		14C9A5E90B3D105F005A0232 /* Settings.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Settings.cpp; sourceTree = "<group>"; };
 		14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerCustom.cpp; sourceTree = "<group>"; };
 		14CF787109F587CA00EB3665 /* CSSValue.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = CSSValue.idl; sourceTree = "<group>"; };
@@ -7365,6 +7398,9 @@
 		1AFE11980CBFFCC4003017FA /* JSSQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSetRowList.h; sourceTree = "<group>"; };
 		1C2649790D7E248A00BD10F2 /* DocumentLoaderMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentLoaderMac.cpp; sourceTree = "<group>"; };
 		1C26497B0D7E24EC00BD10F2 /* PageMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageMac.cpp; sourceTree = "<group>"; };
+		1C435CD314E8544F004E10EA /* Inspector.json */ = {isa = PBXFileReference; lastKnownFileType = text; path = Inspector.json; sourceTree = "<group>"; };
+		1C435CD414E8545B004E10EA /* Inspector-0.1.json */ = {isa = PBXFileReference; lastKnownFileType = text; path = "Inspector-0.1.json"; sourceTree = "<group>"; };
+		1C435CD514E8545B004E10EA /* Inspector-1.0.json */ = {isa = PBXFileReference; lastKnownFileType = text; path = "Inspector-1.0.json"; sourceTree = "<group>"; };
 		1C4C8EFF0AD85D87009475CE /* DeleteButtonController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeleteButtonController.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		1C4C8F000AD85D87009475CE /* DeleteButtonController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeleteButtonController.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		1C4C8F630AD8655D009475CE /* DeleteButton.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeleteButton.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -7760,6 +7796,7 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		37FC96DA1104ED71003E1FAD /* TrailingFloatsRootInlineBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TrailingFloatsRootInlineBox.h; sourceTree = "<group>"; };
 		37FD4297118368460093C029 /* TreeDepthLimit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TreeDepthLimit.h; sourceTree = "<group>"; };
+		3866AF3714F1C17100283D68 /* ScrollingCoordinatorNone.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollingCoordinatorNone.cpp; sourceTree = "<group>"; };
 		3AB02D2812D4F91600FBB694 /* StorageTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTracker.h; sourceTree = "<group>"; };
 		3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTracker.cpp; sourceTree = "<group>"; };
 		3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTrackerClient.h; sourceTree = "<group>"; };
@@ -8197,11 +8234,14 @@
 		4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLShadowElement.h; sourceTree = "<group>"; };
 		4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSShadowRoot.cpp; sourceTree = "<group>"; };
 		4A1E71A414E106AC00626F9D /* JSShadowRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSShadowRoot.h; sourceTree = "<group>"; };
+		4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketFrame.h; sourceTree = "<group>"; };
 		4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureValue.cpp; sourceTree = "<group>"; };
 		4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontFeatureValue.h; sourceTree = "<group>"; };
 		4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureSettings.cpp; sourceTree = "<group>"; };
 		4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = FontFeatureSettings.h; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = FrameSelectionMac.mm; path = mac/FrameSelectionMac.mm; sourceTree = "<group>"; };
+		4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketExtensionDispatcher.cpp; sourceTree = "<group>"; };
+		4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionDispatcher.h; sourceTree = "<group>"; };
 		4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLShadowElement.cpp; sourceTree = "<group>"; };
 		4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLShadowElement.h; sourceTree = "<group>"; };
 		4ABDFF0914DBE312004D117D /* HTMLShadowElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLShadowElement.idl; sourceTree = "<group>"; };
@@ -8218,6 +8258,9 @@
 		4AD01007127E642A0015035F /* HTMLOutputElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLOutputElement.idl; sourceTree = "<group>"; };
 		4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOutputElement.cpp; sourceTree = "<group>"; };
 		4AD0173B127E82860015035F /* JSHTMLOutputElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLOutputElement.h; sourceTree = "<group>"; };
+		4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionProcessor.h; sourceTree = "<group>"; };
+		4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketDeflater.cpp; sourceTree = "<group>"; };
+		4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketDeflater.h; sourceTree = "<group>"; };
 		4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventDispatchMediator.cpp; sourceTree = "<group>"; };
 		4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventDispatchMediator.h; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
@@ -8302,10 +8345,10 @@
 		5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
 		5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerThreadableWebSocketChannel.h; sourceTree = "<group>"; };
 		5116D9750CF177BD00C2B84D /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseDetails.h; sourceTree = "<group>"; };
-		511F23130DC160DA004F0032 /* LocalStorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalStorageTask.cpp; sourceTree = "<group>"; };
-		511F23140DC160DA004F0032 /* LocalStorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalStorageTask.h; sourceTree = "<group>"; };
-		511F23150DC160DA004F0032 /* LocalStorageThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalStorageThread.cpp; sourceTree = "<group>"; };
-		511F23160DC160DA004F0032 /* LocalStorageThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalStorageThread.h; sourceTree = "<group>"; };
+		511F23130DC160DA004F0032 /* StorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTask.cpp; sourceTree = "<group>"; };
+		511F23140DC160DA004F0032 /* StorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTask.h; sourceTree = "<group>"; };
+		511F23150DC160DA004F0032 /* StorageThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageThread.cpp; sourceTree = "<group>"; };
+		511F23160DC160DA004F0032 /* StorageThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageThread.h; sourceTree = "<group>"; };
 		5126E6B90A2E3B12005C29FA /* IconDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = IconDatabase.cpp; sourceTree = "<group>"; };
 		5126E6BA0A2E3B12005C29FA /* IconDatabase.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IconDatabase.h; sourceTree = "<group>"; };
 		512DD8E20D91E2B4000F89EE /* SharedBufferCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SharedBufferCF.cpp; sourceTree = "<group>"; };
@@ -8454,14 +8497,18 @@
 		53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFlexibleBox.h; sourceTree = "<group>"; };
 		550A0BC7085F6039007353D6 /* QualifiedName.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = QualifiedName.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		572E92F914E540580087FFBA /* ShadowRootList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ShadowRootList.cpp; path = ../../dom/ShadowRootList.cpp; sourceTree = "<group>"; };
+		572E92FA14E540580087FFBA /* ShadowRootList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ShadowRootList.h; path = ../../dom/ShadowRootList.h; sourceTree = "<group>"; };
 		573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTypeBuilder.cpp; sourceTree = "<group>"; };
 		573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTypeBuilder.h; sourceTree = "<group>"; };
-		57B7919F14C6A62900F202D1 /* ContentInclusionSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentInclusionSelector.cpp; sourceTree = "<group>"; };
-		57B791A014C6A62900F202D1 /* ContentInclusionSelector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentInclusionSelector.h; sourceTree = "<group>"; };
+		57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentSelector.cpp; sourceTree = "<group>"; };
+		57B791A014C6A62900F202D1 /* HTMLContentSelector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLContentSelector.h; sourceTree = "<group>"; };
 		57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSelectorQuery.cpp; sourceTree = "<group>"; };
 		57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSelectorQuery.h; sourceTree = "<group>"; };
 		57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentElement.cpp; sourceTree = "<group>"; };
 		57B791A814C6A63300F202D1 /* HTMLContentElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLContentElement.h; sourceTree = "<group>"; };
+		57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InsertionPoint.cpp; sourceTree = "<group>"; };
+		57CF497314EE36D700ECFF14 /* InsertionPoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InsertionPoint.h; sourceTree = "<group>"; };
 		5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTreeViewer.cpp; sourceTree = "<group>"; };
 		5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLTreeViewer.h; sourceTree = "<group>"; };
 		590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientation.h; sourceTree = "<group>"; };
@@ -8472,8 +8519,6 @@
 		5913A24013D49EBA00F5B05C /* IdentifiersFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IdentifiersFactory.h; sourceTree = "<group>"; };
 		59309A1011F4AE5800250603 /* DeviceOrientationClientMock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DeviceOrientationClientMock.cpp; path = mock/DeviceOrientationClientMock.cpp; sourceTree = "<group>"; };
 		59309A1211F4AE6A00250603 /* DeviceOrientationClientMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DeviceOrientationClientMock.h; path = mock/DeviceOrientationClientMock.h; sourceTree = "<group>"; };
-		593AB6971355CD9200FC8211 /* PositionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PositionCallback.idl; sourceTree = "<group>"; };
-		593AB6991355CDAE00FC8211 /* PositionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PositionErrorCallback.idl; sourceTree = "<group>"; };
 		5958F1CB1343917C0080B31F /* XMLViewer.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = XMLViewer.css; sourceTree = "<group>"; };
 		5958F1CC1343917C0080B31F /* XMLViewer.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = XMLViewer.js; sourceTree = "<group>"; };
 		596950811321059900C3ED18 /* JobjectWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JobjectWrapper.h; sourceTree = "<group>"; };
@@ -8773,6 +8818,8 @@
 		7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorDOMAgent.h; sourceTree = "<group>"; };
 		7A54857D14E02D51006AE05A /* InspectorHistory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorHistory.cpp; sourceTree = "<group>"; };
 		7A54857E14E02D51006AE05A /* InspectorHistory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorHistory.h; sourceTree = "<group>"; };
+		7A54881514E432A1006AE05A /* DOMPatchSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMPatchSupport.h; sourceTree = "<group>"; };
+		7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMPatchSupport.cpp; sourceTree = "<group>"; };
 		7A563E5412DE32B000F4536D /* InjectedScriptSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptSource.h; sourceTree = "<group>"; };
 		7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InjectedScriptSource.js; sourceTree = "<group>"; };
 		7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroupLoadDeferrer.cpp; sourceTree = "<group>"; };
@@ -10146,7 +10193,9 @@
 		97059976107D975200A50A7C /* PolicyChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyChecker.h; sourceTree = "<group>"; };
 		970B7289144FFAC600F00A37 /* EventInterfaces.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventInterfaces.h; sourceTree = "<group>"; };
 		970B72A5145008EB00F00A37 /* EventHeaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventHeaders.h; sourceTree = "<group>"; };
-		971491D912FD65E8001BFEB1 /* URLString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLString.h; sourceTree = "<group>"; };
+		9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NavigatorGeolocation.cpp; path = Modules/geolocation/NavigatorGeolocation.cpp; sourceTree = "<group>"; };
+		9711460114EF009A00674FD9 /* NavigatorGeolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NavigatorGeolocation.h; path = Modules/geolocation/NavigatorGeolocation.h; sourceTree = "<group>"; };
+		9711460214EF009A00674FD9 /* NavigatorGeolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NavigatorGeolocation.idl; path = Modules/geolocation/NavigatorGeolocation.idl; sourceTree = "<group>"; };
 		97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FTPDirectoryDocument.cpp; sourceTree = "<group>"; };
 		97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FTPDirectoryDocument.h; sourceTree = "<group>"; };
 		97205AB11239291000B17380 /* ImageDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageDocument.cpp; sourceTree = "<group>"; };
@@ -10157,18 +10206,48 @@
 		97205ABA1239292700B17380 /* PluginDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginDocument.h; sourceTree = "<group>"; };
 		9728C3111268E4390041E89B /* MarkupAccumulator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkupAccumulator.cpp; sourceTree = "<group>"; };
 		9728C3121268E4390041E89B /* MarkupAccumulator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkupAccumulator.h; sourceTree = "<group>"; };
+		9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorRegisterProtocolHandler.cpp; sourceTree = "<group>"; };
+		9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorRegisterProtocolHandler.h; sourceTree = "<group>"; };
+		9730BE1614EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = NavigatorRegisterProtocolHandler.idl; sourceTree = "<group>"; };
 		9738899E116EA9DC00ADF313 /* DocumentWriter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentWriter.cpp; sourceTree = "<group>"; };
 		9738899F116EA9DC00ADF313 /* DocumentWriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentWriter.h; sourceTree = "<group>"; };
 		973DC63D145A9409002842C2 /* ExceptionCodeDescription.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionCodeDescription.cpp; sourceTree = "<group>"; };
 		973DC63E145A9409002842C2 /* ExceptionCodeDescription.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionCodeDescription.h; sourceTree = "<group>"; };
 		973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceLoadNotifier.cpp; sourceTree = "<group>"; };
 		973E325510883B7C005BC493 /* ResourceLoadNotifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceLoadNotifier.h; sourceTree = "<group>"; };
+		9746AF1314F4DDE6003E7A70 /* Geolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Geolocation.cpp; path = Modules/geolocation/Geolocation.cpp; sourceTree = "<group>"; };
+		9746AF1414F4DDE6003E7A70 /* Geolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Geolocation.h; path = Modules/geolocation/Geolocation.h; sourceTree = "<group>"; };
+		9746AF1514F4DDE6003E7A70 /* Geolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Geolocation.idl; path = Modules/geolocation/Geolocation.idl; sourceTree = "<group>"; };
+		9746AF1614F4DDE6003E7A70 /* GeolocationController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GeolocationController.cpp; path = Modules/geolocation/GeolocationController.cpp; sourceTree = "<group>"; };
+		9746AF1714F4DDE6003E7A70 /* GeolocationController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationController.h; path = Modules/geolocation/GeolocationController.h; sourceTree = "<group>"; };
+		9746AF1814F4DDE6003E7A70 /* GeolocationError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationError.h; path = Modules/geolocation/GeolocationError.h; sourceTree = "<group>"; };
+		9746AF1914F4DDE6003E7A70 /* GeolocationPosition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationPosition.h; path = Modules/geolocation/GeolocationPosition.h; sourceTree = "<group>"; };
+		9746AF1A14F4DDE6003E7A70 /* Geoposition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Geoposition.h; path = Modules/geolocation/Geoposition.h; sourceTree = "<group>"; };
+		9746AF1B14F4DDE6003E7A70 /* Geoposition.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Geoposition.idl; path = Modules/geolocation/Geoposition.idl; sourceTree = "<group>"; };
+		9746AF1C14F4DDE6003E7A70 /* PositionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionCallback.h; path = Modules/geolocation/PositionCallback.h; sourceTree = "<group>"; };
+		9746AF1D14F4DDE6003E7A70 /* PositionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = PositionCallback.idl; path = Modules/geolocation/PositionCallback.idl; sourceTree = "<group>"; };
+		9746AF1E14F4DDE6003E7A70 /* PositionError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionError.h; path = Modules/geolocation/PositionError.h; sourceTree = "<group>"; };
+		9746AF1F14F4DDE6003E7A70 /* PositionError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = PositionError.idl; path = Modules/geolocation/PositionError.idl; sourceTree = "<group>"; };
+		9746AF2014F4DDE6003E7A70 /* PositionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionErrorCallback.h; path = Modules/geolocation/PositionErrorCallback.h; sourceTree = "<group>"; };
+		9746AF2114F4DDE6003E7A70 /* PositionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = PositionErrorCallback.idl; path = Modules/geolocation/PositionErrorCallback.idl; sourceTree = "<group>"; };
+		9746AF2214F4DDE6003E7A70 /* PositionOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionOptions.h; path = Modules/geolocation/PositionOptions.h; sourceTree = "<group>"; };
 		974A862014B7ADBB003FDC76 /* FrameDestructionObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameDestructionObserver.cpp; sourceTree = "<group>"; };
 		974A862114B7ADBB003FDC76 /* FrameDestructionObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FrameDestructionObserver.h; sourceTree = "<group>"; };
 		974D2DA2146A535D00D51F8B /* SecurityPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SecurityPolicy.cpp; sourceTree = "<group>"; };
 		974D2DA3146A535D00D51F8B /* SecurityPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityPolicy.h; sourceTree = "<group>"; };
 		9752D38B1413104B003305BD /* JSHTMLSpanElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLSpanElement.cpp; sourceTree = "<group>"; };
 		9752D38C1413104B003305BD /* JSHTMLSpanElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLSpanElement.h; sourceTree = "<group>"; };
+		9759E93414EF1CF80026A2DD /* LoadableTextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoadableTextTrack.cpp; sourceTree = "<group>"; };
+		9759E93514EF1CF80026A2DD /* TextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrack.cpp; sourceTree = "<group>"; };
+		9759E93614EF1CF80026A2DD /* TextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrack.h; sourceTree = "<group>"; };
+		9759E93714EF1CF80026A2DD /* TextTrack.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrack.idl; sourceTree = "<group>"; };
+		9759E93814EF1CF80026A2DD /* TextTrackCue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCue.cpp; sourceTree = "<group>"; };
+		9759E93914EF1CF80026A2DD /* TextTrackCue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCue.h; sourceTree = "<group>"; };
+		9759E93A14EF1CF80026A2DD /* TextTrackCue.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCue.idl; sourceTree = "<group>"; };
+		9759E93B14EF1CF80026A2DD /* TextTrackCueList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCueList.cpp; sourceTree = "<group>"; };
+		9759E93C14EF1CF80026A2DD /* TextTrackCueList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCueList.h; sourceTree = "<group>"; };
+		9759E93D14EF1CF80026A2DD /* TextTrackCueList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCueList.idl; sourceTree = "<group>"; };
+		9759E94814EF1D490026A2DD /* LoadableTextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoadableTextTrack.h; sourceTree = "<group>"; };
 		975CA287130365F800E99AD9 /* Crypto.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Crypto.cpp; sourceTree = "<group>"; };
 		975CA288130365F800E99AD9 /* Crypto.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Crypto.h; sourceTree = "<group>"; };
 		975CA289130365F800E99AD9 /* Crypto.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Crypto.idl; sourceTree = "<group>"; };
@@ -10265,6 +10344,8 @@
 		97C1F552122855CB00EDE616 /* HTMLToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLToken.h; path = parser/HTMLToken.h; sourceTree = "<group>"; };
 		97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSecurityPolicy.cpp; sourceTree = "<group>"; };
 		97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSecurityPolicy.h; sourceTree = "<group>"; };
+		97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorSupplement.cpp; sourceTree = "<group>"; };
+		97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorSupplement.h; sourceTree = "<group>"; };
 		97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowProperty.cpp; sourceTree = "<group>"; };
 		97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWindowProperty.h; sourceTree = "<group>"; };
 		97DCE1FF10807C750057D394 /* HistoryController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryController.cpp; sourceTree = "<group>"; };
@@ -10327,6 +10408,8 @@
 		A0EE0DF2144F825500F80B0D /* WebGLDebugRendererInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLDebugRendererInfo.h; path = canvas/WebGLDebugRendererInfo.h; sourceTree = "<group>"; };
 		A0EE0DF3144F825500F80B0D /* WebGLDebugShaders.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLDebugShaders.cpp; path = canvas/WebGLDebugShaders.cpp; sourceTree = "<group>"; };
 		A0EE0DF4144F825500F80B0D /* WebGLDebugShaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLDebugShaders.h; path = canvas/WebGLDebugShaders.h; sourceTree = "<group>"; };
+		A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedSVGDocument.cpp; sourceTree = "<group>"; };
+		A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedSVGDocument.h; sourceTree = "<group>"; };
 		A10BB5821484E3A700B2E87A /* RenderSVGRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGRect.cpp; sourceTree = "<group>"; };
 		A10BB5831484E3A700B2E87A /* RenderSVGRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGRect.h; sourceTree = "<group>"; };
 		A10BB5881484E3B300B2E87A /* RenderSVGShape.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGShape.cpp; sourceTree = "<group>"; };
@@ -10394,6 +10477,8 @@
 		A718760D0B2A120100A16ECE /* DragActions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragActions.h; sourceTree = "<group>"; };
 		A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DragControllerMac.mm; sourceTree = "<group>"; };
 		A71A70C911AFB02000989D6D /* HTMLMeterElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLMeterElement.idl; sourceTree = "<group>"; };
+		A71E083514E3CEAF006A4619 /* PageSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageSupplement.cpp; sourceTree = "<group>"; };
+		A71E083614E3CEAF006A4619 /* PageSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageSupplement.h; sourceTree = "<group>"; };
 		A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformExportMacros.h; sourceTree = "<group>"; };
 		A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RoundedRect.cpp; sourceTree = "<group>"; };
 		A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RoundedRect.h; sourceTree = "<group>"; };
@@ -10471,14 +10556,12 @@
 		A80E6CBE0A1989CA007FB8C5 /* ShadowValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ShadowValue.h; sourceTree = "<group>"; };
 		A80E6CBF0A1989CA007FB8C5 /* CSSValueList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSValueList.h; sourceTree = "<group>"; };
 		A80E6CC10A1989CA007FB8C5 /* CSSImportRule.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSImportRule.cpp; sourceTree = "<group>"; };
-		A80E6CC20A1989CA007FB8C5 /* FontFamilyValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FontFamilyValue.cpp; sourceTree = "<group>"; };
 		A80E6CC30A1989CA007FB8C5 /* FontValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FontValue.h; sourceTree = "<group>"; };
 		A80E6CC40A1989CA007FB8C5 /* CSSValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSValue.h; sourceTree = "<group>"; };
 		A80E6CC50A1989CA007FB8C5 /* CSSStyleRule.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSStyleRule.cpp; sourceTree = "<group>"; };
 		A80E6CC60A1989CA007FB8C5 /* CSSInheritedValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSInheritedValue.cpp; sourceTree = "<group>"; };
 		A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FontValue.cpp; sourceTree = "<group>"; };
 		A80E6CC80A1989CA007FB8C5 /* CSSRuleList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSRuleList.h; sourceTree = "<group>"; };
-		A80E6CC90A1989CA007FB8C5 /* FontFamilyValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FontFamilyValue.h; sourceTree = "<group>"; };
 		A80E6CCA0A1989CA007FB8C5 /* ShadowValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowValue.cpp; sourceTree = "<group>"; };
 		A80E6CCB0A1989CA007FB8C5 /* CSSPageRule.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSPageRule.cpp; sourceTree = "<group>"; };
 		A80E6CCC0A1989CA007FB8C5 /* CSSImportRule.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSImportRule.h; sourceTree = "<group>"; };
@@ -10593,6 +10676,9 @@
 		A833C7F60A2CF1D800D57664 /* xmlattrs.in */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = xmlattrs.in; sourceTree = "<group>"; };
 		A833C80A0A2CF25600D57664 /* XMLNames.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XMLNames.cpp; sourceTree = "<group>"; };
 		A833C80B0A2CF25600D57664 /* XMLNames.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XMLNames.h; sourceTree = "<group>"; };
+		A83B533814F399BB00720D9D /* IDLAttributes.txt */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDLAttributes.txt; path = scripts/IDLAttributes.txt; sourceTree = "<group>"; };
+		A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowWebGL.idl; path = canvas/DOMWindowWebGL.idl; sourceTree = "<group>"; };
+		A83B536C14F749E200720D9D /* DOMWindowXML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowXML.idl; sourceTree = "<group>"; };
 		A83B78F20CCAFF15000B0825 /* JSSVGFontFaceUriElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceUriElement.h; sourceTree = "<group>"; };
 		A83B78F30CCAFF15000B0825 /* JSSVGFontFaceUriElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFontFaceUriElement.cpp; sourceTree = "<group>"; };
 		A83B78F40CCAFF15000B0825 /* JSSVGFontFaceSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceSrcElement.h; sourceTree = "<group>"; };
@@ -10700,8 +10786,10 @@
 		A88DD4880B4629B000C02990 /* PathTraversalState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PathTraversalState.cpp; sourceTree = "<group>"; };
 		A89943260B42338700D7C802 /* BitmapImage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitmapImage.h; sourceTree = "<group>"; };
 		A89943270B42338700D7C802 /* BitmapImage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitmapImage.cpp; sourceTree = "<group>"; };
+		A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = DOMWindowSVG.idl; sourceTree = "<group>"; };
 		A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReplaceNodeWithSpanCommand.cpp; sourceTree = "<group>"; };
 		A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReplaceNodeWithSpanCommand.h; sourceTree = "<group>"; };
+		A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowHTML.idl; sourceTree = "<group>"; };
 		A8BC04911214F69600B5F122 /* HTMLEntityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLEntityTable.cpp; sourceTree = "<group>"; };
 		A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentParser.cpp; sourceTree = "<group>"; };
 		A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodedDataDocumentParser.h; sourceTree = "<group>"; };
@@ -11009,14 +11097,6 @@
 		B10B697E140C174000BC1C26 /* WebVTTTokenizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebVTTTokenizer.cpp; sourceTree = "<group>"; };
 		B10B697F140C174000BC1C26 /* WebVTTTokenizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebVTTTokenizer.h; sourceTree = "<group>"; };
 		B1827492134CA4C100B98C2D /* CallbackFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallbackFunction.cpp; sourceTree = "<group>"; };
-		B1AD4E4D13A12A0B00846B27 /* LoadableTextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoadableTextTrack.cpp; sourceTree = "<group>"; };
-		B1AD4E4E13A12A0B00846B27 /* LoadableTextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoadableTextTrack.h; sourceTree = "<group>"; };
-		B1AD4E5513A12A0B00846B27 /* TextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrack.cpp; sourceTree = "<group>"; };
-		B1AD4E5613A12A0B00846B27 /* TextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrack.h; sourceTree = "<group>"; };
-		B1AD4E5713A12A0B00846B27 /* TextTrackCue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCue.cpp; sourceTree = "<group>"; };
-		B1AD4E5813A12A0B00846B27 /* TextTrackCue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCue.h; sourceTree = "<group>"; };
-		B1AD4E5913A12A0B00846B27 /* TextTrackCueList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCueList.cpp; sourceTree = "<group>"; };
-		B1AD4E5A13A12A0B00846B27 /* TextTrackCueList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCueList.h; sourceTree = "<group>"; };
 		B1AD4E7113A12A4600846B27 /* TextTrackLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TextTrackLoader.cpp; path = loader/TextTrackLoader.cpp; sourceTree = SOURCE_ROOT; };
 		B1AD4E7213A12A4600846B27 /* TextTrackLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TextTrackLoader.h; path = loader/TextTrackLoader.h; sourceTree = SOURCE_ROOT; };
 		B1D5ECB4134B58DA0087C78F /* CallbackFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallbackFunction.h; sourceTree = "<group>"; };
@@ -12026,11 +12106,7 @@
 		BC53DA5F1143141A000D817E /* DOMObjectHashTableMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMObjectHashTableMap.h; sourceTree = "<group>"; };
 		BC53DA61114314BD000D817E /* DOMObjectHashTableMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMObjectHashTableMap.cpp; sourceTree = "<group>"; };
 		BC53DAC611433064000D817E /* JSDOMWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMWrapper.cpp; sourceTree = "<group>"; };
-		BC56CB1C10D5AC8000A77C64 /* GeolocationController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeolocationController.cpp; sourceTree = "<group>"; };
-		BC56CB1D10D5AC8000A77C64 /* GeolocationController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationController.h; sourceTree = "<group>"; };
 		BC56CB1E10D5AC8000A77C64 /* GeolocationClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationClient.h; sourceTree = "<group>"; };
-		BC56CB1F10D5AC8000A77C64 /* GeolocationError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationError.h; sourceTree = "<group>"; };
-		BC56CB2010D5AC8000A77C64 /* GeolocationPosition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationPosition.h; sourceTree = "<group>"; };
 		BC5823F40C0A98DF0053F1B5 /* JSHTMLElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLElementCustom.cpp; sourceTree = "<group>"; };
 		BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSStyleDeclarationCustom.cpp; sourceTree = "<group>"; };
 		BC588AEF0BFA6CF900EE679E /* HTMLParserErrorCodes.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLParserErrorCodes.h; sourceTree = "<group>"; };
@@ -12044,7 +12120,6 @@
 		BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSDOMSelection.h; sourceTree = "<group>"; };
 		BC5C76281497FE1400BC4775 /* PlatformEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PlatformEvent.cpp; sourceTree = "<group>"; };
 		BC5C76291497FE1400BC4775 /* PlatformEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformEvent.h; sourceTree = "<group>"; };
-		BC5CFCA811F793320099ED09 /* LocalizationStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalizationStrategy.h; sourceTree = "<group>"; };
 		BC5EB5DA0E81B7EA00B25965 /* BorderValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BorderValue.h; path = style/BorderValue.h; sourceTree = "<group>"; };
 		BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OutlineValue.h; path = style/OutlineValue.h; sourceTree = "<group>"; };
 		BC5EB5DE0E81B9AB00B25965 /* CollapsedBorderValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CollapsedBorderValue.h; path = style/CollapsedBorderValue.h; sourceTree = "<group>"; };
@@ -12269,8 +12344,6 @@
 		BCC065840F3CE2A700CD2D87 /* JSClientRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRect.h; sourceTree = "<group>"; };
 		BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSClientRectList.cpp; sourceTree = "<group>"; };
 		BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRectList.h; sourceTree = "<group>"; };
-		BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DefaultLocalizationStrategy.cpp; sourceTree = "<group>"; };
-		BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DefaultLocalizationStrategy.h; sourceTree = "<group>"; };
 		BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLInputElementCustom.cpp; sourceTree = "<group>"; };
 		BCC573330D695BBE006EF517 /* DOMProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMProgressEvent.h; sourceTree = "<group>"; };
 		BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProgressEvent.mm; sourceTree = "<group>"; };
@@ -12512,9 +12585,12 @@
 		C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactory.cpp; sourceTree = "<group>"; };
 		C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactory.h; sourceTree = "<group>"; };
 		C585A6CB11D4FB3D004C3E4B /* IDBFactory.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBFactory.idl; sourceTree = "<group>"; };
+		C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformPasteboard.h; sourceTree = "<group>"; };
 		C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlyphMetricsMap.h; sourceTree = "<group>"; };
 		C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageEventDispatcher.cpp; sourceTree = "<group>"; };
 		C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageEventDispatcher.h; sourceTree = "<group>"; };
+		C5F765B414E1D414006C899B /* PasteboardStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardStrategy.h; sourceTree = "<group>"; };
+		C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformPasteboardMac.mm; sourceTree = "<group>"; };
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		C6F08FB91430FE8F00685849 /* MutationRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationRecord.cpp; sourceTree = "<group>"; };
@@ -12569,6 +12645,7 @@
 		CE057FA31220731100A476D5 /* DocumentMarkerController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentMarkerController.cpp; sourceTree = "<group>"; };
 		CE057FA41220731100A476D5 /* DocumentMarkerController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentMarkerController.h; sourceTree = "<group>"; };
 		CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptSourceProvider.h; sourceTree = "<group>"; };
+		CE5CB1B314EDAB6F00BB2795 /* EventSender.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventSender.h; sourceTree = "<group>"; };
 		CEA3949A11D45CDA003094CF /* StaticHashSetNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StaticHashSetNodeList.cpp; sourceTree = "<group>"; };
 		CEA3949B11D45CDA003094CF /* StaticHashSetNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StaticHashSetNodeList.h; sourceTree = "<group>"; };
 		CECCFC3A141973D5002A0AC1 /* DecodeEscapeSequences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodeEscapeSequences.h; sourceTree = "<group>"; };
@@ -12710,6 +12787,32 @@
 		E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannelCustom.cpp; sourceTree = "<group>"; };
 		E1A643F10EC0972500779668 /* WorkerScriptController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptController.h; sourceTree = "<group>"; };
 		E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerScriptController.cpp; sourceTree = "<group>"; };
+		E1AB1EA814E9E27D00449E13 /* FileList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileList.idl; path = fileapi/FileList.idl; sourceTree = "<group>"; };
+		E1AB1EAB14E9E2EF00449E13 /* DirectoryEntry.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryEntry.idl; path = fileapi/DirectoryEntry.idl; sourceTree = "<group>"; };
+		E1AB1EAC14E9E2F800449E13 /* DirectoryEntrySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryEntrySync.idl; path = fileapi/DirectoryEntrySync.idl; sourceTree = "<group>"; };
+		E1AB1EAD14E9E30500449E13 /* DirectoryReader.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryReader.idl; path = fileapi/DirectoryReader.idl; sourceTree = "<group>"; };
+		E1AB1EAE14E9E30B00449E13 /* DirectoryReaderSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryReaderSync.idl; path = fileapi/DirectoryReaderSync.idl; sourceTree = "<group>"; };
+		E1AB1EAF14E9E31700449E13 /* DOMFileSystemSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DOMFileSystemSync.idl; path = fileapi/DOMFileSystemSync.idl; sourceTree = "<group>"; };
+		E1AB1EB014E9E32300449E13 /* EntriesCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntriesCallback.idl; path = fileapi/EntriesCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB114E9E32A00449E13 /* Entry.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = Entry.idl; path = fileapi/Entry.idl; sourceTree = "<group>"; };
+		E1AB1EB214E9E33200449E13 /* EntryArray.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntryArray.idl; path = fileapi/EntryArray.idl; sourceTree = "<group>"; };
+		E1AB1EB314E9E33900449E13 /* EntryArraySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntryArraySync.idl; path = fileapi/EntryArraySync.idl; sourceTree = "<group>"; };
+		E1AB1EB414E9E34500449E13 /* EntryCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntryCallback.idl; path = fileapi/EntryCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB514E9E34B00449E13 /* EntrySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntrySync.idl; path = fileapi/EntrySync.idl; sourceTree = "<group>"; };
+		E1AB1EB614E9E35200449E13 /* ErrorCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = ErrorCallback.idl; path = fileapi/ErrorCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB714E9E35800449E13 /* File.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = File.idl; path = fileapi/File.idl; sourceTree = "<group>"; };
+		E1AB1EB814E9E36200449E13 /* FileCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileCallback.idl; path = fileapi/FileCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB914E9E36D00449E13 /* FileEntry.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileEntry.idl; path = fileapi/FileEntry.idl; sourceTree = "<group>"; };
+		E1AB1EBA14E9E37200449E13 /* FileEntrySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileEntrySync.idl; path = fileapi/FileEntrySync.idl; sourceTree = "<group>"; };
+		E1AB1EBB14E9E37A00449E13 /* FileError.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileError.idl; path = fileapi/FileError.idl; sourceTree = "<group>"; };
+		E1AB1EBC14E9E39700449E13 /* FileException.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileException.idl; path = fileapi/FileException.idl; sourceTree = "<group>"; };
+		E1AB1EBD14E9E3A800449E13 /* FileReaderSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileReaderSync.idl; path = fileapi/FileReaderSync.idl; sourceTree = "<group>"; };
+		E1AB1EBE14E9E3B200449E13 /* FileSystemCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileSystemCallback.idl; path = fileapi/FileSystemCallback.idl; sourceTree = "<group>"; };
+		E1AB1EBF14E9E3BE00449E13 /* FileWriterCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileWriterCallback.idl; path = fileapi/FileWriterCallback.idl; sourceTree = "<group>"; };
+		E1AB1EC014E9E3C400449E13 /* FileWriterSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileWriterSync.idl; path = fileapi/FileWriterSync.idl; sourceTree = "<group>"; };
+		E1AB1EC114E9E3CC00449E13 /* Metadata.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = Metadata.idl; path = fileapi/Metadata.idl; sourceTree = "<group>"; };
+		E1AB1EC214E9E3D500449E13 /* MetadataCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = MetadataCallback.idl; path = fileapi/MetadataCallback.idl; sourceTree = "<group>"; };
+		E1AB1EC314E9E3E200449E13 /* WebKitBlobBuilder.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = WebKitBlobBuilder.idl; path = fileapi/WebKitBlobBuilder.idl; sourceTree = "<group>"; };
 		E1ACAF4A0E791AAF0087D12B /* DOMMessagePort.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMessagePort.mm; sourceTree = "<group>"; };
 		E1ACAF4B0E791AAF0087D12B /* DOMMessagePort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMMessagePort.h; sourceTree = "<group>"; };
 		E1AD12D51295D0BD00ACA989 /* JSProcessingInstructionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSProcessingInstructionCustom.cpp; sourceTree = "<group>"; };
@@ -12832,12 +12935,15 @@
 		E4B423800CBFB73C00AF2ECE /* JSHTMLMediaElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLMediaElement.h; sourceTree = "<group>"; };
 		E4B423850CBFB73C00AF2ECE /* JSProgressEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSProgressEvent.cpp; sourceTree = "<group>"; };
 		E4B423860CBFB73C00AF2ECE /* JSProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSProgressEvent.h; sourceTree = "<group>"; };
+		E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertySetCSSStyleDeclaration.cpp; sourceTree = "<group>"; };
+		E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertySetCSSStyleDeclaration.h; sourceTree = "<group>"; };
 		E4C178950EE6903800824D69 /* CSSSelectorList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSSelectorList.cpp; sourceTree = "<group>"; };
 		E4C178960EE6903800824D69 /* CSSSelectorList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSSelectorList.h; sourceTree = "<group>"; };
 		E4C279560CF9741900E97B98 /* RenderMedia.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderMedia.cpp; sourceTree = "<group>"; };
 		E4C279570CF9741900E97B98 /* RenderMedia.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderMedia.h; sourceTree = "<group>"; };
 		E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PurgeableBufferMac.cpp; sourceTree = "<group>"; };
 		E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PurgeableBuffer.h; sourceTree = "<group>"; };
+		EB49DB8E14F46E8B002299D9 /* IDBTracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTracing.h; sourceTree = "<group>"; };
 		ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentMarker.h; sourceTree = "<group>"; };
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
@@ -12845,6 +12951,8 @@
 		F31639691329481A00A649CB /* InjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptManager.cpp; sourceTree = "<group>"; };
 		F316396A1329481A00A649CB /* InjectedScriptManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptManager.h; sourceTree = "<group>"; };
 		F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptManager.cpp; sourceTree = "<group>"; };
+		F325A40814EE36FA007324E2 /* InspectorCounters.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorCounters.cpp; sourceTree = "<group>"; };
+		F325A40914EE36FA007324E2 /* InspectorCounters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorCounters.h; sourceTree = "<group>"; };
 		F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorConsoleAgent.cpp; sourceTree = "<group>"; };
 		F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleAgent.h; sourceTree = "<group>"; };
 		F33F0281120947F200E5743A /* ScriptProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptProfile.cpp; sourceTree = "<group>"; };
@@ -13237,16 +13345,6 @@
 		FE6FD48C0F676E9300092873 /* JSCoordinates.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCoordinates.h; sourceTree = "<group>"; };
 		FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCoordinatesCustom.cpp; sourceTree = "<group>"; };
 		FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGeolocationCustom.cpp; sourceTree = "<group>"; };
-		FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Geolocation.cpp; sourceTree = "<group>"; };
-		FE80D7B80E9C1F25000D6F75 /* Geolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Geolocation.h; sourceTree = "<group>"; };
-		FE80D7B90E9C1F25000D6F75 /* Geolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Geolocation.idl; sourceTree = "<group>"; };
-		FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Geoposition.h; sourceTree = "<group>"; };
-		FE80D7BC0E9C1F25000D6F75 /* Geoposition.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Geoposition.idl; sourceTree = "<group>"; };
-		FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionCallback.h; sourceTree = "<group>"; };
-		FE80D7BF0E9C1F25000D6F75 /* PositionError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionError.h; sourceTree = "<group>"; };
-		FE80D7C00E9C1F25000D6F75 /* PositionError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PositionError.idl; sourceTree = "<group>"; };
-		FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionErrorCallback.h; sourceTree = "<group>"; };
-		FE80D7C30E9C1F25000D6F75 /* PositionOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionOptions.h; sourceTree = "<group>"; };
 		FE80DA5F0E9C4703000D6F75 /* JSGeolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGeolocation.cpp; sourceTree = "<group>"; };
 		FE80DA600E9C4703000D6F75 /* JSGeolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGeolocation.h; sourceTree = "<group>"; };
 		FE80DA610E9C4703000D6F75 /* JSGeoposition.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGeoposition.cpp; sourceTree = "<group>"; };
@@ -13385,6 +13483,7 @@
 				EDEC98020AED7E170059137F /* WebCorePrefix.h */,
 				9307061309E0CA8200B17FE4 /* DerivedSources.make */,
 				93F19B1908245E59001E9ABC /* Info.plist */,
+				971145FE14EF006E00674FD9 /* Modules */,
 				29A812040FBB9B4100510293 /* accessibility */,
 				BC1A3790097C6F970019F3D8 /* bindings */,
 				1A569CC40D7E2B60007C3983 /* bridge */,
@@ -13860,14 +13959,15 @@
 				C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */,
 				C585A6C011D4FB3D004C3E4B /* IDBRequest.h */,
 				C585A6C111D4FB3D004C3E4B /* IDBRequest.idl */,
+				EB49DB8E14F46E8B002299D9 /* IDBTracing.h */,
 				B6566267120B115A006EA85C /* IDBTransaction.cpp */,
 				B6566268120B115A006EA85C /* IDBTransaction.h */,
 				B6566269120B115A006EA85C /* IDBTransaction.idl */,
 				B656626D120B116B006EA85C /* IDBTransactionBackendInterface.h */,
-				511F23130DC160DA004F0032 /* LocalStorageTask.cpp */,
-				511F23140DC160DA004F0032 /* LocalStorageTask.h */,
-				511F23150DC160DA004F0032 /* LocalStorageThread.cpp */,
-				511F23160DC160DA004F0032 /* LocalStorageThread.h */,
+				511F23130DC160DA004F0032 /* StorageTask.cpp */,
+				511F23140DC160DA004F0032 /* StorageTask.h */,
+				511F23150DC160DA004F0032 /* StorageThread.cpp */,
+				511F23160DC160DA004F0032 /* StorageThread.h */,
 				51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */,
 				51A926790D53F0570063ECC2 /* OriginQuotaManager.h */,
 				51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */,
@@ -13950,6 +14050,7 @@
 				1AF62EE214DA22A70041556C /* mac */,
 				1AF62EE414DA22A70041556C /* ScrollingCoordinator.cpp */,
 				1AF62EE514DA22A70041556C /* ScrollingCoordinator.h */,
+				3866AF3714F1C17100283D68 /* ScrollingCoordinatorNone.cpp */,
 				1AF62F2014DAFE790041556C /* ScrollingThread.cpp */,
 				1AF62F2114DAFE790041556C /* ScrollingThread.h */,
 				1AAADDA114DB409F00AF64B3 /* ScrollingTree.cpp */,
@@ -13977,13 +14078,13 @@
 		1C5FAECA0DCFD8C900D58F78 /* Inspector */ = {
 			isa = PBXGroup;
 			children = (
-				573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */,
-				573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */,
 				7A563E5412DE32B000F4536D /* InjectedScriptSource.h */,
 				4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */,
 				4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */,
 				4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */,
 				4F4F5FFC11CBD30100A186BF /* InspectorFrontend.h */,
+				573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */,
+				573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */,
 				7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */,
 				7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */,
 				7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */,
@@ -14010,6 +14111,8 @@
 				7AABA25814BC613300AA9A11 /* DOMEditor.h */,
 				4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */,
 				4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */,
+				7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */,
+				7A54881514E432A1006AE05A /* DOMPatchSupport.h */,
 				F35AE5AB14925F5B004D5776 /* DOMWrapperVisitor.h */,
 				5913A23F13D49EBA00F5B05C /* IdentifiersFactory.cpp */,
 				5913A24013D49EBA00F5B05C /* IdentifiersFactory.h */,
@@ -14021,6 +14124,9 @@
 				F31639691329481A00A649CB /* InjectedScriptManager.cpp */,
 				F316396A1329481A00A649CB /* InjectedScriptManager.h */,
 				7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */,
+				1C435CD414E8545B004E10EA /* Inspector-0.1.json */,
+				1C435CD514E8545B004E10EA /* Inspector-1.0.json */,
+				1C435CD314E8544F004E10EA /* Inspector.json */,
 				4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */,
 				4F2D205212EAE7B3005C2874 /* InspectorAgent.h */,
 				B885E8D211E06DD2009FFBF4 /* InspectorApplicationCacheAgent.cpp */,
@@ -14034,6 +14140,8 @@
 				F3F5CF1012ED81A80084C569 /* InspectorConsoleInstrumentation.h */,
 				1C81B9570E97330800266E07 /* InspectorController.cpp */,
 				1C81B9560E97330800266E07 /* InspectorController.h */,
+				F325A40814EE36FA007324E2 /* InspectorCounters.cpp */,
+				F325A40914EE36FA007324E2 /* InspectorCounters.h */,
 				82AB1741124B99EC00C5069D /* InspectorCSSAgent.cpp */,
 				82AB1742124B99EC00C5069D /* InspectorCSSAgent.h */,
 				7AB0B1BE1211A62200A76940 /* InspectorDatabaseAgent.cpp */,
@@ -14325,8 +14433,6 @@
 		4150F9ED12B6E0990008C860 /* shadow */ = {
 			isa = PBXGroup;
 			children = (
-				57B7919F14C6A62900F202D1 /* ContentInclusionSelector.cpp */,
-				57B791A014C6A62900F202D1 /* ContentInclusionSelector.h */,
 				57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */,
 				57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */,
 				A7C9ABF61357A3BF00F5503F /* DetailsMarkerControl.cpp */,
@@ -14334,9 +14440,13 @@
 				57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */,
 				57B791A814C6A63300F202D1 /* HTMLContentElement.h */,
 				A7B7749614CF6353004044BB /* HTMLContentElement.idl */,
+				57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */,
+				57B791A014C6A62900F202D1 /* HTMLContentSelector.h */,
 				4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */,
 				4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */,
 				4ABDFF0914DBE312004D117D /* HTMLShadowElement.idl */,
+				57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */,
+				57CF497314EE36D700ECFF14 /* InsertionPoint.h */,
 				417253A81354BBBC00360F2A /* MediaControlElements.cpp */,
 				417253A91354BBBC00360F2A /* MediaControlElements.h */,
 				4157AF7F12F1FB0400A8C6F5 /* MediaControlRootElement.cpp */,
@@ -14347,6 +14457,8 @@
 				A78E526E1346BD1700AD9C31 /* MeterShadowElement.h */,
 				A715E650134BBBEC00D8E713 /* ProgressShadowElement.cpp */,
 				A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */,
+				572E92F914E540580087FFBA /* ShadowRootList.cpp */,
+				572E92FA14E540580087FFBA /* ShadowRootList.h */,
 				4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */,
 				4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */,
 				142B97C713138943008BEF4B /* TextControlInnerElements.cpp */,
@@ -14429,6 +14541,7 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
+				A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */,
 				49EECDCC10503C2300099FAB /* ArrayBuffer.idl */,
 				49EECDC910503C2300099FAB /* ArrayBufferView.idl */,
 				6E4E91A710F7FB3100A2779C /* CanvasContextAttributes.cpp */,
@@ -14754,6 +14867,12 @@
 				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
 				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
 				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
+				4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */,
+				4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */,
+				4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */,
+				4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */,
+				4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */,
+				4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */,
 				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
 				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
 				7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */,
@@ -15039,6 +15158,7 @@
 				CDAA8D0814D385600061EA60 /* PlatformClockCM.mm */,
 				BCAA486E14A052530088FAC4 /* PlatformEventFactoryMac.h */,
 				BCAA486D14A052530088FAC4 /* PlatformEventFactoryMac.mm */,
+				C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */,
 				BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */,
 				D39D006C11F8E308006041F2 /* PopupMenuMac.h */,
 				0668E18E0ADD9640004128E0 /* PopupMenuMac.mm */,
@@ -15151,16 +15271,7 @@
 				65A21483097A3F5300B9050A /* FrameTree.h */,
 				65CBFEF70974F607001DAC25 /* FrameView.cpp */,
 				65CBFEF80974F607001DAC25 /* FrameView.h */,
-				FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */,
-				FE80D7B80E9C1F25000D6F75 /* Geolocation.h */,
-				FE80D7B90E9C1F25000D6F75 /* Geolocation.idl */,
 				BC56CB1E10D5AC8000A77C64 /* GeolocationClient.h */,
-				BC56CB1C10D5AC8000A77C64 /* GeolocationController.cpp */,
-				BC56CB1D10D5AC8000A77C64 /* GeolocationController.h */,
-				BC56CB1F10D5AC8000A77C64 /* GeolocationError.h */,
-				BC56CB2010D5AC8000A77C64 /* GeolocationPosition.h */,
-				FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */,
-				FE80D7BC0E9C1F25000D6F75 /* Geoposition.idl */,
 				C50B561412119D23008B46E0 /* GroupSettings.cpp */,
 				C50B561512119D23008B46E0 /* GroupSettings.h */,
 				BC94D1500C275C8B006BC617 /* History.cpp */,
@@ -15180,6 +15291,11 @@
 				A9C6E65D0D746694006442E9 /* Navigator.idl */,
 				E12719C90EEEC21300F61213 /* NavigatorBase.cpp */,
 				E12719C60EEEC16800F61213 /* NavigatorBase.h */,
+				9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */,
+				9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */,
+				9730BE1614EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.idl */,
+				97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */,
+				97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */,
 				00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
 				00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
 				65FEA86809833ADE00BED4AB /* Page.cpp */,
@@ -15190,6 +15306,8 @@
 				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
 				371E65CD13661EED00BEEDB0 /* PageSerializer.cpp */,
 				371E65CB13661EDC00BEEDB0 /* PageSerializer.h */,
+				A71E083514E3CEAF006A4619 /* PageSupplement.cpp */,
+				A71E083614E3CEAF006A4619 /* PageSupplement.h */,
 				FFD5B977135CC97800D5E92A /* PageVisibilityState.cpp */,
 				FFD5B978135CC97800D5E92A /* PageVisibilityState.h */,
 				8A844D0111D3C18E0014065C /* Performance.cpp */,
@@ -15201,13 +15319,6 @@
 				8AF4E55811DC5A63000ED3DE /* PerformanceTiming.cpp */,
 				8AF4E55911DC5A63000ED3DE /* PerformanceTiming.h */,
 				8AF4E55A11DC5A63000ED3DE /* PerformanceTiming.idl */,
-				FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */,
-				593AB6971355CD9200FC8211 /* PositionCallback.idl */,
-				FE80D7BF0E9C1F25000D6F75 /* PositionError.h */,
-				FE80D7C00E9C1F25000D6F75 /* PositionError.idl */,
-				FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */,
-				593AB6991355CDAE00FC8211 /* PositionErrorCallback.idl */,
-				FE80D7C30E9C1F25000D6F75 /* PositionOptions.h */,
 				B776D43C1104527500BEB0EC /* PrintContext.cpp */,
 				B776D43A1104525D00BEB0EC /* PrintContext.h */,
 				BCEC01BA0C274DAC009F4EC9 /* Screen.cpp */,
@@ -16641,6 +16752,7 @@
 				2E37DFD712DBAFB800A6B233 /* DOMURL.cpp */,
 				2E37DFD812DBAFB800A6B233 /* DOMURL.h */,
 				2E37DFD912DBAFB800A6B233 /* DOMURL.idl */,
+				A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */,
 				F55B3D871251F12D003EF269 /* EmailInputType.cpp */,
 				F55B3D881251F12D003EF269 /* EmailInputType.h */,
 				F55B3D891251F12D003EF269 /* FileInputType.cpp */,
@@ -16915,8 +17027,6 @@
 				A456FA2511AD4A830020B420 /* LabelsNodeList.h */,
 				985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */,
 				985BB96C13A94058007A0B69 /* LinkRelAttribute.h */,
-				B1AD4E4D13A12A0B00846B27 /* LoadableTextTrack.cpp */,
-				B1AD4E4E13A12A0B00846B27 /* LoadableTextTrack.h */,
 				CD27F6E6145770D30078207D /* MediaController.cpp */,
 				CD27F6E4145767870078207D /* MediaController.h */,
 				CD27F6E014575C1B0078207D /* MediaController.idl */,
@@ -16960,15 +17070,6 @@
 				F55B3DA61251F12D003EF269 /* TextInputType.h */,
 				BCEF45E80E687767001C1287 /* TextMetrics.h */,
 				BCEF453F0E676AC1001C1287 /* TextMetrics.idl */,
-				B1AD4E5513A12A0B00846B27 /* TextTrack.cpp */,
-				B1AD4E5613A12A0B00846B27 /* TextTrack.h */,
-				0707569C1422979800414161 /* TextTrack.idl */,
-				B1AD4E5713A12A0B00846B27 /* TextTrackCue.cpp */,
-				B1AD4E5813A12A0B00846B27 /* TextTrackCue.h */,
-				0707569D1422979800414161 /* TextTrackCue.idl */,
-				B1AD4E5913A12A0B00846B27 /* TextTrackCueList.cpp */,
-				B1AD4E5A13A12A0B00846B27 /* TextTrackCueList.h */,
-				0707569E1422979800414161 /* TextTrackCueList.idl */,
 				F55B3DA71251F12D003EF269 /* TimeInputType.cpp */,
 				F55B3DA81251F12D003EF269 /* TimeInputType.h */,
 				E446139D0CD6331000FADA75 /* TimeRanges.cpp */,
@@ -16991,6 +17092,40 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		971145FE14EF006E00674FD9 /* Modules */ = {
+			isa = PBXGroup;
+			children = (
+				971145FF14EF007900674FD9 /* geolocation */,
+			);
+			name = Modules;
+			sourceTree = "<group>";
+		};
+		971145FF14EF007900674FD9 /* geolocation */ = {
+			isa = PBXGroup;
+			children = (
+				9746AF1314F4DDE6003E7A70 /* Geolocation.cpp */,
+				9746AF1414F4DDE6003E7A70 /* Geolocation.h */,
+				9746AF1514F4DDE6003E7A70 /* Geolocation.idl */,
+				9746AF1614F4DDE6003E7A70 /* GeolocationController.cpp */,
+				9746AF1714F4DDE6003E7A70 /* GeolocationController.h */,
+				9746AF1814F4DDE6003E7A70 /* GeolocationError.h */,
+				9746AF1914F4DDE6003E7A70 /* GeolocationPosition.h */,
+				9746AF1A14F4DDE6003E7A70 /* Geoposition.h */,
+				9746AF1B14F4DDE6003E7A70 /* Geoposition.idl */,
+				9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */,
+				9711460114EF009A00674FD9 /* NavigatorGeolocation.h */,
+				9711460214EF009A00674FD9 /* NavigatorGeolocation.idl */,
+				9746AF1C14F4DDE6003E7A70 /* PositionCallback.h */,
+				9746AF1D14F4DDE6003E7A70 /* PositionCallback.idl */,
+				9746AF1E14F4DDE6003E7A70 /* PositionError.h */,
+				9746AF1F14F4DDE6003E7A70 /* PositionError.idl */,
+				9746AF2014F4DDE6003E7A70 /* PositionErrorCallback.h */,
+				9746AF2114F4DDE6003E7A70 /* PositionErrorCallback.idl */,
+				9746AF2214F4DDE6003E7A70 /* PositionOptions.h */,
+			);
+			name = geolocation;
+			sourceTree = "<group>";
+		};
 		976D6C57122B8A18001FD1F7 /* fileapi */ = {
 			isa = PBXGroup;
 			children = (
@@ -17003,13 +17138,17 @@
 				976D6C60122B8A3D001FD1F7 /* BlobURL.h */,
 				89878539122CA064003AABDA /* DirectoryEntry.cpp */,
 				8987853A122CA064003AABDA /* DirectoryEntry.h */,
+				E1AB1EAB14E9E2EF00449E13 /* DirectoryEntry.idl */,
 				893C47F01248BD39002B3D86 /* DirectoryEntrySync.cpp */,
 				893C47F11248BD39002B3D86 /* DirectoryEntrySync.h */,
+				E1AB1EAC14E9E2F800449E13 /* DirectoryEntrySync.idl */,
 				8987853B122CA064003AABDA /* DirectoryReader.cpp */,
 				8987853C122CA064003AABDA /* DirectoryReader.h */,
+				E1AB1EAD14E9E30500449E13 /* DirectoryReader.idl */,
 				890AE0E01256A07900F5968C /* DirectoryReaderBase.h */,
 				893C47F21248BD39002B3D86 /* DirectoryReaderSync.cpp */,
 				893C47F31248BD39002B3D86 /* DirectoryReaderSync.h */,
+				E1AB1EAE14E9E30B00449E13 /* DirectoryReaderSync.idl */,
 				8987853D122CA064003AABDA /* DOMFilePath.cpp */,
 				8987853E122CA064003AABDA /* DOMFilePath.h */,
 				8987853F122CA064003AABDA /* DOMFileSystem.cpp */,
@@ -17019,31 +17158,46 @@
 				893C47F51248BD39002B3D86 /* DOMFileSystemBase.h */,
 				893C47F61248BD39002B3D86 /* DOMFileSystemSync.cpp */,
 				893C47F71248BD39002B3D86 /* DOMFileSystemSync.h */,
+				E1AB1EAF14E9E31700449E13 /* DOMFileSystemSync.idl */,
 				89878541122CA064003AABDA /* EntriesCallback.h */,
+				E1AB1EB014E9E32300449E13 /* EntriesCallback.idl */,
 				89878542122CA064003AABDA /* Entry.cpp */,
 				89878543122CA064003AABDA /* Entry.h */,
+				E1AB1EB114E9E32A00449E13 /* Entry.idl */,
 				89878544122CA064003AABDA /* EntryArray.cpp */,
 				89878545122CA064003AABDA /* EntryArray.h */,
+				E1AB1EB214E9E33200449E13 /* EntryArray.idl */,
 				893C47F81248BD39002B3D86 /* EntryArraySync.cpp */,
 				893C47F91248BD39002B3D86 /* EntryArraySync.h */,
+				E1AB1EB314E9E33900449E13 /* EntryArraySync.idl */,
 				C6F41046130C6E8900393DE4 /* EntryBase.cpp */,
 				893C47FB1248BD39002B3D86 /* EntryBase.h */,
 				89878546122CA064003AABDA /* EntryCallback.h */,
+				E1AB1EB414E9E34500449E13 /* EntryCallback.idl */,
 				893C47FC1248BD39002B3D86 /* EntrySync.cpp */,
 				893C47FD1248BD39002B3D86 /* EntrySync.h */,
+				E1AB1EB514E9E34B00449E13 /* EntrySync.idl */,
 				89878547122CA064003AABDA /* ErrorCallback.h */,
+				E1AB1EB614E9E35200449E13 /* ErrorCallback.idl */,
 				976D6C61122B8A3D001FD1F7 /* File.cpp */,
 				976D6C62122B8A3D001FD1F7 /* File.h */,
+				E1AB1EB714E9E35800449E13 /* File.idl */,
 				893C47A51238908B002B3D86 /* FileCallback.h */,
+				E1AB1EB814E9E36200449E13 /* FileCallback.idl */,
 				89878548122CA064003AABDA /* FileEntry.cpp */,
 				89878549122CA064003AABDA /* FileEntry.h */,
+				E1AB1EB914E9E36D00449E13 /* FileEntry.idl */,
 				893C47FE1248BD39002B3D86 /* FileEntrySync.cpp */,
 				893C47FF1248BD39002B3D86 /* FileEntrySync.h */,
+				E1AB1EBA14E9E37200449E13 /* FileEntrySync.idl */,
 				976D6C64122B8A3D001FD1F7 /* FileError.h */,
+				E1AB1EBB14E9E37A00449E13 /* FileError.idl */,
 				978D07B5145A0F030096908D /* FileException.cpp */,
 				2EDF369E122C94C8002F7D4E /* FileException.h */,
+				E1AB1EBC14E9E39700449E13 /* FileException.idl */,
 				976D6C66122B8A3D001FD1F7 /* FileList.cpp */,
 				976D6C67122B8A3D001FD1F7 /* FileList.h */,
+				E1AB1EA814E9E27D00449E13 /* FileList.idl */,
 				4689F1AE1267BAE100E8D380 /* FileMetadata.h */,
 				976D6C69122B8A3D001FD1F7 /* FileReader.cpp */,
 				976D6C6A122B8A3D001FD1F7 /* FileReader.h */,
@@ -17053,9 +17207,11 @@
 				2E75841C12779ADA0062628B /* FileReaderLoaderClient.h */,
 				2EDF369A122C94B4002F7D4E /* FileReaderSync.cpp */,
 				2EDF369B122C94B4002F7D4E /* FileReaderSync.h */,
+				E1AB1EBD14E9E3A800449E13 /* FileReaderSync.idl */,
 				976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */,
 				976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */,
 				8987854A122CA064003AABDA /* FileSystemCallback.h */,
+				E1AB1EBE14E9E3B200449E13 /* FileSystemCallback.idl */,
 				8987854B122CA064003AABDA /* FileSystemCallbacks.cpp */,
 				8987854C122CA064003AABDA /* FileSystemCallbacks.h */,
 				976D6C6E122B8A3D001FD1F7 /* FileThread.cpp */,
@@ -17068,12 +17224,16 @@
 				46BC724C129B104C0071C07E /* FileWriterBase.h */,
 				46BC724D129B104C0071C07E /* FileWriterBaseCallback.h */,
 				893C47A61238908B002B3D86 /* FileWriterCallback.h */,
+				E1AB1EBF14E9E3BE00449E13 /* FileWriterCallback.idl */,
 				46700ECE127B96CB00F5D5D6 /* FileWriterSync.cpp */,
 				46700ECF127B96CB00F5D5D6 /* FileWriterSync.h */,
+				E1AB1EC014E9E3C400449E13 /* FileWriterSync.idl */,
 				8987854E122CA064003AABDA /* LocalFileSystem.cpp */,
 				8987854F122CA064003AABDA /* LocalFileSystem.h */,
 				89878550122CA064003AABDA /* Metadata.h */,
+				E1AB1EC114E9E3CC00449E13 /* Metadata.idl */,
 				89878551122CA064003AABDA /* MetadataCallback.h */,
+				E1AB1EC214E9E3D500449E13 /* MetadataCallback.idl */,
 				978D07B7145A0F1B0096908D /* OperationNotAllowedException.cpp */,
 				2E2445F51395893A004B6C19 /* OperationNotAllowedException.h */,
 				2E2445F61395893A004B6C19 /* OperationNotAllowedException.idl */,
@@ -17081,6 +17241,7 @@
 				976D6C76122B8A3D001FD1F7 /* ThreadableBlobRegistry.h */,
 				976D6C5C122B8A3D001FD1F7 /* WebKitBlobBuilder.cpp */,
 				976D6C5D122B8A3D001FD1F7 /* WebKitBlobBuilder.h */,
+				E1AB1EC314E9E3E200449E13 /* WebKitBlobBuilder.idl */,
 				8987854D122CA064003AABDA /* WebKitFlags.h */,
 			);
 			name = fileapi;
@@ -17162,13 +17323,13 @@
 		A75E8B7F0E1DE2B0007F2481 /* filters */ = {
 			isa = PBXGroup;
 			children = (
-				50CC089914C6E99C0017AB51 /* CustomFilterNumberParameter.h */,
 				49ECEB5C1499790D00CDD3A4 /* arm */,
 				50D405F7147D31F300D30BB5 /* CustomFilterMesh.cpp */,
 				50D405F8147D31F300D30BB5 /* CustomFilterMesh.h */,
-				509CC9FA14C069ED00BBECBD /* CustomFilterParameter.h */,
+				50CC089914C6E99C0017AB51 /* CustomFilterNumberParameter.h */,
 				50CC0A3814C6F5B10017AB51 /* CustomFilterOperation.cpp */,
 				50ACE2CA14B5D79300446666 /* CustomFilterOperation.h */,
+				509CC9FA14C069ED00BBECBD /* CustomFilterParameter.h */,
 				503D0CA714B5B08700F32F57 /* CustomFilterProgram.cpp */,
 				503D0CA814B5B08700F32F57 /* CustomFilterProgram.h */,
 				503D0CA914B5B08700F32F57 /* CustomFilterProgramClient.h */,
@@ -18088,6 +18249,8 @@
 		A8D2B2521287A56000AF4DDA /* cache */ = {
 			isa = PBXGroup;
 			children = (
+				A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */,
+				A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */,
 				BCB16C000979C3BD00467741 /* CachedCSSStyleSheet.cpp */,
 				BCB16C010979C3BD00467741 /* CachedCSSStyleSheet.h */,
 				BC64B4C90CB4295D005F2B62 /* CachedFont.cpp */,
@@ -18138,6 +18301,17 @@
 		B1AD4E7713A12A7200846B27 /* track */ = {
 			isa = PBXGroup;
 			children = (
+				9759E93414EF1CF80026A2DD /* LoadableTextTrack.cpp */,
+				9759E94814EF1D490026A2DD /* LoadableTextTrack.h */,
+				9759E93514EF1CF80026A2DD /* TextTrack.cpp */,
+				9759E93614EF1CF80026A2DD /* TextTrack.h */,
+				9759E93714EF1CF80026A2DD /* TextTrack.idl */,
+				9759E93814EF1CF80026A2DD /* TextTrackCue.cpp */,
+				9759E93914EF1CF80026A2DD /* TextTrackCue.h */,
+				9759E93A14EF1CF80026A2DD /* TextTrackCue.idl */,
+				9759E93B14EF1CF80026A2DD /* TextTrackCueList.cpp */,
+				9759E93C14EF1CF80026A2DD /* TextTrackCueList.h */,
+				9759E93D14EF1CF80026A2DD /* TextTrackCueList.idl */,
 				076970841463AD8700F502CF /* TextTrackList.cpp */,
 				076970851463AD8700F502CF /* TextTrackList.h */,
 				07B5A3061468537100A81ECE /* TextTrackList.idl */,
@@ -18163,6 +18337,7 @@
 				081CDFBD126ECFE800D215CA /* properties */,
 				B22277CB0D00BF1F0071B782 /* ColorDistance.cpp */,
 				B22277CC0D00BF1F0071B782 /* ColorDistance.h */,
+				A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */,
 				E415F1830D9A1A830033CE97 /* ElementTimeControl.h */,
 				E415F10C0D9A05870033CE97 /* ElementTimeControl.idl */,
 				B22277CD0D00BF1F0071B782 /* GradientAttributes.h */,
@@ -18815,6 +18990,11 @@
 				37202198106213C600F25C4B /* FontSmoothingMode.h */,
 				3784C34A0E11AA34007D8D48 /* FontTraitsMask.h */,
 				BCE4413512F7490B009B84B8 /* FontWidthVariant.h */,
+				144FCE5414EC79E7000D17A3 /* FractionalLayoutPoint.h */,
+				144FCFDE14EF2509000D17A3 /* FractionalLayoutRect.cpp */,
+				144FCFDF14EF2509000D17A3 /* FractionalLayoutRect.h */,
+				144FCE5714EC79E7000D17A3 /* FractionalLayoutSize.cpp */,
+				144FCE5814EC79E7000D17A3 /* FractionalLayoutSize.h */,
 				BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */,
 				BCE04C890DAFF7A0007A0F41 /* Generator.h */,
 				2D2FC0561460CD6F00263633 /* GeneratorGeneratedImage.cpp */,
@@ -19063,6 +19243,7 @@
 				BC1A3794097C6FC40019F3D8 /* objc */,
 				93F8B3050A300FE100F61AB8 /* CodeGenerator.pm */,
 				93F8B3070A300FEA00F61AB8 /* generate-bindings.pl */,
+				A83B533814F399BB00720D9D /* IDLAttributes.txt */,
 				14813BF309EDF88E00F757E1 /* IDLParser.pm */,
 				93F8B3080A300FEA00F61AB8 /* IDLStructure.pm */,
 				C0F2A43F13869A280066C534 /* preprocessor.pm */,
@@ -19673,8 +19854,6 @@
 				F587868402DE3B8601EA4122 /* Cursor.h */,
 				A5732B08136A161D005C8D7C /* DateComponents.cpp */,
 				A5732B09136A161D005C8D7C /* DateComponents.h */,
-				BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */,
-				BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */,
 				A79546420B5C4CB4007B438F /* DragData.cpp */,
 				A7B6E69D0B291A9600D0529F /* DragData.h */,
 				A7CFB3CF0B7ED10A0070C32D /* DragImage.cpp */,
@@ -19690,6 +19869,7 @@
 				C57FEDE01212EE9C0097BE65 /* FileSystem.cpp */,
 				514B3F720C722047000530DF /* FileSystem.h */,
 				BC073BA90C399B1F000F5979 /* FloatConversion.h */,
+				144FCE5114EC79BC000D17A3 /* FractionalLayoutUnit.h */,
 				A8748BDF12CBF2DC001FBA41 /* HashTools.h */,
 				D6FDAEF2149C06190037B1E1 /* HistogramSupport.cpp */,
 				D630E2AB149BF344005B2F93 /* HistogramSupport.h */,
@@ -19707,7 +19887,6 @@
 				BCFF64900EAD15C200C1D6F7 /* LengthSize.h */,
 				A7AD2F850EC89D07008AB002 /* LinkHash.cpp */,
 				A7AD2F860EC89D07008AB002 /* LinkHash.h */,
-				BC5CFCA811F793320099ED09 /* LocalizationStrategy.h */,
 				C046E1AB1208A9FE00BA2CF7 /* LocalizedStrings.cpp */,
 				935207BD09BD410A00F2038D /* LocalizedStrings.h */,
 				A8239DFE09B3CF8A00B60641 /* Logging.cpp */,
@@ -19718,6 +19897,7 @@
 				BC772C4D0C4EB3040083285F /* MIMETypeRegistry.h */,
 				98EB1F941313FE0500D0E1EA /* NotImplemented.h */,
 				4B2708C50AF19EE40065127F /* Pasteboard.h */,
+				C5F765B414E1D414006C899B /* PasteboardStrategy.h */,
 				BC5C76281497FE1400BC4775 /* PlatformEvent.cpp */,
 				BC5C76291497FE1400BC4775 /* PlatformEvent.h */,
 				A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */,
@@ -19725,6 +19905,7 @@
 				935C476609AC4D4300A6AAB4 /* PlatformKeyboardEvent.h */,
 				932871BF0B20DEB70049035A /* PlatformMenuDescription.h */,
 				935C476709AC4D4300A6AAB4 /* PlatformMouseEvent.h */,
+				C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */,
 				BCEC01D60C274EB4009F4EC9 /* PlatformScreen.h */,
 				1AD8F81A11CAB9E900E93E54 /* PlatformStrategies.cpp */,
 				1AD8F81911CAB9E900E93E54 /* PlatformStrategies.h */,
@@ -19782,7 +19963,6 @@
 				93309EA1099EB78C0056E581 /* Timer.cpp */,
 				9305B24C098F1B6B00C28855 /* Timer.h */,
 				1419D2C40CEA6F6100FF507A /* TreeShared.h */,
-				971491D912FD65E8001BFEB1 /* URLString.h */,
 				2E3BBF051162DA1100B9409A /* UUID.cpp */,
 				2E3BBF061162DA1100B9409A /* UUID.h */,
 				515788C01207852C00A37C4A /* VisitedLinkStrategy.h */,
@@ -19838,6 +20018,7 @@
 		E1F0424309839389006694EA /* xml */ = {
 			isa = PBXGroup;
 			children = (
+				A83B536C14F749E200720D9D /* DOMWindowXML.idl */,
 				00B9318013BA867F0035A948 /* parser */,
 				1ACE53E10A8D18E70022947D /* DOMParser.cpp */,
 				1ACE53E20A8D18E70022947D /* DOMParser.h */,
@@ -20012,8 +20193,6 @@
 				A80E6CD20A1989CA007FB8C5 /* CSSMediaRule.cpp */,
 				A80E6CD90A1989CA007FB8C5 /* CSSMediaRule.h */,
 				85C56CA20AA89C1000D95755 /* CSSMediaRule.idl */,
-				A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */,
-				A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */,
 				A80E73470A199C77007FB8C5 /* CSSNamespace.h */,
 				F98FFF4211A2676200F548E8 /* CSSOMUtils.cpp */,
 				F98FFF4311A2676200F548E8 /* CSSOMUtils.h */,
@@ -20081,8 +20260,6 @@
 				501BAAB11395114B00F7ACEB /* CSSWrapShapes.cpp */,
 				501BA9E11393CEA000F7ACEB /* CSSWrapShapes.h */,
 				A80E6CE10A1989CA007FB8C5 /* DashboardRegion.h */,
-				A80E6CC20A1989CA007FB8C5 /* FontFamilyValue.cpp */,
-				A80E6CC90A1989CA007FB8C5 /* FontFamilyValue.h */,
 				4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */,
 				4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */,
 				A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */,
@@ -20116,6 +20293,8 @@
 				D3AA10F1123A98AA0092152B /* MediaQueryMatcher.cpp */,
 				D3AA10F2123A98AA0092152B /* MediaQueryMatcher.h */,
 				A80E6CD10A1989CA007FB8C5 /* Pair.h */,
+				E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */,
+				E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */,
 				93CA4C9F09DF93FA00DF8677 /* quirks.css */,
 				BC4368E70C226E32005EFB5F /* Rect.h */,
 				A80E79960A19BD21007FB8C5 /* Rect.idl */,
@@ -20129,6 +20308,8 @@
 				0FF5026E102BA9660066F39A /* StyleMedia.cpp */,
 				0FF5026F102BA96A0066F39A /* StyleMedia.h */,
 				0FF50270102BA96A0066F39A /* StyleMedia.idl */,
+				A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */,
+				A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */,
 				A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */,
 				A8EA80040A19516E00A8EF5F /* StyleSheet.h */,
 				850656DC0AAB44D9002D15C0 /* StyleSheet.idl */,
@@ -20533,6 +20714,7 @@
 				939885C108B7E3D100E707C4 /* EventNames.cpp */,
 				939885C208B7E3D100E707C4 /* EventNames.h */,
 				8F6756191288B17B0047ACA3 /* EventQueue.h */,
+				CE5CB1B314EDAB6F00BB2795 /* EventSender.h */,
 				E12EDBE90B308E0B002704B6 /* EventTarget.cpp */,
 				E12EDB7A0B308A78002704B6 /* EventTarget.h */,
 				85AFA7420AAF298400E84305 /* EventTarget.idl */,
@@ -21199,6 +21381,7 @@
 				BCD533640ED6848900887468 /* CachedScriptSourceProvider.h in Headers */,
 				5038BE411472AD980095E0D1 /* CachedShader.h in Headers */,
 				D0BC54491443AC4A00E105DA /* CachedStyleSheetClient.h in Headers */,
+				A104F24414C71F7A009E2C23 /* CachedSVGDocument.h in Headers */,
 				0753860314489E9800B78452 /* CachedTextTrack.h in Headers */,
 				BCB16C280979C3BD00467741 /* CachedXSLStyleSheet.h in Headers */,
 				93F1995008245E59001E9ABC /* CachePolicy.h in Headers */,
@@ -21256,7 +21439,6 @@
 				A818721C0977D3C0005826D9 /* ContainerNode.h in Headers */,
 				E1A1470811102B1500EEC0F3 /* ContainerNodeAlgorithms.h in Headers */,
 				BC5EB9810E82072500B25965 /* ContentData.h in Headers */,
-				57B791A414C6A62900F202D1 /* ContentInclusionSelector.h in Headers */,
 				59102FBC14327D3B003C9D04 /* ContentSearchUtils.h in Headers */,
 				97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */,
 				57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */,
@@ -21314,7 +21496,6 @@
 				A80E6D080A1989CA007FB8C5 /* CSSInitialValue.h in Headers */,
 				BC772E131331620C001EC9CE /* CSSLineBoxContainValue.h in Headers */,
 				A80E6D030A1989CA007FB8C5 /* CSSMediaRule.h in Headers */,
-				A80E6DFC0A199067007FB8C5 /* StylePropertySet.h in Headers */,
 				A80E734E0A199C77007FB8C5 /* CSSNamespace.h in Headers */,
 				F98FFF4511A2676200F548E8 /* CSSOMUtils.h in Headers */,
 				A80E6D000A1989CA007FB8C5 /* CSSPageRule.h in Headers */,
@@ -21352,7 +21533,9 @@
 				BC2272AD0E82E8F300E7F975 /* CursorList.h in Headers */,
 				62CD325A1157E57C0063B0A7 /* CustomEvent.h in Headers */,
 				50D405FA147D31F300D30BB5 /* CustomFilterMesh.h in Headers */,
+				50CC089A14C6E99C0017AB51 /* CustomFilterNumberParameter.h in Headers */,
 				50ACE2CB14B5D79300446666 /* CustomFilterOperation.h in Headers */,
+				509CC9FB14C069ED00BBECBD /* CustomFilterParameter.h in Headers */,
 				503D0CAB14B5B08700F32F57 /* CustomFilterProgram.h in Headers */,
 				503D0CAC14B5B08700F32F57 /* CustomFilterProgramClient.h in Headers */,
 				50D40612147D49DE00D30BB5 /* CustomFilterShader.h in Headers */,
@@ -21381,7 +21564,6 @@
 				4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */,
 				41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */,
 				FD06DFA6134A4DEF006F5D7D /* DefaultAudioDestinationNode.h in Headers */,
-				BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */,
 				4167EBF6102962BA003D252A /* DefaultSharedWorkerRepository.h in Headers */,
 				FD31602C12B0267600C1A359 /* DelayDSPKernel.h in Headers */,
 				FD31602E12B0267600C1A359 /* DelayNode.h in Headers */,
@@ -21674,6 +21856,7 @@
 				85989DCF0ACC8BBD00A0BC51 /* DOMOverflowEventInternal.h in Headers */,
 				E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */,
 				1ACE53E80A8D18E70022947D /* DOMParser.h in Headers */,
+				7A54881714E432A1006AE05A /* DOMPatchSupport.h in Headers */,
 				A9C6E4EC0D745E2B006442E9 /* DOMPlugin.h in Headers */,
 				A9C6E4F00D745E38006442E9 /* DOMPluginArray.h in Headers */,
 				BC1A37BB097C715F0019F3D8 /* DOMPrivate.h in Headers */,
@@ -22012,6 +22195,8 @@
 				316FE0820E6CCC2800BF6088 /* DOMWebKitCSSKeyframesRuleInternal.h in Headers */,
 				498391500F1E76B400C23782 /* DOMWebKitCSSMatrix.h in Headers */,
 				498391520F1E76B400C23782 /* DOMWebKitCSSMatrixInternal.h in Headers */,
+				8AD0A59614C88358000D83C5 /* DOMWebKitCSSRegionRule.h in Headers */,
+				8AD0A59814C88358000D83C5 /* DOMWebKitCSSRegionRuleInternal.h in Headers */,
 				31611E610E1C4E1400F6A579 /* DOMWebKitCSSTransformValue.h in Headers */,
 				31611E630E1C4E1400F6A579 /* DOMWebKitCSSTransformValueInternal.h in Headers */,
 				8A195932147EA16E00D1EA61 /* DOMWebKitNamedFlow.h in Headers */,
@@ -22056,6 +22241,7 @@
 				4BAE95B10B2FA9CE00AED8A0 /* EditorDeleteAction.h in Headers */,
 				93FDAFCA0B11307400E2746F /* EditorInsertAction.h in Headers */,
 				A8C4A80709D563270003AC8D /* Element.h in Headers */,
+				2CF6878A14D32EFF00340F39 /* ElementAttributeData.h in Headers */,
 				63F5D4F70E8C4B7100C0BD04 /* ElementRareData.h in Headers */,
 				E415F1840D9A1A830033CE97 /* ElementTimeControl.h in Headers */,
 				A8CFF6BE0A156118000A4234 /* EllipsisBox.h in Headers */,
@@ -22178,7 +22364,6 @@
 				B2C3DA660D006CD600EF6F26 /* FontDescription.h in Headers */,
 				B2C3DA680D006CD600EF6F26 /* FontFallbackList.h in Headers */,
 				B2C3DA6A0D006CD600EF6F26 /* FontFamily.h in Headers */,
-				A80E6CF30A1989CA007FB8C5 /* FontFamilyValue.h in Headers */,
 				4A6E9FC813C17D570046A7F8 /* FontFeatureSettings.h in Headers */,
 				4A6E9FC413C17D1D0046A7F8 /* FontFeatureValue.h in Headers */,
 				0845680812B90DA600960A9F /* FontMetrics.h in Headers */,
@@ -22201,6 +22386,9 @@
 				656D373A0ADBA5DE00A4554D /* FormState.h in Headers */,
 				41885B9311B6FDA6003383BB /* FormSubmission.h in Headers */,
 				935C476D09AC4D6300A6AAB4 /* FoundationExtras.h in Headers */,
+				144FCFE114EF2509000D17A3 /* FractionalLayoutRect.h in Headers */,
+				144FCE5D14EC79E7000D17A3 /* FractionalLayoutSize.h in Headers */,
+				144FCE5214EC79BC000D17A3 /* FractionalLayoutUnit.h in Headers */,
 				A853123D11D0471B00D4D077 /* FragmentScriptingPermission.h in Headers */,
 				65BF022F0974816300C43196 /* Frame.h in Headers */,
 				A7B070D3130A409C00A3763C /* FrameActionScheduler.h in Headers */,
@@ -22223,13 +22411,14 @@
 				BCE04C8A0DAFF7A0007A0F41 /* Generator.h in Headers */,
 				2D481F04146B5C6B00AA7834 /* GeneratorGeneratedImage.h in Headers */,
 				A622A8FF122C44A600A785B3 /* GenericBinding.h in Headers */,
-				FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */,
+				0720B0A114D3323500642955 /* GenericEventQueue.h in Headers */,
+				9746AF2414F4DDE6003E7A70 /* Geolocation.h in Headers */,
 				BC56CB2310D5AC8000A77C64 /* GeolocationClient.h in Headers */,
 				052BFCEB128ABF2100FD338D /* GeolocationClientMock.h in Headers */,
-				BC56CB2210D5AC8000A77C64 /* GeolocationController.h in Headers */,
-				BC56CB2410D5AC8000A77C64 /* GeolocationError.h in Headers */,
-				BC56CB2510D5AC8000A77C64 /* GeolocationPosition.h in Headers */,
-				FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */,
+				9746AF2714F4DDE6003E7A70 /* GeolocationController.h in Headers */,
+				9746AF2814F4DDE6003E7A70 /* GeolocationError.h in Headers */,
+				9746AF2914F4DDE6003E7A70 /* GeolocationPosition.h in Headers */,
+				9746AF2A14F4DDE6003E7A70 /* Geoposition.h in Headers */,
 				086BBD0F136039C2008B15D8 /* Glyph.h in Headers */,
 				B2C3DA6C0D006CD600EF6F26 /* GlyphBuffer.h in Headers */,
 				C5D4AA7A116BAFB60069CA93 /* GlyphMetricsMap.h in Headers */,
@@ -22279,6 +22468,7 @@
 				A8DF3FD0097FA0FC0052981B /* HTMLCollection.h in Headers */,
 				977B3865122883E900B81FF8 /* HTMLConstructionSite.h in Headers */,
 				57B791AA14C6A63300F202D1 /* HTMLContentElement.h in Headers */,
+				57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */,
 				E1A31663134BCAE8007C9A4F /* HTMLConverter.h in Headers */,
 				F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */,
 				D359D78A129CA2710006E5D2 /* HTMLDetailsElement.h in Headers */,
@@ -22412,6 +22602,7 @@
 				C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */,
 				C585A6F111D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h in Headers */,
 				C585A6F411D4FB3D004C3E4B /* IDBRequest.h in Headers */,
+				EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */,
 				B656626B120B115A006EA85C /* IDBTransaction.h in Headers */,
 				1A71D57C0F33819000F9CE4E /* IdentifierRep.h in Headers */,
 				5913A24213D49EBA00F5B05C /* IdentifiersFactory.h in Headers */,
@@ -22442,6 +22633,7 @@
 				BCEA485A097D93020094C9E4 /* InlineTextBox.h in Headers */,
 				37E3524D12450C6600BAF5D9 /* InputType.h in Headers */,
 				93309DEA099E64920056E581 /* InsertIntoTextNodeCommand.h in Headers */,
+				57CF497514EE36D700ECFF14 /* InsertionPoint.h in Headers */,
 				93309DEC099E64920056E581 /* InsertLineBreakCommand.h in Headers */,
 				D07DEABA0A36554A00CA30F8 /* InsertListCommand.h in Headers */,
 				93309DEE099E64920056E581 /* InsertNodeBeforeCommand.h in Headers */,
@@ -22455,6 +22647,7 @@
 				F3335BF912E07DC300D33011 /* InspectorConsoleAgent.h in Headers */,
 				F3F5CF1112ED81A80084C569 /* InspectorConsoleInstrumentation.h in Headers */,
 				1C81B95A0E97330800266E07 /* InspectorController.h in Headers */,
+				F325A40B14EE36FA007324E2 /* InspectorCounters.h in Headers */,
 				82AB1744124B99EC00C5069D /* InspectorCSSAgent.h in Headers */,
 				7AB0B1C11211A62200A76940 /* InspectorDatabaseAgent.h in Headers */,
 				F3F5CF1312ED81B30084C569 /* InspectorDatabaseInstrumentation.h in Headers */,
@@ -22470,6 +22663,7 @@
 				F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */,
 				F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */,
 				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
+				7A54858014E02D51006AE05A /* InspectorHistory.h in Headers */,
 				7ACD88D414C08BD60084EDD2 /* InspectorIndexedDBAgent.h in Headers */,
 				20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */,
 				7AA51DD6148506A900AD2752 /* InspectorMemoryAgent.h in Headers */,
@@ -23004,6 +23198,7 @@
 				316FE0720E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.h in Headers */,
 				316FE0740E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.h in Headers */,
 				498391400F1E767500C23782 /* JSWebKitCSSMatrix.h in Headers */,
+				8AD0A59514C88336000D83C5 /* JSWebKitCSSRegionRule.h in Headers */,
 				31611E5B0E1C4DE000F6A579 /* JSWebKitCSSTransformValue.h in Headers */,
 				C6F0902D14327D4F00685849 /* JSWebKitMutationObserver.h in Headers */,
 				494BD79E0F55C94C00747828 /* JSWebKitPoint.h in Headers */,
@@ -23060,18 +23255,17 @@
 				98CE432A129E00E5005821DC /* LinkLoader.h in Headers */,
 				984264F112D5280A000D88A4 /* LinkLoaderClient.h in Headers */,
 				985BB96E13A94058007A0B69 /* LinkRelAttribute.h in Headers */,
-				B1AD4E5F13A12A0B00846B27 /* LoadableTextTrack.h in Headers */,
+				9759E94914EF1D490026A2DD /* LoadableTextTrack.h in Headers */,
 				656D37320ADBA5DE00A4554D /* LoaderNSURLExtras.h in Headers */,
 				7EE6846912D26E3800E79415 /* LoaderRunLoopCF.h in Headers */,
 				06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */,
 				7633A72613D8B33A008501B6 /* LocaleToScriptMapping.h in Headers */,
 				89878568122CA064003AABDA /* LocalFileSystem.h in Headers */,
-				BC5CFCA911F793320099ED09 /* LocalizationStrategy.h in Headers */,
 				A5732B0D136A16C4005C8D7C /* LocalizedDate.h in Headers */,
 				F5142C69123F12B000F5BD4C /* LocalizedNumber.h in Headers */,
 				935207BE09BD410A00F2038D /* LocalizedStrings.h in Headers */,
-				511F23180DC160DA004F0032 /* LocalStorageTask.h in Headers */,
-				511F231A0DC160DA004F0032 /* LocalStorageThread.h in Headers */,
+				511F23180DC160DA004F0032 /* StorageTask.h in Headers */,
+				511F231A0DC160DA004F0032 /* StorageThread.h in Headers */,
 				BCE1C41B0D982980003B02F2 /* Location.h in Headers */,
 				A8239E0109B3CF8A00B60641 /* Logging.h in Headers */,
 				FD31603912B0267600C1A359 /* LowPass2FilterNode.h in Headers */,
@@ -23148,6 +23342,9 @@
 				979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */,
 				A9C6E5A60D746458006442E9 /* Navigator.h in Headers */,
 				E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */,
+				9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */,
+				97E4A12614F4C5D400870E43 /* NavigatorRegisterProtocolHandler.h in Headers */,
+				97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */,
 				8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */,
 				656D37430ADBA5DE00A4554D /* NetscapePlugInStreamLoader.h in Headers */,
 				628D214C12131ED10055DCFC /* NetworkingContext.h in Headers */,
@@ -23211,6 +23408,7 @@
 				F3820895147D35F90010BC06 /* PageRuntimeAgent.h in Headers */,
 				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
 				371E65CC13661EDC00BEEDB0 /* PageSerializer.h in Headers */,
+				A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */,
 				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
 				FFD5B97B135CC97800D5E92A /* PageVisibilityState.h in Headers */,
@@ -23222,6 +23420,7 @@
 				F55B3DCA1251F12D003EF269 /* PasswordInputType.h in Headers */,
 				4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */,
 				A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */,
+				C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */,
 				B27535800B053814002CE64F /* Path.h in Headers */,
 				A88DD4870B4629A300C02990 /* PathTraversalState.h in Headers */,
 				A8FA6E5D0E4CFDED00D5CF49 /* Pattern.h in Headers */,
@@ -23245,6 +23444,7 @@
 				932871C00B20DEB70049035A /* PlatformMenuDescription.h in Headers */,
 				41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */,
 				935C476909AC4D4300A6AAB4 /* PlatformMouseEvent.h in Headers */,
+				C598905814E9C29900E8D18B /* PlatformPasteboard.h in Headers */,
 				BCEC01D70C274EB4009F4EC9 /* PlatformScreen.h in Headers */,
 				1AD8F81B11CAB9E900E93E54 /* PlatformStrategies.h in Headers */,
 				B2C3DA2B0D006C1D00EF6F26 /* PlatformString.h in Headers */,
@@ -23269,20 +23469,22 @@
 				D39D006D11F8E308006041F2 /* PopupMenuMac.h in Headers */,
 				BC3BE12B0E98092F00835588 /* PopupMenuStyle.h in Headers */,
 				93F199DE08245E59001E9ABC /* Position.h in Headers */,
-				FE80D7CB0E9C1F25000D6F75 /* PositionCallback.h in Headers */,
-				FE80D7CD0E9C1F25000D6F75 /* PositionError.h in Headers */,
-				FE80D7CF0E9C1F25000D6F75 /* PositionErrorCallback.h in Headers */,
+				9746AF2C14F4DDE6003E7A70 /* PositionCallback.h in Headers */,
+				9746AF2E14F4DDE6003E7A70 /* PositionError.h in Headers */,
+				9746AF3014F4DDE6003E7A70 /* PositionErrorCallback.h in Headers */,
 				37919C240B7D188600A56998 /* PositionIterator.h in Headers */,
-				FE80D7D10E9C1F25000D6F75 /* PositionOptions.h in Headers */,
+				9746AF3214F4DDE6003E7A70 /* PositionOptions.h in Headers */,
 				C0F2A44113869AAB0066C534 /* preprocessor.pm in Headers */,
 				B71FE6DF11091CB300DAEF77 /* PrintContext.h in Headers */,
 				A8EA7EBC0A1945D000A8EF5F /* ProcessingInstruction.h in Headers */,
 				E44613EC0CD681B500FADA75 /* ProgressEvent.h in Headers */,
 				A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */,
 				1A2A68240B5BEDE70002A480 /* ProgressTracker.h in Headers */,
+				E4BBED0F14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h in Headers */,
 				514C76750CE923A1007EF3CD /* ProtectionSpace.h in Headers */,
 				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
 				1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */,
+				10FB084B14E15C7E00A3DB98 /* PublicURLManager.h in Headers */,
 				E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */,
 				7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */,
 				550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */,
@@ -23458,6 +23660,7 @@
 				A8CFF5E10A155A05000A4234 /* RootInlineBox.h in Headers */,
 				49E911C90EF86D47009D0CAF /* RotateTransformOperation.h in Headers */,
 				A73F95FF12C97BFE0031AAF9 /* RoundedRect.h in Headers */,
+				BC0B358814C4F9830055E22A /* RunLoop.h in Headers */,
 				1C63A2480F71646600C09D5A /* RunLoopTimer.h in Headers */,
 				1A569D1F0D7E2B82007C3983 /* runtime_array.h in Headers */,
 				1A569D210D7E2B82007C3983 /* runtime_method.h in Headers */,
@@ -23510,6 +23713,12 @@
 				0FE71406142170B800DB33BA /* ScrollbarThemeMock.h in Headers */,
 				5D925B680F64D4DD00B847F0 /* ScrollBehavior.h in Headers */,
 				1AA84F05143BA7BD0051D153 /* ScrollElasticityController.h in Headers */,
+				1AF62EE814DA22A70041556C /* ScrollingCoordinator.h in Headers */,
+				1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */,
+				1AAADDA414DB409F00AF64B3 /* ScrollingTree.h in Headers */,
+				1AAADDE414DC8C8F00AF64B3 /* ScrollingTreeNode.h in Headers */,
+				1AAADDE914DC8DF800AF64B3 /* ScrollingTreeNodeMac.h in Headers */,
+				1AAADDBF14DC640700AF64B3 /* ScrollingTreeState.h in Headers */,
 				93C09C860B0657AA005ABD4D /* ScrollTypes.h in Headers */,
 				BC6D6E2609AF943500F59759 /* ScrollView.h in Headers */,
 				F55B3DD21251F12D003EF269 /* SearchInputType.h in Headers */,
@@ -23532,6 +23741,7 @@
 				0F3DD45012F5EA1B000D9190 /* ShadowBlur.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
 				A6D169641346B4C1000EB770 /* ShadowRoot.h in Headers */,
+				572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */,
 				A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */,
 				B2AFFC940D00A5DF0030074D /* ShapeArabic.h in Headers */,
 				1A4A954E0B4EDCCB002D8C3C /* SharedBuffer.h in Headers */,
@@ -23635,6 +23845,7 @@
 				BC5EB72A0E81DE8100B25965 /* StyleMarqueeData.h in Headers */,
 				0FF50272102BA96A0066F39A /* StyleMedia.h in Headers */,
 				BC5EB74E0E81E06700B25965 /* StyleMultiColData.h in Headers */,
+				A80E6DFC0A199067007FB8C5 /* StylePropertySet.h in Headers */,
 				BC2272E40E82EE9B00E7F975 /* StyleRareInheritedData.h in Headers */,
 				BC2272BD0E82EAAE00E7F975 /* StyleRareNonInheritedData.h in Headers */,
 				BC2272870E82E70700E7F975 /* StyleReflection.h in Headers */,
@@ -23926,9 +24137,9 @@
 				93F198F608245E59001E9ABC /* TextResourceDecoder.h in Headers */,
 				A824B4650E2EF2EA0081A7B7 /* TextRun.h in Headers */,
 				B2C3DA4B0D006C1D00EF6F26 /* TextStream.h in Headers */,
-				B1AD4E6713A12A0B00846B27 /* TextTrack.h in Headers */,
-				B1AD4E6913A12A0B00846B27 /* TextTrackCue.h in Headers */,
-				B1AD4E6B13A12A0B00846B27 /* TextTrackCueList.h in Headers */,
+				9759E94014EF1CF80026A2DD /* TextTrack.h in Headers */,
+				9759E94314EF1CF80026A2DD /* TextTrackCue.h in Headers */,
+				9759E94614EF1CF80026A2DD /* TextTrackCueList.h in Headers */,
 				076970871463AD8700F502CF /* TextTrackList.h in Headers */,
 				B1AD4E7413A12A4600846B27 /* TextTrackLoader.h in Headers */,
 				498770F11242C535002226BA /* Texture.h in Headers */,
@@ -23974,7 +24185,6 @@
 				E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */,
 				D086FE9809D53AAB005BC74D /* UnlinkCommand.h in Headers */,
 				F55B3DDE1251F12D003EF269 /* URLInputType.h in Headers */,
-				971491DA12FD65E8001BFEB1 /* URLString.h in Headers */,
 				656581B209D14EE6000E61D7 /* UserAgentStyleSheets.h in Headers */,
 				003F1FEA11E6AB43008258D9 /* UserContentTypes.h in Headers */,
 				BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */,
@@ -24055,6 +24265,10 @@
 				518A34C21026C831001B6896 /* WebSocket.h in Headers */,
 				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
 				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
+				4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */,
+				4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */,
+				4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */,
+				4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */,
 				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
 				7637C543112E7B7E003D6CDC /* WebSocketHandshakeRequest.h in Headers */,
 				767F99C011A119560080C51D /* WebSocketHandshakeResponse.h in Headers */,
@@ -24139,22 +24353,6 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
-				509CC9FB14C069ED00BBECBD /* CustomFilterParameter.h in Headers */,
-				50CC089A14C6E99C0017AB51 /* CustomFilterNumberParameter.h in Headers */,
-				BC0B358814C4F9830055E22A /* RunLoop.h in Headers */,
-				8AD0A59514C88336000D83C5 /* JSWebKitCSSRegionRule.h in Headers */,
-				8AD0A59614C88358000D83C5 /* DOMWebKitCSSRegionRule.h in Headers */,
-				8AD0A59814C88358000D83C5 /* DOMWebKitCSSRegionRuleInternal.h in Headers */,
-				0720B0A114D3323500642955 /* GenericEventQueue.h in Headers */,
-				2CF6878A14D32EFF00340F39 /* ElementAttributeData.h in Headers */,
-				1AF62EE814DA22A70041556C /* ScrollingCoordinator.h in Headers */,
-				1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */,
-				1AAADDA414DB409F00AF64B3 /* ScrollingTree.h in Headers */,
-				1AAADDBF14DC640700AF64B3 /* ScrollingTreeState.h in Headers */,
-				1AAADDE414DC8C8F00AF64B3 /* ScrollingTreeNode.h in Headers */,
-				1AAADDE914DC8DF800AF64B3 /* ScrollingTreeNodeMac.h in Headers */,
-				10FB084B14E15C7E00A3DB98 /* PublicURLManager.h in Headers */,
-				7A54858014E02D51006AE05A /* InspectorHistory.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -24622,6 +24820,7 @@
 				BCB16C290979C3BD00467741 /* CachedResourceLoader.cpp in Sources */,
 				BCB16C230979C3BD00467741 /* CachedScript.cpp in Sources */,
 				5038BE401472AD980095E0D1 /* CachedShader.cpp in Sources */,
+				A104F24314C71F7A009E2C23 /* CachedSVGDocument.cpp in Sources */,
 				0753860214489E9800B78452 /* CachedTextTrack.cpp in Sources */,
 				BCB16C270979C3BD00467741 /* CachedXSLStyleSheet.cpp in Sources */,
 				49AE2D96134EE5F90072920A /* CalculationValue.cpp in Sources */,
@@ -24670,7 +24869,6 @@
 				41F0618F0F5F069800A07EAC /* ConsoleMessage.cpp in Sources */,
 				A818721F0977D3C0005826D9 /* ContainerNode.cpp in Sources */,
 				BC5EB9800E82072500B25965 /* ContentData.cpp in Sources */,
-				57B791A314C6A62900F202D1 /* ContentInclusionSelector.cpp in Sources */,
 				59102FBB14327D3B003C9D04 /* ContentSearchUtils.cpp in Sources */,
 				97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */,
 				57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */,
@@ -24722,7 +24920,6 @@
 				A80E6D020A1989CA007FB8C5 /* CSSInitialValue.cpp in Sources */,
 				BC772E16133162C2001EC9CE /* CSSLineBoxContainValue.cpp in Sources */,
 				A80E6CFC0A1989CA007FB8C5 /* CSSMediaRule.cpp in Sources */,
-				A80E6DFB0A199067007FB8C5 /* StylePropertySet.cpp in Sources */,
 				F98FFF4411A2676200F548E8 /* CSSOMUtils.cpp in Sources */,
 				A80E6CF50A1989CA007FB8C5 /* CSSPageRule.cpp in Sources */,
 				BC772B3D0C4EA91E0083285F /* CSSParser.cpp in Sources */,
@@ -24776,7 +24973,6 @@
 				4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */,
 				41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */,
 				FD06DFA5134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp in Sources */,
-				BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */,
 				4167EBF5102962BA003D252A /* DefaultSharedWorkerRepository.cpp in Sources */,
 				FD31602B12B0267600C1A359 /* DelayDSPKernel.cpp in Sources */,
 				FD31602D12B0267600C1A359 /* DelayNode.cpp in Sources */,
@@ -24947,6 +25143,7 @@
 				85C7F5D10AAFB8D9004014DD /* DOMOverflowEvent.mm in Sources */,
 				E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */,
 				1ACE53E70A8D18E70022947D /* DOMParser.cpp in Sources */,
+				7A54881814E432A1006AE05A /* DOMPatchSupport.cpp in Sources */,
 				A9C6E4EB0D745E2B006442E9 /* DOMPlugin.cpp in Sources */,
 				A9C6E4EF0D745E38006442E9 /* DOMPluginArray.cpp in Sources */,
 				85F56A7B0A98CE3700ADB60A /* DOMProcessingInstruction.mm in Sources */,
@@ -25147,6 +25344,7 @@
 				93A38B4B0D0E5808006872C2 /* EditorCommand.cpp in Sources */,
 				ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */,
 				A8C4A80809D563270003AC8D /* Element.cpp in Sources */,
+				2CF6878814D32EB500340F39 /* ElementAttributeData.cpp in Sources */,
 				A8CFF6CB0A1561CD000A4234 /* EllipsisBox.cpp in Sources */,
 				F55B3DBB1251F12D003EF269 /* EmailInputType.cpp in Sources */,
 				A8EA7EC10A1945D000A8EF5F /* EntityReference.cpp in Sources */,
@@ -25250,7 +25448,6 @@
 				37ACCF690DA414E70089E602 /* FontDescription.cpp in Sources */,
 				B2C3DA670D006CD600EF6F26 /* FontFallbackList.cpp in Sources */,
 				B2C3DA690D006CD600EF6F26 /* FontFamily.cpp in Sources */,
-				A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */,
 				72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */,
 				4A6E9FC713C17D570046A7F8 /* FontFeatureSettings.cpp in Sources */,
 				4A6E9FC313C17D1D0046A7F8 /* FontFeatureValue.cpp in Sources */,
@@ -25268,6 +25465,8 @@
 				514C764F0CE9234E007EF3CD /* FormDataStreamMac.mm in Sources */,
 				656D373B0ADBA5DE00A4554D /* FormState.cpp in Sources */,
 				41885B9411B6FDA6003383BB /* FormSubmission.cpp in Sources */,
+				144FCFE014EF2509000D17A3 /* FractionalLayoutRect.cpp in Sources */,
+				144FCE5C14EC79E7000D17A3 /* FractionalLayoutSize.cpp in Sources */,
 				65BF022E0974816300C43196 /* Frame.cpp in Sources */,
 				A7B070D2130A409C00A3763C /* FrameActionScheduler.cpp in Sources */,
 				974A862214B7ADBB003FDC76 /* FrameDestructionObserver.cpp in Sources */,
@@ -25282,9 +25481,10 @@
 				51C81B890C4422F70019ECE3 /* FTPDirectoryParser.cpp in Sources */,
 				1432E8490C51493F00B1500F /* GCController.cpp in Sources */,
 				2D481F03146B5C6500AA7834 /* GeneratorGeneratedImage.cpp in Sources */,
-				FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */,
+				0720B0A014D3323500642955 /* GenericEventQueue.cpp in Sources */,
+				9746AF2314F4DDE6003E7A70 /* Geolocation.cpp in Sources */,
 				052BFCE9128ABF1500FD338D /* GeolocationClientMock.cpp in Sources */,
-				BC56CB2110D5AC8000A77C64 /* GeolocationController.cpp in Sources */,
+				9746AF2614F4DDE6003E7A70 /* GeolocationController.cpp in Sources */,
 				B2C3DA6D0D006CD600EF6F26 /* GlyphPageTreeNode.cpp in Sources */,
 				B2AFFC830D00A5C10030074D /* GlyphPageTreeNodeMac.cpp in Sources */,
 				BC53C6080DA56C570021EB5D /* Gradient.cpp in Sources */,
@@ -25330,6 +25530,7 @@
 				A8DF3FD1097FA0FC0052981B /* HTMLCollection.cpp in Sources */,
 				977B3864122883E900B81FF8 /* HTMLConstructionSite.cpp in Sources */,
 				57B791A914C6A63300F202D1 /* HTMLContentElement.cpp in Sources */,
+				57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */,
 				5D4F51DF132725480016F541 /* HTMLConverter.mm in Sources */,
 				F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */,
 				D359D789129CA2710006E5D2 /* HTMLDetailsElement.cpp in Sources */,
@@ -25480,6 +25681,7 @@
 				BCEA4859097D93020094C9E4 /* InlineTextBox.cpp in Sources */,
 				37E3524B12450C5200BAF5D9 /* InputType.cpp in Sources */,
 				93309DE9099E64920056E581 /* InsertIntoTextNodeCommand.cpp in Sources */,
+				57CF497414EE36D700ECFF14 /* InsertionPoint.cpp in Sources */,
 				93309DEB099E64920056E581 /* InsertLineBreakCommand.cpp in Sources */,
 				D07DEAB90A36554A00CA30F8 /* InsertListCommand.cpp in Sources */,
 				93309DED099E64920056E581 /* InsertNodeBeforeCommand.cpp in Sources */,
@@ -25492,6 +25694,7 @@
 				7A1F2B52126C61B20006A7E6 /* InspectorClient.cpp in Sources */,
 				F3335BF812E07DC300D33011 /* InspectorConsoleAgent.cpp in Sources */,
 				1C81B95B0E97330800266E07 /* InspectorController.cpp in Sources */,
+				F325A40A14EE36FA007324E2 /* InspectorCounters.cpp in Sources */,
 				82AB1743124B99EC00C5069D /* InspectorCSSAgent.cpp in Sources */,
 				7AB0B1C01211A62200A76940 /* InspectorDatabaseAgent.cpp in Sources */,
 				41F062150F5F192600A07EAC /* InspectorDatabaseResource.cpp in Sources */,
@@ -25504,6 +25707,7 @@
 				4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */,
 				F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */,
 				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
+				7A54857F14E02D51006AE05A /* InspectorHistory.cpp in Sources */,
 				7ACD88D314C08BD60084EDD2 /* InspectorIndexedDBAgent.cpp in Sources */,
 				20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */,
 				7AA51DD5148506A900AD2752 /* InspectorMemoryAgent.cpp in Sources */,
@@ -25515,6 +25719,7 @@
 				82AB1773125C826700C5069D /* InspectorStyleSheet.cpp in Sources */,
 				82889B4C13C62392009A6156 /* InspectorStyleTextEditor.cpp in Sources */,
 				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
+				573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */,
 				4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */,
 				F3810C1B1365A49600ED6E33 /* InspectorWorkerAgent.cpp in Sources */,
 				F350B73513F1377D00880C43 /* InstrumentingAgents.cpp in Sources */,
@@ -26214,7 +26419,7 @@
 				A7AD2F870EC89D07008AB002 /* LinkHash.cpp in Sources */,
 				98CE4326129E00BD005821DC /* LinkLoader.cpp in Sources */,
 				985BB96D13A94058007A0B69 /* LinkRelAttribute.cpp in Sources */,
-				B1AD4E5E13A12A0B00846B27 /* LoadableTextTrack.cpp in Sources */,
+				9759E93E14EF1CF80026A2DD /* LoadableTextTrack.cpp in Sources */,
 				656D37330ADBA5DE00A4554D /* LoaderNSURLExtras.mm in Sources */,
 				7EE6846812D26E3800E79415 /* LoaderRunLoopCF.cpp in Sources */,
 				06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */,
@@ -26224,8 +26429,8 @@
 				F5CC42DC12F801CA00D5F7E3 /* LocalizedNumberMac.mm in Sources */,
 				C046E1AC1208A9FE00BA2CF7 /* LocalizedStrings.cpp in Sources */,
 				BC25B52A131C6D3900180E10 /* LocalizedStringsMac.mm in Sources */,
-				511F23170DC160DA004F0032 /* LocalStorageTask.cpp in Sources */,
-				511F23190DC160DA004F0032 /* LocalStorageThread.cpp in Sources */,
+				511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */,
+				511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */,
 				BCE1C41C0D982981003B02F2 /* Location.cpp in Sources */,
 				A8239E0009B3CF8A00B60641 /* Logging.cpp in Sources */,
 				1402645E0AFDC19B005919E2 /* LoggingMac.mm in Sources */,
@@ -26295,6 +26500,9 @@
 				979F43D31075E44A0000F83B /* NavigationScheduler.cpp in Sources */,
 				A9C6E5A50D746458006442E9 /* Navigator.cpp in Sources */,
 				E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */,
+				9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */,
+				97E4A12714F4C5D700870E43 /* NavigatorRegisterProtocolHandler.cpp in Sources */,
+				97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */,
 				5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */,
 				59C27F05138D28C10079B7E2 /* NetworkResourcesData.cpp in Sources */,
 				1A7FA61B0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp in Sources */,
@@ -26342,6 +26550,7 @@
 				F3820894147D35F90010BC06 /* PageRuntimeAgent.cpp in Sources */,
 				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
 				371E65CE13661EED00BEEDB0 /* PageSerializer.cpp in Sources */,
+				A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */,
 				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
 				51E1ECC20C91C90400DC255B /* PageURLRecord.cpp in Sources */,
 				FFD5B97A135CC97800D5E92A /* PageVisibilityState.cpp in Sources */,
@@ -26364,9 +26573,11 @@
 				4958782112A57DDF007238AC /* PlatformCAAnimationMac.mm in Sources */,
 				4958782212A57DDF007238AC /* PlatformCALayerMac.mm in Sources */,
 				CDEA763014608A53008B31F1 /* PlatformClockCA.cpp in Sources */,
+				CDAA8D0A14D71B2E0061EA60 /* PlatformClockCM.mm in Sources */,
 				BC5C762A1497FE1400BC4775 /* PlatformEvent.cpp in Sources */,
 				BCAA486F14A052530088FAC4 /* PlatformEventFactoryMac.mm in Sources */,
 				41BF700F0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp in Sources */,
+				C598902E14E9B0F800E8D18B /* PlatformPasteboardMac.mm in Sources */,
 				BC94D1080C274F88006BC617 /* PlatformScreenMac.mm in Sources */,
 				1AD8F81C11CAB9E900E93E54 /* PlatformStrategies.cpp in Sources */,
 				A9C6E4F30D745E48006442E9 /* PluginData.cpp in Sources */,
@@ -26386,6 +26597,7 @@
 				E44613EB0CD681B400FADA75 /* ProgressEvent.cpp in Sources */,
 				A715E652134BBBEC00D8E713 /* ProgressShadowElement.cpp in Sources */,
 				1A2A68230B5BEDE70002A480 /* ProgressTracker.cpp in Sources */,
+				E4BBED0E14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp in Sources */,
 				514C76740CE923A1007EF3CD /* ProtectionSpace.cpp in Sources */,
 				1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */,
 				1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */,
@@ -26525,8 +26737,8 @@
 				A8CFF5E70A155A05000A4234 /* RootInlineBox.cpp in Sources */,
 				49E911C80EF86D47009D0CAF /* RotateTransformOperation.cpp in Sources */,
 				A73F95FE12C97BFE0031AAF9 /* RoundedRect.cpp in Sources */,
-				BC0B358314C4F9540055E22A /* RunLoopMac.mm in Sources */,
 				BC0B358714C4F9830055E22A /* RunLoop.cpp in Sources */,
+				BC0B358314C4F9540055E22A /* RunLoopMac.mm in Sources */,
 				1C63A2490F71646600C09D5A /* RunLoopTimerCF.cpp in Sources */,
 				1A569D1E0D7E2B82007C3983 /* runtime_array.cpp in Sources */,
 				1A569D200D7E2B82007C3983 /* runtime_method.cpp in Sources */,
@@ -26573,6 +26785,16 @@
 				0FE71405142170B800DB33BA /* ScrollbarThemeMock.cpp in Sources */,
 				5D925B670F64D4DD00B847F0 /* ScrollBehavior.cpp in Sources */,
 				1AA84F04143BA7BD0051D153 /* ScrollElasticityController.mm in Sources */,
+				1AF62EE714DA22A70041556C /* ScrollingCoordinator.cpp in Sources */,
+				1AF62EE614DA22A70041556C /* ScrollingCoordinatorMac.mm in Sources */,
+				3866AF3814F1C17100283D68 /* ScrollingCoordinatorNone.cpp in Sources */,
+				1AF62F2514DAFE9E0041556C /* ScrollingThread.cpp in Sources */,
+				1AF62F2414DAFE910041556C /* ScrollingThreadMac.mm in Sources */,
+				1AAADDA314DB409F00AF64B3 /* ScrollingTree.cpp in Sources */,
+				1AAADDE314DC8C8F00AF64B3 /* ScrollingTreeNode.cpp in Sources */,
+				1AAADDE814DC8DF800AF64B3 /* ScrollingTreeNodeMac.mm in Sources */,
+				1AAADDBE14DC640700AF64B3 /* ScrollingTreeState.cpp in Sources */,
+				1AAADDDA14DC74EC00AF64B3 /* ScrollingTreeStateMac.mm in Sources */,
 				BC2441C40E8B65D00055320F /* ScrollView.cpp in Sources */,
 				9353676B09AED88B00D35CD6 /* ScrollViewMac.mm in Sources */,
 				F55B3DD11251F12D003EF269 /* SearchInputType.cpp in Sources */,
@@ -26593,6 +26815,7 @@
 				0F3DD44F12F5EA1B000D9190 /* ShadowBlur.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
 				A6D169621346B49B000EB770 /* ShadowRoot.cpp in Sources */,
+				572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */,
 				A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */,
 				B2AFFC930D00A5DF0030074D /* ShapeArabic.c in Sources */,
 				1A4A954D0B4EDCCB002D8C3C /* SharedBuffer.cpp in Sources */,
@@ -26686,6 +26909,7 @@
 				BC5EB7290E81DE8100B25965 /* StyleMarqueeData.cpp in Sources */,
 				0FF50271102BA96A0066F39A /* StyleMedia.cpp in Sources */,
 				BC5EB74D0E81E06700B25965 /* StyleMultiColData.cpp in Sources */,
+				A80E6DFB0A199067007FB8C5 /* StylePropertySet.cpp in Sources */,
 				BC2272E30E82EE9B00E7F975 /* StyleRareInheritedData.cpp in Sources */,
 				BC2272BC0E82EAAE00E7F975 /* StyleRareNonInheritedData.cpp in Sources */,
 				A8EA800D0A19516E00A8EF5F /* StyleSheet.cpp in Sources */,
@@ -26896,9 +27120,9 @@
 				93F19A9D08245E59001E9ABC /* TextResourceDecoder.cpp in Sources */,
 				376DCCE113B4F966002EBEFC /* TextRun.cpp in Sources */,
 				B2C3DA4A0D006C1D00EF6F26 /* TextStream.cpp in Sources */,
-				B1AD4E6613A12A0B00846B27 /* TextTrack.cpp in Sources */,
-				B1AD4E6813A12A0B00846B27 /* TextTrackCue.cpp in Sources */,
-				B1AD4E6A13A12A0B00846B27 /* TextTrackCueList.cpp in Sources */,
+				9759E93F14EF1CF80026A2DD /* TextTrack.cpp in Sources */,
+				9759E94214EF1CF80026A2DD /* TextTrackCue.cpp in Sources */,
+				9759E94514EF1CF80026A2DD /* TextTrackCueList.cpp in Sources */,
 				076970861463AD8700F502CF /* TextTrackList.cpp in Sources */,
 				B1AD4E7313A12A4600846B27 /* TextTrackLoader.cpp in Sources */,
 				498770F01242C535002226BA /* Texture.cpp in Sources */,
@@ -27001,6 +27225,8 @@
 				1CAF34820A6C405200ABE06E /* WebScriptObject.mm in Sources */,
 				518A34C11026C831001B6896 /* WebSocket.cpp in Sources */,
 				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
+				4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */,
+				4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */,
 				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
 				7637C541112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp in Sources */,
 				767F99BE11A1194A0080C51D /* WebSocketHandshakeResponse.cpp in Sources */,
@@ -27078,20 +27304,6 @@
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSAuditor.cpp in Sources */,
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
-				573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */,
-				0720B0A014D3323500642955 /* GenericEventQueue.cpp in Sources */,
-				2CF6878814D32EB500340F39 /* ElementAttributeData.cpp in Sources */,
-				1AF62EE614DA22A70041556C /* ScrollingCoordinatorMac.mm in Sources */,
-				1AF62EE714DA22A70041556C /* ScrollingCoordinator.cpp in Sources */,
-				1AF62F2414DAFE910041556C /* ScrollingThreadMac.mm in Sources */,
-				1AF62F2514DAFE9E0041556C /* ScrollingThread.cpp in Sources */,
-				1AAADDA314DB409F00AF64B3 /* ScrollingTree.cpp in Sources */,
-				1AAADDBE14DC640700AF64B3 /* ScrollingTreeState.cpp in Sources */,
-				1AAADDDA14DC74EC00AF64B3 /* ScrollingTreeStateMac.mm in Sources */,
-				1AAADDE314DC8C8F00AF64B3 /* ScrollingTreeNode.cpp in Sources */,
-				1AAADDE814DC8DF800AF64B3 /* ScrollingTreeNodeMac.mm in Sources */,
-				7A54857F14E02D51006AE05A /* InspectorHistory.cpp in Sources */,
-				CDAA8D0A14D71B2E0061EA60 /* PlatformClockCM.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/WebCorePrefix.h b/Source/WebCore/WebCorePrefix.h
index 518b7b910..142c6abfc 100644
--- a/Source/WebCore/WebCorePrefix.h
+++ b/Source/WebCore/WebCorePrefix.h
@@ -89,6 +89,34 @@
 
 #ifdef __cplusplus
 
+
+#include <ciso646>
+
+#if defined(_LIBCPP_VERSION)
+
+// Add work around for a bug in libc++ that caused standard heap
+// APIs to not compile <rdar://problem/10858112>.
+
+#include <type_traits>
+
+_LIBCPP_BEGIN_NAMESPACE_STD
+
+template <class _Tp>
+inline _LIBCPP_INLINE_VISIBILITY
+typename enable_if
+<
+    !is_convertible<_Tp, __rv<_Tp> >::value,
+    const _Tp&
+>::type
+move(const _Tp& __t)
+{
+    return __t;
+}
+
+_LIBCPP_END_NAMESPACE_STD
+
+#endif // defined(_LIBCPP_VERSION)
+
 #include <algorithm>
 #include <cstddef>
 #include <new>
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index bbbbff2dd..c0af86102 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -163,7 +163,10 @@ bool AccessibilityObject::isAccessibilityObjectSearchMatch(AccessibilityObject*
         
     case HeadingSearchKey:
         return axObject->isHeading();
-        
+    
+    case HighlightedSearchKey:
+        return axObject->hasHighlighting();
+            
     case ItalicFontSearchKey:
         return axObject->hasItalicFont();
         
@@ -1414,6 +1417,16 @@ AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value
     return role;
 }
 
+bool AccessibilityObject::hasHighlighting() const
+{
+    for (Node* node = this->node(); node; node = node->parentNode()) {
+        if (node->hasTagName(markTag))
+            return true;
+    }
+    
+    return false;
+}
+
 const AtomicString& AccessibilityObject::placeholderValue() const
 {
     const AtomicString& placeholder = getAttribute(placeholderAttr);
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 249fa2940..e9a6aff57 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -244,6 +244,7 @@ enum AccessibilitySearchKey {
     HeadingLevel6SearchKey,
     HeadingSameLevelSearchKey,
     HeadingSearchKey,
+    HighlightedSearchKey,
     ItalicFontSearchKey,
     LandmarkSearchKey,
     LinkSearchKey,
@@ -409,6 +410,7 @@ public:
     virtual bool hasSameStyle(RenderObject*) const { return false; }
     bool hasStaticText() const { return roleValue() == StaticTextRole; }
     virtual bool hasUnderline() const { return false; }
+    bool hasHighlighting() const;
 
     virtual bool canSetFocusAttribute() const { return false; }
     virtual bool canSetTextRangeAttributes() const { return false; }
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 44ced9db9..8799346c9 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -707,7 +707,7 @@ bool AccessibilityRenderObject::isReadOnly() const
 bool AccessibilityRenderObject::isOffScreen() const
 {
     ASSERT(m_renderer);
-    LayoutRect contentRect = m_renderer->absoluteClippedOverflowRect();
+    IntRect contentRect = pixelSnappedIntRect(m_renderer->absoluteClippedOverflowRect());
     FrameView* view = m_renderer->frame()->view();
     IntRect viewRect = view->visibleContentRect();
     viewRect.intersect(contentRect);
@@ -1212,7 +1212,7 @@ String AccessibilityRenderObject::stringValue() const
 static String accessibleNameForNode(Node* node)
 {
     if (node->isTextNode())
-        return static_cast<Text*>(node)->data();
+        return toText(node)->data();
 
     if (node->hasTagName(inputTag))
         return static_cast<HTMLInputElement*>(node)->value();
@@ -1428,14 +1428,14 @@ String AccessibilityRenderObject::accessibilityDescription() const
                 const AtomicString& title = static_cast<HTMLFrameElementBase*>(owner)->getAttribute(titleAttr);
                 if (!title.isEmpty())
                     return title;
-                return static_cast<HTMLFrameElementBase*>(owner)->getAttribute(nameAttr);
+                return static_cast<HTMLFrameElementBase*>(owner)->getNameAttribute();
             }
             if (owner->isHTMLElement())
-                return toHTMLElement(owner)->getAttribute(nameAttr);
+                return toHTMLElement(owner)->getNameAttribute();
         }
         owner = document->body();
         if (owner && owner->isHTMLElement())
-            return toHTMLElement(owner)->getAttribute(nameAttr);
+            return toHTMLElement(owner)->getNameAttribute();
     }
 
     return String();
@@ -2630,9 +2630,9 @@ IntRect AccessibilityRenderObject::boundsForVisiblePositionRange(const VisiblePo
     }
     
 #if PLATFORM(MAC)
-    return m_renderer->document()->view()->contentsToScreen(ourrect);
+    return m_renderer->document()->view()->contentsToScreen(pixelSnappedIntRect(ourrect));
 #else
-    return ourrect;
+    return pixelSnappedIntRect(ourrect);
 #endif
 }
     
@@ -2675,7 +2675,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const LayoutP
     while (1) {
         LayoutPoint ourpoint;
 #if PLATFORM(MAC)
-        ourpoint = frameView->screenToContents(point);
+        ourpoint = frameView->screenToContents(roundedIntPoint(point));
 #else
         ourpoint = point;
 #endif
@@ -2854,7 +2854,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityHitTest(const IntPo
     Node* node = hitTestResult.innerNode()->shadowAncestorNode();
 
     if (node->hasTagName(areaTag)) 
-        return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
+        return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), roundedIntPoint(point));
     
     if (node->hasTagName(optionTag))
         node = static_cast<HTMLOptionElement*>(node)->ownerSelectElement();
@@ -3348,6 +3348,9 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
 {
     Node* node = this->node();
 
+    if (isWebArea())
+        return true;
+    
     // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
     // do anything.  For example, setFocusedNode() will do nothing if the current focused
     // node will not relinquish the focus.
diff --git a/Source/WebCore/accessibility/AccessibilityTable.cpp b/Source/WebCore/accessibility/AccessibilityTable.cpp
index 8e1ef7a13..56ef47bcd 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.cpp
+++ b/Source/WebCore/accessibility/AccessibilityTable.cpp
@@ -170,7 +170,7 @@ bool AccessibilityTable::isDataTable() const
             if (!row && isTHCell)
                 headersInFirstRowCount++;
 
-            // If the first column is comprised of all <tg> tags, assume it is a data table.
+            // If the first column is comprised of all <th> tags, assume it is a data table.
             if (!col && isTHCell)
                 headersInFirstColumnCount++;
             
diff --git a/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp b/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
index 525d28ea5..7f6b89412 100644
--- a/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
@@ -396,14 +396,8 @@ static gint webkitAccessibleGetIndexInParent(AtkObject* object)
     if (parent && parent->isTableRow() && coreObject->isTableCell())
         return getIndexInParentForCellInRow(coreObject);
 
-    AccessibilityObject::AccessibilityChildrenVector children = parent->children();
-    unsigned count = children.size();
-    for (unsigned i = 0; i < count; ++i) {
-        if (children[i] == coreObject)
-            return i;
-    }
-
-    return -1;
+    size_t index = parent->children().find(coreObject);
+    return (index == WTF::notFound) ? -1 : index;
 }
 
 static AtkAttributeSet* webkitAccessibleGetAttributes(AtkObject* object)
diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
index ea91c7745..6bc4c63eb 100644
--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
@@ -259,6 +259,10 @@ using namespace std;
 #define NSAccessibilityHeadingSearchKey @"AXHeadingSearchKey"
 #endif
 
+#ifndef NSAccessibilityHighlightedSearchKey
+#define NSAccessibilityHighlightedSearchKey @"AXHighlightedSearchKey"
+#endif
+
 #ifndef NSAccessibilityItalicFontSearchKey
 #define NSAccessibilityItalicFontSearchKey @"AXItalicFontSearchKey"
 #endif
@@ -467,6 +471,7 @@ static AccessibilitySearchKeyMap* createAccessibilitySearchKeyMap()
         { NSAccessibilityHeadingLevel6SearchKey, HeadingLevel6SearchKey },
         { NSAccessibilityHeadingSameLevelSearchKey, HeadingSameLevelSearchKey },
         { NSAccessibilityHeadingSearchKey, HeadingSearchKey },
+        { NSAccessibilityHighlightedSearchKey, HighlightedSearchKey },
         { NSAccessibilityItalicFontSearchKey, ItalicFontSearchKey },
         { NSAccessibilityLandmarkSearchKey, LandmarkSearchKey },
         { NSAccessibilityLinkSearchKey, LinkSearchKey },
@@ -676,6 +681,12 @@ static void AXAttributeStringSetStyle(NSMutableAttributedString* attrString, Ren
             AXAttributeStringSetColor(attrString, NSAccessibilityStrikethroughColorTextAttribute, nsColor(linethrough), range);
         }
     }
+    
+    // Indicate background highlighting.
+    for (Node* node = renderer->node(); node; node = node->parentNode()) {
+        if (node->hasTagName(markTag))
+            AXAttributeStringSetNumber(attrString, @"AXHighlight", [NSNumber numberWithBool:YES], range);
+    }
 }
 
 static void AXAttributeStringSetBlockquoteLevel(NSMutableAttributedString* attrString, RenderObject* renderer, NSRange range)
diff --git a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
index ff02a4205..c2041d3df 100644
--- a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
+++ b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
@@ -122,6 +122,7 @@ static void destroyOnContextThread(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
 ActiveDOMCallback::ActiveDOMCallback(ScriptExecutionContext* context)
     : m_impl(adoptPtr(new ActiveDOMObjectCallbackImpl(context)))
 {
+    m_impl->suspendIfNeeded();
 }
 
 ActiveDOMCallback::~ActiveDOMCallback()
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 59e8b0f64..8fad2c5d7 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -182,6 +182,10 @@ bool RuntimeEnabledFeatures::isMediaSourceEnabled = false;
 
 #if ENABLE(SHADOW_DOM)
 bool RuntimeEnabledFeatures::isShadowDOMEnabled = false;
+bool RuntimeEnabledFeatures::isMultipleShadowSubtreesEnabled = false;
 #endif
 
+#if ENABLE(STYLE_SCOPED)
+bool RuntimeEnabledFeatures::isStyleScopedEnabled = false;
+#endif
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 6732cb1f0..36065c82a 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -194,6 +194,14 @@ public:
 #if ENABLE(SHADOW_DOM)
     static bool shadowDOMEnabled() { return isShadowDOMEnabled; }
     static void setShadowDOMEnabled(bool isEnabled) { isShadowDOMEnabled = isEnabled; }
+
+    static bool multipleShadowSubtreesEnabled() { return isMultipleShadowSubtreesEnabled; }
+    static void setMultipleShadowSubtreesEnabled(bool isEnabled) { isMultipleShadowSubtreesEnabled = isEnabled; }
+#endif
+
+#if ENABLE(STYLE_SCOPED)
+    static bool styleScopedEnabled() { return isStyleScopedEnabled; }
+    static void setStyleScopedEnabled(bool isEnabled) { isStyleScopedEnabled = isEnabled; }
 #endif
 
 private:
@@ -255,6 +263,11 @@ private:
 
 #if ENABLE(SHADOW_DOM)
     static bool isShadowDOMEnabled;
+    static bool isMultipleShadowSubtreesEnabled;
+#endif
+
+#if ENABLE(STYLE_SCOPED)
+    static bool isStyleScopedEnabled;
 #endif
 };
 
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index e8bf9901d..a51280f95 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -460,5 +460,5 @@ $(top_builddir)/DerivedSources/webkit/WebKitDOMCustom.h: $(WebCore)/bindings/gob
 
 # Filter out SVG and IndexedDB for now
 gdom_feature_defines := $(filter-out ENABLE_INDEXED_DATABASE=1, $(filter-out ENABLE_SVG%, $(FEATURE_DEFINES)))
-DerivedSources/webkit/WebKitDOM%.cpp DerivedSources/webkit/WebKitDOM%.h DerivedSources/webkit/WebKitDOM%Private.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm $(WebCore)/bindings/gobject/GNUmakefile.am $(SUPPLEMENTAL_DEPENDENCY_FILE)
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCES_WEBKIT)" --defines "LANGUAGE_GOBJECT=1 $(gdom_feature_defines)" --generator GObject --supplementalDependencyFile $(SUPPLEMENTAL_DEPENDENCY_FILE) $<
+DerivedSources/webkit/WebKitDOM%.cpp DerivedSources/webkit/WebKitDOM%.h DerivedSources/webkit/WebKitDOM%Private.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm $(WebCore)/bindings/gobject/GNUmakefile.am $(supplemental_dependency_file)
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCES_WEBKIT)" --defines "LANGUAGE_GOBJECT=1 $(gdom_feature_defines)" --generator GObject --supplementalDependencyFile $(supplemental_dependency_file) $<
diff --git a/Source/WebCore/bindings/js/GCController.cpp b/Source/WebCore/bindings/js/GCController.cpp
index 765e363e4..cf70f18c3 100644
--- a/Source/WebCore/bindings/js/GCController.cpp
+++ b/Source/WebCore/bindings/js/GCController.cpp
@@ -36,11 +36,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-static void* collect(void*)
+static void collect(void*)
 {
     JSLock lock(SilenceAssertionsOnly);
     JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
-    return 0;
 }
 
 GCController& gcController()
@@ -77,7 +76,7 @@ void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDon
     ThreadIdentifier threadID = createThread(collect, 0, "WebCore: GCController");
 
     if (waitUntilDone) {
-        waitForThreadCompletion(threadID, 0);
+        waitForThreadCompletion(threadID);
         return;
     }
 
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 061ca59a4..bbe3f1cd3 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -117,6 +117,7 @@
 #include "JSMessageChannelCustom.cpp"
 #include "JSMessageEventCustom.cpp"
 #include "JSMessagePortCustom.cpp"
+#include "JSMutationCallbackCustom.cpp"
 #include "JSNamedNodeMapCustom.cpp"
 #include "JSNodeCustom.cpp"
 #include "JSNodeFilterCondition.cpp"
@@ -155,6 +156,7 @@
 #include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
 #include "JSWebKitCSSKeyframesRuleCustom.cpp"
+#include "JSWebKitMutationObserverCustom.cpp"
 #include "JSWebKitPointCustom.cpp"
 #include "JSWebSocketCustom.cpp"
 #include "JSWorkerContextBase.cpp"
diff --git a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 66936ed34..8518cde35 100644
--- a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -30,6 +30,7 @@
 #include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSValue.h"
+#include "HashTools.h"
 #include "JSCSSValue.h"
 #include "JSNode.h"
 #include "PlatformString.h"
@@ -138,46 +139,51 @@ static PropertyNamePrefix getCSSPropertyNamePrefix(const StringImpl& propertyNam
     return PropertyNamePrefixNone;
 }
 
-template<typename CharacterType>
-static inline bool containsASCIIUpperChar(const CharacterType* string, size_t length)
+static inline void writeWebKitPrefix(char*& buffer)
 {
-    for (unsigned i = 0; i < length; ++i) {
-        if (isASCIIUpper(string[i]))
-            return true;
-    }
-    return false;
+    *buffer++ = '-';
+    *buffer++ = 'w';
+    *buffer++ = 'e';
+    *buffer++ = 'b';
+    *buffer++ = 'k';
+    *buffer++ = 'i';
+    *buffer++ = 't';
+    *buffer++ = '-';
 }
 
-static inline bool containsASCIIUpperChar(const StringImpl& string)
+static inline void writeEpubPrefix(char*& buffer)
 {
-    if (string.is8Bit())
-        return containsASCIIUpperChar(string.characters8(), string.length());
-    return containsASCIIUpperChar(string.characters16(), string.length());
+    *buffer++ = '-';
+    *buffer++ = 'e';
+    *buffer++ = 'p';
+    *buffer++ = 'u';
+    *buffer++ = 'b';
+    *buffer++ = '-';
 }
 
-static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPosPrefix = 0)
+static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, bool* hadPixelOrPosPrefix = 0)
 {
     if (hadPixelOrPosPrefix)
         *hadPixelOrPosPrefix = false;
 
     unsigned length = propertyName.length();
     if (!length)
-        return String();
+        return 0;
 
     StringImpl* propertyNameString = propertyName.impl();
-    // If there is no uppercase character in the propertyName, there can
-    // be no prefix, nor extension and we can return the same string.
-    if (!containsASCIIUpperChar(*propertyNameString))
-        return String(propertyNameString);
-
-    StringBuilder builder;
-    builder.reserveCapacity(length);
+    const size_t bufferSize = maxCSSPropertyNameLength + 1;
+    char buffer[bufferSize];
+    char* bufferPtr = buffer;
+    const char* name = bufferPtr;
 
     unsigned i = 0;
+    // Prefixes CSS, Pixel, Pos are ignored.
+    // Prefixes Apple, KHTML and Webkit are transposed to "-webkit-".
+    // The prefix "Epub" becomes "-epub-".
     switch (getCSSPropertyNamePrefix(*propertyNameString)) {
     case PropertyNamePrefixNone:
         if (isASCIIUpper((*propertyNameString)[0]))
-            return String();
+            return 0;
         break;
     case PropertyNamePrefixCSS:
         i += 3;
@@ -193,28 +199,59 @@ static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPo
             *hadPixelOrPosPrefix = true;
         break;
     case PropertyNamePrefixApple:
-    case PropertyNamePrefixEpub:
     case PropertyNamePrefixKHTML:
+        writeWebKitPrefix(bufferPtr);
+        i += 5;
+        break;
+    case PropertyNamePrefixEpub:
+        writeEpubPrefix(bufferPtr);
+        i += 4;
+        break;
     case PropertyNamePrefixWebKit:
-        builder.append('-');
+        writeWebKitPrefix(bufferPtr);
+        i += 6;
+        break;
     }
 
-    builder.append(toASCIILower((*propertyNameString)[i++]));
+    *bufferPtr++ = toASCIILower((*propertyNameString)[i++]);
+
+    char* bufferEnd = buffer + bufferSize;
+    char* stringEnd = bufferEnd - 1;
+    size_t bufferSizeLeft = stringEnd - bufferPtr;
+    size_t propertySizeLeft = length - i;
+    if (propertySizeLeft > bufferSizeLeft)
+        return 0;
 
     for (; i < length; ++i) {
         UChar c = (*propertyNameString)[i];
-        if (!isASCIIUpper(c))
-            builder.append(c);
-        else
-            builder.append(makeString('-', toASCIILower(c)));
+        if (!c || c >= 0x7F)
+            return 0; // illegal character
+        if (isASCIIUpper(c)) {
+            size_t bufferSizeLeft = stringEnd - bufferPtr;
+            size_t propertySizeLeft = length - i + 1;
+            if (propertySizeLeft > bufferSizeLeft)
+                return 0;
+            *bufferPtr++ = '-';
+            *bufferPtr++ = toASCIILower(c);
+        } else
+            *bufferPtr++ = c;
+        ASSERT(bufferPtr < bufferEnd);
     }
+    ASSERT(bufferPtr < bufferEnd);
+    *bufferPtr = '\0';
 
-    return builder.toString();
+    unsigned outputLength = bufferPtr - buffer;
+#if PLATFORM(IOS)
+    cssPropertyNameIOSAliasing(buffer, name, outputLength);
+#endif
+
+    const Property* hashTableEntry = findProperty(name, outputLength);
+    return hashTableEntry ? hashTableEntry->id : 0;
 }
 
 static bool isCSSPropertyName(const Identifier& propertyIdentifier)
 {
-    return cssPropertyID(cssPropertyName(propertyIdentifier));
+    return cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
 }
 
 bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*, const Identifier& propertyName)
@@ -232,8 +269,8 @@ JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, con
     // positioned element. if it is not a positioned element, return 0
     // from MSIE documentation FIXME: IMPLEMENT THAT (Dirk)
     bool pixelOrPos;
-    String prop = cssPropertyName(propertyName, &pixelOrPos);
-    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValue(prop);
+    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
+    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(cssPropertyID));
     if (v) {
         if (pixelOrPos && v->isPrimitiveValue())
             return jsNumber(static_pointer_cast<CSSPrimitiveValue>(v)->getFloatValue(CSSPrimitiveValue::CSS_PX));
@@ -242,22 +279,21 @@ JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, con
 
     // If the property is a shorthand property (such as "padding"), 
     // it can only be accessed using getPropertyValue.
-
-    return jsString(exec, thisObj->impl()->getPropertyValue(prop));
+    return jsString(exec, thisObj->impl()->getPropertyValueInternal(static_cast<CSSPropertyID>(cssPropertyID)));
 }
 
 bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     bool pixelOrPos;
-    String prop = cssPropertyName(propertyName, &pixelOrPos);
-    if (!cssPropertyID(prop))
+    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
+    if (!cssPropertyID)
         return false;
 
     String propValue = valueToStringWithNullCheck(exec, value);
     if (pixelOrPos)
         propValue += "px";
     ExceptionCode ec = 0;
-    impl()->setProperty(prop, propValue, emptyString(), ec);
+    impl()->setPropertyInternal(static_cast<CSSPropertyID>(cssPropertyID), propValue, false, ec);
     setDOMException(exec, ec);
     return true;
 }
diff --git a/Source/WebCore/bindings/js/JSClipboardCustom.cpp b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
index efce79bc0..3532c7859 100644
--- a/Source/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,21 +48,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-JSValue JSClipboard::types(ExecState* exec) const
-{
-    Clipboard* clipboard = impl();
-
-    HashSet<String> types = clipboard->types();
-    if (types.isEmpty())
-        return jsNull();
-
-    MarkedArgumentBuffer list;
-    HashSet<String>::const_iterator end = types.end();
-    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
-        list.append(jsString(exec, stringToUString(*it)));
-    return constructArray(exec, globalObject(), list);
-}
-
 JSValue JSClipboard::clearData(ExecState* exec)
 {
     Clipboard* clipboard = impl();
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 69cc1b84a..13580aec8 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -49,7 +49,7 @@ const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const
 JSValue jsStringSlowCase(ExecState* exec, JSStringCache& stringCache, StringImpl* stringImpl)
 {
     JSString* wrapper = jsString(exec, UString(stringImpl));
-    stringCache.add(stringImpl, Weak<JSString>(exec->globalData(), wrapper, currentWorld(exec)->stringWrapperOwner(), stringImpl));
+    stringCache.add(stringImpl, PassWeak<JSString>(exec->globalData(), wrapper, currentWorld(exec)->stringWrapperOwner(), stringImpl));
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 7e1af20fc..0eb3d9cf5 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -23,6 +23,7 @@
 #define JSDOMBinding_h
 
 #include "CSSImportRule.h"
+#include "CSSStyleDeclaration.h"
 #include "CSSStyleSheet.h"
 #include "JSDOMGlobalObject.h"
 #include "JSDOMWrapper.h"
@@ -38,15 +39,16 @@
 #include <runtime/ObjectPrototype.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-enum ParameterMissingPolicy {
-    MissingIsUndefined,
-    MissingIsEmpty
+enum ParameterDefaultPolicy {
+    DefaultIsUndefined,
+    DefaultIsNullString
 };
 
-#define MAYBE_MISSING_PARAMETER(exec, index, policy) (((policy) == MissingIsEmpty && (index) >= (exec)->argumentCount()) ? (JSValue()) : ((exec)->argument(index)))
+#define MAYBE_MISSING_PARAMETER(exec, index, policy) (((policy) == DefaultIsNullString && (index) >= (exec)->argumentCount()) ? (JSValue()) : ((exec)->argument(index)))
 
     class Frame;
     class KURL;
@@ -131,17 +133,16 @@ enum ParameterMissingPolicy {
     {
         if (JSDOMWrapper* wrapper = getInlineCachedWrapper(world, domObject))
             return wrapper;
-        return world->m_wrappers.get(domObject).get();
+        return world->m_wrappers.get(domObject);
     }
 
     template <typename DOMClass> inline void cacheWrapper(DOMWrapperWorld* world, DOMClass* domObject, JSDOMWrapper* wrapper)
     {
         if (setInlineCachedWrapper(world, domObject, wrapper))
             return;
-        pair<DOMObjectWrapperMap::iterator, bool> entry = world->m_wrappers.add(domObject, JSC::Weak<JSDOMWrapper>());
-        ASSERT(entry.second);
-        JSC::Weak<JSDOMWrapper> handle(*world->globalData(), wrapper, wrapperOwner(world, domObject), wrapperContext(world, domObject));
-        entry.first->second.swap(handle);
+        JSC::PassWeak<JSDOMWrapper> passWeak(*world->globalData(), wrapper, wrapperOwner(world, domObject), wrapperContext(world, domObject));
+        pair<DOMObjectWrapperMap::iterator, bool> result = world->m_wrappers.add(domObject, passWeak);
+        ASSERT_UNUSED(result, result.second);
     }
 
     template <typename DOMClass> inline void uncacheWrapper(DOMWrapperWorld* world, DOMClass* domObject, JSDOMWrapper* wrapper)
@@ -342,6 +343,23 @@ enum ParameterMissingPolicy {
         return AtomicString(identifier.impl());
     }
 
+    inline Vector<unsigned long> jsUnsignedLongArrayToVector(JSC::ExecState* exec, JSC::JSValue value)
+    {
+        unsigned length;
+        JSC::JSObject* object = toJSSequence(exec, value, length);
+        if (exec->hadException())
+            return Vector<unsigned long>();
+
+        Vector<unsigned long> result;
+        for (unsigned i = 0; i < length; i++) {
+            JSC::JSValue indexedValue;
+            indexedValue = object->get(exec, i);
+            if (exec->hadException() || indexedValue.isUndefinedOrNull() || !indexedValue.isNumber())
+                return Vector<unsigned long>();
+            result.append(indexedValue.toUInt32(exec));
+        }
+        return result;
+    }
 } // namespace WebCore
 
 #endif // JSDOMBinding_h
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
index 8de432edf..160465f4b 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -43,7 +43,7 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0, CREATE_METHOD_TABLE(JSDOMWindowBase) };
 
-const GlobalObjectMethodTable JSDOMWindowBase::s_globalObjectMethodTable = { &supportsProfiling, &supportsRichSourceInfo, &shouldInterruptScript };
+const GlobalObjectMethodTable JSDOMWindowBase::s_globalObjectMethodTable = { &allowsAccessFrom, &supportsProfiling, &supportsRichSourceInfo, &shouldInterruptScript };
 
 JSDOMWindowBase::JSDOMWindowBase(JSGlobalData& globalData, Structure* structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(globalData, structure, shell->world(), &s_globalObjectMethodTable)
@@ -92,6 +92,31 @@ void JSDOMWindowBase::printErrorMessage(const String& message) const
     printErrorMessageForFrame(impl()->frame(), message);
 }
 
+// This method checks whether accesss to *this* global object is permitted from
+// the given context; this differs from allowsAccessFromPrivate, since that
+// method checks whether the given context is permitted to access the current
+// window the shell is referencing (which may come from a different security
+// origin to this global object).
+bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* thisObject, ExecState* exec)
+{
+    JSGlobalObject* otherObject = exec->lexicalGlobalObject();
+
+    const JSDOMWindow* originWindow = asJSDOMWindow(otherObject);
+    const JSDOMWindow* targetWindow = asJSDOMWindow(thisObject);
+
+    if (originWindow == targetWindow)
+        return true;
+
+    const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
+    const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
+
+    if (originSecurityOrigin->canAccess(targetSecurityOrigin))
+        return true;
+
+    targetWindow->printErrorMessage(targetWindow->crossDomainAccessErrorMessage(otherObject));
+    return false;
+}
+
 bool JSDOMWindowBase::supportsProfiling(const JSGlobalObject* object)
 {
 #if !ENABLE(JAVASCRIPT_DEBUGGER) || !ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.h b/Source/WebCore/bindings/js/JSDOMWindowBase.h
index 84c18624a..51e0f894f 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.h
@@ -63,7 +63,8 @@ namespace WebCore {
         static bool supportsProfiling(const JSC::JSGlobalObject*);
         static bool supportsRichSourceInfo(const JSC::JSGlobalObject*);
         static bool shouldInterruptScript(const JSC::JSGlobalObject*);
-
+        static bool allowsAccessFrom(const JSC::JSGlobalObject*, JSC::ExecState*);
+        
         bool allowsAccessFrom(JSC::ExecState*) const;
         bool allowsAccessFromNoErrorMessage(JSC::ExecState*) const;
         bool allowsAccessFrom(JSC::ExecState*, String& message) const;
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index baf80d360..0ba259e76 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -99,12 +99,12 @@ JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, const Identifie
 
 static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))->domWindow());
 }
 
 static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(index)->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->scopedChild(index)->domWindow());
 }
 
 static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
@@ -220,7 +220,7 @@ bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi
     // naming frames things that conflict with window properties that
     // are in Moz but not IE. Since we have some of these, we have to do
     // it the Moz way.
-    if (thisObject->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))) {
+    if (thisObject->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))) {
         slot.setCustom(thisObject, childFrameGetter);
         return true;
     }
@@ -244,7 +244,7 @@ bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi
     // allow window[1] or parent[1] etc. (#56983)
     bool ok;
     unsigned i = propertyName.toArrayIndex(ok);
-    if (ok && i < thisObject->impl()->frame()->tree()->childCount()) {
+    if (ok && i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
         slot.setCustomIndex(thisObject, i, indexGetter);
         return true;
     }
@@ -310,7 +310,7 @@ bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co
     // naming frames things that conflict with window properties that
     // are in Moz but not IE. Since we have some of these, we have to do
     // it the Moz way.
-    if (thisObject->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))) {
+    if (thisObject->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))) {
         PropertySlot slot;
         slot.setCustom(thisObject, childFrameGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
@@ -319,7 +319,7 @@ bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co
     
     bool ok;
     unsigned i = propertyName.toArrayIndex(ok);
-    if (ok && i < thisObject->impl()->frame()->tree()->childCount()) {
+    if (ok && i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
         PropertySlot slot;
         slot.setCustomIndex(thisObject, i, indexGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
index 45506e6e4..1f06713b5 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -149,16 +149,6 @@ DOMWindow* JSDOMWindowShell::impl() const
     return window()->impl();
 }
 
-void* JSDOMWindowShell::operator new(size_t size)
-{
-    Heap& heap = JSDOMWindow::commonJSGlobalData()->heap;
-#if ENABLE(GC_VALIDATION)
-    ASSERT(!heap.globalData()->isInitializingObject());
-    heap.globalData()->setInitializingObject(true);
-#endif
-    return heap.allocate(size);
-}
-
 // ----
 // Conversion methods
 // ----
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
index e111cb84d..b7c750140 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -58,7 +58,8 @@ namespace WebCore {
 
         static JSDOMWindowShell* create(PassRefPtr<DOMWindow> window, JSC::Structure* structure, DOMWrapperWorld* world) 
         {
-            JSDOMWindowShell* shell = new JSDOMWindowShell(structure, world);
+            JSC::Heap& heap = JSDOMWindow::commonJSGlobalData()->heap;
+            JSDOMWindowShell* shell = new (NotNull, JSC::allocateCell<JSDOMWindowShell>(heap)) JSDOMWindowShell(structure, world);
             shell->finishCreation(*world->globalData(), window);
             return shell; 
         }
@@ -75,7 +76,6 @@ namespace WebCore {
         void finishCreation(JSC::JSGlobalData&, PassRefPtr<DOMWindow>);
 
     private:
-        void* operator new(size_t);
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | Base::StructureFlags;
 
         static JSC::UString className(const JSC::JSObject*);
diff --git a/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp b/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
index 31232d3cc..57d980cfb 100644
--- a/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSDOMBinding.h"
 #include "JSEntryCallback.h"
 #include "JSErrorCallback.h"
+#include <runtime/Error.h>
 #include <wtf/Assertions.h>
 
 using namespace JSC;
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index a3c320197..6de073b05 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -22,6 +22,7 @@
 
 #include "Event.h"
 #include "Frame.h"
+#include "InspectorCounters.h"
 #include "JSEvent.h"
 #include "JSEventTarget.h"
 #include "JSMainThreadExecState.h"
@@ -44,11 +45,12 @@ JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isA
         m_jsFunction.setMayBeNull(*m_isolatedWorld->globalData(), wrapper, function);
     else
         ASSERT(!function);
-
+    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 JSEventListener::~JSEventListener()
 {
+    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
diff --git a/Source/WebCore/bindings/js/JSEventListener.h b/Source/WebCore/bindings/js/JSEventListener.h
index 4cee34711..32a8c5634 100644
--- a/Source/WebCore/bindings/js/JSEventListener.h
+++ b/Source/WebCore/bindings/js/JSEventListener.h
@@ -53,7 +53,7 @@ namespace WebCore {
         DOMWrapperWorld* isolatedWorld() const { return m_isolatedWorld.get(); }
 
         JSC::JSObject* wrapper() const { return m_wrapper.get(); }
-        void setWrapper(JSC::JSGlobalData& globalData, JSC::JSObject* wrapper) const { m_wrapper.set(globalData, wrapper, 0); }
+        void setWrapper(JSC::JSGlobalData& globalData, JSC::JSObject* wrapper) const { m_wrapper = JSC::PassWeak<JSC::JSObject>(globalData, wrapper, 0); }
 
     private:
         virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index 73cb2fa7e..70402bc46 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -76,17 +76,17 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(state->globalData(), toJS(state, deprecatedGlobalObjectForPrototype(state), node));
 }
 
-JSValue JSInjectedScriptHost::inspectedNode(ExecState* exec)
+JSValue JSInjectedScriptHost::inspectedObject(ExecState* exec)
 {
     if (exec->argumentCount() < 1)
         return jsUndefined();
 
-    Node* node = impl()->inspectedNode(exec->argument(0).toInt32(exec));
-    if (!node)
+    InjectedScriptHost::InspectableObject* object = impl()->inspectedObject(exec->argument(0).toInt32(exec));
+    if (!object)
         return jsUndefined();
 
     JSLock lock(SilenceAssertionsOnly);
-    return toJS(exec, globalObject(), node);
+    return object->get(exec).jsValue();
 }
 
 JSValue JSInjectedScriptHost::internalConstructorName(ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSNavigatorCustom.cpp b/Source/WebCore/bindings/js/JSNavigatorCustom.cpp
deleted file mode 100644
index 2d8d49dfd..000000000
--- a/Source/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- *  Copyright (C) 2000 Harri Porten (porten@kde.org)
- *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
- *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
- *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "JSNavigator.h"
-
-#include "CallbackFunction.h"
-#include "ExceptionCode.h"
-#include "JSNavigatorUserMediaErrorCallback.h"
-#include "JSNavigatorUserMediaSuccessCallback.h"
-#include "Navigator.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-#if ENABLE(MEDIA_STREAM)
-JSValue JSNavigator::webkitGetUserMedia(ExecState* exec)
-{
-    // Arguments: Options, successCallback, (optional)errorCallback
-
-    String options = ustringToString(exec->argument(0).toString(exec)->value(exec));
-    if (exec->hadException())
-        return jsUndefined();
-
-    RefPtr<NavigatorUserMediaSuccessCallback> successCallback = createFunctionOnlyCallback<JSNavigatorUserMediaSuccessCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(1));
-    if (exec->hadException())
-        return jsUndefined();
-
-    RefPtr<NavigatorUserMediaErrorCallback> errorCallback = createFunctionOnlyCallback<JSNavigatorUserMediaErrorCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(2), CallbackAllowUndefined);
-    if (exec->hadException())
-        return jsUndefined();
-
-    ExceptionCode ec = 0;
-    m_impl->webkitGetUserMedia(options, successCallback.release(), errorCallback.release(), ec);
-
-    if (ec)
-        setDOMException(exec, ec);
-
-    return jsUndefined();
-}
-#endif // ENABLE(MEDIA_STREAM)
-
-}
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.cpp b/Source/WebCore/bindings/js/JSNodeCustom.cpp
index 61c15d6b9..7cdd5fce7 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeCustom.cpp
@@ -256,9 +256,6 @@ static ALWAYS_INLINE JSValue createWrapperInline(ExecState* exec, JSDOMGlobalObj
         case Node::DOCUMENT_FRAGMENT_NODE:
             wrapper = CREATE_DOM_WRAPPER(exec, globalObject, DocumentFragment, node);
             break;
-        case Node::SHADOW_ROOT_NODE:
-            wrapper = CREATE_DOM_WRAPPER(exec, globalObject, Node, node);
-            break;
         case Node::ENTITY_REFERENCE_NODE:
             wrapper = CREATE_DOM_WRAPPER(exec, globalObject, EntityReference, node);
             break;
diff --git a/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp b/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp
index 38edfb68d..f01f84b90 100644
--- a/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp
@@ -30,21 +30,52 @@
 
 #include "config.h"
 
+#include "History.h"
+#include "JSHistory.h"
 #include "JSPopStateEvent.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+// Save the state value to the m_state member of a JSPopStateEvent, and return it, for convenience.
+static const JSValue& cacheState(ExecState* exec, JSPopStateEvent* event, const JSValue& state)
+{
+    event->m_state.set(exec->globalData(), event, state);
+    return state;
+}
+
 JSValue JSPopStateEvent::state(ExecState* exec) const
 {
+    JSValue cachedValue = m_state.get();
+    if (!cachedValue.isEmpty())
+        return cachedValue;
+
     PopStateEvent* event = static_cast<PopStateEvent*>(impl());
-    SerializedScriptValue* serializedState = event->serializedState();
-    if (serializedState)
-        return serializedState->deserialize(exec, globalObject(), 0);
+
     if (!event->state().hasNoValue())
-        return event->state().jsValue();
-    return jsNull();
+        return cacheState(exec, const_cast<JSPopStateEvent*>(this), event->state().jsValue());
+
+    History* history = event->history();
+    if (!history || !event->serializedState())
+        return cacheState(exec, const_cast<JSPopStateEvent*>(this), jsNull());
+
+    // There's no cached value from a previous invocation, nor a state value was provided by the
+    // event, but there is a history object, so first we need to see if the state object has been
+    // deserialized through the history object already.
+    // The current history state object might've changed in the meantime, so we need to take care
+    // of using the correct one, and always share the same deserialization with history.state.
+
+    bool isSameState = history->isSameAsCurrentState(event->serializedState());
+    JSValue result;
+
+    if (isSameState) {
+        JSHistory* jsHistory = static_cast<JSHistory*>(toJS(exec, globalObject(), history).asCell());
+        result = jsHistory->state(exec);
+    } else
+        result = event->serializedState()->deserialize(exec, globalObject(), 0);
+
+    return cacheState(exec, const_cast<JSPopStateEvent*>(this), result);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/ScriptControllerQt.cpp b/Source/WebCore/bindings/js/ScriptControllerQt.cpp
index a8cdf9dd0..979a4f658 100644
--- a/Source/WebCore/bindings/js/ScriptControllerQt.cpp
+++ b/Source/WebCore/bindings/js/ScriptControllerQt.cpp
@@ -42,8 +42,6 @@
 #include "qt_instance.h"
 #include "runtime_root.h"
 
-#include <QWidget>
-
 namespace WebCore {
 
 PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(WebCore::Widget* widget)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index 3f7bd4f64..0ecd5a870 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -92,6 +92,12 @@ public:
 
     bool isPaused() { return m_paused; }
 
+    class Task {
+    public:
+        virtual ~Task() { }
+        virtual void run() = 0;
+    };
+
 protected:
     typedef HashSet<ScriptDebugListener*> ListenerSet;
     typedef void (ScriptDebugServer::*JavaScriptExecutionCallback)(ScriptDebugListener*);
diff --git a/Source/WebCore/bindings/js/ScriptWrappable.h b/Source/WebCore/bindings/js/ScriptWrappable.h
index 4fef50655..92d05e804 100644
--- a/Source/WebCore/bindings/js/ScriptWrappable.h
+++ b/Source/WebCore/bindings/js/ScriptWrappable.h
@@ -45,7 +45,7 @@ public:
 
     void setWrapper(JSC::JSGlobalData& globalData, JSDOMWrapper* wrapper, JSC::WeakHandleOwner* wrapperOwner, void* context)
     {
-        m_wrapper.set(globalData, wrapper, wrapperOwner, context);
+        m_wrapper = JSC::PassWeak<JSDOMWrapper>(globalData, wrapper, wrapperOwner, context);
     }
 
     void clearWrapper()
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index 3ac6ecf58..77cd65b3a 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -31,13 +31,26 @@
 #include "File.h"
 #include "FileList.h"
 #include "ImageData.h"
+#include "JSArrayBuffer.h"
+#include "JSArrayBufferView.h"
 #include "JSBlob.h"
+#include "JSDataView.h"
 #include "JSDOMGlobalObject.h"
 #include "JSFile.h"
 #include "JSFileList.h"
+#include "JSFloat32Array.h"
+#include "JSFloat64Array.h"
 #include "JSImageData.h"
+#include "JSInt16Array.h"
+#include "JSInt32Array.h"
+#include "JSInt8Array.h"
 #include "JSMessagePort.h"
 #include "JSNavigator.h"
+#include "JSUint16Array.h"
+#include "JSUint32Array.h"
+#include "JSUint8Array.h"
+#include "JSUint8ClampedArray.h"
+#include "ScriptValue.h"
 #include "SharedBuffer.h"
 #include <limits>
 #include <JavaScriptCore/APICast.h>
@@ -90,9 +103,47 @@ enum SerializationTag {
     RegExpTag = 18,
     ObjectReferenceTag = 19,
     MessagePortReferenceTag = 20,
+    ArrayBufferTag = 21,
+    ArrayBufferViewTag = 22,
     ErrorTag = 255
 };
 
+enum ArrayBufferViewSubtag {
+    DataViewTag = 0,
+    Int8ArrayTag = 1,
+    Uint8ArrayTag = 2,
+    Uint8ClampedArrayTag = 3,
+    Int16ArrayTag = 4,
+    Uint16ArrayTag = 5,
+    Int32ArrayTag = 6,
+    Uint32ArrayTag = 7,
+    Float32ArrayTag = 8,
+    Float64ArrayTag = 9
+};
+
+static unsigned typedArrayElementSize(ArrayBufferViewSubtag tag)
+{
+    switch (tag) {
+    case DataViewTag:
+    case Int8ArrayTag:
+    case Uint8ArrayTag:
+    case Uint8ClampedArrayTag:
+        return 1;
+    case Int16ArrayTag:
+    case Uint16ArrayTag:
+        return 2;
+    case Int32ArrayTag:
+    case Uint32ArrayTag:
+    case Float32ArrayTag:
+        return 4;
+    case Float64ArrayTag:
+        return 8;
+    default:
+        return 0;
+    }
+
+}
+
 /* CurrentVersion tracks the serialization version so that persistant stores
  * are able to correctly bail out in the case of encountering newer formats.
  *
@@ -136,8 +187,10 @@ static const unsigned int StringPoolTag = 0xFFFFFFFE;
  *    | FileList
  *    | ImageData
  *    | Blob
- *    | ObjectReferenceTag <opIndex:IndexType>
+ *    | ObjectReference
  *    | MessagePortReferenceTag <value:uint32_t>
+ *    | ArrayBuffer
+ *    | ArrayBufferViewTag ArrayBufferViewSubtag <byteOffset:uint32_t> <byteLenght:uint32_t> (ArrayBuffer | ObjectReference)
  *
  * String :-
  *      EmptyStringTag
@@ -164,6 +217,12 @@ static const unsigned int StringPoolTag = 0xFFFFFFFE;
  *
  * RegExp :-
  *    RegExpTag <pattern:StringData><flags:StringData>
+ *
+ * ObjectReference :-
+ *    ObjectReferenceTag <opIndex:IndexType>
+ *
+ * ArrayBuffer :-
+ *    ArrayBufferTag <length:uint32_t> <contents:byte{length}>
  */
 
 typedef pair<JSC::JSValue, SerializationReturnCode> DeserializationResult;
@@ -416,6 +475,40 @@ private:
         }
     }
 
+    bool dumpArrayBufferView(JSObject* obj)
+    {
+        write(ArrayBufferViewTag);
+        if (obj->inherits(&JSDataView::s_info))
+            write(DataViewTag);
+        else if (obj->inherits(&JSUint8ClampedArray::s_info))
+            write(Uint8ClampedArrayTag);
+        else if (obj->inherits(&JSInt8Array::s_info))
+            write(Int8ArrayTag);
+        else if (obj->inherits(&JSUint8Array::s_info))
+            write(Uint8ArrayTag);
+        else if (obj->inherits(&JSInt16Array::s_info))
+            write(Int16ArrayTag);
+        else if (obj->inherits(&JSUint16Array::s_info))
+            write(Uint16ArrayTag);
+        else if (obj->inherits(&JSInt32Array::s_info))
+            write(Int32ArrayTag);
+        else if (obj->inherits(&JSUint32Array::s_info))
+            write(Uint32ArrayTag);
+        else if (obj->inherits(&JSFloat32Array::s_info))
+            write(Float32ArrayTag);
+        else if (obj->inherits(&JSFloat64Array::s_info))
+            write(Float64ArrayTag);
+        else
+            return false;
+
+        RefPtr<ArrayBufferView> arrayBufferView = toArrayBufferView(obj);
+        write(static_cast<uint32_t>(arrayBufferView->byteOffset()));
+        write(static_cast<uint32_t>(arrayBufferView->byteLength()));
+        RefPtr<ArrayBuffer> arrayBuffer = arrayBufferView->buffer();
+        JSValue bufferObj = toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()), arrayBuffer.get());
+        return dumpIfTerminal(bufferObj);
+    }
+
     bool dumpIfTerminal(JSValue value)
     {
         if (!value.isCell()) {
@@ -509,6 +602,20 @@ private:
                 }
                 return false;
             }
+            if (obj->inherits(&JSArrayBuffer::s_info)) {
+                if (!startObjectInternal(obj)) // handle duplicates
+                    return true;
+                write(ArrayBufferTag);
+                RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(obj);
+                write(arrayBuffer->byteLength());
+                write(static_cast<const uint8_t *>(arrayBuffer->data()), arrayBuffer->byteLength());
+                return true;
+            }
+            if (obj->inherits(&JSArrayBufferView::s_info)) {
+                if (!startObjectInternal(obj))
+                    return true;
+                return dumpArrayBufferView(obj);
+            }
 
             CallData unusedData;
             if (getCallData(value, unusedData) == CallTypeNone)
@@ -524,6 +631,11 @@ private:
         writeLittleEndian<uint8_t>(m_buffer, static_cast<uint8_t>(tag));
     }
 
+    void write(ArrayBufferViewSubtag tag)
+    {
+        writeLittleEndian<uint8_t>(m_buffer, static_cast<uint8_t>(tag));
+    }
+
     void write(uint8_t c)
     {
         writeLittleEndian(m_buffer, c);
@@ -1064,6 +1176,14 @@ private:
         return static_cast<SerializationTag>(*m_ptr++);
     }
 
+    bool readArrayBufferViewSubtag(ArrayBufferViewSubtag& tag)
+    {
+        if (m_ptr >= m_end)
+            return false;
+        tag = static_cast<ArrayBufferViewSubtag>(*m_ptr++);
+        return true;
+    }
+
     void putProperty(JSArray* array, unsigned index, JSValue value)
     {
         if (array->canSetIndex(index))
@@ -1093,6 +1213,83 @@ private:
         return true;
     }
 
+    bool readArrayBuffer(RefPtr<ArrayBuffer>& arrayBuffer)
+    {
+        uint32_t length;
+        if (!read(length))
+            return false;
+        if (m_ptr + length > m_end)
+            return false;
+        arrayBuffer = ArrayBuffer::create(m_ptr, length);
+        m_ptr += length;
+        return true;
+    }
+
+    bool readArrayBufferView(JSValue& arrayBufferView)
+    {
+        ArrayBufferViewSubtag arrayBufferViewSubtag;
+        if (!readArrayBufferViewSubtag(arrayBufferViewSubtag))
+            return false;
+        uint32_t byteOffset;
+        if (!read(byteOffset))
+            return false;
+        uint32_t byteLength;
+        if (!read(byteLength))
+            return false;
+        JSObject* arrayBufferObj = asObject(readTerminal());
+        if (!arrayBufferObj || !arrayBufferObj->inherits(&JSArrayBuffer::s_info))
+            return false;
+
+        unsigned elementSize = typedArrayElementSize(arrayBufferViewSubtag);
+        if (!elementSize)
+            return false;
+        unsigned length = byteLength / elementSize;
+        if (length * elementSize != byteLength)
+            return false;
+
+        RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(arrayBufferObj);
+        switch (arrayBufferViewSubtag) {
+        case DataViewTag:
+            arrayBufferView = getJSValue(DataView::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Int8ArrayTag:
+            arrayBufferView = getJSValue(Int8Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint8ArrayTag:
+            arrayBufferView = getJSValue(Uint8Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint8ClampedArrayTag:
+            arrayBufferView = getJSValue(Uint8ClampedArray::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Int16ArrayTag:
+            arrayBufferView = getJSValue(Int16Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint16ArrayTag:
+            arrayBufferView = getJSValue(Uint16Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Int32ArrayTag:
+            arrayBufferView = getJSValue(Int32Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint32ArrayTag:
+            arrayBufferView = getJSValue(Uint32Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Float32ArrayTag:
+            arrayBufferView = getJSValue(Float32Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Float64ArrayTag:
+            arrayBufferView = getJSValue(Float64Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    template<class T>
+    JSValue getJSValue(T* nativeObj)
+    {
+        return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), nativeObj);
+    }
+
     JSValue readTerminal()
     {
         SerializationTag tag = readTag();
@@ -1149,7 +1346,7 @@ private:
             }
             if (!m_isDOMGlobalObject)
                 return jsNull();
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            return getJSValue(result.get());
         }
         case ImageDataTag: {
             int32_t width;
@@ -1172,7 +1369,7 @@ private:
             RefPtr<ImageData> result = ImageData::create(IntSize(width, height));
             memcpy(result->data()->data()->data(), m_ptr, length);
             m_ptr += length;
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            return getJSValue(result.get());
         }
         case BlobTag: {
             CachedStringRef url;
@@ -1186,7 +1383,7 @@ private:
                 return JSValue();
             if (!m_isDOMGlobalObject)
                 return jsNull();
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), Blob::create(KURL(KURL(), url->ustring().impl()), String(type->ustring().impl()), size));
+            return getJSValue(Blob::create(KURL(KURL(), url->ustring().impl()), String(type->ustring().impl()), size).get());
         }
         case StringTag: {
             CachedStringRef cachedString;
@@ -1223,8 +1420,26 @@ private:
                 fail();
                 return JSValue();
             }
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()),
-                        m_messagePorts->at(index).get());
+            return getJSValue(m_messagePorts->at(index).get());
+        }
+        case ArrayBufferTag: {
+            RefPtr<ArrayBuffer> arrayBuffer;
+            if (!readArrayBuffer(arrayBuffer)) {
+                fail();
+                return JSValue();
+            }
+            JSValue result = getJSValue(arrayBuffer.get());
+            m_gcBuffer.append(result);
+            return result;
+        }
+        case ArrayBufferViewTag: {
+            JSValue arrayBufferView;
+            if (!readArrayBufferView(arrayBufferView)) {
+                fail();
+                return JSValue();
+            }
+            m_gcBuffer.append(arrayBufferView);
+            return arrayBufferView;
         }
         default:
             m_ptr--; // Push the tag back
@@ -1452,6 +1667,14 @@ JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* glob
     return result.first;
 }
 
+#if ENABLE(INSPECTOR)
+ScriptValue SerializedScriptValue::deserializeForInspector(ScriptState* scriptState)
+{
+    JSValue value = deserialize(scriptState, scriptState->lexicalGlobalObject(), 0);
+    return ScriptValue(scriptState->globalData(), value);
+}
+#endif
+
 JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception, MessagePortArray* messagePorts)
 {
     ExecState* exec = toJS(destinationContext);
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.h b/Source/WebCore/bindings/js/SerializedScriptValue.h
index caed6473c..75ce694b2 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.h
@@ -27,6 +27,7 @@
 #ifndef SerializedScriptValue_h
 #define SerializedScriptValue_h
 
+#include "ScriptState.h"
 #include <heap/Strong.h>
 #include <runtime/JSValue.h>
 #include <wtf/Forward.h>
@@ -52,6 +53,7 @@ enum SerializationReturnCode {
     
 enum SerializationErrorMode { NonThrowing, Throwing };
 
+class ScriptValue;
 class SharedBuffer;
 
 class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
@@ -77,6 +79,10 @@ public:
     JSValueRef deserialize(JSContextRef, JSValueRef* exception, MessagePortArray*);
     JSValueRef deserialize(JSContextRef, JSValueRef* exception);
 
+#if ENABLE(INSPECTOR)
+    ScriptValue deserializeForInspector(ScriptState*);
+#endif
+
     const Vector<uint8_t>& data() { return m_data; }
 
     ~SerializedScriptValue();
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
index 14d64650f..67bb4da6d 100644
--- a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
@@ -33,23 +33,26 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
 
 #include "WorkerScriptDebugServer.h"
-
-#include "WorkerContext.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 const char* WorkerScriptDebugServer::debuggerTaskMode = "debugger";
 
-WorkerScriptDebugServer::WorkerScriptDebugServer()
+WorkerScriptDebugServer::WorkerScriptDebugServer(WorkerContext*)
     : ScriptDebugServer()
 {
 }
 
-void WorkerScriptDebugServer::addListener(ScriptDebugListener*, WorkerContext*)
+void WorkerScriptDebugServer::addListener(ScriptDebugListener*)
+{
+}
+
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener*)
 {
 }
 
-void WorkerScriptDebugServer::removeListener(ScriptDebugListener*, WorkerContext*)
+void WorkerScriptDebugServer::interruptAndRunTask(PassOwnPtr<ScriptDebugServer::Task>)
 {
 }
 
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
index f4c976535..d2d7710c7 100644
--- a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
@@ -42,14 +42,16 @@ class WorkerContext;
 class WorkerScriptDebugServer : public ScriptDebugServer {
     WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
 public:
-    WorkerScriptDebugServer();
+    explicit WorkerScriptDebugServer(WorkerContext*);
     ~WorkerScriptDebugServer() { }
 
-    void addListener(ScriptDebugListener*, WorkerContext*);
-    void removeListener(ScriptDebugListener*, WorkerContext*);
+    void addListener(ScriptDebugListener*);
+    void removeListener(ScriptDebugListener*);
 
     static const char* debuggerTaskMode;
 
+    void interruptAndRunTask(PassOwnPtr<ScriptDebugServer::Task>);
+
 private:
     virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*) { }
     virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) { return 0; }
diff --git a/Source/WebCore/bindings/objc/DOM.mm b/Source/WebCore/bindings/objc/DOM.mm
index 8ccb7e286..780634acb 100644
--- a/Source/WebCore/bindings/objc/DOM.mm
+++ b/Source/WebCore/bindings/objc/DOM.mm
@@ -327,8 +327,6 @@ Class kitClass(WebCore::Node* impl)
             // FIXME: Create an XPath objective C wrapper
             // See http://bugs.webkit.org/show_bug.cgi?id=8755
             return nil;
-        case WebCore::Node::SHADOW_ROOT_NODE:
-            return [DOMNode class];
     }
     ASSERT_NOT_REACHED();
     return nil;
diff --git a/Source/WebCore/bindings/objc/PublicDOMInterfaces.h b/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
index b379c0b3c..1239971be 100644
--- a/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
+++ b/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
@@ -331,6 +331,7 @@
 @end
 
 @interface DOMHTMLAnchorElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *charset;
 @property(copy) NSString *coords;
 @property(copy) NSString *href;
@@ -367,6 +368,7 @@
 @end
 
 @interface DOMHTMLAreaElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *alt;
 @property(copy) NSString *coords;
 @property(copy) NSString *href;
@@ -408,6 +410,7 @@
 @end
 
 @interface DOMHTMLButtonElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property BOOL disabled;
 @property(copy) NSString *name;
@@ -468,7 +471,7 @@
 @end
 
 @interface DOMHTMLElement : DOMElement WEBKIT_VERSION_1_3
-@property(copy) NSString *accessKey;
+@property(copy) NSString *accessKey AVAILABLE_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *title;
 @property(copy) NSString *idName;
 @property(copy) NSString *lang;
@@ -483,6 +486,7 @@
 @property(readonly) BOOL isContentEditable;
 @property(readonly, copy) NSString *titleDisplayString AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @property int tabIndex;
+- (void)click AVAILABLE_AFTER_WEBKIT_VERSION_5_1;
 @end
 
 @interface DOMHTMLEmbedElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -601,6 +605,7 @@
 @property BOOL defaultChecked;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property(copy) NSString *accept;
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *align;
 @property(copy) NSString *alt;
 @property BOOL checked;
@@ -633,11 +638,13 @@
 @end
 
 @interface DOMHTMLLabelElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property(copy) NSString *htmlFor;
 @end
 
 @interface DOMHTMLLegendElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property(copy) NSString *align;
 @end
@@ -874,6 +881,7 @@
 @interface DOMHTMLTextAreaElement : DOMHTMLElement WEBKIT_VERSION_1_3
 @property(copy) NSString *defaultValue;
 @property(readonly, retain) DOMHTMLFormElement *form;
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property int cols;
 @property BOOL disabled;
 @property(copy) NSString *name;
diff --git a/Source/WebCore/bindings/scripts/CodeGenerator.pm b/Source/WebCore/bindings/scripts/CodeGenerator.pm
index d5b6bdf19..ea5835996 100644
--- a/Source/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/Source/WebCore/bindings/scripts/CodeGenerator.pm
@@ -528,7 +528,7 @@ sub ContentAttributeName
     my $contentAttributeName = $attribute->signature->extendedAttributes->{"Reflect"};
     return undef if !$contentAttributeName;
 
-    $contentAttributeName = lc $generator->AttributeNameForGetterAndSetter($attribute) if $contentAttributeName eq "1";
+    $contentAttributeName = lc $generator->AttributeNameForGetterAndSetter($attribute) if $contentAttributeName eq "VALUE_IS_MISSING";
 
     my $namespace = $generator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
 
@@ -627,7 +627,11 @@ sub GenerateCompileTimeCheckForEnumsIfNeeded
                 push(@checks, "#if ${conditionalString}\n");
             }
 
-            push(@checks, "COMPILE_ASSERT($value == ${interfaceName}::$name, ${interfaceName}Enum${name}IsWrongUseDoNotCheckConstants);\n");
+            if ($constant->extendedAttributes->{"ImplementedBy"}) {
+                push(@checks, "COMPILE_ASSERT($value == " . $constant->extendedAttributes->{"ImplementedBy"} . "::$name, ${interfaceName}Enum${name}IsWrongUseDoNotCheckConstants);\n");
+            } else {
+                push(@checks, "COMPILE_ASSERT($value == ${interfaceName}::$name, ${interfaceName}Enum${name}IsWrongUseDoNotCheckConstants);\n");
+            }
 
             if ($conditional) {
                 push(@checks, "#endif\n");
@@ -638,4 +642,25 @@ sub GenerateCompileTimeCheckForEnumsIfNeeded
     return @checks;
 }
 
+sub ExtendedAttributeContains
+{
+    my $object = shift;
+    my $callWith = shift;
+    return 0 unless $callWith;
+    my $keyword = shift;
+
+    my @callWithKeywords = split /\s*\|\s*/, $callWith;
+    return grep { $_ eq $keyword } @callWithKeywords;
+}
+
+# FIXME: This is backwards. We currently name the interface and the IDL files with the implementation name. We
+# should use the real interface name in the IDL files and then use ImplementedAs to map this to the implementation name.
+sub GetVisibleInterfaceName
+{
+    my $object = shift;
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->extendedAttributes->{"InterfaceName"};
+    return $interfaceName ? $interfaceName : $dataNode->name;
+}
+
 1;
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
index a909a57d0..efe755290 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
@@ -191,16 +191,18 @@ sub ShouldSkipType
 {
     my $typeInfo = shift;
 
-    return 1 if $typeInfo->signature->extendedAttributes->{"Custom"};
-
-    return 1 if $typeInfo->signature->extendedAttributes->{"CustomArgumentHandling"}
-             or $typeInfo->signature->extendedAttributes->{"CustomGetter"}
-             or $typeInfo->signature->extendedAttributes->{"CPPCustom"};
+    return 1 if $typeInfo->signature->extendedAttributes->{"Custom"}
+                or $typeInfo->signature->extendedAttributes->{"CustomGetter"};
 
     # FIXME: We don't generate bindings for SVG related interfaces yet
     return 1 if $typeInfo->signature->name =~ /getSVGDocument/;
 
     return 1 if $typeInfo->signature->name =~ /Constructor/;
+    
+    # FIXME: This is typically used to add script execution state arguments to the method.
+    # These functions will not compile with the C++ bindings as is, so disable them
+    # to restore compilation until a proper implementation can be developed.
+    return 1 if $typeInfo->signature->extendedAttributes->{"CallWith"};
     return 0;
 }
 
@@ -462,7 +464,7 @@ sub GenerateHeader
     if ($numFunctions > 0) {
         foreach my $function (@{$dataNode->functions}) {
             next if ShouldSkipType($function);
-            my $functionName = $function->signature->name;
+            my $functionName = $function->signature->extendedAttributes->{"ImplementedAs"} || $function->signature->name;
 
             my $returnType = GetCPPType($function->signature->type, 0);
             my $numberOfParameters = @{$function->parameters};
@@ -807,7 +809,7 @@ sub GenerateImplementation
                 my $implGetter = GetCPPTypeGetter($paramName, $idlType);
 
                 push(@parameterNames, $implGetter);
-                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"Return"};
+                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"CustomReturn"};
 
                 unless ($codeGenerator->IsPrimitiveType($idlType) or $codeGenerator->IsStringType($idlType)) {
                     push(@needsAssert, "    ASSERT($paramName);\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index 6edfd0c80..47677a8c3 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -188,10 +188,11 @@ sub SkipFunction {
     my $prefix = shift;
 
     my $functionName = "webkit_dom_" . $decamelize . "_" . $prefix . decamelize($function->signature->name);
-    my $isCustomFunction = $function->signature->extendedAttributes->{"Custom"} ||
-        $function->signature->extendedAttributes->{"CustomArgumentHandling"};
+    my $isCustomFunction = $function->signature->extendedAttributes->{"Custom"};
+    my $callWith = $function->signature->extendedAttributes->{"CallWith"};
+    my $isUnsupportedCallWith = $codeGenerator->ExtendedAttributeContains($callWith, "ScriptArguments") || $codeGenerator->ExtendedAttributeContains($callWith, "CallStack");
 
-    if ($isCustomFunction &&
+    if (($isCustomFunction || $isUnsupportedCallWith) &&
         $functionName ne "webkit_dom_node_replace_child" &&
         $functionName ne "webkit_dom_node_insert_before" &&
         $functionName ne "webkit_dom_node_remove_child" &&
@@ -388,8 +389,8 @@ sub GenerateProperty {
         push(@setterArguments, "${convertFunction}(g_value_get_$gtype(value))");
         unshift(@getterArguments, "coreSelf");
         unshift(@setterArguments, "coreSelf");
-        $getterFunctionName = "${implementedBy}::$getterFunctionName";
-        $setterFunctionName = "${implementedBy}::$setterFunctionName";
+        $getterFunctionName = "WebCore::${implementedBy}::$getterFunctionName";
+        $setterFunctionName = "WebCore::${implementedBy}::$setterFunctionName";
     } else {
         push(@setterArguments, "${convertFunction}(g_value_get_$gtype(value))");
         $getterFunctionName = "coreSelf->$getterFunctionName";
@@ -417,7 +418,7 @@ sub GenerateProperty {
         push(@txtGetProps, "        g_value_take_string(value, convertToUTF8String(${getterFunctionName}(" . join(", ", @getterArguments) . ")));\n");
         $done = 1;
     } elsif ($gtype eq "object") {
-        push(@txtGetProps, "        RefPtr<WebCore::${propType}> ptr = coreSelf->${getPropNameFunction}(" . (@{$attribute->getterExceptions} ? "ec" : "") . ");\n");
+        push(@txtGetProps, "        RefPtr<WebCore::${propType}> ptr = ${getterFunctionName}(" . join(", ", @getterArguments) . ");\n");
         push(@txtGetProps, "        g_value_set_object(value, WebKit::kit(ptr.get()));\n");
         $done = 1;
     }
@@ -738,10 +739,6 @@ sub GenerateFunction {
 
     my @callImplParams;
 
-    # skip some custom functions for now
-    my $isCustomFunction = $function->signature->extendedAttributes->{"Custom"} ||
-                       $function->signature->extendedAttributes->{"CustomArgumentHandling"};
-
     foreach my $param (@{$function->parameters}) {
         my $paramIDLType = $param->type;
         if ($paramIDLType eq "EventListener" || $paramIDLType eq "MediaQueryListListener") {
@@ -868,7 +865,7 @@ sub GenerateFunction {
 
             push(@cBody, "    }\n");
         }
-        $returnParamName = "converted_".$paramName if $param->extendedAttributes->{"Return"};
+        $returnParamName = "converted_".$paramName if $param->extendedAttributes->{"CustomReturn"};
     }
 
     my $assign = "";
@@ -929,7 +926,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $functionName = "${implementedBy}::${functionName}";
+                $functionName = "WebCore::${implementedBy}::${functionName}";
             } else {
                 $functionName = "item->${functionName}";
             }
@@ -940,7 +937,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $getterContentHead = "${assign}convertToUTF8String(${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "));\n";
+                $getterContentHead = "${assign}convertToUTF8String(WebCore::${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "));\n";
             } else {
                 $getterContentHead = "${assign}convertToUTF8String(item->${functionSigName}(" . join(", ", @arguments) . "));\n";
             }
@@ -955,7 +952,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $functionName = "${implementedBy}::${functionName}";
+                $functionName = "WebCore::${implementedBy}::${functionName}";
             } else {
                 $functionName = "item->${functionName}";
             }
@@ -967,7 +964,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $functionName = "${implementedBy}::${functionName}";
+                $functionName = "WebCore::${implementedBy}::${functionName}";
                 $contentHead = "${assign}${assignPre}${functionName}(" . join(", ", @arguments) . "${assignPost});\n";
             } else {
                 $functionName = "item->${functionName}";
@@ -979,7 +976,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $contentHead = "${assign}${assignPre}${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "${assignPost});\n";
+                $contentHead = "${assign}${assignPre}WebCore::${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "${assignPost});\n";
             } else {
                 $contentHead = "${assign}${assignPre}item->${functionSigName}(" . join(", ", @arguments) . "${assignPost});\n";
             }
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 2e914262f..2aa9f5977 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -30,7 +30,7 @@ use strict;
 
 use constant FileNamePrefix => "JS";
 
-my ($codeGenerator);
+my $codeGenerator;
 
 my $module = "";
 my $outputDir = "";
@@ -189,20 +189,6 @@ sub GetParentClassName
     return "JS" . $codeGenerator->StripModule($dataNode->parents(0));
 }
 
-sub GetVisibleClassName
-{
-    my $className = shift;
-
-    return "DOMException" if $className eq "DOMCoreException";
-    return "FormData" if $className eq "DOMFormData";
-    return "MimeType" if $className eq "DOMMimeType";
-    return "MimeTypeArray" if $className eq "DOMMimeTypeArray";
-    return "Plugin" if $className eq "DOMPlugin";
-    return "PluginArray" if $className eq "DOMPluginArray";
-    
-    return $className;
-}
-
 sub GetCallbackClassName
 {
     my $className = shift;
@@ -274,6 +260,8 @@ sub AddIncludesForType
     } elsif ($type eq "DOMString[]") {
         # FIXME: Add proper support for T[], T[]?, sequence<T>
         $includesRef->{"JSDOMStringList.h"} = 1;
+    } elsif ($type eq "unsigned long[]") {
+        $includesRef->{"<wtf/Vector.h>"} = 1;
     } elsif ($isCallback) {
         $includesRef->{"JS${type}.h"} = 1;
     } elsif (IsTypedArrayType($type)) {
@@ -437,7 +425,7 @@ sub GenerateGetOwnPropertySlotBody
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(ok);\n");
 
-        # If the item function returns a string then we let the ConvertNullStringTo handle the cases
+        # If the item function returns a string then we let the TreatReturnedNullStringAs handle the cases
         # where the index is out of range.
         if (IndexGetterReturnsStrings($implClassName)) {
             push(@getOwnPropertySlotImpl, "    if (ok) {\n");
@@ -469,7 +457,7 @@ sub GenerateGetOwnPropertySlotBody
         &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}) {
         push(@getOwnPropertySlotImpl, "    if (thisObject->getOwnPropertySlotDelegate(exec, propertyName, slot))\n");
         push(@getOwnPropertySlotImpl, "        return true;\n");
     }
@@ -495,7 +483,7 @@ sub GenerateGetOwnPropertyDescriptorBody
     my $namespaceMaybe = ($inlined ? "JSC::" : "");
     
     my @getOwnPropertyDescriptorImpl = ();
-    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+    if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
         if ($interfaceName eq "DOMWindow") {
             push(@implContent, "    if (!thisObject->allowsAccessFrom(exec))\n");
         } else {
@@ -570,7 +558,7 @@ sub GenerateGetOwnPropertyDescriptorBody
         &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}) {
         push(@getOwnPropertyDescriptorImpl, "    if (thisObject->getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
         push(@getOwnPropertyDescriptorImpl, "        return true;\n");
     }
@@ -758,7 +746,7 @@ sub GenerateHeader
                  || $dataNode->extendedAttributes->{"IndexedGetter"}
                  || $dataNode->extendedAttributes->{"NumericIndexedGetter"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
-                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}
+                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}
                  || $dataNode->extendedAttributes->{"NamedGetter"}
                  || $dataNode->extendedAttributes->{"CustomNamedGetter"};
 
@@ -767,8 +755,8 @@ sub GenerateHeader
         push(@headerContent, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\n");
         push(@headerContent, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) && !$dataNode->extendedAttributes->{"CustomNamedGetter"};
-        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"};
-        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"};
+        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
         $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
 
@@ -794,6 +782,7 @@ sub GenerateHeader
 
     if (!$hasParent) {
         push(@headerContent, "    static void destroy(JSC::JSCell*);\n");
+        push(@headerContent, "    ~${className}();\n");
     }
 
     # Class info
@@ -828,7 +817,7 @@ sub GenerateHeader
     }
 
     # Custom getOwnPropertyNames function
-    if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
+    if ($dataNode->extendedAttributes->{"CustomEnumerateProperty"} || $dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
         push(@headerContent, "    static void getOwnPropertyNames(JSC::JSObject*, JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);\n");
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
     }
@@ -1002,7 +991,7 @@ sub GenerateHeader
         push(@headerContent, "\n");
     }
 
-    if (!$hasParent || $dataNode->extendedAttributes->{"JSGenerateToJS"} || $dataNode->extendedAttributes->{"JSCustomToJS"}) {
+    if (!$hasParent || $dataNode->extendedAttributes->{"JSGenerateToJSObject"} || ($dataNode->extendedAttributes->{"CustomToJSObject"} || $dataNode->extendedAttributes->{"JSCustomToJSObject"})) {
         push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, $implType*);\n");
     }
     if (!$hasParent || $dataNode->extendedAttributes->{"JSGenerateToNativeObject"}) {
@@ -1048,13 +1037,13 @@ sub GenerateHeader
         "    {\n" .
         "        return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);\n" .
         "    }\n");
-    if ($dataNode->extendedAttributes->{"JSCustomPrototypePutDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomNamedGetterOnPrototype"}) {
         push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
         push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
     }
 
     # Custom defineOwnProperty function
-    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomPrototypeDefineOwnProperty"};
+    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomDefineOwnPropertyOnPrototype"};
 
     push(@headerContent, "\nprivate:\n");
     push(@headerContent, "    ${className}Prototype(JSC::JSGlobalData& globalData, JSC::JSGlobalObject*, JSC::Structure* structure) : JSC::JSNonFinalObject(globalData, structure) { }\n");
@@ -1320,7 +1309,7 @@ sub GenerateImplementation
     my $hasRealParent = @{$dataNode->parents} > 0;
     my $hasParent = $hasLegacyParent || $hasRealParent;
     my $parentClassName = GetParentClassName($dataNode);
-    my $visibleClassName = GetVisibleClassName($interfaceName);
+    my $visibleInterfaceName = $codeGenerator->GetVisibleInterfaceName($dataNode);
     my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
     my $needsMarkChildren = $dataNode->extendedAttributes->{"JSCustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
 
@@ -1340,9 +1329,6 @@ sub GenerateImplementation
     push(@implContent, "namespace WebCore {\n\n");
 
     push(@implContent, "ASSERT_CLASS_FITS_IN_CELL($className);\n");
-    if ($interfaceName ne "DOMWindow" && !$dataNode->extendedAttributes->{"IsWorkerContext"}) {
-        push(@implContent, "ASSERT_HAS_TRIVIAL_DESTRUCTOR($className);\n\n");
-    }
 
     my $numAttributes = GenerateAttributesHashTable($object, $dataNode);
 
@@ -1369,6 +1355,10 @@ sub GenerateImplementation
             push(@hashValue2, "0");
             push(@hashSpecials, "DontDelete | ReadOnly");
 
+            my $implementedBy = $constant->extendedAttributes->{"ImplementedBy"};
+            if ($implementedBy) {
+                $implIncludes{"${implementedBy}.h"} = 1;
+            }
             my $conditional = $constant->extendedAttributes->{"Conditional"};
             if ($conditional) {
                 $conditionals{$name} = $conditional;
@@ -1408,7 +1398,7 @@ sub GenerateImplementation
         push(@implContent, $codeGenerator->GenerateCompileTimeCheckForEnumsIfNeeded($dataNode));
 
         my $protoClassName = "${className}Prototype";
-        GenerateConstructorDefinition(\@implContent, $className, $protoClassName, $interfaceName, $visibleClassName, $dataNode);
+        GenerateConstructorDefinition(\@implContent, $className, $protoClassName, $interfaceName, $visibleInterfaceName, $dataNode);
         if ($dataNode->extendedAttributes->{"NamedConstructor"}) {
             GenerateConstructorDefinition(\@implContent, $className, $protoClassName, $interfaceName, $dataNode->extendedAttributes->{"NamedConstructor"}, $dataNode, "GeneratingNamedConstructor");
         }
@@ -1474,9 +1464,9 @@ sub GenerateImplementation
         push(@implContent, "{\n");
         push(@implContent, "    return getHashTableForGlobalData(exec->globalData(), &${className}PrototypeTable);\n");
         push(@implContent, "}\n\n");
-        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleClassName}Prototype\", &Base::s_info, 0, get${className}PrototypeTable, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
+        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleInterfaceName}Prototype\", &Base::s_info, 0, get${className}PrototypeTable, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
     } else {
-        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleClassName}Prototype\", &Base::s_info, &${className}PrototypeTable, 0, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
+        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleInterfaceName}Prototype\", &Base::s_info, &${className}PrototypeTable, 0, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
     }
     if ($interfaceName ne "DOMWindow" && !$dataNode->extendedAttributes->{"IsWorkerContext"}) {
         push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec, JSGlobalObject* globalObject)\n");
@@ -1517,7 +1507,7 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
-    if ($dataNode->extendedAttributes->{"JSCustomPrototypePutDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomNamedGetterOnPrototype"}) {
         push(@implContent, "void ${className}Prototype::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}Prototype* thisObject = jsCast<${className}Prototype*>(cell);\n");
@@ -1535,7 +1525,7 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
-    push(@implContent, "const ClassInfo $className" . "::s_info = { \"${visibleClassName}\", &Base::s_info, ");
+    push(@implContent, "const ClassInfo $className" . "::s_info = { \"${visibleInterfaceName}\", &Base::s_info, ");
 
     if ($numAttributes > 0 && !$dataNode->extendedAttributes->{"JSNoStaticTables"}) {
         push(@implContent, "&${className}Table");
@@ -1615,7 +1605,14 @@ sub GenerateImplementation
         push(@implContent, "void ${className}::destroy(JSC::JSCell* cell)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(cell);\n");
-        push(@implContent, "    thisObject->releaseImplIfNotNull();\n");
+        push(@implContent, "    thisObject->${className}::~${className}();\n");
+        push(@implContent, "}\n\n");
+
+        # We also need a destructor for the allocateCell to work properly with the destructor-free part of the heap.
+        # Otherwise, these destroy functions/destructors won't get called.
+        push(@implContent, "${className}::~${className}()\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    releaseImplIfNotNull();\n");
         push(@implContent, "}\n\n");
     }
 
@@ -1623,7 +1620,7 @@ sub GenerateImplementation
                  || !$dataNode->extendedAttributes->{"OmitConstructor"} 
                  || $dataNode->extendedAttributes->{"IndexedGetter"}
                  || $dataNode->extendedAttributes->{"NumericIndexedGetter"}
-                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}
+                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"NamedGetter"}
                  || $dataNode->extendedAttributes->{"CustomNamedGetter"};
@@ -1681,16 +1678,16 @@ sub GenerateImplementation
                     $needsMarkChildren = 1;
                 }
 
-                if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && 
-                        !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurity"} &&
-                        !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurityOnGetter"}) {
+                if ($dataNode->extendedAttributes->{"CheckSecurity"} && 
+                        !$attribute->signature->extendedAttributes->{"DoNotCheckSecurity"} &&
+                        !$attribute->signature->extendedAttributes->{"DoNotCheckSecurityOnGetter"}) {
                     push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
                     push(@implContent, "        return jsUndefined();\n");
                 }
 
                 if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"}) {
                     push(@implContent, "    return castedThis->$implGetterFunctionName(exec);\n");
-                } elsif ($attribute->signature->extendedAttributes->{"CheckAccessToNode"}) {
+                } elsif ($attribute->signature->extendedAttributes->{"CheckSecurityForNode"}) {
                     $implIncludes{"JSDOMBinding.h"} = 1;
                     push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
                     push(@implContent, "    return shouldAllowAccessToNode(exec, impl->" . $attribute->signature->name . "()) ? " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl->$implGetterFunctionName()", "castedThis") . " : jsUndefined();\n");
@@ -1716,10 +1713,7 @@ sub GenerateImplementation
                     # Once JSDOMWrappers have a back-pointer to the globalObject we can pass castedThis->globalObject()
                     push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec, castedThis);\n");
                 } elsif (!@{$attribute->getterExceptions}) {
-                    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"};
-                    my $callWithArg = "";
-
-                    push(@implContent, "    UNUSED_PARAM(exec);\n") if (!$callWith);
+                    push(@implContent, "    UNUSED_PARAM(exec);\n") if !$attribute->signature->extendedAttributes->{"CallWith"};
 
                     my $cacheIndex = 0;
                     if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
@@ -1729,18 +1723,16 @@ sub GenerateImplementation
                         push(@implContent, "        return cachedValue;\n");
                     }
 
-                    if ($callWith) {
-                        $callWithArg = GenerateCallWith($callWith, \@implContent, "jsUndefined()");
-                    }
+                    my @callWithArgs = GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()");
 
                     if ($svgListPropertyType) {
-                        push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "castedThis->impl()->$implGetterFunctionName($callWithArg)", "castedThis") . ";\n");
+                        push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "castedThis->impl()->$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
                     } elsif ($svgPropertyOrListPropertyType) {
                         push(@implContent, "    $svgPropertyOrListPropertyType& impl = castedThis->impl()->propertyReference();\n");
                         if ($svgPropertyOrListPropertyType eq "float") { # Special case for JSSVGNumber
                             push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl", "castedThis") . ";\n");
                         } else {
-                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName($callWithArg)", "castedThis") . ";\n");
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
 
                         }
                     } else {
@@ -1754,9 +1746,7 @@ sub GenerateImplementation
                             $functionName = "impl->${functionName}";
                         }
 
-                        if ($callWith) {
-                            unshift(@arguments, $callWithArg);
-                        }
+                        unshift(@arguments, @callWithArgs);
 
                         my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, "${functionName}(" . join(", ", @arguments) . ")", "castedThis");
                         push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
@@ -1772,14 +1762,10 @@ sub GenerateImplementation
                     push(@implContent, "    return result;\n");
 
                 } else {
-                    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"};
                     my @arguments = ("ec");
+                    push(@implContent, "    ExceptionCode ec = 0;\n");
 
-                    push(@implContent, "    ExceptionCode ec = 0;\n");                    
-
-                    if ($callWith) {
-                        unshift(@arguments, GenerateCallWith($callWith, \@implContent, "jsUndefined()"));
-                    }
+                    unshift(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()"));
 
                     if ($svgPropertyOrListPropertyType) {
                         push(@implContent, "    $svgPropertyOrListPropertyType impl(*castedThis->impl());\n");
@@ -1807,7 +1793,7 @@ sub GenerateImplementation
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* domObject = static_cast<$className*>(asObject(slotBase));\n");
 
-                if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+                if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
                     push(@implContent, "    if (!domObject->allowsAccessFrom(exec))\n");
                     push(@implContent, "        return jsUndefined();\n");
                 }
@@ -1878,7 +1864,7 @@ sub GenerateImplementation
                         push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                         push(@implContent, "{\n");
 
-                        if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+                        if ($dataNode->extendedAttributes->{"CheckSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
                             if ($interfaceName eq "DOMWindow") {
                                 push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
                             } else {
@@ -1983,10 +1969,7 @@ sub GenerateImplementation
                                     $functionName = "impl->${functionName}";
                                 }
 
-                                my $callWith = $attribute->signature->extendedAttributes->{"CallWith"};
-                                if ($callWith) {
-                                    unshift(@arguments, GenerateCallWith($callWith, \@implContent, ""));
-                                }
+                                unshift(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, ""));
 
                                 push(@arguments, "ec") if @{$attribute->setterExceptions};
                                 push(@implContent, "    ${functionName}(" . join(", ", @arguments) . ");\n");
@@ -2006,7 +1989,7 @@ sub GenerateImplementation
 
                 push(@implContent, "void ${constructorFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                 push(@implContent, "{\n");
-                if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+                if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
                     if ($interfaceName eq "DOMWindow") {
                         push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
                     } else {
@@ -2027,7 +2010,7 @@ sub GenerateImplementation
         }
     }
 
-    if (($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
+    if (($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) && !$dataNode->extendedAttributes->{"CustomEnumerateProperty"}) {
         push(@implContent, "void ${className}::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(object);\n");
@@ -2097,8 +2080,8 @@ sub GenerateImplementation
 
             push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(castedThis, &${className}::s_info);\n") unless ($function->isStatic);
 
-            if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} and
-                !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"} and
+            if ($dataNode->extendedAttributes->{"CheckSecurity"} and
+                !$function->signature->extendedAttributes->{"DoNotCheckSecurity"} and
                 !$function->isStatic) {
                 push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
                 push(@implContent, "        return JSValue::encode(jsUndefined());\n");
@@ -2123,7 +2106,7 @@ sub GenerateImplementation
                     push(@implContent, "    ExceptionCode ec = 0;\n");
                 }
 
-                if ($function->signature->extendedAttributes->{"CheckAccessToNode"} and !$function->isStatic) {
+                if ($function->signature->extendedAttributes->{"CheckSecurityForNode"} and !$function->isStatic) {
                     push(@implContent, "    if (!shouldAllowAccessToNode(exec, impl->" . $function->signature->name . "(" . (@{$function->raisesExceptions} ? "ec" : "") .")))\n");
                     push(@implContent, "        return JSValue::encode(jsUndefined());\n");
                     $implIncludes{"JSDOMBinding.h"} = 1;
@@ -2149,7 +2132,9 @@ sub GenerateImplementation
 
             push(@implContent, "#endif\n\n") if $conditional;
         }
-        
+    }
+
+    if ($numFunctions > 0 || $numCachedAttributes > 0) {
         if ($needsMarkChildren && !$dataNode->extendedAttributes->{"JSCustomMarkFunction"}) {
             push(@implContent, "void ${className}::visitChildren(JSCell* cell, SlotVisitor& visitor)\n");
             push(@implContent, "{\n");
@@ -2172,12 +2157,13 @@ sub GenerateImplementation
             }
             push(@implContent, "}\n\n");
         }
-        # Cached attributes are indeed allowed when there is a custom mark/visitChildren function.
-        # The custom function must make sure to account for the cached attribute.
-        # Uncomment the below line to temporarily enforce generated mark functions when cached attributes are present.
-        # die "Can't generate binding for class with cached attribute and custom mark." if (($numCachedAttributes > 0) and ($dataNode->extendedAttributes->{"JSCustomMarkFunction"}));
     }
 
+    # Cached attributes are indeed allowed when there is a custom mark/visitChildren function.
+    # The custom function must make sure to account for the cached attribute.
+    # Uncomment the below line to temporarily enforce generated mark functions when cached attributes are present.
+    # die "Can't generate binding for class with cached attribute and custom mark." if (($numCachedAttributes > 0) and ($dataNode->extendedAttributes->{"JSCustomMarkFunction"}));
+
     if ($numConstants > 0) {
         push(@implContent, "// Constant getters\n\n");
 
@@ -2316,7 +2302,7 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
-    if ((!$hasParent or $dataNode->extendedAttributes->{"JSGenerateToJS"}) and !$dataNode->extendedAttributes->{"JSCustomToJS"}) {
+    if ((!$hasParent or $dataNode->extendedAttributes->{"JSGenerateToJSObject"}) and !($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"JSCustomToJSObject"})) {
         push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* impl)\n");
         push(@implContent, "{\n");
         if ($svgPropertyType) {
@@ -2343,20 +2329,33 @@ sub GenerateImplementation
 sub GenerateCallWith
 {
     my $callWith = shift;
+    return () unless $callWith;
     my $outputArray = shift;
     my $returnValue = shift;
-    my $callWithArg = "COMPILE_ASSERT(false)";
+    my $function = shift;
 
-    if ($callWith eq "ScriptState") {
-        $callWithArg = "exec";
-    } elsif ($callWith eq "ScriptExecutionContext") {
+    my @callWithArgs;
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState")) {
+        push(@callWithArgs, "exec");
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptExecutionContext")) {
         push(@$outputArray, "    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();\n");
         push(@$outputArray, "    if (!scriptContext)\n");
         push(@$outputArray, "        return" . ($returnValue ? " " . $returnValue : "") . ";\n");
-        $callWithArg = "scriptContext";
+        push(@callWithArgs, "scriptContext");
     }
-
-    return $callWithArg;
+    if ($function and $codeGenerator->ExtendedAttributeContains($callWith, "ScriptArguments")) {
+        push(@$outputArray, "    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, " . @{$function->parameters} . "));\n");
+        $implIncludes{"ScriptArguments.h"} = 1;
+        push(@callWithArgs, "scriptArguments");
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "CallStack")) {
+        push(@$outputArray, "    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));\n");
+        $implIncludes{"ScriptCallStack.h"} = 1;
+        $implIncludes{"ScriptCallStackFactory.h"} = 1;
+        push(@callWithArgs, "callStack");
+    }
+    return @callWithArgs;
 }
 
 sub GenerateArgumentsCountCheck
@@ -2397,42 +2396,31 @@ sub GenerateParametersCheck
 
     my @arguments;
     my $functionName;
-    if ($function->isStatic) {
-        $functionName = "${implClassName}::${functionImplementationName}";
-    } elsif ($function->signature->extendedAttributes->{"ImplementedBy"}) {
-        my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    if ($implementedBy) {
         AddToImplIncludes("${implementedBy}.h");
-        unshift(@arguments, "impl");
+        unshift(@arguments, "impl") if !$function->isStatic;
         $functionName = "${implementedBy}::${functionImplementationName}";
+    } elsif ($function->isStatic) {
+        $functionName = "${implClassName}::${functionImplementationName}";
     } elsif ($svgPropertyOrListPropertyType and !$svgListPropertyType) {
         $functionName = "podImpl.${functionImplementationName}";
     } else {
         $functionName = "impl->${functionImplementationName}";
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"} and !$function->isStatic) {
-        push(@$outputArray, "    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, $numParameters));\n");
-        push(@$outputArray, "    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));\n");
-        $implIncludes{"ScriptArguments.h"} = 1;
-        $implIncludes{"ScriptCallStack.h"} = 1;
-        $implIncludes{"ScriptCallStackFactory.h"} = 1;
-    }
-
-    my $callWith = $function->signature->extendedAttributes->{"CallWith"};
-    if ($callWith and !$function->signature->extendedAttributes->{"Constructor"}) {
-        push(@arguments, GenerateCallWith($callWith, \@$outputArray, "JSValue::encode(jsUndefined())"));
+    if (!$function->signature->extendedAttributes->{"Constructor"}) {
+        push(@arguments, GenerateCallWith($function->signature->extendedAttributes->{"CallWith"}, \@$outputArray, "JSValue::encode(jsUndefined())", $function));
     }
 
     $implIncludes{"ExceptionCode.h"} = 1;
     $implIncludes{"JSDOMBinding.h"} = 1;
 
     foreach my $parameter (@{$function->parameters}) {
-        # Optional callbacks should be treated differently, because they always have a default value (0),
-        # and we can reduce the number of overloaded functions that take a different number of parameters.
-        # Optional arguments with [Optional=CallWithDefaultValue] or [Optional=CallWithNullValue]
-        # should not generate an early call.
+        # Optional arguments with [Optional] should generate an early call with fewer arguments.
+        # Optional arguments with [Optional=...] should not generate the early call.
         my $optional = $parameter->extendedAttributes->{"Optional"};
-        if ($optional && $optional ne "CallWithDefaultValue" && $optional ne "CallWithNullValue" && !$parameter->extendedAttributes->{"Callback"}) {
+        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && !$parameter->extendedAttributes->{"Callback"}) {
             # Generate early call if there are enough parameters.
             if (!$hasOptionalArguments) {
                 push(@$outputArray, "\n    size_t argsCount = exec->argumentCount();\n");
@@ -2441,9 +2429,6 @@ sub GenerateParametersCheck
             push(@$outputArray, "    if (argsCount <= $argsIndex) {\n");
 
             my @optionalCallbackArguments = @arguments;
-            if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-                push @optionalCallbackArguments, "scriptArguments, callStack";
-            }
             if (@{$function->raisesExceptions}) {
                 push @optionalCallbackArguments, "ec";
             }
@@ -2467,7 +2452,7 @@ sub GenerateParametersCheck
         } elsif ($parameter->extendedAttributes->{"Callback"}) {
             my $callbackClassName = GetCallbackClassName($argType);
             $implIncludes{"$callbackClassName.h"} = 1;
-            if ($parameter->extendedAttributes->{"Optional"}) {
+            if ($optional) {
                 push(@$outputArray, "    RefPtr<$argType> $name;\n");
                 push(@$outputArray, "    if (exec->argumentCount() > $argsIndex && !exec->argument($argsIndex).isUndefinedOrNull()) {\n");
                 push(@$outputArray, "        if (!exec->argument($argsIndex).isObject()) {\n");
@@ -2499,13 +2484,12 @@ sub GenerateParametersCheck
                 }
             }
 
-            my $optional = $parameter->extendedAttributes->{"Optional"};
-            my $parameterMissingPolicy = "MissingIsUndefined";
-            if ($optional && $optional eq "CallWithNullValue") {
-                $parameterMissingPolicy = "MissingIsEmpty";
+            my $parameterDefaultPolicy = "DefaultIsUndefined";
+            if ($optional and $optional eq "DefaultIsNullString") {
+                $parameterDefaultPolicy = "DefaultIsNullString";
             }
 
-            push(@$outputArray, "    " . GetNativeTypeFromSignature($parameter) . " $name(" . JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(exec, $argsIndex, $parameterMissingPolicy)") . ");\n");
+            push(@$outputArray, "    " . GetNativeTypeFromSignature($parameter) . " $name(" . JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(exec, $argsIndex, $parameterDefaultPolicy)") . ");\n");
 
             # If a parameter is "an index" and it's negative it should throw an INDEX_SIZE_ERR exception.
             # But this needs to be done in the bindings, because the type is unsigned and the fact that it
@@ -2539,9 +2523,6 @@ sub GenerateParametersCheck
         $argsIndex++;
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push @arguments, "scriptArguments, callStack";
-    }
     if (@{$function->raisesExceptions}) {
         push @arguments, "ec";
     }
@@ -2732,8 +2713,7 @@ sub GenerateImplementationFunctionCall()
         push(@implContent, "\n" . $indent . "JSC::JSValue result = " . NativeToJSValue($function->signature, 1, $implClassName, $functionString, "castedThis") . ";\n");
         push(@implContent, $indent . "setDOMException(exec, ec);\n") if @{$function->raisesExceptions};
 
-        my $callWith = $function->signature->extendedAttributes->{"CallWith"};
-        if ($callWith and $callWith eq "ScriptState") {
+        if ($codeGenerator->ExtendedAttributeContains($function->signature->extendedAttributes->{"CallWith"}, "ScriptState")) {
             push(@implContent, $indent . "if (exec->hadException())\n");
             push(@implContent, $indent . "    return JSValue::encode(jsUndefined());\n");
         }
@@ -2774,7 +2754,8 @@ my %nativeType = (
     "long long" => "long long",
     "unsigned long long" => "unsigned long long",
     "MediaQueryListListener" => "RefPtr<MediaQueryListListener>",
-    "DOMTimeStamp" => "DOMTimeStamp"
+    "DOMTimeStamp" => "DOMTimeStamp",
+    "unsigned long[]" => "Vector<unsigned long>"
 );
 
 sub GetNativeType
@@ -2903,6 +2884,11 @@ sub JSValueToNative
         return "toDOMStringList($value)";
     }
 
+    if ($type eq "unsigned long[]") {
+        AddToImplIncludes("JSDOMBinding.h", $conditional);
+        return "jsUnsignedLongArrayToVector(exec, $value)";
+    }
+
     AddToImplIncludes("HTMLOptionElement.h", $conditional) if $type eq "HTMLOptionElement";
     AddToImplIncludes("JSCustomVoidCallback.h", $conditional) if $type eq "VoidCallback";
     AddToImplIncludes("Event.h", $conditional) if $type eq "Event";
@@ -2941,20 +2927,18 @@ sub NativeToJSValue
 
     if ($codeGenerator->IsStringType($type)) {
         AddToImplIncludes("KURL.h", $conditional);
-        my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
+        my $conv = $signature->extendedAttributes->{"TreatReturnedNullStringAs"};
         if (defined $conv) {
             return "jsStringOrNull(exec, $value)" if $conv eq "Null";
             return "jsStringOrUndefined(exec, $value)" if $conv eq "Undefined";
             return "jsStringOrFalse(exec, $value)" if $conv eq "False";
 
-            die "Unknown value for ConvertNullStringTo extended attribute";
+            die "Unknown value for TreatReturnedNullStringAs extended attribute";
         }
-        $conv = $signature->extendedAttributes->{"ConvertScriptString"};
-        return "jsOwnedStringOrNull(exec, $value)" if $conv;
         AddToImplIncludes("<runtime/JSString.h>", $conditional);
         return "jsString(exec, $value)";
     }
-    
+
     my $globalObject = "$thisValue->globalObject()";
 
     if ($type eq "CSSStyleDeclaration") {
@@ -2979,6 +2963,8 @@ sub NativeToJSValue
     } elsif ($type eq "SerializedScriptValue" or $type eq "any") {
         AddToImplIncludes("SerializedScriptValue.h", $conditional);
         return "$value ? $value->deserialize(exec, castedThis->globalObject(), 0) : jsNull()";
+    } elsif ($type eq "unsigned long[]") {
+        AddToImplIncludes("<wrt/Vector.h>", $conditional);
     } else {
         # Default, include header with same name.
         AddToImplIncludes("JS$type.h", $conditional);
@@ -3298,7 +3284,6 @@ sub GenerateConstructorDeclaration
     my $interfaceName = shift;
 
     my $constructorClassName = "${className}Constructor";
-    my $callWith = $dataNode->extendedAttributes->{"CallWith"};
 
     push(@$outputArray, "class ${constructorClassName} : public DOMConstructorObject {\n");
     push(@$outputArray, "private:\n");
@@ -3374,23 +3359,28 @@ sub GenerateConstructorDefinition
     my $className = shift;
     my $protoClassName = shift;
     my $interfaceName = shift;
-    my $visibleClassName = shift;
+    my $visibleInterfaceName = shift;
     my $dataNode = shift;
     my $generatingNamedConstructor = shift;
 
     my $constructorClassName = $generatingNamedConstructor ? "${className}NamedConstructor" : "${className}Constructor";
-    my $numberOfconstructParameters = $dataNode->extendedAttributes->{"ConstructorParameters"};
+    my $numberOfConstructorParameters = $dataNode->extendedAttributes->{"ConstructorParameters"};
+    if (!defined $numberOfConstructorParameters) {
+        if (IsConstructorTemplate($dataNode, "Event")) {
+            $numberOfConstructorParameters = 2;
+        } elsif ($dataNode->extendedAttributes->{"Constructor"} and !$dataNode->extendedAttributes->{"CustomConstructor"} and !$dataNode->extendedAttributes->{"JSCustomConstructor"}) {
+            $numberOfConstructorParameters = @{$dataNode->constructor->parameters};
+        }
+    }
 
     if ($generatingNamedConstructor) {
-        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleClassName}Constructor\", &Base::s_info, 0, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
+        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleInterfaceName}Constructor\", &Base::s_info, 0, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
         push(@$outputArray, "${constructorClassName}::${constructorClassName}(Structure* structure, JSDOMGlobalObject* globalObject)\n");
         push(@$outputArray, "    : DOMConstructorWithDocument(structure, globalObject)\n");
         push(@$outputArray, "{\n");
         push(@$outputArray, "}\n\n");
     } else {
-        push(@$outputArray, "ASSERT_HAS_TRIVIAL_DESTRUCTOR(${constructorClassName});\n\n");
-
-        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleClassName}Constructor\", &Base::s_info, &${constructorClassName}Table, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
+        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleInterfaceName}Constructor\", &Base::s_info, &${constructorClassName}Table, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
         push(@$outputArray, "${constructorClassName}::${constructorClassName}(Structure* structure, JSDOMGlobalObject* globalObject)\n");
         push(@$outputArray, "    : DOMConstructorObject(structure, globalObject)\n");
         push(@$outputArray, "{\n");
@@ -3412,7 +3402,7 @@ sub GenerateConstructorDefinition
         push(@$outputArray, "    ASSERT(inherits(&s_info));\n");
         push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), DontDelete | ReadOnly);\n");
     }
-    push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(${numberOfconstructParameters}), ReadOnly | DontDelete | DontEnum);\n") if $numberOfconstructParameters;
+    push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(${numberOfConstructorParameters}), ReadOnly | DontDelete | DontEnum);\n") if defined $numberOfConstructorParameters;
     push(@$outputArray, "}\n\n");
 
     if (!$generatingNamedConstructor) {
@@ -3526,7 +3516,7 @@ END
             my $numParameters = @{$function->parameters};
             my ($dummy, $paramIndex) = GenerateParametersCheck($outputArray, $function, $dataNode, $numParameters, $interfaceName, "constructorCallback", undef, undef, undef);
 
-            if ($dataNode->extendedAttributes->{"CallWith"} && $dataNode->extendedAttributes->{"CallWith"} eq "ScriptExecutionContext") {
+            if ($codeGenerator->ExtendedAttributeContains($dataNode->extendedAttributes->{"CallWith"}, "ScriptExecutionContext")) {
                 push(@constructorArgList, "context");
                 push(@$outputArray, "    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();\n");
                 push(@$outputArray, "    if (!context)\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 5a63fc33b..3978481bc 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -1495,7 +1495,7 @@ sub GenerateImplementation
                 $needsCustom{"NodeFilter"} = $paramName if $idlType eq "NodeFilter";
                 $needsCustom{"EventListener"} = $paramName if $idlType eq "EventListener";
                 $needsCustom{"EventTarget"} = $paramName if $idlType eq "EventTarget";
-                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"Return"};
+                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"CustomReturn"};
 
                 unless ($codeGenerator->IsPrimitiveType($idlType) or $codeGenerator->IsStringType($idlType)) {
                     push(@needsAssert, "    ASSERT($paramName);\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 10015ad3e..8c46f8c42 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006 Apple Computer, Inc.
-# Copyright (C) 2007-2012 Google Inc.
+# Copyright (C) 2007, 2008, 2009 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # Copyright (C) Research In Motion Limited 2010. All rights reserved.
 # Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
@@ -32,7 +32,7 @@ use Digest::MD5;
 
 use constant FileNamePrefix => "V8";
 
-my ($codeGenerator);
+my $codeGenerator;
 
 my $module = "";
 my $outputDir = "";
@@ -407,7 +407,7 @@ END
     GenerateHeaderCustomCall($dataNode);
     GenerateHeaderCustomInternalFieldIndices($dataNode);
 
-    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+    if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
         push(@headerContent, <<END);
     static bool namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType, v8::Local<v8::Value> data);
     static bool indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t index, v8::AccessType, v8::Local<v8::Value> data);
@@ -427,7 +427,7 @@ END
 ALWAYS_INLINE v8::Handle<v8::Object> ${className}::existingWrapper(${nativeType}* impl)
 {
 END
-    my $getWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getWrapper(impl)" : "${domMapFunction}.get(impl)";
+    my $getWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getExistingWrapper(impl)" : "${domMapFunction}.get(impl)";
     push(@headerContent, <<END);
     return ${getWrapper};
 }
@@ -447,7 +447,7 @@ END
 }
 END
 
-    if (!HasCustomToV8Implementation($dataNode, $interfaceName)) {
+    if (!($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"V8CustomToJSObject"})) {
         push(@headerContent, <<END);
 
 inline v8::Handle<v8::Value> toV8(${nativeType}* impl${forceNewObjectParameter})
@@ -469,14 +469,11 @@ v8::Handle<v8::Value> toV8Slow(Node*, bool);
 
 inline v8::Handle<v8::Value> toV8(Node* impl, bool forceNewObject = false)
 {
-    if (!impl)
+    if (UNLIKELY(!impl))
         return v8::Null();
-    if (!forceNewObject) {
-        v8::Handle<v8::Value> wrapper = V8DOMWrapper::getWrapper(impl);
-        if (!wrapper.IsEmpty())
-            return wrapper;
-    }
-    return toV8Slow(impl, forceNewObject);
+    if (UNLIKELY(forceNewObject))
+        return toV8Slow(impl, forceNewObject);
+    return V8DOMWrapper::getWrapper(impl);
 }
 END
     }
@@ -568,7 +565,7 @@ sub GenerateHeaderNamedAndIndexedPropertyAccessors
     my $hasCustomNamedGetter = $dataNode->extendedAttributes->{"NamedGetter"} || $dataNode->extendedAttributes->{"CustomNamedGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
     my $hasCustomNamedSetter = $dataNode->extendedAttributes->{"CustomNamedSetter"};
     my $hasCustomDeleters = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
-    my $hasCustomEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    my $hasCustomEnumerator = $dataNode->extendedAttributes->{"CustomEnumerateProperty"};
     if ($interfaceName eq "HTMLOptionsCollection") {
         $interfaceName = "HTMLCollection";
         $hasCustomIndexedGetter = 1;
@@ -678,7 +675,7 @@ sub IsNodeSubType
 sub IsVisibleAcrossOrigins
 {
     my $dataNode = shift;
-    return $dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($dataNode->name eq "DOMWindow");
+    return $dataNode->extendedAttributes->{"CheckSecurity"} && !($dataNode->name eq "DOMWindow");
 }
 
 sub IsConstructable
@@ -831,7 +828,7 @@ END
         my $url = $attribute->signature->extendedAttributes->{"URL"};
         if ($getterStringUsesImp && $reflect && !$url && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
             # Generate super-compact call for regular attribute getter:
-            my $contentAttributeName = $reflect eq "1" ? lc $attrName : $reflect;
+            my $contentAttributeName = $reflect eq "VALUE_IS_MISSING" ? lc $attrName : $reflect;
             my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
             AddToImplIncludes("${namespace}.h");
             push(@implContentDecls, "    return getElementStringAttr(info, ${namespace}::${contentAttributeName}Attr);\n");
@@ -854,7 +851,7 @@ END
     }
 
     # Generate security checks if necessary
-    if ($attribute->signature->extendedAttributes->{"CheckAccessToNode"}) {
+    if ($attribute->signature->extendedAttributes->{"CheckSecurityForNode"}) {
         push(@implContentDecls, "    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->" . $attribute->signature->name . "()))\n    return v8::Handle<v8::Value>();\n\n");
     }
 
@@ -866,14 +863,11 @@ END
 
     my $returnType = GetTypeFromSignature($attribute->signature);
     my $getterString;
-    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"} || "";
 
     if ($getterStringUsesImp) {
         my ($functionName, @arguments) = $codeGenerator->GetterExpression(\%implIncludes, $interfaceName, $attribute);
 
-        if ($callWith) {
-            push(@arguments, GenerateCallWith($callWith, \@implContentDecls, "    ", 0, 0));
-        }
+        push(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContentDecls, "    ", 0, 0));
 
         push(@arguments, "ec") if $useExceptions;
         if ($attribute->signature->extendedAttributes->{"ImplementedBy"}) {
@@ -905,7 +899,7 @@ END
         }
         push(@implContentDecls, GenerateSetDOMException("    "));
 
-        if ($callWith eq "ScriptState") {
+        if ($codeGenerator->ExtendedAttributeContains($attribute->signature->extendedAttributes->{"CallWith"}, "ScriptState")) {
             push(@implContentDecls, "    if (state.hadException())\n");
             push(@implContentDecls, "        return throwError(state.exception());\n");
         }
@@ -922,7 +916,7 @@ END
     # Special case for readonly or Replaceable attributes (with a few exceptions). This attempts to ensure that JS wrappers don't get
     # garbage-collected prematurely when their lifetime is strongly tied to their owner. We accomplish this by inserting a reference to
     # the newly created wrapper into an internal field of the holder object.
-    if ($attrName ne "self" && (IsWrapperType($returnType) && ($attribute->type =~ /^readonly/ || $attribute->signature->extendedAttributes->{"Replaceable"})
+    if (!IsNodeSubType($dataNode) && $attrName ne "self" && (IsWrapperType($returnType) && ($attribute->type =~ /^readonly/ || $attribute->signature->extendedAttributes->{"Replaceable"})
         && $returnType ne "EventTarget" && $returnType ne "SerializedScriptValue" && $returnType ne "DOMWindow" 
         && $returnType !~ /SVG/ && $returnType !~ /HTML/ && !IsDOMNodeType($returnType))) {
         AddIncludesForType($returnType);
@@ -1075,7 +1069,7 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         if ($reflect && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
             # Generate super-compact call for regular attribute setter:
-            my $contentAttributeName = $reflect eq "1" ? lc $attrName : $reflect;
+            my $contentAttributeName = $reflect eq "VALUE_IS_MISSING" ? lc $attrName : $reflect;
             my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
             AddToImplIncludes("${namespace}.h");
             push(@implContentDecls, "    setElementStringAttr(info, ${namespace}::${contentAttributeName}Attr, value);\n");
@@ -1118,8 +1112,6 @@ END
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
     }
 
-    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"} || "";
-
     if ($implClassName eq "SVGNumber") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
@@ -1145,9 +1137,7 @@ END
         } else {
             my ($functionName, @arguments) = $codeGenerator->SetterExpression(\%implIncludes, $interfaceName, $attribute);
 
-            if ($callWith) {
-                push(@arguments, GenerateCallWith($callWith, \@implContentDecls, "    ", 1, 0));
-            }
+            push(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContentDecls, "    ", 1, 0));
 
             push(@arguments, $result);
             push(@arguments, "ec") if $useExceptions;
@@ -1168,7 +1158,7 @@ END
         push(@implContentDecls, "        V8Proxy::setDOMException(ec);\n");
     }
 
-    if ($callWith eq "ScriptState") {
+    if ($codeGenerator->ExtendedAttributeContains($attribute->signature->extendedAttributes->{"CallWith"}, "ScriptState")) {
         push(@implContentDecls, "    if (state.hadException())\n");
         push(@implContentDecls, "        throwError(state.exception());\n");
     }
@@ -1371,8 +1361,6 @@ static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments& args)
     INC_STATS(\"DOM.$implClassName.$name\");
 END
 
-    my $numParameters = @{$function->parameters};
-
     push(@implContentDecls, GenerateArgumentsCountCheck($function, $dataNode));
 
     my ($svgPropertyType, $svgListPropertyType, $svgNativeType) = GetSVGPropertyTypes($implClassName);
@@ -1399,9 +1387,9 @@ END
     }
 
     # Check domain security if needed
-    if (($dataNode->extendedAttributes->{"CheckDomainSecurity"}
+    if (($dataNode->extendedAttributes->{"CheckSecurity"}
        || $interfaceName eq "DOMWindow")
-       && !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+       && !$function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
     # We have not find real use cases yet.
     push(@implContentDecls, <<END);
     if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
@@ -1427,18 +1415,7 @@ END
         # right before the label 'fail:'.
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push(@implContentDecls, <<END);
-    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, $numParameters));
-    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
-    if (!callStack)
-        return v8::Undefined();
-END
-        AddToImplIncludes("ScriptArguments.h");
-        AddToImplIncludes("ScriptCallStack.h");
-        AddToImplIncludes("ScriptCallStackFactory.h");
-    }
-    if ($function->signature->extendedAttributes->{"CheckAccessToNode"}) {
+    if ($function->signature->extendedAttributes->{"CheckSecurityForNode"}) {
         push(@implContentDecls, "    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->" . $function->signature->name . "(ec)))\n");
         push(@implContentDecls, "        return v8::Handle<v8::Value>();\n");
 END
@@ -1464,30 +1441,45 @@ END
 sub GenerateCallWith
 {
     my $callWith = shift;
+    return () unless $callWith;
     my $outputArray = shift;
     my $indent = shift;
     my $returnVoid = shift;
     my $emptyContext = shift;
-    my $callWithArg = "COMPILE_ASSERT(false)";
+    my $function = shift;
 
-    if ($callWith eq "ScriptState") {
+    my @callWithArgs;
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState")) {
         if ($emptyContext) {
             push(@$outputArray, $indent . "EmptyScriptState state;\n");
-            $callWithArg = "&state";
+            push(@callWithArgs, "&state");
         } else {
             push(@$outputArray, $indent . "ScriptState* state = ScriptState::current();\n");
             push(@$outputArray, $indent . "if (!state)\n");
             push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8::Undefined()") . ";\n");
-            $callWithArg = "state";
+            push(@callWithArgs, "state");
         }
-    } elsif ($callWith eq "ScriptExecutionContext") {
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptExecutionContext")) {
         push(@$outputArray, $indent . "ScriptExecutionContext* scriptContext = getScriptExecutionContext();\n");
         push(@$outputArray, $indent . "if (!scriptContext)\n");
         push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8::Undefined()") . ";\n");
-        $callWithArg = "scriptContext";
+        push(@callWithArgs, "scriptContext");
     }
-
-    return $callWithArg;
+    if ($function and $codeGenerator->ExtendedAttributeContains($callWith, "ScriptArguments")) {
+        push(@$outputArray, $indent . "RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, " . @{$function->parameters} . "));\n");
+        push(@callWithArgs, "scriptArguments");
+        AddToImplIncludes("ScriptArguments.h");
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "CallStack")) {
+        push(@$outputArray, $indent . "RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());\n");
+        push(@$outputArray, $indent . "if (!callStack)\n");
+        push(@$outputArray, $indent . "    return v8::Undefined();\n");
+        push(@callWithArgs, "callStack");
+        AddToImplIncludes("ScriptCallStack.h");
+        AddToImplIncludes("ScriptCallStackFactory.h");
+    }
+    return @callWithArgs;
 }
 
 sub GenerateArgumentsCountCheck
@@ -1526,21 +1518,19 @@ sub GenerateParametersCheck
 
         my $parameterName = $parameter->name;
 
-        # Optional callbacks should be treated differently, because they always have a default value (0),
-        # and we can reduce the number of overloaded functions that take a different number of parameters.
-        # Optional arguments with default values [Optional=CallWithDefaultValue] or [Optional=CallWithNullValue] should not generate an early call.
-        my $optional = $parameter->extendedAttributes->{"Optional"};        
-        if ($optional && $optional ne "CallWithDefaultValue" && $optional ne "CallWithNullValue" && !$parameter->extendedAttributes->{"Callback"}) {
-            # Generate early call if there are not enough parameters.
+        # Optional arguments with [Optional] should generate an early call with fewer arguments.
+        # Optional arguments with [Optional=...] should not generate the early call.
+        my $optional = $parameter->extendedAttributes->{"Optional"};
+        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && !$parameter->extendedAttributes->{"Callback"}) {
             $parameterCheckString .= "    if (args.Length() <= $paramIndex) {\n";
             my $functionCall = GenerateFunctionCallString($function, $paramIndex, "    " x 2, $implClassName);
             $parameterCheckString .= $functionCall;
             $parameterCheckString .= "    }\n";
         }
 
-        my $parameterMissingPolicy = "MissingIsUndefined";
-        if ($optional && $optional eq "CallWithNullValue") {
-            $parameterMissingPolicy = "MissingIsEmpty";
+        my $parameterDefaultPolicy = "DefaultIsUndefined";
+        if ($optional and $optional eq "DefaultIsNullString") {
+            $parameterDefaultPolicy = "DefaultIsNullString";
         }
 
         AddToImplIncludes("ExceptionCode.h");
@@ -1548,7 +1538,7 @@ sub GenerateParametersCheck
         if ($parameter->extendedAttributes->{"Callback"}) {
             my $className = GetCallbackClassName($parameter->type);
             AddToImplIncludes("$className.h");
-            if ($parameter->extendedAttributes->{"Optional"}) {
+            if ($optional) {
                 $parameterCheckString .= "    RefPtr<" . $parameter->type . "> $parameterName;\n";
                 $parameterCheckString .= "    if (args.Length() > $paramIndex && !args[$paramIndex]->IsNull() && !args[$paramIndex]->IsUndefined()) {\n";
                 $parameterCheckString .= "        if (!args[$paramIndex]->IsObject())\n";
@@ -1574,7 +1564,7 @@ sub GenerateParametersCheck
             $parameterCheckString .= "        goto fail;\n";
             $parameterCheckString .= "    }\n";
         } elsif ($nativeType =~ /^V8Parameter/) {
-            my $value = JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterMissingPolicy)");
+            my $value = JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterDefaultPolicy)");
             $parameterCheckString .= "    " . ConvertToV8Parameter($parameter, $nativeType, $parameterName, $value) . "\n";
         } else {
             AddToImplIncludes("V8BindingMacros.h");
@@ -1595,7 +1585,7 @@ sub GenerateParametersCheck
                 }
             }
             $parameterCheckString .= "    EXCEPTION_BLOCK($nativeType, $parameterName, " .
-                 JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterMissingPolicy)") . ");\n";
+                 JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterDefaultPolicy)") . ");\n";
             if ($nativeType eq 'OptionsObject') {
                $parameterCheckString .= "    if (args.Length() > $paramIndex && !$parameterName.isUndefinedOrNull() && !$parameterName.isObject()) {\n";
                $parameterCheckString .= "        ec = TYPE_MISMATCH_ERR;\n";
@@ -1692,7 +1682,13 @@ END
         push(@implContent, "        goto fail;\n");
     }
 
-    my $DOMObject = $dataNode->extendedAttributes->{"ActiveDOMObject"} ? "ActiveDOMObject" : "DOMObject";
+    my $DOMObject = "DOMObject";
+    if (IsNodeSubType($dataNode)) {
+        $DOMObject = "DOMNode";
+    } elsif ($dataNode->extendedAttributes->{"ActiveDOMObject"}) {
+        $DOMObject = "ActiveDOMObject";
+    }
+
     push(@implContent, <<END);
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
@@ -1933,11 +1929,11 @@ sub GenerateSingleBatchedAttribute
     my $attrExt = $attribute->signature->extendedAttributes;
 
     my $accessControl = "v8::DEFAULT";
-    if ($attrExt->{"DoNotCheckDomainSecurityOnGetter"}) {
+    if ($attrExt->{"DoNotCheckSecurityOnGetter"}) {
         $accessControl = "v8::ALL_CAN_READ";
-    } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSetter"}) {
+    } elsif ($attrExt->{"DoNotCheckSecurityOnSetter"}) {
         $accessControl = "v8::ALL_CAN_WRITE";
-    } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
+    } elsif ($attrExt->{"DoNotCheckSecurity"}) {
         $accessControl = "v8::ALL_CAN_READ";
         if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
             $accessControl .= " | v8::ALL_CAN_WRITE";
@@ -1956,7 +1952,7 @@ sub GenerateSingleBatchedAttribute
         $attrExt->{"V8CustomSetter"} ||
         $attrExt->{"V8CustomGetter"} ||
         "";
-    if ($customAccessor eq 1) {
+    if ($customAccessor eq "VALUE_IS_MISSING") {
         # use the naming convension, interface + (capitalize) attr name
         $customAccessor = $interfaceName . "::" . $attrName;
     }
@@ -2086,7 +2082,7 @@ sub GenerateImplementationIndexer
 
     if ($indexerType && !$hasCustomSetter) {
         if ($indexerType eq "DOMString") {
-            my $conversion = $indexer->extendedAttributes->{"ConvertNullStringTo"};
+            my $conversion = $indexer->extendedAttributes->{"TreatReturnedNullStringAs"};
             if ($conversion && $conversion eq "Null") {
                 push(@implContent, <<END);
     setCollectionStringOrNullIndexedGetter<${interfaceName}>(desc);
@@ -2170,7 +2166,7 @@ END
 
     my $hasCustomNamedSetter = $dataNode->extendedAttributes->{"CustomNamedSetter"};
     my $hasDeleter = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
-    my $hasEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    my $hasEnumerator = $dataNode->extendedAttributes->{"CustomEnumerateProperty"};
     my $setOn = "Instance";
 
     # V8 has access-check callback API (see ObjectTemplate::SetAccessCheckCallbacks) and it's used on DOMWindow
@@ -2228,7 +2224,7 @@ sub GenerateImplementation
     my $object = shift;
     my $dataNode = shift;
     my $interfaceName = $dataNode->name;
-    my $visibleInterfaceName = GetVisibleInterfaceName($interfaceName);
+    my $visibleInterfaceName = $codeGenerator->GetVisibleInterfaceName($dataNode);
     my $className = "V8$interfaceName";
     my $implClassName = $interfaceName;
 
@@ -2337,7 +2333,7 @@ sub GenerateImplementation
         # If the function does not need domain security check, we need to
         # generate an access getter that returns different function objects
         # for different calling context.
-        if (($dataNode->extendedAttributes->{"CheckDomainSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+        if (($dataNode->extendedAttributes->{"CheckSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
             if (!$isCustom || $function->{overloadIndex} == 1) {
                 GenerateDomainSafeFunctionGetter($function, $implClassName);
             }
@@ -2388,7 +2384,7 @@ sub GenerateImplementation
 
         my $attrExt = $function->signature->extendedAttributes;
         # Don't put any nonstandard functions into this table:
-        if ($attrExt->{"V8OnInstance"}) {
+        if ($attrExt->{"V8Unforgeable"}) {
             next;
         }
         if ($function->isStatic) {
@@ -2397,8 +2393,8 @@ sub GenerateImplementation
         if ($attrExt->{"V8EnabledAtRuntime"} || RequiresCustomSignature($function) || $attrExt->{"V8DoNotCheckSignature"}) {
             next;
         }
-        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
-            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+        if ($attrExt->{"DoNotCheckSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckSecurity"} || $interfaceName eq "DOMWindow")) {
             next;
         }
         if ($attrExt->{"NotEnumerable"} || $attrExt->{"V8ReadOnly"}) {
@@ -2432,6 +2428,10 @@ END
         my $value = $constant->value;
         my $attrExt = $constant->extendedAttributes;
         my $conditional = $attrExt->{"Conditional"};
+        my $implementedBy = $attrExt->{"ImplementedBy"};
+        if ($implementedBy) {
+            AddToImplIncludes("${implementedBy}.h");
+        }
         if ($attrExt->{"V8EnabledAtRuntime"}) {
             push(@constantsEnabledAtRuntime, $constant);
         } else {
@@ -2464,7 +2464,7 @@ END
     }
 
     my $access_check = "";
-    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($interfaceName eq "DOMWindow")) {
+    if ($dataNode->extendedAttributes->{"CheckSecurity"} && !($interfaceName eq "DOMWindow")) {
         $access_check = "instance->SetAccessCheckCallbacks(V8${interfaceName}::namedSecurityCheck, V8${interfaceName}::indexedSecurityCheck, v8::External::Wrap(&V8${interfaceName}::info));";
     }
 
@@ -2607,7 +2607,7 @@ END
         my $commentInfo = "Function '$name' (ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
 
         my $template = "proto";
-        if ($attrExt->{"V8OnInstance"}) {
+        if ($attrExt->{"V8Unforgeable"}) {
             $template = "instance";
         }
         if ($function->isStatic) {
@@ -2621,8 +2621,8 @@ END
             $conditional = "if (${enable_function}())\n        ";
         }
 
-        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
-            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+        if ($attrExt->{"DoNotCheckSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckSecurity"} || $interfaceName eq "DOMWindow")) {
             # Mark the accessor as ReadOnly and set it on the proto object so
             # it can be shadowed. This is really a hack to make it work.
             # There are several sceneria to call into the accessor:
@@ -3049,7 +3049,7 @@ END
 
     # FIXME: We need a better way of recovering the correct prototype chain
     # for every sort of object. For now, we special-case cross-origin visible
-    # objects (i.e., those with CheckDomainSecurity).
+    # objects (i.e., those with CheckSecurity).
     if (IsVisibleAcrossOrigins($dataNode)) {
         push(@implContent, <<END);
     if (impl->frame()) {
@@ -3111,40 +3111,6 @@ END
 END
 }
 
-sub HasCustomToV8Implementation {
-    # FIXME: This subroutine is lame. Probably should be an .idl attribute (CustomToV8)?
-    my $dataNode = shift;
-    my $interfaceName = shift;
-
-    # We generate a custom converter (but JSC doesn't) for the following:
-    return 1 if $interfaceName eq "CSSStyleSheet";
-    return 1 if $interfaceName eq "CanvasPixelArray";
-    return 1 if $interfaceName eq "DOMWindow";
-    return 1 if $interfaceName eq "Element";
-    return 1 if $interfaceName eq "HTMLDocument";
-    return 1 if $interfaceName eq "HTMLElement";
-    return 1 if $interfaceName eq "Location";
-    return 1 if $interfaceName eq "SVGDocument";
-    return 1 if $interfaceName eq "SVGElement";
-    return 1 if $interfaceName eq "ScriptProfile";
-    return 1 if $interfaceName eq "ScriptProfileNode";
-    return 1 if $interfaceName eq "WorkerContext";
-    # We don't generate a custom converter (but JSC does) for the following:
-    return 0 if $interfaceName eq "AbstractWorker";
-    return 0 if $interfaceName eq "CanvasRenderingContext";
-    return 0 if $interfaceName eq "SVGElementInstance";
-    return 0 if $interfaceName eq "NodeList";
-    return 0 if $interfaceName eq "CSSRuleList";
-    return 0 if $interfaceName eq "CSSStyleDeclaration";
-    return 0 if $interfaceName eq "MediaList";
-    return 0 if $interfaceName eq "StyleSheetList";
-    return 0 if $interfaceName eq "DOMImplementation";
-    return 0 if $interfaceName eq "TextTrack";
-
-    # For everything else, do what JSC does.
-    return $dataNode->extendedAttributes->{"JSCustomToJS"};
-}
-
 sub GetDomMapFunction
 {
     my $dataNode = shift;
@@ -3189,25 +3155,24 @@ sub GenerateFunctionCallString()
 
     my @arguments;
     my $functionName;
-    if ($function->isStatic) {
-        $functionName = "${implClassName}::${name}";
-    } elsif ($function->signature->extendedAttributes->{"ImplementedBy"}) {
-        my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    if ($implementedBy) {
         AddToImplIncludes("${implementedBy}.h");
-        unshift(@arguments, "imp");
+        unshift(@arguments, "imp") if !$function->isStatic;
         $functionName = "${implementedBy}::${name}";
+    } elsif ($function->isStatic) {
+        $functionName = "${implClassName}::${name}";
     } else {
         $functionName = "imp->${name}";
     }
 
-    my $callWith = $function->signature->extendedAttributes->{"CallWith"} || "";
-    if ($callWith) {
-        my @callWithOutput = ();
-        push(@arguments, GenerateCallWith($callWith, \@callWithOutput, $indent, 0, 1));
-        $result .= join("", @callWithOutput);
-        $index++;
-        $numberOfParameters++
-    }
+    my $callWith = $function->signature->extendedAttributes->{"CallWith"};
+    my @callWithOutput = ();
+    my @callWithArgs = GenerateCallWith($callWith, \@callWithOutput, $indent, 0, 1, $function);
+    $result .= join("", @callWithOutput);
+    push(@arguments, @callWithArgs);
+    $index += @callWithArgs;
+    $numberOfParameters += @callWithArgs;
 
     foreach my $parameter (@{$function->parameters}) {
         if ($index eq $numberOfParameters) {
@@ -3216,7 +3181,7 @@ sub GenerateFunctionCallString()
         my $paramName = $parameter->name;
         my $paramType = $parameter->type;
 
-        if ($parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
+        if ($parameter->type eq "IDBKey" || $parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
             push @arguments, "$paramName.get()";
         } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($parameter->type) and not $implClassName =~ /List$/) {
             push @arguments, "$paramName->propertyReference()";
@@ -3232,10 +3197,6 @@ sub GenerateFunctionCallString()
         $index++;
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push @arguments, "scriptArguments, callStack";
-    }
-
     if (@{$function->raisesExceptions}) {
         push @arguments, "ec";
     }
@@ -3247,13 +3208,13 @@ sub GenerateFunctionCallString()
 
     if ($returnType eq "void") {
         $result .= $indent . "$functionString;\n";
-    } elsif ($callWith eq "ScriptState" or @{$function->raisesExceptions}) {
+    } elsif ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState") or @{$function->raisesExceptions}) {
         $result .= $indent . $nativeReturnType . " result = $functionString;\n";
     } else {
         # Can inline the function call into the return statement to avoid overhead of using a Ref<> temporary
         $return = $functionString;
         $returnIsRef = 0;
-    
+
         if ($implClassName eq "SVGTransformList" and IsRefPtrType($returnType)) {
             $return = "WTF::getPtr(" . $return . ")";
         }
@@ -3264,7 +3225,7 @@ sub GenerateFunctionCallString()
         $result .= $indent . "    goto fail;\n";
     }
 
-    if ($callWith eq "ScriptState") {
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState")) {
         $result .= $indent . "if (state.hadException())\n";
         $result .= $indent . "    return throwError(state.exception());\n"
     }
@@ -3594,7 +3555,7 @@ sub RequiresCustomSignature
     }
     foreach my $parameter (@{$function->parameters}) {
         my $optional = $parameter->extendedAttributes->{"Optional"};
-        if (($optional && $optional ne "CallWithDefaultValue" && $optional ne "CallWithNullValue") || $parameter->extendedAttributes->{"Callback"}) {
+        if (($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString") || $parameter->extendedAttributes->{"Callback"}) {
             return 0;
         }
     }
@@ -3717,16 +3678,14 @@ sub NativeToJSValue
     return "v8NumberArray($value)" if $type eq "double[]";
 
     if ($codeGenerator->IsStringType($type)) {
-        my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
+        my $conv = $signature->extendedAttributes->{"TreatReturnedNullStringAs"};
         if (defined $conv) {
             return "v8StringOrNull($value)" if $conv eq "Null";
             return "v8StringOrUndefined($value)" if $conv eq "Undefined";
             return "v8StringOrFalse($value)" if $conv eq "False";
 
-            die "Unknown value for ConvertNullStringTo extended attribute";
+            die "Unknown value for TreatReturnedNullStringAs extended attribute";
         }
-        $conv = $signature->extendedAttributes->{"ConvertScriptString"};
-        return "v8StringOrNull($value)" if $conv;
         return "v8String($value)";
     }
 
@@ -3824,15 +3783,6 @@ sub WriteData
     @headerContent = ();
 }
 
-sub GetVisibleInterfaceName
-{
-    my $interfaceName = shift;
-
-    return "DOMException" if $interfaceName eq "DOMCoreException";
-    return "FormData" if $interfaceName eq "DOMFormData";
-    return $interfaceName;
-}
-
 sub GetCallbackClassName
 {
     my $interfaceName = shift;
@@ -3867,7 +3817,7 @@ sub GetRuntimeEnableFunctionName
     my $signature = shift;
 
     # If a parameter is given (e.g. "V8EnabledAtRuntime=FeatureName") return the RuntimeEnabledFeatures::{FeatureName}Enabled() method.
-    return "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($signature->extendedAttributes->{"V8EnabledAtRuntime"}) . "Enabled" if ($signature->extendedAttributes->{"V8EnabledAtRuntime"} && $signature->extendedAttributes->{"V8EnabledAtRuntime"} ne "1");
+    return "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($signature->extendedAttributes->{"V8EnabledAtRuntime"}) . "Enabled" if ($signature->extendedAttributes->{"V8EnabledAtRuntime"} && $signature->extendedAttributes->{"V8EnabledAtRuntime"} ne "VALUE_IS_MISSING");
 
     # Otherwise return a function named RuntimeEnabledFeatures::{methodName}Enabled().
     return "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($signature->name) . "Enabled";
diff --git a/Source/WebCore/bindings/scripts/IDLAttributes.txt b/Source/WebCore/bindings/scripts/IDLAttributes.txt
new file mode 100644
index 000000000..d105e0872
--- /dev/null
+++ b/Source/WebCore/bindings/scripts/IDLAttributes.txt
@@ -0,0 +1,113 @@
+#
+# This file describes all IDL attributes.
+# If any IDL file uses an IDL attribute not listed below, the WebKit build will fail.
+# If you want to add a new IDL attribute, you need to
+#     (1) add the IDL attribute to this file
+#     (2) add the explanation to the WebKit IDL document (https://trac.webkit.org/wiki/WebKitIDL)
+#     (3) add test cases to run-bindings-tests
+#
+# The syntax of this file is as follows:
+#     - You can write one IDL attribute per one line.
+#     - "ATTR" means that the IDL attribute ATTR does not take any argument; i.e. [ATTR].
+#     - "ATTR=X" means that the IDL attribute ATTR always takes one argument X; i.e. [ATTR=X].
+#     - "ATTR=X|Y|Z" means that the IDL attribute ATTR takes one or more arguments
+#       and the arguments are X, Y or Z; e.g. [ATTR=X], [ATTR=Y], [ATTR=X|Z], [ATTR=X|Y|Z].
+#     - "ATTR=|X|Y|Z" means that the IDL attribute ATTR can take arguments
+#       and the arguments are X, Y or Z; e.g. [ATTR], [ATTR=X], [ATTR=Y], [ATTR=X|Z], [ATTR=X|Y|Z].
+#     - "ATTR=*" means that the IDL attribute ATTR can take arbitrary arguments;
+#       e.g. [ATTR=INDEXED_DATABASE], [ATTR=deleteFunction].
+#
+
+ActiveDOMObject
+CPPPureInterface
+CachedAttribute
+CallWith=ScriptExecutionContext|ScriptState|ScriptArguments|CallStack
+Callback
+CheckSecurity
+CheckSecurityForNode
+Conditional=*
+Constructor
+ConstructorParameters=*
+ConstructorRaisesException
+ConstructorTemplate=Event
+Custom
+CustomCall
+CustomConstructor
+CustomDeleteProperty
+CustomEnumerateProperty
+CustomGetOwnPropertySlot
+CustomGetter
+CustomIndexedSetter
+CustomNamedGetter
+CustomNamedSetter
+CustomPutFunction
+CustomReturn
+CustomSetter
+CustomToJSObject
+Deletable
+DoNotCheckConstants
+DoNotCheckSecurity
+DoNotCheckSecurityOnGetter
+DoNotCheckSecurityOnSetter
+EventTarget
+ExtendsDOMGlobalObject
+Immutable
+ImplementedAs=*
+IndexedGetter
+InterfaceName=*
+InitializedByEventConstructor
+IsIndex
+IsWorkerContext
+JSCustom
+JSCustomConstructor
+JSCustomDefineOwnProperty
+JSCustomDefineOwnPropertyOnPrototype
+JSCustomFinalize
+JSCustomGetOwnPropertySlotAndDescriptor
+JSCustomGetter
+JSCustomHeader
+JSCustomIsReachable
+JSCustomMarkFunction
+JSCustomNamedGetterOnPrototype
+JSCustomPushEventHandlerScope
+JSCustomSetter
+JSCustomToJSObject
+JSCustomToNativeObject
+JSGenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame
+JSGenerateToJSObject
+JSGenerateToNativeObject
+JSInlineGetOwnPropertySlot
+JSLegacyParent=*
+JSNoStaticTables
+JSWindowEventListener
+MasqueradesAsUndefined
+NamedConstructor=*
+NamedGetter
+NotEnumerable
+NumericIndexedGetter
+ObjCCustomImplementation
+ObjCLegacyUnnamedParameters
+ObjCPolymorphic
+ObjCProtocol
+OmitConstructor
+Optional=|DefaultIsNullString|DefaultIsUndefined
+Reflect=*
+Replaceable
+ReplaceableConstructor
+ReturnNewObject
+StrictTypeChecking
+Supplemental=*
+TreatNullAs=NullString
+TreatReturnedNullStringAs=False|Null|Undefined
+TreatUndefinedAs=NullString
+URL
+V8Custom
+V8CustomConstructor
+V8CustomGetter
+V8CustomSetter
+V8CustomToJSObject
+V8DependentLifetime
+V8DoNotCheckSignature
+V8EnabledAtRuntime=*
+V8ReadOnly
+V8Unforgeable
diff --git a/Source/WebCore/bindings/scripts/IDLParser.pm b/Source/WebCore/bindings/scripts/IDLParser.pm
index fbb7ac255..52671a335 100644
--- a/Source/WebCore/bindings/scripts/IDLParser.pm
+++ b/Source/WebCore/bindings/scripts/IDLParser.pm
@@ -215,7 +215,7 @@ sub parseExtendedAttributes
             if ($name eq "Constructor") {
                 $attrs{$name} = "";
             } else {
-                $attrs{$name} = 1;
+                $attrs{$name} = "VALUE_IS_MISSING";
             }
             $str =~ s/^\s*,?//;
         } else {
@@ -297,7 +297,7 @@ sub ParseInterface
             $newDataNode->signature->name("Constructor");
             $newDataNode->signature->extendedAttributes($extendedAttributes);
             parseParameters($newDataNode, $extendedAttributes->{"Constructor"});
-            $extendedAttributes->{"Constructor"} = 1;
+            $extendedAttributes->{"Constructor"} = "VALUE_IS_MISSING";
             $dataNode->constructor($newDataNode);
         } elsif (defined $extendedAttributes->{"NamedConstructor"}) {
             my $newDataNode = new domFunction();
diff --git a/Source/WebCore/bindings/scripts/resolve-supplemental.pl b/Source/WebCore/bindings/scripts/resolve-supplemental.pl
index 9fe0e661c..168b349dc 100644
--- a/Source/WebCore/bindings/scripts/resolve-supplemental.pl
+++ b/Source/WebCore/bindings/scripts/resolve-supplemental.pl
@@ -30,12 +30,14 @@ my $defines;
 my $preprocessor;
 my $verbose;
 my $idlFilesList;
+my $idlAttributesFile;
 my $supplementalDependencyFile;
 
 GetOptions('defines=s' => \$defines,
            'preprocessor=s' => \$preprocessor,
            'verbose' => \$verbose,
            'idlFilesList=s' => \$idlFilesList,
+           'idlAttributesFile=s' => \$idlAttributesFile,
            'supplementalDependencyFile=s' => \$supplementalDependencyFile);
 
 die('Must specify #define macros using --defines.') unless defined($defines);
@@ -61,6 +63,12 @@ foreach my $idlFile (@idlFiles) {
     $interfaceNameToIdlFile{fileparse(basename($idlFile), ".idl")} = $fullPath;
 }
 
+# Runs the IDL attribute checker.
+my $idlAttributes = loadIDLAttributes($idlAttributesFile);
+foreach my $idlFile (keys %documents) {
+    checkIDLAttributes($idlAttributes, $documents{$idlFile}, basename($idlFile));
+}
+
 # Resolves [Supplemental=XXX] dependencies.
 my %supplementals;
 foreach my $idlFile (keys %documents) {
@@ -93,3 +101,86 @@ foreach my $idlFile (sort keys %supplementals) {
     print FH $idlFile, " @{$supplementals{$idlFile}}\n";
 }
 close FH;
+
+sub loadIDLAttributes
+{
+    my $idlAttributesFile = shift;
+
+    my %idlAttributes;
+    open FH, "<", $idlAttributesFile or die "Couldn't open $idlAttributesFile: $!";
+    while (my $line = <FH>) {
+        chomp $line;
+        next if $line =~ /^\s*#/;
+        next if $line =~ /^\s*$/;
+
+        if ($line =~ /^\s*([^=\s]*)\s*=?\s*(.*)/) {
+            my $name = $1;
+            $idlAttributes{$name} = {};
+            if ($2) {
+                foreach my $rightValue (split /\|/, $2) {
+                    $rightValue =~ s/^\s*|\s*$//g;
+                    $rightValue = "VALUE_IS_MISSING" unless $rightValue;
+                    $idlAttributes{$name}{$rightValue} = 1;
+                }
+            } else {
+                $idlAttributes{$name}{"VALUE_IS_MISSING"} = 1;
+            }
+        } else {
+            die "The format of " . basename($idlAttributesFile) . " is wrong: line $.\n";
+        }
+    }
+    close FH;
+
+    return \%idlAttributes;
+}
+
+sub checkIDLAttributes
+{
+    my $idlAttributes = shift;
+    my $document = shift;
+    my $idlFile = shift;
+
+    foreach my $dataNode (@{$document->classes}) {
+        checkIfIDLAttributesExists($idlAttributes, $dataNode->extendedAttributes, $idlFile);
+
+        foreach my $attribute (@{$dataNode->attributes}) {
+            checkIfIDLAttributesExists($idlAttributes, $attribute->signature->extendedAttributes, $idlFile);
+        }
+
+        foreach my $function (@{$dataNode->functions}) {
+            checkIfIDLAttributesExists($idlAttributes, $function->signature->extendedAttributes, $idlFile);
+            foreach my $parameter (@{$function->parameters}) {
+                checkIfIDLAttributesExists($idlAttributes, $parameter->extendedAttributes, $idlFile);
+            }
+        }
+    }
+}
+
+sub checkIfIDLAttributesExists
+{
+    my $idlAttributes = shift;
+    my $extendedAttributes = shift;
+    my $idlFile = shift;
+
+    my $error;
+    OUTER: for my $name (keys %$extendedAttributes) {
+        if (!exists $idlAttributes->{$name}) {
+            $error = "Unknown IDL attribute [$name] is found at $idlFile.";
+            last OUTER;
+        }
+        if ($idlAttributes->{$name}{"*"}) {
+            next;
+        }
+        for my $rightValue (split /\s*\|\s*/, $extendedAttributes->{$name}) {
+            if (!exists $idlAttributes->{$name}{$rightValue}) {
+                $error = "Unknown IDL attribute [$name=" . $extendedAttributes->{$name} . "] is found at $idlFile.";
+                last OUTER;
+            }
+        }
+    }
+    if ($error) {
+        die "IDL ATTRIBUTE CHECKER ERROR: $error
+If you want to add a new IDL attribute, you need to add it to WebCore/bindings/scripts/IDLAttributes.txt and add explanations to the WebKit IDL document (https://trac.webkit.org/wiki/WebKitIDL).
+";
+    }
+}
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp
index a90991088..cd28aab52 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp
@@ -25,11 +25,11 @@
 #include "WebDOMTestInterface.h"
 
 #include "KURL.h"
+#include "Node.h"
 #include "TestInterface.h"
-#include "TestObj.h"
 #include "TestSupplemental.h"
+#include "WebDOMNode.h"
 #include "WebDOMString.h"
-#include "WebDOMTestObj.h"
 #include "WebExceptionHandler.h"
 #include "wtf/text/AtomicString.h"
 #include <wtf/GetPtr.h>
@@ -108,6 +108,24 @@ void WebDOMTestInterface::setSupplementalStr2(const WebDOMString& newSupplementa
 }
 
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+WebDOMNode WebDOMTestInterface::supplementalNode() const
+{
+    if (!impl())
+        return WebDOMNode();
+
+    return toWebKit(WTF::getPtr(TestSupplemental::supplementalNode(impl())));
+}
+
+void WebDOMTestInterface::setSupplementalNode(const WebDOMNode& newSupplementalNode)
+{
+    if (!impl())
+        return;
+
+    TestSupplemental::setSupplementalNode(impl(), toWebCore(newSupplementalNode));
+}
+
+#endif
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
 void WebDOMTestInterface::supplementalMethod1()
@@ -122,15 +140,12 @@ void WebDOMTestInterface::supplementalMethod1()
 
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-WebDOMTestObj WebDOMTestInterface::supplementalMethod2(const WebDOMString& strArg, const WebDOMTestObj& objArg)
+void WebDOMTestInterface::supplementalMethod4()
 {
     if (!impl())
-        return WebDOMTestObj();
+        return;
 
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(WebCore::TestSupplemental::supplementalMethod2(impl(), strArg, toWebCore(objArg), ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
+    WebCore::TestSupplemental::supplementalMethod4(impl());
 }
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
index 4c7f666bf..280460bbd 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
@@ -32,7 +32,7 @@ namespace WebCore {
 class TestInterface;
 };
 
-class WebDOMTestObj;
+class WebDOMNode;
 
 class WebDOMTestInterface : public WebDOMObject {
 public:
@@ -59,9 +59,13 @@ public:
     WebDOMString supplementalStr2() const;
     void setSupplementalStr2(const WebDOMString&);
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    WebDOMNode supplementalNode() const;
+    void setSupplementalNode(const WebDOMNode&);
+#endif
 
     void supplementalMethod1();
-    WebDOMTestObj supplementalMethod2(const WebDOMString& strArg, const WebDOMTestObj& objArg);
+    void supplementalMethod4();
 
     WebCore::TestInterface* impl() const;
 
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
index d81871fa6..ac076486f 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
@@ -487,88 +487,6 @@ void WebDOMTestObj::setStringAttrWithSetterException(const WebDOMString& newStri
     webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
 }
 
-int WebDOMTestObj::withScriptStateAttribute() const
-{
-    if (!impl())
-        return 0;
-
-    return impl()->withScriptStateAttribute();
-}
-
-void WebDOMTestObj::setWithScriptStateAttribute(int newWithScriptStateAttribute)
-{
-    if (!impl())
-        return;
-
-    impl()->setWithScriptStateAttribute(newWithScriptStateAttribute);
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptExecutionContextAttribute() const
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    return toWebKit(WTF::getPtr(impl()->withScriptExecutionContextAttribute()));
-}
-
-void WebDOMTestObj::setWithScriptExecutionContextAttribute(const WebDOMTestObj& newWithScriptExecutionContextAttribute)
-{
-    if (!impl())
-        return;
-
-    impl()->setWithScriptExecutionContextAttribute(toWebCore(newWithScriptExecutionContextAttribute));
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptStateAttributeRaises() const
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(impl()->withScriptStateAttributeRaises(ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
-}
-
-void WebDOMTestObj::setWithScriptStateAttributeRaises(const WebDOMTestObj& newWithScriptStateAttributeRaises)
-{
-    if (!impl())
-        return;
-
-    WebCore::ExceptionCode ec = 0;
-    impl()->setWithScriptStateAttributeRaises(toWebCore(newWithScriptStateAttributeRaises), ec);
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptExecutionContextAttributeRaises() const
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(impl()->withScriptExecutionContextAttributeRaises(ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
-}
-
-void WebDOMTestObj::setWithScriptExecutionContextAttributeRaises(const WebDOMTestObj& newWithScriptExecutionContextAttributeRaises)
-{
-    if (!impl())
-        return;
-
-    WebCore::ExceptionCode ec = 0;
-    impl()->setWithScriptExecutionContextAttributeRaises(toWebCore(newWithScriptExecutionContextAttributeRaises), ec);
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-}
-
-WebDOMString WebDOMTestObj::scriptStringAttr() const
-{
-    if (!impl())
-        return WebDOMString();
-
-    return static_cast<const WTF::String&>(impl()->scriptStringAttr());
-}
-
 #if ENABLE(Condition1)
 int WebDOMTestObj::conditionalAttr1() const
 {
@@ -874,73 +792,52 @@ void WebDOMTestObj::removeEventListener(const WebDOMString& type, const WebDOMEv
     impl()->removeEventListener(type, toWebCore(listener), useCapture);
 }
 
-void WebDOMTestObj::withScriptStateVoid()
+void WebDOMTestObj::methodWithOptionalArg(int opt)
 {
     if (!impl())
         return;
 
-    impl()->withScriptStateVoid();
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptStateObj()
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    return toWebKit(WTF::getPtr(impl()->withScriptStateObj()));
+    impl()->methodWithOptionalArg(opt);
 }
 
-void WebDOMTestObj::withScriptStateVoidException()
+void WebDOMTestObj::methodWithNonOptionalArgAndOptionalArg(int nonOpt, int opt)
 {
     if (!impl())
         return;
 
-    WebCore::ExceptionCode ec = 0;
-    impl()->withScriptStateVoidException(ec);
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptStateObjException()
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(impl()->withScriptStateObjException(ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
+    impl()->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
 }
 
-void WebDOMTestObj::withScriptExecutionContext()
+void WebDOMTestObj::methodWithNonOptionalArgAndTwoOptionalArgs(int nonOpt, int opt1, int opt2)
 {
     if (!impl())
         return;
 
-    impl()->withScriptExecutionContext();
+    impl()->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
 }
 
-void WebDOMTestObj::methodWithOptionalArg(int opt)
+void WebDOMTestObj::methodWithOptionalString(const WebDOMString& str)
 {
     if (!impl())
         return;
 
-    impl()->methodWithOptionalArg(opt);
+    impl()->methodWithOptionalString(str);
 }
 
-void WebDOMTestObj::methodWithNonOptionalArgAndOptionalArg(int nonOpt, int opt)
+void WebDOMTestObj::methodWithOptionalStringIsUndefined(const WebDOMString& str)
 {
     if (!impl())
         return;
 
-    impl()->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
+    impl()->methodWithOptionalStringIsUndefined(str);
 }
 
-void WebDOMTestObj::methodWithNonOptionalArgAndTwoOptionalArgs(int nonOpt, int opt1, int opt2)
+void WebDOMTestObj::methodWithOptionalStringIsNullString(const WebDOMString& str)
 {
     if (!impl())
         return;
 
-    impl()->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
+    impl()->methodWithOptionalStringIsNullString(str);
 }
 
 
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
index 6f9101d12..5d90fd261 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
@@ -120,15 +120,6 @@ public:
     void setStringAttrWithGetterException(const WebDOMString&);
     WebDOMString stringAttrWithSetterException() const;
     void setStringAttrWithSetterException(const WebDOMString&);
-    int withScriptStateAttribute() const;
-    void setWithScriptStateAttribute(int);
-    WebDOMTestObj withScriptExecutionContextAttribute() const;
-    void setWithScriptExecutionContextAttribute(const WebDOMTestObj&);
-    WebDOMTestObj withScriptStateAttributeRaises() const;
-    void setWithScriptStateAttributeRaises(const WebDOMTestObj&);
-    WebDOMTestObj withScriptExecutionContextAttributeRaises() const;
-    void setWithScriptExecutionContextAttributeRaises(const WebDOMTestObj&);
-    WebDOMString scriptStringAttr() const;
 #if ENABLE(Condition1)
     int conditionalAttr1() const;
     void setConditionalAttr1(int);
@@ -178,14 +169,12 @@ public:
     void methodWithException();
     void addEventListener(const WebDOMString& type, const WebDOMEventListener& listener, bool useCapture);
     void removeEventListener(const WebDOMString& type, const WebDOMEventListener& listener, bool useCapture);
-    void withScriptStateVoid();
-    WebDOMTestObj withScriptStateObj();
-    void withScriptStateVoidException();
-    WebDOMTestObj withScriptStateObjException();
-    void withScriptExecutionContext();
     void methodWithOptionalArg(int opt);
     void methodWithNonOptionalArgAndOptionalArg(int nonOpt, int opt);
     void methodWithNonOptionalArgAndTwoOptionalArgs(int nonOpt, int opt1, int opt2);
+    void methodWithOptionalString(const WebDOMString& str);
+    void methodWithOptionalStringIsUndefined(const WebDOMString& str);
+    void methodWithOptionalStringIsNullString(const WebDOMString& str);
     WebDOMString conditionalMethod1();
     void conditionalMethod2();
     void conditionalMethod3();
@@ -200,7 +189,7 @@ public:
     void convert5(const WebDOMe& );
     WebDOMSVGPoint mutablePointFunction();
     WebDOMSVGPoint immutablePointFunction();
-    void orange();
+    void banana();
     WebDOMbool strictFunction(const WebDOMString& str, float a, int b);
 
     WebCore::TestObj* impl() const;
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
index 26ab91bc8..a73ebf1c7 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
@@ -28,11 +28,14 @@
 #include "DOMObjectCache.h"
 #include "ExceptionCode.h"
 #include "JSMainThreadExecState.h"
+#include "Node.h"
 #include "TestInterface.h"
 #include "TestObj.h"
 #include "TestSupplemental.h"
 #include "WebKitDOMBinding.h"
 #include "gobject/ConvertToUTF8String.h"
+#include "webkit/WebKitDOMNode.h"
+#include "webkit/WebKitDOMNodePrivate.h"
 #include "webkit/WebKitDOMTestInterface.h"
 #include "webkit/WebKitDOMTestInterfacePrivate.h"
 #include "webkit/WebKitDOMTestObj.h"
@@ -62,7 +65,7 @@ webkit_dom_test_interface_supplemental_method1(WebKitDOMTestInterface* self)
     g_return_if_fail(self);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    TestSupplemental::supplementalMethod1(item);
+    WebCore::TestSupplemental::supplementalMethod1(item);
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
@@ -82,7 +85,7 @@ webkit_dom_test_interface_supplemental_method2(WebKitDOMTestInterface* self, con
         g_return_val_if_fail(converted_obj_arg, 0);
     }
     WebCore::ExceptionCode ec = 0;
-    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(TestSupplemental::supplementalMethod2(item, converted_str_arg, converted_obj_arg, ec));
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(WebCore::TestSupplemental::supplementalMethod2(item, converted_str_arg, converted_obj_arg, ec));
     if (ec) {
         WebCore::ExceptionCodeDescription ecdesc(ec);
         g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
@@ -94,6 +97,17 @@ webkit_dom_test_interface_supplemental_method2(WebKitDOMTestInterface* self, con
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
+void
+webkit_dom_test_interface_supplemental_method4(WebKitDOMTestInterface* self)
+{
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestInterface * item = WebKit::core(self);
+    TestSupplemental::supplementalMethod4(item);
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+}
+
 gchar*
 webkit_dom_test_interface_get_supplemental_str1(WebKitDOMTestInterface* self)
 {
@@ -101,7 +115,7 @@ webkit_dom_test_interface_get_supplemental_str1(WebKitDOMTestInterface* self)
     g_return_val_if_fail(self, 0);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    gchar* res = convertToUTF8String(TestSupplemental::supplementalStr1(item));
+    gchar* res = convertToUTF8String(WebCore::TestSupplemental::supplementalStr1(item));
     return res;
 #else
     return NULL;
@@ -115,7 +129,7 @@ webkit_dom_test_interface_get_supplemental_str2(WebKitDOMTestInterface* self)
     g_return_val_if_fail(self, 0);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    gchar* res = convertToUTF8String(TestSupplemental::supplementalStr2(item));
+    gchar* res = convertToUTF8String(WebCore::TestSupplemental::supplementalStr2(item));
     return res;
 #else
     return NULL;
@@ -131,7 +145,39 @@ webkit_dom_test_interface_set_supplemental_str2(WebKitDOMTestInterface* self, co
     WebCore::TestInterface * item = WebKit::core(self);
     g_return_if_fail(value);
     WTF::String converted_value = WTF::String::fromUTF8(value);
-    TestSupplemental::setSupplementalStr2(item, converted_value);
+    WebCore::TestSupplemental::setSupplementalStr2(item, converted_value);
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+}
+
+WebKitDOMNode*
+webkit_dom_test_interface_get_supplemental_node(WebKitDOMTestInterface* self)
+{
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestInterface * item = WebKit::core(self);
+    PassRefPtr<WebCore::Node> g_res = WTF::getPtr(WebCore::TestSupplemental::supplementalNode(item));
+    WebKitDOMNode* res = WebKit::kit(g_res.get());
+    return res;
+#else
+    return NULL;
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+}
+
+void
+webkit_dom_test_interface_set_supplemental_node(WebKitDOMTestInterface* self, WebKitDOMNode* value)
+{
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestInterface * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::Node * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    WebCore::TestSupplemental::setSupplementalNode(item, converted_value);
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
@@ -159,6 +205,9 @@ enum {
 #if ENABLE(Condition11) || ENABLE(Condition12)
     PROP_SUPPLEMENTAL_STR2,
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    PROP_SUPPLEMENTAL_NODE,
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 };
 
 
@@ -187,7 +236,7 @@ static void webkit_dom_test_interface_set_property(GObject* object, guint prop_i
 #if ENABLE(Condition11) || ENABLE(Condition12)
     case PROP_SUPPLEMENTAL_STR2:
     {
-        TestSupplemental::setSupplementalStr2(coreSelf, WTF::String::fromUTF8(g_value_get_string(value)));
+        WebCore::TestSupplemental::setSupplementalStr2(coreSelf, WTF::String::fromUTF8(g_value_get_string(value)));
         break;
     }
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
@@ -207,14 +256,22 @@ static void webkit_dom_test_interface_get_property(GObject* object, guint prop_i
 #if ENABLE(Condition11) || ENABLE(Condition12)
     case PROP_SUPPLEMENTAL_STR1:
     {
-        g_value_take_string(value, convertToUTF8String(TestSupplemental::supplementalStr1(coreSelf)));
+        g_value_take_string(value, convertToUTF8String(WebCore::TestSupplemental::supplementalStr1(coreSelf)));
         break;
     }
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 #if ENABLE(Condition11) || ENABLE(Condition12)
     case PROP_SUPPLEMENTAL_STR2:
     {
-        g_value_take_string(value, convertToUTF8String(TestSupplemental::supplementalStr2(coreSelf)));
+        g_value_take_string(value, convertToUTF8String(WebCore::TestSupplemental::supplementalStr2(coreSelf)));
+        break;
+    }
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    case PROP_SUPPLEMENTAL_NODE:
+    {
+        RefPtr<WebCore::Node> ptr = WebCore::TestSupplemental::supplementalNode(coreSelf);
+        g_value_set_object(value, WebKit::kit(ptr.get()));
         break;
     }
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
@@ -258,6 +315,15 @@ static void webkit_dom_test_interface_class_init(WebKitDOMTestInterfaceClass* re
                                                            "", /* default */
                                                            WEBKIT_PARAM_READWRITE));
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_object_class_install_property(gobjectClass,
+                                    PROP_SUPPLEMENTAL_NODE,
+                                    g_param_spec_object("supplemental-node", /* name */
+                                                           "test_interface_supplemental-node", /* short description */
+                                                           "read-write  WebKitDOMNode* TestInterface.supplemental-node", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_NODE, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 
 
 }
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h
index ea1a7b150..0b688920e 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h
@@ -70,6 +70,16 @@ WEBKIT_API WebKitDOMTestObj*
 webkit_dom_test_interface_supplemental_method2(WebKitDOMTestInterface* self, const gchar* str_arg, WebKitDOMTestObj* obj_arg, GError **error);
 
 /**
+ * webkit_dom_test_interface_supplemental_method4:
+ * @self: A #WebKitDOMTestInterface
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_interface_supplemental_method4(WebKitDOMTestInterface* self);
+
+/**
  * webkit_dom_test_interface_get_supplemental_str1:
  * @self: A #WebKitDOMTestInterface
  *
@@ -100,6 +110,27 @@ webkit_dom_test_interface_get_supplemental_str2(WebKitDOMTestInterface* self);
 WEBKIT_API void
 webkit_dom_test_interface_set_supplemental_str2(WebKitDOMTestInterface* self, const gchar* value);
 
+/**
+ * webkit_dom_test_interface_get_supplemental_node:
+ * @self: A #WebKitDOMTestInterface
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMNode*
+webkit_dom_test_interface_get_supplemental_node(WebKitDOMTestInterface* self);
+
+/**
+ * webkit_dom_test_interface_set_supplemental_node:
+ * @self: A #WebKitDOMTestInterface
+ * @value: A #WebKitDOMNode
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_interface_set_supplemental_node(WebKitDOMTestInterface* self, WebKitDOMNode* value);
+
 G_END_DECLS
 
 #endif /* WebKitDOMTestInterface_h */
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index 5f9f95f44..35add3087 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -308,6 +308,42 @@ webkit_dom_test_obj_with_script_execution_context(WebKitDOMTestObj* self)
 }
 
 void
+webkit_dom_test_obj_with_script_execution_context_and_script_state(WebKitDOMTestObj* self)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    item->withScriptExecutionContextAndScriptState();
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception(WebKitDOMTestObj* self, GError **error)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    WebCore::ExceptionCode ec = 0;
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateObjException(ec));
+    if (ec) {
+        WebCore::ExceptionCodeDescription ecdesc(ec);
+        g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
+    }
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces(WebKitDOMTestObj* self)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateWithSpaces());
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+void
 webkit_dom_test_obj_method_with_optional_arg(WebKitDOMTestObj* self, glong opt)
 {
     g_return_if_fail(self);
@@ -334,6 +370,39 @@ webkit_dom_test_obj_method_with_non_optional_arg_and_two_optional_args(WebKitDOM
     item->methodWithNonOptionalArgAndTwoOptionalArgs(non_opt, opt1, opt2);
 }
 
+void
+webkit_dom_test_obj_method_with_optional_string(WebKitDOMTestObj* self, const gchar* str)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(str);
+    WTF::String converted_str = WTF::String::fromUTF8(str);
+    item->methodWithOptionalString(converted_str);
+}
+
+void
+webkit_dom_test_obj_method_with_optional_string_is_undefined(WebKitDOMTestObj* self, const gchar* str)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(str);
+    WTF::String converted_str = WTF::String::fromUTF8(str);
+    item->methodWithOptionalStringIsUndefined(converted_str);
+}
+
+void
+webkit_dom_test_obj_method_with_optional_string_is_null_string(WebKitDOMTestObj* self, const gchar* str)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(str);
+    WTF::String converted_str = WTF::String::fromUTF8(str);
+    item->methodWithOptionalStringIsNullString(converted_str);
+}
+
 gchar*
 webkit_dom_test_obj_conditional_method1(WebKitDOMTestObj* self)
 {
@@ -1157,16 +1226,94 @@ webkit_dom_test_obj_set_with_script_execution_context_attribute_raises(WebKitDOM
     }
 }
 
-gchar*
-webkit_dom_test_obj_get_script_string_attr(WebKitDOMTestObj* self)
+WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self)
 {
     g_return_val_if_fail(self, 0);
     WebCore::JSMainThreadNullState state;
     WebCore::TestObj * item = WebKit::core(self);
-    gchar* res = convertToUTF8String(item->scriptStringAttr());
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateAttribute());
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
     return res;
 }
 
+void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::TestObj * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    item->setWithScriptExecutionContextAndScriptStateAttribute(converted_value);
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, GError **error)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    WebCore::ExceptionCode ec = 0;
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateAttributeRaises(ec));
+    if (ec) {
+        WebCore::ExceptionCodeDescription ecdesc(ec);
+        g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
+    }
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, WebKitDOMTestObj* value, GError **error)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::TestObj * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    WebCore::ExceptionCode ec = 0;
+    item->setWithScriptExecutionContextAndScriptStateAttributeRaises(converted_value, ec);
+    if (ec) {
+        WebCore::ExceptionCodeDescription ecdesc(ec);
+        g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
+    }
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateWithSpacesAttribute());
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::TestObj * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    item->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(converted_value);
+}
+
 glong
 webkit_dom_test_obj_get_conditional_attr1(WebKitDOMTestObj* self)
 {
@@ -1410,7 +1557,10 @@ enum {
     PROP_WITH_SCRIPT_EXECUTION_CONTEXT_ATTRIBUTE,
     PROP_WITH_SCRIPT_STATE_ATTRIBUTE_RAISES,
     PROP_WITH_SCRIPT_EXECUTION_CONTEXT_ATTRIBUTE_RAISES,
-    PROP_SCRIPT_STRING_ATTR,
+    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE,
+    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE_RAISES,
+    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_WITH_SPACES_ATTRIBUTE,
+    PROP_WITH_SCRIPT_ARGUMENTS_AND_CALL_STACK_ATTRIBUTE,
 #if ENABLE(Condition1)
     PROP_CONDITIONAL_ATTR1,
 #endif /* ENABLE(Condition1) */
@@ -1750,9 +1900,29 @@ static void webkit_dom_test_obj_get_property(GObject* object, guint prop_id, GVa
         g_value_set_object(value, WebKit::kit(ptr.get()));
         break;
     }
-    case PROP_SCRIPT_STRING_ATTR:
+    case PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE:
     {
-        g_value_take_string(value, convertToUTF8String(coreSelf->scriptStringAttr()));
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptExecutionContextAndScriptStateAttribute();
+        g_value_set_object(value, WebKit::kit(ptr.get()));
+        break;
+    }
+    case PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE_RAISES:
+    {
+        WebCore::ExceptionCode ec = 0;
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptExecutionContextAndScriptStateAttributeRaises(ec);
+        g_value_set_object(value, WebKit::kit(ptr.get()));
+        break;
+    }
+    case PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_WITH_SPACES_ATTRIBUTE:
+    {
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptExecutionContextAndScriptStateWithSpacesAttribute();
+        g_value_set_object(value, WebKit::kit(ptr.get()));
+        break;
+    }
+    case PROP_WITH_SCRIPT_ARGUMENTS_AND_CALL_STACK_ATTRIBUTE:
+    {
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptArgumentsAndCallStackAttribute();
+        g_value_set_object(value, WebKit::kit(ptr.get()));
         break;
     }
 #if ENABLE(Condition1)
@@ -2064,12 +2234,33 @@ G_MAXLONG, /* max */
                                                            WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
                                                            WEBKIT_PARAM_READWRITE));
     g_object_class_install_property(gobjectClass,
-                                    PROP_SCRIPT_STRING_ATTR,
-                                    g_param_spec_string("script-string-attr", /* name */
-                                                           "test_obj_script-string-attr", /* short description */
-                                                           "read-only  gchar* TestObj.script-string-attr", /* longer - could do with some extra doc stuff here */
-                                                           "", /* default */
-                                                           WEBKIT_PARAM_READABLE));
+                                    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE,
+                                    g_param_spec_object("with-script-execution-context-and-script-state-attribute", /* name */
+                                                           "test_obj_with-script-execution-context-and-script-state-attribute", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-execution-context-and-script-state-attribute", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
+                                    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE_RAISES,
+                                    g_param_spec_object("with-script-execution-context-and-script-state-attribute-raises", /* name */
+                                                           "test_obj_with-script-execution-context-and-script-state-attribute-raises", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-execution-context-and-script-state-attribute-raises", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
+                                    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_WITH_SPACES_ATTRIBUTE,
+                                    g_param_spec_object("with-script-execution-context-and-script-state-with-spaces-attribute", /* name */
+                                                           "test_obj_with-script-execution-context-and-script-state-with-spaces-attribute", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-execution-context-and-script-state-with-spaces-attribute", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
+                                    PROP_WITH_SCRIPT_ARGUMENTS_AND_CALL_STACK_ATTRIBUTE,
+                                    g_param_spec_object("with-script-arguments-and-call-stack-attribute", /* name */
+                                                           "test_obj_with-script-arguments-and-call-stack-attribute", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-arguments-and-call-stack-attribute", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
 #if ENABLE(Condition1)
     g_object_class_install_property(gobjectClass,
                                     PROP_CONDITIONAL_ATTR1,
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
index f118dd880..caeb51ffa 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
@@ -226,6 +226,37 @@ WEBKIT_API void
 webkit_dom_test_obj_with_script_execution_context(WebKitDOMTestObj* self);
 
 /**
+ * webkit_dom_test_obj_with_script_execution_context_and_script_state:
+ * @self: A #WebKitDOMTestObj
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_with_script_execution_context_and_script_state(WebKitDOMTestObj* self);
+
+/**
+ * webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception:
+ * @self: A #WebKitDOMTestObj
+ * @error: #GError
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception(WebKitDOMTestObj* self, GError **error);
+
+/**
+ * webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces:
+ * @self: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces(WebKitDOMTestObj* self);
+
+/**
  * webkit_dom_test_obj_method_with_optional_arg:
  * @self: A #WebKitDOMTestObj
  * @opt: A #glong
@@ -262,6 +293,39 @@ WEBKIT_API void
 webkit_dom_test_obj_method_with_non_optional_arg_and_two_optional_args(WebKitDOMTestObj* self, glong non_opt, glong opt1, glong opt2);
 
 /**
+ * webkit_dom_test_obj_method_with_optional_string:
+ * @self: A #WebKitDOMTestObj
+ * @str: A #gchar
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_method_with_optional_string(WebKitDOMTestObj* self, const gchar* str);
+
+/**
+ * webkit_dom_test_obj_method_with_optional_string_is_undefined:
+ * @self: A #WebKitDOMTestObj
+ * @str: A #gchar
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_method_with_optional_string_is_undefined(WebKitDOMTestObj* self, const gchar* str);
+
+/**
+ * webkit_dom_test_obj_method_with_optional_string_is_null_string:
+ * @self: A #WebKitDOMTestObj
+ * @str: A #gchar
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_method_with_optional_string_is_null_string(WebKitDOMTestObj* self, const gchar* str);
+
+/**
  * webkit_dom_test_obj_conditional_method1:
  * @self: A #WebKitDOMTestObj
  *
@@ -1020,14 +1084,69 @@ WEBKIT_API void
 webkit_dom_test_obj_set_with_script_execution_context_attribute_raises(WebKitDOMTestObj* self, WebKitDOMTestObj* value, GError **error);
 
 /**
- * webkit_dom_test_obj_get_script_string_attr:
+ * webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute:
  * @self: A #WebKitDOMTestObj
  *
- * Returns:
+ * Returns: (transfer none):
  *
 **/
-WEBKIT_API gchar*
-webkit_dom_test_obj_get_script_string_attr(WebKitDOMTestObj* self);
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self);
+
+/**
+ * webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute:
+ * @self: A #WebKitDOMTestObj
+ * @value: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value);
+
+/**
+ * webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises:
+ * @self: A #WebKitDOMTestObj
+ * @error: #GError
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, GError **error);
+
+/**
+ * webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises:
+ * @self: A #WebKitDOMTestObj
+ * @value: A #WebKitDOMTestObj
+ * @error: #GError
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, WebKitDOMTestObj* value, GError **error);
+
+/**
+ * webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute:
+ * @self: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self);
+
+/**
+ * webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute:
+ * @self: A #WebKitDOMTestObj
+ * @value: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value);
 
 /**
  * webkit_dom_test_obj_get_conditional_attr1:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
index e2aabcd35..67220b7af 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
@@ -36,8 +36,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSFloat64Array);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSFloat64Array);
-
 /* Hash table */
 
 static const HashTableValue JSFloat64ArrayTableValues[] =
@@ -55,8 +53,6 @@ static const HashTableValue JSFloat64ArrayConstructorTableValues[] =
 };
 
 static const HashTable JSFloat64ArrayConstructorTable = { 1, 0, JSFloat64ArrayConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSFloat64ArrayConstructor);
-
 const ClassInfo JSFloat64ArrayConstructor::s_info = { "Float64ArrayConstructor", &Base::s_info, &JSFloat64ArrayConstructorTable, 0, CREATE_METHOD_TABLE(JSFloat64ArrayConstructor) };
 
 JSFloat64ArrayConstructor::JSFloat64ArrayConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -235,7 +231,7 @@ EncodedJSValue JSC_HOST_CALL jsFloat64ArrayPrototypeFunctionFoo(ExecState* exec)
     Float64Array* impl = static_cast<Float64Array*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    Float32Array* array(toFloat32Array(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    Float32Array* array(toFloat32Array(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
index f886cdda7..6e66849f0 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestActiveDOMObject);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestActiveDOMObject);
-
 /* Hash table */
 
 static const HashTableValue JSTestActiveDOMObjectTableValues[] =
@@ -53,8 +51,6 @@ static const HashTableValue JSTestActiveDOMObjectConstructorTableValues[] =
 };
 
 static const HashTable JSTestActiveDOMObjectConstructorTable = { 1, 0, JSTestActiveDOMObjectConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestActiveDOMObjectConstructor);
-
 const ClassInfo JSTestActiveDOMObjectConstructor::s_info = { "TestActiveDOMObjectConstructor", &Base::s_info, &JSTestActiveDOMObjectConstructorTable, 0, CREATE_METHOD_TABLE(JSTestActiveDOMObjectConstructor) };
 
 JSTestActiveDOMObjectConstructor::JSTestActiveDOMObjectConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -130,7 +126,12 @@ JSObject* JSTestActiveDOMObject::createPrototype(ExecState* exec, JSGlobalObject
 void JSTestActiveDOMObject::destroy(JSC::JSCell* cell)
 {
     JSTestActiveDOMObject* thisObject = jsCast<JSTestActiveDOMObject*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestActiveDOMObject::~JSTestActiveDOMObject();
+}
+
+JSTestActiveDOMObject::~JSTestActiveDOMObject()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestActiveDOMObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -186,7 +187,7 @@ EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionExcitingFunct
     TestActiveDOMObject* impl = static_cast<TestActiveDOMObject*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    Node* nextChild(toNode(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    Node* nextChild(toNode(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->excitingFunction(nextChild);
@@ -203,7 +204,7 @@ EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionPostMessage(E
     TestActiveDOMObject* impl = static_cast<TestActiveDOMObject*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& message(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& message(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->postMessage(message);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
index bcd224dd2..2a42407a0 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestActiveDOMObject();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
index fdf0fa192..aeab46b4c 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestCustomNamedGetter);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestCustomNamedGetter);
-
 /* Hash table */
 
 static const HashTableValue JSTestCustomNamedGetterTableValues[] =
@@ -52,8 +50,6 @@ static const HashTableValue JSTestCustomNamedGetterConstructorTableValues[] =
 };
 
 static const HashTable JSTestCustomNamedGetterConstructorTable = { 1, 0, JSTestCustomNamedGetterConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestCustomNamedGetterConstructor);
-
 const ClassInfo JSTestCustomNamedGetterConstructor::s_info = { "TestCustomNamedGetterConstructor", &Base::s_info, &JSTestCustomNamedGetterConstructorTable, 0, CREATE_METHOD_TABLE(JSTestCustomNamedGetterConstructor) };
 
 JSTestCustomNamedGetterConstructor::JSTestCustomNamedGetterConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -128,7 +124,12 @@ JSObject* JSTestCustomNamedGetter::createPrototype(ExecState* exec, JSGlobalObje
 void JSTestCustomNamedGetter::destroy(JSC::JSCell* cell)
 {
     JSTestCustomNamedGetter* thisObject = jsCast<JSTestCustomNamedGetter*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestCustomNamedGetter::~JSTestCustomNamedGetter();
+}
+
+JSTestCustomNamedGetter::~JSTestCustomNamedGetter()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestCustomNamedGetter::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -176,7 +177,7 @@ EncodedJSValue JSC_HOST_CALL jsTestCustomNamedGetterPrototypeFunctionAnotherFunc
     TestCustomNamedGetter* impl = static_cast<TestCustomNamedGetter*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->anotherFunction(str);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
index f530c8b5c..83b8b4f75 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestCustomNamedGetter();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
index dbe8e5e30..bd72745ae 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestEventConstructor);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventConstructor);
-
 /* Hash table for constructor */
 
 static const HashTableValue JSTestEventConstructorTableValues[] =
@@ -54,8 +52,6 @@ static const HashTableValue JSTestEventConstructorConstructorTableValues[] =
 };
 
 static const HashTable JSTestEventConstructorConstructorTable = { 1, 0, JSTestEventConstructorConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventConstructorConstructor);
-
 const ClassInfo JSTestEventConstructorConstructor::s_info = { "TestEventConstructorConstructor", &Base::s_info, &JSTestEventConstructorConstructorTable, 0, CREATE_METHOD_TABLE(JSTestEventConstructorConstructor) };
 
 JSTestEventConstructorConstructor::JSTestEventConstructorConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -68,6 +64,7 @@ void JSTestEventConstructorConstructor::finishCreation(ExecState* exec, JSDOMGlo
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestEventConstructorPrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestEventConstructorConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,7 +158,12 @@ JSObject* JSTestEventConstructor::createPrototype(ExecState* exec, JSGlobalObjec
 void JSTestEventConstructor::destroy(JSC::JSCell* cell)
 {
     JSTestEventConstructor* thisObject = jsCast<JSTestEventConstructor*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestEventConstructor::~JSTestEventConstructor();
+}
+
+JSTestEventConstructor::~JSTestEventConstructor()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestEventConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
index 888ae5d9a..260bdeb3b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
@@ -45,6 +45,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestEventConstructor();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
index 9a522f300..157288984 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
@@ -39,8 +39,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestEventTarget);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventTarget);
-
 /* Hash table */
 
 static const HashTableValue JSTestEventTargetTableValues[] =
@@ -58,8 +56,6 @@ static const HashTableValue JSTestEventTargetConstructorTableValues[] =
 };
 
 static const HashTable JSTestEventTargetConstructorTable = { 1, 0, JSTestEventTargetConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventTargetConstructor);
-
 const ClassInfo JSTestEventTargetConstructor::s_info = { "TestEventTargetConstructor", &Base::s_info, &JSTestEventTargetConstructorTable, 0, CREATE_METHOD_TABLE(JSTestEventTargetConstructor) };
 
 JSTestEventTargetConstructor::JSTestEventTargetConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -137,7 +133,12 @@ JSObject* JSTestEventTarget::createPrototype(ExecState* exec, JSGlobalObject* gl
 void JSTestEventTarget::destroy(JSC::JSCell* cell)
 {
     JSTestEventTarget* thisObject = jsCast<JSTestEventTarget*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestEventTarget::~JSTestEventTarget();
+}
+
+JSTestEventTarget::~JSTestEventTarget()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestEventTarget::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -231,7 +232,7 @@ EncodedJSValue JSC_HOST_CALL jsTestEventTargetPrototypeFunctionItem(ExecState* e
     TestEventTarget* impl = static_cast<TestEventTarget*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int index(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toUInt32(exec));
+    int index(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toUInt32(exec));
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return JSValue::encode(jsUndefined());
@@ -288,7 +289,7 @@ EncodedJSValue JSC_HOST_CALL jsTestEventTargetPrototypeFunctionDispatchEvent(Exe
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    Event* evt(toEvent(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    Event* evt(toEvent(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
index 6fd4a3447..48edd5707 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
@@ -44,6 +44,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestEventTarget();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
index 476d7250c..c3888e8e8 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
@@ -35,17 +35,20 @@
 #include <wtf/GetPtr.h>
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
+#include "JSNode.h"
 #include "KURL.h"
 #include <runtime/JSString.h>
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+#include "Node.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestInterface);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestInterface);
-
 /* Hash table */
 
 static const HashTableValue JSTestInterfaceTableValues[] =
@@ -59,11 +62,14 @@ static const HashTableValue JSTestInterfaceTableValues[] =
 #if ENABLE(Condition11) || ENABLE(Condition12)
     { "supplementalStr3", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceSupplementalStr3), (intptr_t)setJSTestInterfaceSupplementalStr3, NoIntrinsic },
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    { "supplementalNode", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceSupplementalNode), (intptr_t)setJSTestInterfaceSupplementalNode, NoIntrinsic },
+#endif
     { "constructor", DontEnum | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceConstructor), (intptr_t)0, NoIntrinsic },
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
-static const HashTable JSTestInterfaceTable = { 9, 7, JSTestInterfaceTableValues, 0 };
+static const HashTable JSTestInterfaceTable = { 16, 15, JSTestInterfaceTableValues, 0 };
 /* Hash table for constructor */
 
 static const HashTableValue JSTestInterfaceConstructorTableValues[] =
@@ -74,20 +80,21 @@ static const HashTableValue JSTestInterfaceConstructorTableValues[] =
 #if ENABLE(Condition11) || ENABLE(Condition12)
     { "SUPPLEMENTALCONSTANT2", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceSUPPLEMENTALCONSTANT2), (intptr_t)0, NoIntrinsic },
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    { "supplementalMethod4", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestInterfaceConstructorFunctionSupplementalMethod4), (intptr_t)0, NoIntrinsic },
+#endif
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
 static const HashTable JSTestInterfaceConstructorTable = { 4, 3, JSTestInterfaceConstructorTableValues, 0 };
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(1 == TestInterface::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(1 == TestSupplemental::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(2 == TestInterface::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(2 == TestSupplemental::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
 #endif
 
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestInterfaceConstructor);
-
 const ClassInfo JSTestInterfaceConstructor::s_info = { "TestInterfaceConstructor", &Base::s_info, &JSTestInterfaceConstructorTable, 0, CREATE_METHOD_TABLE(JSTestInterfaceConstructor) };
 
 JSTestInterfaceConstructor::JSTestInterfaceConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -100,16 +107,17 @@ void JSTestInterfaceConstructor::finishCreation(ExecState* exec, JSDOMGlobalObje
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(cell), propertyName, slot);
+    return getStaticPropertySlot<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(cell), propertyName, slot);
 }
 
 bool JSTestInterfaceConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    return getStaticValueDescriptor<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(object), propertyName, descriptor);
+    return getStaticPropertyDescriptor<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(object), propertyName, descriptor);
 }
 
 EncodedJSValue JSC_HOST_CALL JSTestInterfaceConstructor::constructJSTestInterface(ExecState* exec)
@@ -118,10 +126,10 @@ EncodedJSValue JSC_HOST_CALL JSTestInterfaceConstructor::constructJSTestInterfac
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
@@ -205,7 +213,12 @@ JSObject* JSTestInterface::createPrototype(ExecState* exec, JSGlobalObject* glob
 void JSTestInterface::destroy(JSC::JSCell* cell)
 {
     JSTestInterface* thisObject = jsCast<JSTestInterface*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestInterface::~JSTestInterface();
+}
+
+JSTestInterface::~JSTestInterface()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -255,6 +268,18 @@ JSValue jsTestInterfaceSupplementalStr3(ExecState* exec, JSValue slotBase, const
 
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+JSValue jsTestInterfaceSupplementalNode(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestInterface* castedThis = static_cast<JSTestInterface*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TestInterface* impl = static_cast<TestInterface*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(TestSupplemental::supplementalNode(impl)));
+    return result;
+}
+
+#endif
+
 JSValue jsTestInterfaceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSTestInterface* domObject = static_cast<JSTestInterface*>(asObject(slotBase));
@@ -288,6 +313,16 @@ void setJSTestInterfaceSupplementalStr3(ExecState* exec, JSObject* thisObject, J
 
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+void setJSTestInterfaceSupplementalNode(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestInterface* castedThis = static_cast<JSTestInterface*>(thisObject);
+    TestInterface* impl = static_cast<TestInterface*>(castedThis->impl());
+    TestSupplemental::setSupplementalNode(impl, toNode(value));
+}
+
+#endif
+
 JSValue JSTestInterface::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
     return getDOMConstructor<JSTestInterfaceConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
@@ -323,10 +358,10 @@ EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod2
     ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
     if (!scriptContext)
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -350,6 +385,15 @@ EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod3
 
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMethod4(ExecState* exec)
+{
+    TestSupplemental::supplementalMethod4();
+    return JSValue::encode(jsUndefined());
+}
+
+#endif
+
 // Constant getters
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
index c6f3da952..a0ce24452 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
@@ -47,6 +47,7 @@ public:
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestInterface();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
@@ -151,6 +152,7 @@ protected:
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod1(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod2(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod3(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMethod4(JSC::ExecState*);
 // Attributes
 
 JSC::JSValue jsTestInterfaceSupplementalStr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
@@ -158,6 +160,8 @@ JSC::JSValue jsTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSValue, cons
 void setJSTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestInterfaceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
index 1a7821fe4..4237cbd3b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestMediaQueryListListener);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestMediaQueryListListener);
-
 /* Hash table */
 
 static const HashTableValue JSTestMediaQueryListListenerTableValues[] =
@@ -52,8 +50,6 @@ static const HashTableValue JSTestMediaQueryListListenerConstructorTableValues[]
 };
 
 static const HashTable JSTestMediaQueryListListenerConstructorTable = { 1, 0, JSTestMediaQueryListListenerConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestMediaQueryListListenerConstructor);
-
 const ClassInfo JSTestMediaQueryListListenerConstructor::s_info = { "TestMediaQueryListListenerConstructor", &Base::s_info, &JSTestMediaQueryListListenerConstructorTable, 0, CREATE_METHOD_TABLE(JSTestMediaQueryListListenerConstructor) };
 
 JSTestMediaQueryListListenerConstructor::JSTestMediaQueryListListenerConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -128,7 +124,12 @@ JSObject* JSTestMediaQueryListListener::createPrototype(ExecState* exec, JSGloba
 void JSTestMediaQueryListListener::destroy(JSC::JSCell* cell)
 {
     JSTestMediaQueryListListener* thisObject = jsCast<JSTestMediaQueryListListener*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestMediaQueryListListener::~JSTestMediaQueryListListener();
+}
+
+JSTestMediaQueryListListener::~JSTestMediaQueryListListener()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestMediaQueryListListener::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -166,7 +167,7 @@ EncodedJSValue JSC_HOST_CALL jsTestMediaQueryListListenerPrototypeFunctionMethod
     TestMediaQueryListListener* impl = static_cast<TestMediaQueryListListener*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    RefPtr<MediaQueryListListener> listener(MediaQueryListListener::create(ScriptValue(exec->globalData(), MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined))));
+    RefPtr<MediaQueryListListener> listener(MediaQueryListListener::create(ScriptValue(exec->globalData(), MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined))));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->method(listener);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
index f03fcb51c..af5bb5800 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestMediaQueryListListener();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
index 147f2c19f..225208dc2 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
@@ -32,8 +32,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestNamedConstructor);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestNamedConstructor);
-
 /* Hash table for constructor */
 
 static const HashTableValue JSTestNamedConstructorTableValues[] =
@@ -51,8 +49,6 @@ static const HashTableValue JSTestNamedConstructorConstructorTableValues[] =
 };
 
 static const HashTable JSTestNamedConstructorConstructorTable = { 1, 0, JSTestNamedConstructorConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestNamedConstructorConstructor);
-
 const ClassInfo JSTestNamedConstructorConstructor::s_info = { "TestNamedConstructorConstructor", &Base::s_info, &JSTestNamedConstructorConstructorTable, 0, CREATE_METHOD_TABLE(JSTestNamedConstructorConstructor) };
 
 JSTestNamedConstructorConstructor::JSTestNamedConstructorConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -97,13 +93,13 @@ EncodedJSValue JSC_HOST_CALL JSTestNamedConstructorNamedConstructor::constructJS
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& str3(ustringToString(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsEmpty).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 2, MissingIsEmpty).toString(exec)->value(exec)));
+    const String& str3(ustringToString(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsNullString).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsNullString).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     RefPtr<TestNamedConstructor> object = TestNamedConstructor::createForJSConstructor(jsConstructor->document(), str1, str2, str3, ec);
@@ -157,7 +153,12 @@ JSObject* JSTestNamedConstructor::createPrototype(ExecState* exec, JSGlobalObjec
 void JSTestNamedConstructor::destroy(JSC::JSCell* cell)
 {
     JSTestNamedConstructor* thisObject = jsCast<JSTestNamedConstructor*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestNamedConstructor::~JSTestNamedConstructor();
+}
+
+JSTestNamedConstructor::~JSTestNamedConstructor()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestNamedConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
index 23bb53958..f93f97f2f 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestNamedConstructor();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 98e79b3e0..97dcc8f2f 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -42,7 +42,6 @@
 #include "JSd.h"
 #include "JSe.h"
 #include "JSint.h"
-#include "JSlog.h"
 #include "KURL.h"
 #include "SVGDocument.h"
 #include "SVGStaticPropertyTearOff.h"
@@ -73,8 +72,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestObj);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestObj);
-
 /* Hash table */
 
 static const HashTableValue JSTestObjTableValues[] =
@@ -109,7 +106,10 @@ static const HashTableValue JSTestObjTableValues[] =
     { "withScriptExecutionContextAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAttribute), (intptr_t)setJSTestObjWithScriptExecutionContextAttribute, NoIntrinsic },
     { "withScriptStateAttributeRaises", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptStateAttributeRaises), (intptr_t)setJSTestObjWithScriptStateAttributeRaises, NoIntrinsic },
     { "withScriptExecutionContextAttributeRaises", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAttributeRaises), (intptr_t)setJSTestObjWithScriptExecutionContextAttributeRaises, NoIntrinsic },
-    { "scriptStringAttr", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjScriptStringAttr), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAndScriptStateAttribute), (intptr_t)setJSTestObjWithScriptExecutionContextAndScriptStateAttribute, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateAttributeRaises", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises), (intptr_t)setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateWithSpacesAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute), (intptr_t)setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute, NoIntrinsic },
+    { "withScriptArgumentsAndCallStackAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptArgumentsAndCallStackAttribute), (intptr_t)setJSTestObjWithScriptArgumentsAndCallStackAttribute, NoIntrinsic },
 #if ENABLE(Condition1)
     { "conditionalAttr1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjConditionalAttr1), (intptr_t)setJSTestObjConditionalAttr1, NoIntrinsic },
 #endif
@@ -187,9 +187,7 @@ COMPILE_ASSERT(0X20 == TestObj::CONST_VALUE_13, TestObjEnumCONST_VALUE_13IsWrong
 COMPILE_ASSERT(0x1abc == TestObj::CONST_VALUE_14, TestObjEnumCONST_VALUE_14IsWrongUseDoNotCheckConstants);
 COMPILE_ASSERT(15 == TestObj::CONST_IMPL, TestObjEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
 
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestObjConstructor);
-
-const ClassInfo JSTestObjConstructor::s_info = { "TestObjConstructor", &Base::s_info, &JSTestObjConstructorTable, 0, CREATE_METHOD_TABLE(JSTestObjConstructor) };
+const ClassInfo JSTestObjConstructor::s_info = { "TestObjectConstructor", &Base::s_info, &JSTestObjConstructorTable, 0, CREATE_METHOD_TABLE(JSTestObjConstructor) };
 
 JSTestObjConstructor::JSTestObjConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
     : DOMConstructorObject(structure, globalObject)
@@ -201,6 +199,7 @@ void JSTestObjConstructor::finishCreation(ExecState* exec, JSDOMGlobalObject* gl
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestObjPrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestObjConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -258,7 +257,6 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { "methodWithException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithException), (intptr_t)0, NoIntrinsic },
     { "customMethod", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomMethod), (intptr_t)0, NoIntrinsic },
     { "customMethodWithArgs", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomMethodWithArgs), (intptr_t)3, NoIntrinsic },
-    { "customArgsAndException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomArgsAndException), (intptr_t)1, NoIntrinsic },
     { "addEventListener", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionAddEventListener), (intptr_t)3, NoIntrinsic },
     { "removeEventListener", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionRemoveEventListener), (intptr_t)3, NoIntrinsic },
     { "withScriptStateVoid", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptStateVoid), (intptr_t)0, NoIntrinsic },
@@ -266,9 +264,16 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { "withScriptStateVoidException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptStateVoidException), (intptr_t)0, NoIntrinsic },
     { "withScriptStateObjException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptStateObjException), (intptr_t)0, NoIntrinsic },
     { "withScriptExecutionContext", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContext), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptState", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateObjException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateWithSpaces", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces), (intptr_t)0, NoIntrinsic },
+    { "withScriptArgumentsAndCallStack", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack), (intptr_t)0, NoIntrinsic },
     { "methodWithOptionalArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalArg), (intptr_t)1, NoIntrinsic },
     { "methodWithNonOptionalArgAndOptionalArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg), (intptr_t)2, NoIntrinsic },
     { "methodWithNonOptionalArgAndTwoOptionalArgs", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs), (intptr_t)3, NoIntrinsic },
+    { "methodWithOptionalString", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalString), (intptr_t)1, NoIntrinsic },
+    { "methodWithOptionalStringIsUndefined", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined), (intptr_t)1, NoIntrinsic },
+    { "methodWithOptionalStringIsNullString", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString), (intptr_t)1, NoIntrinsic },
     { "methodWithCallbackArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithCallbackArg), (intptr_t)1, NoIntrinsic },
     { "methodWithNonCallbackArgAndCallbackArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg), (intptr_t)2, NoIntrinsic },
     { "methodWithCallbackAndOptionalArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg), (intptr_t)1, NoIntrinsic },
@@ -282,6 +287,7 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { "conditionalMethod3", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionConditionalMethod3), (intptr_t)0, NoIntrinsic },
 #endif
     { "overloadedMethod", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionOverloadedMethod), (intptr_t)2, NoIntrinsic },
+    { "methodWithUnsignedLongArray", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithUnsignedLongArray), (intptr_t)1, NoIntrinsic },
     { "getSVGDocument", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionGetSVGDocument), (intptr_t)0, NoIntrinsic },
     { "convert1", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionConvert1), (intptr_t)1, NoIntrinsic },
     { "convert2", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionConvert2), (intptr_t)1, NoIntrinsic },
@@ -295,8 +301,8 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
-static const HashTable JSTestObjPrototypeTable = { 138, 127, JSTestObjPrototypeTableValues, 0 };
-const ClassInfo JSTestObjPrototype::s_info = { "TestObjPrototype", &Base::s_info, &JSTestObjPrototypeTable, 0, CREATE_METHOD_TABLE(JSTestObjPrototype) };
+static const HashTable JSTestObjPrototypeTable = { 266, 255, JSTestObjPrototypeTableValues, 0 };
+const ClassInfo JSTestObjPrototype::s_info = { "TestObjectPrototype", &Base::s_info, &JSTestObjPrototypeTable, 0, CREATE_METHOD_TABLE(JSTestObjPrototype) };
 
 JSObject* JSTestObjPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
@@ -315,7 +321,7 @@ bool JSTestObjPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* e
     return getStaticPropertyDescriptor<JSTestObjPrototype, JSObject>(exec, &JSTestObjPrototypeTable, thisObject, propertyName, descriptor);
 }
 
-const ClassInfo JSTestObj::s_info = { "TestObj", &Base::s_info, &JSTestObjTable, 0 , CREATE_METHOD_TABLE(JSTestObj) };
+const ClassInfo JSTestObj::s_info = { "TestObject", &Base::s_info, &JSTestObjTable, 0 , CREATE_METHOD_TABLE(JSTestObj) };
 
 JSTestObj::JSTestObj(Structure* structure, JSDOMGlobalObject* globalObject, PassRefPtr<TestObj> impl)
     : JSDOMWrapper(structure, globalObject)
@@ -337,7 +343,12 @@ JSObject* JSTestObj::createPrototype(ExecState* exec, JSGlobalObject* globalObje
 void JSTestObj::destroy(JSC::JSCell* cell)
 {
     JSTestObj* thisObject = jsCast<JSTestObj*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestObj::~JSTestObj();
+}
+
+JSTestObj::~JSTestObj()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestObj::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -659,12 +670,50 @@ JSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, JSVa
 }
 
 
-JSValue jsTestObjScriptStringAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
-    UNUSED_PARAM(exec);
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return jsUndefined();
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateAttribute(exec, scriptContext)));
+    return result;
+}
+
+
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    ExceptionCode ec = 0;
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return jsUndefined();
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateAttributeRaises(exec, scriptContext, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return jsUndefined();
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateWithSpacesAttribute(exec, scriptContext)));
+    return result;
+}
+
+
+JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
-    JSValue result = jsOwnedStringOrNull(exec, impl->scriptStringAttr());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptArgumentsAndCallStackAttribute(callStack)));
     return result;
 }
 
@@ -1071,6 +1120,50 @@ void setJSTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, JSOb
 }
 
 
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return;
+    impl->setWithScriptExecutionContextAndScriptStateAttribute(exec, scriptContext, toTestObj(value));
+}
+
+
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ExceptionCode ec = 0;
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return;
+    impl->setWithScriptExecutionContextAndScriptStateAttributeRaises(exec, scriptContext, toTestObj(value), ec);
+    setDOMException(exec, ec);
+}
+
+
+void setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return;
+    impl->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(exec, scriptContext, toTestObj(value));
+}
+
+
+void setJSTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
+    impl->setWithScriptArgumentsAndCallStackAttribute(callStack, toTestObj(value));
+}
+
+
 #if ENABLE(Condition1)
 void setJSTestObjConditionalAttr1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
@@ -1187,13 +1280,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionVoidMethodWithArgs(ExecSt
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->voidMethodWithArgs(intArg, strArg, objArg);
@@ -1223,13 +1316,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionIntMethodWithArgs(ExecSta
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1260,13 +1353,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionObjMethodWithArgs(ExecSta
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1285,10 +1378,10 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodThatRequiresAllArgs
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1307,7 +1400,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionSerializedValue(ExecState
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    RefPtr<SerializedScriptValue> serializedArg(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    RefPtr<SerializedScriptValue> serializedArg(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->serializedValue(serializedArg);
@@ -1324,7 +1417,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionIdbKey(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    RefPtr<IDBKey> key(createIDBKeyFromValue(exec, MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    RefPtr<IDBKey> key(createIDBKeyFromValue(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->idbKey(key);
@@ -1341,7 +1434,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(ExecState*
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    OptionsObject* oo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    OptionsObject* oo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1351,7 +1444,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(ExecState*
         return JSValue::encode(jsUndefined());
     }
 
-    OptionsObject* ooo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    OptionsObject* ooo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->optionsObject(oo, ooo);
@@ -1392,27 +1485,6 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethodWithArgs(Exec
     return JSValue::encode(castedThis->customMethodWithArgs(exec));
 }
 
-EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomArgsAndException(ExecState* exec)
-{
-    JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&JSTestObj::s_info))
-        return throwVMTypeError(exec);
-    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
-    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
-    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
-    if (exec->argumentCount() < 1)
-        return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    ExceptionCode ec = 0;
-    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, 1));
-    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
-    log* intArg(tolog(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
-    if (exec->hadException())
-        return JSValue::encode(jsUndefined());
-    impl->customArgsAndException(intArg, scriptArguments, callStack, ec);
-    setDOMException(exec, ec);
-    return JSValue::encode(jsUndefined());
-}
-
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionAddEventListener(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1520,6 +1592,73 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContex
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return JSValue::encode(jsUndefined());
+    impl->withScriptExecutionContextAndScriptState(exec, scriptContext);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ExceptionCode ec = 0;
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return JSValue::encode(jsUndefined());
+
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateObjException(exec, scriptContext, ec)));
+    setDOMException(exec, ec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return JSValue::encode(jsUndefined());
+
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateWithSpaces(exec, scriptContext)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, 0));
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
+    impl->withScriptArgumentsAndCallStack(scriptArguments, callStack);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1535,7 +1674,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(Exe
         return JSValue::encode(jsUndefined());
     }
 
-    int opt(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int opt(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->methodWithOptionalArg(opt);
@@ -1552,7 +1691,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1562,7 +1701,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
         return JSValue::encode(jsUndefined());
     }
 
-    int opt(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toInt32(exec));
+    int opt(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
@@ -1579,7 +1718,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1589,7 +1728,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
         return JSValue::encode(jsUndefined());
     }
 
-    int opt1(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toInt32(exec));
+    int opt1(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     if (argsCount <= 2) {
@@ -1597,13 +1736,65 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
         return JSValue::encode(jsUndefined());
     }
 
-    int opt2(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined).toInt32(exec));
+    int opt2(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalString(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+
+    size_t argsCount = exec->argumentCount();
+    if (argsCount <= 0) {
+        impl->methodWithOptionalString();
+        return JSValue::encode(jsUndefined());
+    }
+
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithOptionalString(str);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithOptionalStringIsUndefined(str);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsNullString).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsNullString).toString(exec)->value(exec)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithOptionalStringIsNullString(str);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1633,7 +1824,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgA
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int nonCallback(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int nonCallback(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     if (exec->argumentCount() <= 1 || !exec->argument(1).isObject()) {
@@ -1721,10 +1912,10 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod1(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(objArg, strArg);
@@ -1741,7 +1932,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod2(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1751,7 +1942,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod2(
         return JSValue::encode(jsUndefined());
     }
 
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(objArg, intArg);
@@ -1768,7 +1959,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod3(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(strArg);
@@ -1785,7 +1976,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod4(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(intArg);
@@ -1821,7 +2012,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod6(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    DOMStringList* listArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    DOMStringList* listArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(listArg);
@@ -1838,7 +2029,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod7(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    DOMStringList* arrayArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    DOMStringList* arrayArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(arrayArg);
@@ -1883,7 +2074,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional
         return JSValue::encode(result);
     }
 
-    int arg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int arg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1896,7 +2087,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod
 {
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int arg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int arg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     TestObj::overloadedMethod1(arg);
@@ -1910,7 +2101,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod
 {
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& type(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& type(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     TestObj::overloadedMethod1(type);
@@ -1930,6 +2121,23 @@ EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod1(ExecS
 
 #endif
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUnsignedLongArray(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
+    Vector<unsigned long> unsignedLongArray(jsUnsignedLongArrayToVector(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithUnsignedLongArray(unsignedLongArray);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetSVGDocument(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1957,7 +2165,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert1(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    a* (toa(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    a* (toa(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert1();
@@ -1974,7 +2182,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert2(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    b* (tob(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    b* (tob(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert2();
@@ -1991,7 +2199,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert3(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    c* (toc(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    c* (toc(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert3();
@@ -2008,7 +2216,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert4(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    d* (tod(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    d* (tod(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert4();
@@ -2025,7 +2233,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert5(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    e* (toe(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    e* (toe(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert5();
@@ -2081,15 +2289,15 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionStrictFunction(ExecState*
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    float a(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toFloat(exec));
+    float a(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toFloat(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     if (exec->argumentCount() > 2 && !exec->argument(2).isUndefinedOrNull() && !exec->argument(2).inherits(&JSint::s_info))
         return throwVMTypeError(exec);
-    int* b(toint(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    int* b(toint(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index 89cc93226..cb9dafb6d 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -44,6 +44,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestObj();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
@@ -163,7 +164,6 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(JSC::E
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethodWithArgs(JSC::ExecState*);
-JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomArgsAndException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionAddEventListener(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionRemoveEventListener(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateVoid(JSC::ExecState*);
@@ -171,9 +171,16 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateObj(J
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateVoidException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateObjException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContext(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalString(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg(JSC::ExecState*);
@@ -184,6 +191,7 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(JSC
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod1(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUnsignedLongArray(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetSVGDocument(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert1(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert2(JSC::ExecState*);
@@ -253,7 +261,14 @@ JSC::JSValue jsTestObjWithScriptStateAttributeRaises(JSC::ExecState*, JSC::JSVal
 void setJSTestObjWithScriptStateAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjWithScriptExecutionContextAttributeRaises(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjWithScriptExecutionContextAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjScriptStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjConditionalAttr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjConditionalAttr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
index 02deeda6f..c0ea6eaad 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
@@ -36,8 +36,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestSerializedScriptValueInterface);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestSerializedScriptValueInterface);
-
 /* Hash table */
 
 static const HashTableValue JSTestSerializedScriptValueInterfaceTableValues[] =
@@ -59,8 +57,6 @@ static const HashTableValue JSTestSerializedScriptValueInterfaceConstructorTable
 };
 
 static const HashTable JSTestSerializedScriptValueInterfaceConstructorTable = { 1, 0, JSTestSerializedScriptValueInterfaceConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestSerializedScriptValueInterfaceConstructor);
-
 const ClassInfo JSTestSerializedScriptValueInterfaceConstructor::s_info = { "TestSerializedScriptValueInterfaceConstructor", &Base::s_info, &JSTestSerializedScriptValueInterfaceConstructorTable, 0, CREATE_METHOD_TABLE(JSTestSerializedScriptValueInterfaceConstructor) };
 
 JSTestSerializedScriptValueInterfaceConstructor::JSTestSerializedScriptValueInterfaceConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -73,6 +69,7 @@ void JSTestSerializedScriptValueInterfaceConstructor::finishCreation(ExecState*
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestSerializedScriptValueInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestSerializedScriptValueInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -90,10 +87,10 @@ EncodedJSValue JSC_HOST_CALL JSTestSerializedScriptValueInterfaceConstructor::co
     JSTestSerializedScriptValueInterfaceConstructor* jsConstructor = static_cast<JSTestSerializedScriptValueInterfaceConstructor*>(exec->callee());
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& hello(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& hello(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    RefPtr<SerializedScriptValue> value(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    RefPtr<SerializedScriptValue> value(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     RefPtr<TestSerializedScriptValueInterface> object = TestSerializedScriptValueInterface::create(hello, value);
@@ -143,7 +140,12 @@ JSObject* JSTestSerializedScriptValueInterface::createPrototype(ExecState* exec,
 void JSTestSerializedScriptValueInterface::destroy(JSC::JSCell* cell)
 {
     JSTestSerializedScriptValueInterface* thisObject = jsCast<JSTestSerializedScriptValueInterface*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface();
+}
+
+JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestSerializedScriptValueInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -240,6 +242,19 @@ JSValue JSTestSerializedScriptValueInterface::getConstructor(ExecState* exec, JS
     return getDOMConstructor<JSTestSerializedScriptValueInterfaceConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+void JSTestSerializedScriptValueInterface::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSTestSerializedScriptValueInterface* thisObject = jsCast<JSTestSerializedScriptValueInterface*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+    Base::visitChildren(thisObject, visitor);
+    if (thisObject->m_cachedValue)
+        visitor.append(&thisObject->m_cachedValue);
+    if (thisObject->m_cachedReadonlyValue)
+        visitor.append(&thisObject->m_cachedReadonlyValue);
+}
+
 static inline bool isObservable(JSTestSerializedScriptValueInterface* jsTestSerializedScriptValueInterface)
 {
     if (jsTestSerializedScriptValueInterface->hasCustomProperties())
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
index 363fc85e0..c944e42a3 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
@@ -46,6 +46,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestSerializedScriptValueInterface();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
index da6f2094c..7e3b1c402 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
@@ -28,6 +28,7 @@
 
 #if WEBKIT_VERSION_MAX_ALLOWED >= WEBKIT_VERSION_LATEST
 
+@class DOMNode;
 @class DOMTestObj;
 @class NSString;
 
@@ -53,9 +54,14 @@ enum {
 - (NSString *)supplementalStr3;
 - (void)setSupplementalStr3:(NSString *)newSupplementalStr3;
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+- (DOMNode *)supplementalNode;
+- (void)setSupplementalNode:(DOMNode *)newSupplementalNode;
+#endif
 - (void)supplementalMethod1;
 - (DOMTestObj *)supplementalMethod2:(NSString *)strArg objArg:(DOMTestObj *)objArg;
 - (void)supplementalMethod3;
+- (void)supplementalMethod4;
 @end
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm
index d8a17a073..381e4c2c3 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm
@@ -43,6 +43,7 @@
 #import "ExceptionHandlers.h"
 #import "JSMainThreadExecState.h"
 #import "KURL.h"
+#import "Node.h"
 #import "TestInterface.h"
 #import "TestObj.h"
 #import "TestSupplemental.h"
@@ -108,6 +109,22 @@
 }
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+- (DOMNode *)supplementalNode
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(TestSupplemental::supplementalNode(IMPL)));
+}
+
+- (void)setSupplementalNode:(DOMNode *)newSupplementalNode
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newSupplementalNode);
+
+    TestSupplemental::setSupplementalNode(IMPL, core(newSupplementalNode));
+}
+#endif
+
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod1
@@ -141,6 +158,16 @@
 
 #endif
 
+
+#if ENABLE(Condition11) || ENABLE(Condition12)
+- (void)supplementalMethod4
+{
+    WebCore::JSMainThreadNullState state;
+    TestSupplemental::supplementalMethod4(IMPL);
+}
+
+#endif
+
 @end
 
 WebCore::TestInterface* core(DOMTestInterface *wrapper)
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
index 547455674..295741e67 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
@@ -43,7 +43,6 @@
 @class DOMc;
 @class DOMd;
 @class DOMe;
-@class DOMlog;
 @class NSString;
 @protocol DOMEventListener;
 
@@ -123,7 +122,14 @@ enum {
 - (void)setWithScriptStateAttributeRaises:(DOMTestObj *)newWithScriptStateAttributeRaises;
 - (DOMTestObj *)withScriptExecutionContextAttributeRaises;
 - (void)setWithScriptExecutionContextAttributeRaises:(DOMTestObj *)newWithScriptExecutionContextAttributeRaises;
-- (NSString *)scriptStringAttr;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttribute;
+- (void)setWithScriptExecutionContextAndScriptStateAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttribute;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttributeRaises;
+- (void)setWithScriptExecutionContextAndScriptStateAttributeRaises:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttributeRaises;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpacesAttribute;
+- (void)setWithScriptExecutionContextAndScriptStateWithSpacesAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateWithSpacesAttribute;
+- (DOMTestObj *)withScriptArgumentsAndCallStackAttribute;
+- (void)setWithScriptArgumentsAndCallStackAttribute:(DOMTestObj *)newWithScriptArgumentsAndCallStackAttribute;
 #if ENABLE(Condition1)
 - (int)conditionalAttr1;
 - (void)setConditionalAttr1:(int)newConditionalAttr1;
@@ -172,7 +178,6 @@ enum {
 - (void)methodWithException;
 - (void)customMethod;
 - (void)customMethodWithArgs:(int)intArg strArg:(NSString *)strArg objArg:(DOMTestObj *)objArg;
-- (void)customArgsAndException:(DOMlog *)intArg;
 - (void)addEventListener:(NSString *)type listener:(id <DOMEventListener>)listener useCapture:(BOOL)useCapture;
 - (void)removeEventListener:(NSString *)type listener:(id <DOMEventListener>)listener useCapture:(BOOL)useCapture;
 - (void)withScriptStateVoid;
@@ -180,9 +185,16 @@ enum {
 - (void)withScriptStateVoidException;
 - (DOMTestObj *)withScriptStateObjException;
 - (void)withScriptExecutionContext;
+- (void)withScriptExecutionContextAndScriptState;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateObjException;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpaces;
+- (void)withScriptArgumentsAndCallStack;
 - (void)methodWithOptionalArg:(int)opt;
 - (void)methodWithNonOptionalArgAndOptionalArg:(int)nonOpt opt:(int)opt;
 - (void)methodWithNonOptionalArgAndTwoOptionalArgs:(int)nonOpt opt1:(int)opt1 opt2:(int)opt2;
+- (void)methodWithOptionalString:(NSString *)str;
+- (void)methodWithOptionalStringIsUndefined:(NSString *)str;
+- (void)methodWithOptionalStringIsNullString:(NSString *)str;
 - (NSString *)conditionalMethod1;
 - (void)conditionalMethod2;
 - (void)conditionalMethod3;
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
index b4ff638c7..38f9c6bec 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
@@ -50,7 +50,6 @@
 #import "DOMcInternal.h"
 #import "DOMdInternal.h"
 #import "DOMeInternal.h"
-#import "DOMlogInternal.h"
 #import "Document.h"
 #import "EventListener.h"
 #import "ExceptionHandlers.h"
@@ -76,7 +75,6 @@
 #import "c.h"
 #import "d.h"
 #import "e.h"
-#import "log.h"
 #import <wtf/GetPtr.h>
 
 #define IMPL reinterpret_cast<WebCore::TestObj*>(_internal)
@@ -476,10 +474,65 @@
     WebCore::raiseOnDOMError(ec);
 }
 
-- (NSString *)scriptStringAttr
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttribute
 {
     WebCore::JSMainThreadNullState state;
-    return IMPL->scriptStringAttr();
+    return kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateAttribute()));
+}
+
+- (void)setWithScriptExecutionContextAndScriptStateAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptExecutionContextAndScriptStateAttribute);
+
+    IMPL->setWithScriptExecutionContextAndScriptStateAttribute(core(newWithScriptExecutionContextAndScriptStateAttribute));
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttributeRaises
+{
+    WebCore::JSMainThreadNullState state;
+    WebCore::ExceptionCode ec = 0;
+    DOMTestObj *result = kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateAttributeRaises(ec)));
+    WebCore::raiseOnDOMError(ec);
+    return result;
+}
+
+- (void)setWithScriptExecutionContextAndScriptStateAttributeRaises:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttributeRaises
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptExecutionContextAndScriptStateAttributeRaises);
+
+    WebCore::ExceptionCode ec = 0;
+    IMPL->setWithScriptExecutionContextAndScriptStateAttributeRaises(core(newWithScriptExecutionContextAndScriptStateAttributeRaises), ec);
+    WebCore::raiseOnDOMError(ec);
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpacesAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateWithSpacesAttribute()));
+}
+
+- (void)setWithScriptExecutionContextAndScriptStateWithSpacesAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateWithSpacesAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptExecutionContextAndScriptStateWithSpacesAttribute);
+
+    IMPL->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(core(newWithScriptExecutionContextAndScriptStateWithSpacesAttribute));
+}
+
+- (DOMTestObj *)withScriptArgumentsAndCallStackAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL->withScriptArgumentsAndCallStackAttribute()));
+}
+
+- (void)setWithScriptArgumentsAndCallStackAttribute:(DOMTestObj *)newWithScriptArgumentsAndCallStackAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptArgumentsAndCallStackAttribute);
+
+    IMPL->setWithScriptArgumentsAndCallStackAttribute(core(newWithScriptArgumentsAndCallStackAttribute));
 }
 
 #if ENABLE(Condition1)
@@ -725,14 +778,6 @@
     IMPL->customMethodWithArgs(intArg, strArg, core(objArg));
 }
 
-- (void)customArgsAndException:(DOMlog *)intArg
-{
-    WebCore::JSMainThreadNullState state;
-    WebCore::ExceptionCode ec = 0;
-    IMPL->customArgsAndException(core(intArg), ec);
-    WebCore::raiseOnDOMError(ec);
-}
-
 - (void)addEventListener:(NSString *)type listener:(id <DOMEventListener>)listener useCapture:(BOOL)useCapture
 {
     WebCore::JSMainThreadNullState state;
@@ -782,6 +827,33 @@
     IMPL->withScriptExecutionContext();
 }
 
+- (void)withScriptExecutionContextAndScriptState
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->withScriptExecutionContextAndScriptState();
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateObjException
+{
+    WebCore::JSMainThreadNullState state;
+    WebCore::ExceptionCode ec = 0;
+    DOMTestObj *result = kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateObjException(ec)));
+    WebCore::raiseOnDOMError(ec);
+    return result;
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpaces
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateWithSpaces()));
+}
+
+- (void)withScriptArgumentsAndCallStack
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->withScriptArgumentsAndCallStack();
+}
+
 - (void)methodWithOptionalArg:(int)opt
 {
     WebCore::JSMainThreadNullState state;
@@ -800,6 +872,24 @@
     IMPL->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
 }
 
+- (void)methodWithOptionalString:(NSString *)str
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->methodWithOptionalString(str);
+}
+
+- (void)methodWithOptionalStringIsUndefined:(NSString *)str
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->methodWithOptionalStringIsUndefined(str);
+}
+
+- (void)methodWithOptionalStringIsNullString:(NSString *)str
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->methodWithOptionalStringIsNullString(str);
+}
+
 
 #if ENABLE(Condition1)
 - (NSString *)conditionalMethod1
diff --git a/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl b/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl
index 09d60bd52..bbd46e0d4 100644
--- a/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl
+++ b/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl
@@ -28,10 +28,10 @@
 
 module test {
     interface [
-        CheckDomainSecurity
+        CheckSecurity
     ] TestActiveDOMObject {
         readonly attribute long excitingAttr;
         void excitingFunction(in Node nextChild);
-        [DoNotCheckDomainSecurity] void postMessage(in DOMString message);
+        [DoNotCheckSecurity] void postMessage(in DOMString message);
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/TestInterface.idl b/Source/WebCore/bindings/scripts/test/TestInterface.idl
index b043061ee..a058f1a9e 100644
--- a/Source/WebCore/bindings/scripts/test/TestInterface.idl
+++ b/Source/WebCore/bindings/scripts/test/TestInterface.idl
@@ -34,7 +34,7 @@ module test {
         CustomNamedSetter,
         Conditional=Condition1|Condition2,
         CallWith=ScriptExecutionContext,
-        Constructor(in DOMString str1, in [Optional=CallWithDefaultValue] DOMString str2),
+        Constructor(in DOMString str1, in [Optional=DefaultIsUndefined] DOMString str2),
         ConstructorRaisesException
     ] TestInterface {
     };
diff --git a/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl b/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl
index fa8d3b3aa..e0f8539e4 100644
--- a/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl
+++ b/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl
@@ -31,7 +31,7 @@
 module test {
     interface [
         ActiveDOMObject,
-        NamedConstructor=Audio(in DOMString str1, in [Optional=CallWithDefaultValue] DOMString str2, in [Optional=CallWithNullValue] DOMString str3),
+        NamedConstructor=Audio(in DOMString str1, in [Optional=DefaultIsUndefined] DOMString str2, in [Optional=DefaultIsNullString] DOMString str3),
         ConstructorRaisesException
     ] TestNamedConstructor {
     };
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index 94e89e1a0..171fda48c 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -31,7 +31,8 @@
 // changes in its ouput.
 module test {
     interface [
-        Constructor
+        Constructor,
+        InterfaceName=TestObject
     ] TestObj {
         // Attributes
         readonly attribute long            readOnlyIntAttr;
@@ -88,9 +89,6 @@ module test {
         [Custom] void customMethod();
         [Custom] void customMethodWithArgs(in long intArg, in DOMString strArg, in TestObj objArg);
 
-        [CustomArgumentHandling] void customArgsAndException(in log intArg)
-            raises(DOMException);
-
         void addEventListener(in DOMString type, 
                               in EventListener listener, 
                               in [Optional] boolean useCapture);
@@ -106,6 +104,11 @@ module test {
         [CallWith=ScriptState] TestObj withScriptStateObjException()
             raises(DOMException);
         [CallWith=ScriptExecutionContext] void withScriptExecutionContext();
+        [CallWith=ScriptExecutionContext|ScriptState] void withScriptExecutionContextAndScriptState();
+        [CallWith=ScriptExecutionContext|ScriptState] TestObj withScriptExecutionContextAndScriptStateObjException()
+            raises(DOMException);
+        [CallWith=  ScriptExecutionContext  |  ScriptState  ] TestObj withScriptExecutionContextAndScriptStateWithSpaces();
+        [CallWith=ScriptArguments|CallStack] void withScriptArgumentsAndCallStack();
 
         attribute [CallWith=ScriptState] long withScriptStateAttribute;
         attribute [CallWith=ScriptExecutionContext] TestObj withScriptExecutionContextAttribute;
@@ -113,11 +116,19 @@ module test {
             getter raises(DOMException);
         attribute [CallWith=ScriptExecutionContext] TestObj withScriptExecutionContextAttributeRaises
             getter raises(DOMException);
+        attribute [CallWith=ScriptExecutionContext|ScriptState] TestObj withScriptExecutionContextAndScriptStateAttribute;
+        attribute [CallWith=ScriptExecutionContext|ScriptState] TestObj withScriptExecutionContextAndScriptStateAttributeRaises
+            getter raises(DOMException);
+        attribute [CallWith=  ScriptExecutionContext  |  ScriptState  ] TestObj withScriptExecutionContextAndScriptStateWithSpacesAttribute;
+        attribute [CallWith=ScriptArguments|CallStack] TestObj withScriptArgumentsAndCallStackAttribute;
 
         // 'Optional' extended attribute
         void    methodWithOptionalArg(in [Optional] long opt);
         void    methodWithNonOptionalArgAndOptionalArg(in long nonOpt, in [Optional] long opt);
         void    methodWithNonOptionalArgAndTwoOptionalArgs(in long nonOpt, in [Optional] long opt1, in [Optional] long opt2);
+        void    methodWithOptionalString(in [Optional] DOMString str);
+        void    methodWithOptionalStringIsUndefined(in [Optional=DefaultIsUndefined] DOMString str);
+        void    methodWithOptionalStringIsNullString(in [Optional=DefaultIsNullString] DOMString str);
 
 #if defined(TESTING_V8) || defined(TESTING_JS)
         // 'Callback' extended attribute
@@ -126,9 +137,6 @@ module test {
         void    methodWithCallbackAndOptionalArg(in [Callback, Optional] TestCallback callback);
 #endif
 
-        // 'ConvertScriptString' extended attribute
-        readonly attribute [ConvertScriptString] DOMString scriptStringAttr;
-
         // 'Conditional' extended attribute
         attribute [Conditional=Condition1] long conditionalAttr1;
         attribute [Conditional=Condition1&Condition2] long conditionalAttr2;
@@ -184,13 +192,17 @@ module test {
         attribute double[]                  doubleArray;
 #endif
 
-        readonly attribute [CheckAccessToNode] Document contentDocument;
-        [CheckAccessToNode] SVGDocument getSVGDocument()
+#if defined(TESTING_JS)
+        void methodWithUnsignedLongArray(in unsigned long[] unsignedLongArray);
+#endif
+
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
+        [CheckSecurityForNode] SVGDocument getSVGDocument()
             raises(DOMException);
 
-        void convert1(in [ConvertNullStringTo=Null] a);
-        void convert2(in [ConvertNullStringTo=Undefined] b);
-        void convert3(in [ConvertNullStringTo=False] c);
+        void convert1(in [TreatReturnedNullStringAs=Null] a);
+        void convert2(in [TreatReturnedNullStringAs=Undefined] b);
+        void convert3(in [TreatReturnedNullStringAs=False] c);
         void convert4(in [TreatNullAs=NullString] d);
         void convert5(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] e);
 
diff --git a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
index 2355d6d39..0d7e96169 100644
--- a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
+++ b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
@@ -36,10 +36,12 @@ module test {
         readonly attribute DOMString supplementalStr1;
         attribute DOMString supplementalStr2;
         attribute [CustomGetter, CustomSetter] DOMString supplementalStr3;
+        attribute Node supplementalNode;
 
         void supplementalMethod1();
         [CallWith=ScriptExecutionContext] TestObj supplementalMethod2(in DOMString strArg, in TestObj objArg) raises(DOMException);
         [Custom] void supplementalMethod3();
+        static void supplementalMethod4();
 
         const unsigned short SUPPLEMENTALCONSTANT1 = 1;
         const [Reflect=CONST_IMPL] unsigned short SUPPLEMENTALCONSTANT2 = 2;
diff --git a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
index 4ea69e598..cf5306d42 100644
--- a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
+++ b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
@@ -31,7 +31,7 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Float64Array : ArrayBufferView {
         Int32Array foo(in Float32Array array);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
index 26070b3e3..0a0f628b4 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
@@ -54,7 +54,7 @@ static v8::Handle<v8::Value> fooCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     Float64Array* imp = V8Float64Array::toNative(args.Holder());
-    EXCEPTION_BLOCK(Float32Array*, array, V8Float32Array::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8Float32Array::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(Float32Array*, array, V8Float32Array::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8Float32Array::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     return toV8(imp->foo(array));
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index 66582879b..dc73c2690 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -55,7 +55,7 @@ static v8::Handle<v8::Value> excitingFunctionCallback(const v8::Arguments& args)
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(args.Holder());
     if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
         return v8::Handle<v8::Value>();
-    EXCEPTION_BLOCK(Node*, nextChild, V8Node::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(Node*, nextChild, V8Node::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->excitingFunction(nextChild);
     return v8::Handle<v8::Value>();
 }
@@ -66,7 +66,7 @@ static v8::Handle<v8::Value> postMessageCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(args.Holder());
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, message, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, message, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->postMessage(message);
     return v8::Handle<v8::Value>();
 }
@@ -117,7 +117,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestActiveDOMObjectTempla
     v8::Handle<v8::Signature> excitingFunctionSignature = v8::Signature::New(desc, excitingFunctionArgc, excitingFunctionArgv);
     proto->Set(v8::String::New("excitingFunction"), v8::FunctionTemplate::New(TestActiveDOMObjectInternal::excitingFunctionCallback, v8::Handle<v8::Value>(), excitingFunctionSignature));
 
-    // Function 'postMessage' (ExtAttr: 'DoNotCheckDomainSecurity')
+    // Function 'postMessage' (ExtAttr: 'DoNotCheckSecurity')
     proto->SetAccessor(v8::String::New("postMessage"), TestActiveDOMObjectInternal::postMessageAttrGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
 
     // Custom toString template
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
index bf1bc4a49..699eb4b93 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
@@ -45,7 +45,7 @@ static v8::Handle<v8::Value> anotherFunctionCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestCustomNamedGetter* imp = V8TestCustomNamedGetter::toNative(args.Holder());
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->anotherFunction(str);
     return v8::Handle<v8::Value>();
 }
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
index 00e0f34ec..be0113383 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
@@ -50,7 +50,7 @@ static v8::Handle<v8::Value> itemCallback(const v8::Arguments& args)
     TestEventTarget* imp = V8TestEventTarget::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    EXCEPTION_BLOCK(int, index, toUInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, index, toUInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (UNLIKELY(index < 0)) {
         ec = INDEX_SIZE_ERR;
         goto fail;
@@ -92,7 +92,7 @@ static v8::Handle<v8::Value> dispatchEventCallback(const v8::Arguments& args)
     TestEventTarget* imp = V8TestEventTarget::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    EXCEPTION_BLOCK(Event*, evt, V8Event::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8Event::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(Event*, evt, V8Event::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8Event::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     bool result = imp->dispatchEvent(evt, ec);
     if (UNLIKELY(ec))
         goto fail;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 0477223f2..a347626f1 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -31,6 +31,7 @@
 #include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
+#include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8TestObj.h"
 #include <wtf/GetPtr.h>
@@ -83,6 +84,30 @@ static void supplementalStr2AttrSetter(v8::Local<v8::String> name, v8::Local<v8:
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
 
+static v8::Handle<v8::Value> supplementalNodeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestInterface.supplementalNode._get");
+    TestInterface* imp = V8TestInterface::toNative(info.Holder());
+    return toV8(TestSupplemental::supplementalNode(imp));
+}
+
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
+
+#if ENABLE(Condition11) || ENABLE(Condition12)
+
+static void supplementalNodeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestInterface.supplementalNode._set");
+    TestInterface* imp = V8TestInterface::toNative(info.Holder());
+    Node* v = V8Node::HasInstance(value) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    TestSupplemental::setSupplementalNode(imp, WTF::getPtr(v));
+    return;
+}
+
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
+
+#if ENABLE(Condition11) || ENABLE(Condition12)
+
 static v8::Handle<v8::Value> supplementalMethod1Callback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestInterface.supplementalMethod1");
@@ -103,8 +128,8 @@ static v8::Handle<v8::Value> supplementalMethod2Callback(const v8::Arguments& ar
     TestInterface* imp = V8TestInterface::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined))) : 0);
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
         return v8::Undefined();
@@ -120,6 +145,17 @@ static v8::Handle<v8::Value> supplementalMethod2Callback(const v8::Arguments& ar
 
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+
+static v8::Handle<v8::Value> supplementalMethod4Callback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestInterface.supplementalMethod4");
+    TestSupplemental::supplementalMethod4();
+    return v8::Handle<v8::Value>();
+}
+
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
+
 } // namespace TestInterfaceInternal
 
 static const BatchedAttribute TestInterfaceAttrs[] = {
@@ -135,6 +171,10 @@ static const BatchedAttribute TestInterfaceAttrs[] = {
     // Attribute 'supplementalStr3' (Type: 'attribute' ExtAttr: 'CustomSetter CustomGetter Conditional ImplementedBy')
     {"supplementalStr3", V8TestInterface::supplementalStr3AccessorGetter, V8TestInterface::supplementalStr3AccessorSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    // Attribute 'supplementalNode' (Type: 'attribute' ExtAttr: 'Conditional ImplementedBy')
+    {"supplementalNode", TestInterfaceInternal::supplementalNodeAttrGetter, TestInterfaceInternal::supplementalNodeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
 };
 
 static const BatchedCallback TestInterfaceCallbacks[] = {
@@ -157,10 +197,10 @@ static const BatchedConstant TestInterfaceConsts[] = {
 
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(1 == TestInterface::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(1 == TestSupplemental::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(2 == TestInterface::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(2 == TestSupplemental::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
 #endif
 
 v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments& args)
@@ -176,8 +216,8 @@ v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments&
         return throwError("Not enough arguments", V8Proxy::TypeError);
 
     ExceptionCode ec = 0;
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
@@ -219,6 +259,9 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestInterfaceTemplate(v8:
 #if ENABLE(Condition11) || ENABLE(Condition12)
     proto->Set(v8::String::New("supplementalMethod2"), v8::FunctionTemplate::New(TestInterfaceInternal::supplementalMethod2Callback, v8::Handle<v8::Value>(), supplementalMethod2Signature));
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    desc->Set(v8::String::New("supplementalMethod4"), v8::FunctionTemplate::New(TestInterfaceInternal::supplementalMethod4Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
     batchConfigureConstants(desc, proto, TestInterfaceConsts, WTF_ARRAY_LENGTH(TestInterfaceConsts));
 
     // Custom toString template
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index 142012d04..1fa12d4eb 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -46,7 +46,7 @@ static v8::Handle<v8::Value> methodCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestMediaQueryListListener* imp = V8TestMediaQueryListListener::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<MediaQueryListListener>, listener, MediaQueryListListener::create(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(RefPtr<MediaQueryListListener>, listener, MediaQueryListListener::create(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->method(listener);
     return v8::Handle<v8::Value>();
 }
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 97f4a2611..8e6f61dff 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -67,9 +67,9 @@ static v8::Handle<v8::Value> V8TestNamedConstructorConstructorCallback(const v8:
         return throwError("Not enough arguments", V8Proxy::TypeError);
 
     ExceptionCode ec = 0;
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str3, MAYBE_MISSING_PARAMETER(args, 2, MissingIsEmpty));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str3, MAYBE_MISSING_PARAMETER(args, 2, DefaultIsNullString));
 
     RefPtr<TestNamedConstructor> impl = TestNamedConstructor::createForJSConstructor(document, str1, str2, str3, ec);
     v8::Handle<v8::Object> wrapper = args.Holder();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 2ece58248..4a2029a22 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -51,7 +51,6 @@
 #include "V8d.h"
 #include "V8e.h"
 #include "V8int.h"
-#include "V8log.h"
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -594,11 +593,127 @@ static void withScriptExecutionContextAttributeRaisesAttrSetter(v8::Local<v8::St
     return;
 }
 
-static v8::Handle<v8::Value> scriptStringAttrAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateAttributeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
-    INC_STATS("DOM.TestObj.scriptStringAttr._get");
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttribute._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8StringOrNull(imp->scriptStringAttr());
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return v8::Undefined();
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    return toV8(imp->withScriptExecutionContextAndScriptStateAttribute(state, scriptContext));
+}
+
+static void withScriptExecutionContextAndScriptStateAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttribute._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return;
+    imp->setWithScriptExecutionContextAndScriptStateAttribute(state, scriptContext, WTF::getPtr(v));
+    if (state.hadException())
+        throwError(state.exception());
+    return;
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttributeRaises._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    ExceptionCode ec = 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return v8::Undefined();
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    RefPtr<TestObj> v = imp->withScriptExecutionContextAndScriptStateAttributeRaises(state, scriptContext, ec);
+    if (UNLIKELY(ec)) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    if (state.hadException())
+        return throwError(state.exception());
+    return toV8(v.release());
+}
+
+static void withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttributeRaises._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    ExceptionCode ec = 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return;
+    imp->setWithScriptExecutionContextAndScriptStateAttributeRaises(state, scriptContext, WTF::getPtr(v), ec);
+    if (UNLIKELY(ec))
+        V8Proxy::setDOMException(ec);
+    if (state.hadException())
+        throwError(state.exception());
+    return;
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateWithSpacesAttribute._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return v8::Undefined();
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    return toV8(imp->withScriptExecutionContextAndScriptStateWithSpacesAttribute(state, scriptContext));
+}
+
+static void withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateWithSpacesAttribute._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return;
+    imp->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(state, scriptContext, WTF::getPtr(v));
+    if (state.hadException())
+        throwError(state.exception());
+    return;
+}
+
+static v8::Handle<v8::Value> withScriptArgumentsAndCallStackAttributeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptArgumentsAndCallStackAttribute._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
+    if (!callStack)
+        return v8::Undefined();
+    return toV8(imp->withScriptArgumentsAndCallStackAttribute(callStack));
+}
+
+static void withScriptArgumentsAndCallStackAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptArgumentsAndCallStackAttribute._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
+    if (!callStack)
+        return v8::Undefined();
+    imp->setWithScriptArgumentsAndCallStackAttribute(callStack, WTF::getPtr(v));
+    return;
 }
 
 #if ENABLE(Condition1)
@@ -875,9 +990,9 @@ static v8::Handle<v8::Value> voidMethodWithArgsCallback(const v8::Arguments& arg
     if (args.Length() < 3)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     imp->voidMethodWithArgs(intArg, strArg, objArg);
     return v8::Handle<v8::Value>();
 }
@@ -895,9 +1010,9 @@ static v8::Handle<v8::Value> intMethodWithArgsCallback(const v8::Arguments& args
     if (args.Length() < 3)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     return v8::Integer::New(imp->intMethodWithArgs(intArg, strArg, objArg));
 }
 
@@ -914,9 +1029,9 @@ static v8::Handle<v8::Value> objMethodWithArgsCallback(const v8::Arguments& args
     if (args.Length() < 3)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     return toV8(imp->objMethodWithArgs(intArg, strArg, objArg));
 }
 
@@ -928,8 +1043,8 @@ static v8::Handle<v8::Value> methodThatRequiresAllArgsAndThrowsCallback(const v8
     TestObj* imp = V8TestObj::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined))) : 0);
     RefPtr<TestObj> result = imp->methodThatRequiresAllArgsAndThrows(strArg, objArg, ec);
     if (UNLIKELY(ec))
         goto fail;
@@ -960,8 +1075,8 @@ static v8::Handle<v8::Value> idbKeyCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<IDBKey>, key, createIDBKeyFromValue(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    imp->idbKey(key);
+    EXCEPTION_BLOCK(RefPtr<IDBKey>, key, createIDBKeyFromValue(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    imp->idbKey(key.get());
     return v8::Handle<v8::Value>();
 }
 
@@ -971,7 +1086,7 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(OptionsObject, oo, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    EXCEPTION_BLOCK(OptionsObject, oo, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     if (args.Length() > 0 && !oo.isUndefinedOrNull() && !oo.isObject()) {
         ec = TYPE_MISMATCH_ERR;
         V8Proxy::setDOMException(ec);
@@ -981,7 +1096,7 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
         imp->optionsObject(oo);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(OptionsObject, ooo, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
+    EXCEPTION_BLOCK(OptionsObject, ooo, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     if (args.Length() > 1 && !ooo.isUndefinedOrNull() && !ooo.isObject()) {
         ec = TYPE_MISMATCH_ERR;
         V8Proxy::setDOMException(ec);
@@ -1007,29 +1122,6 @@ static v8::Handle<v8::Value> methodWithExceptionCallback(const v8::Arguments& ar
     return v8::Handle<v8::Value>();
 }
 
-static v8::Handle<v8::Value> customArgsAndExceptionCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.TestObj.customArgsAndException");
-    if (args.Length() < 1)
-        return throwError("Not enough arguments", V8Proxy::TypeError);
-    TestObj* imp = V8TestObj::toNative(args.Holder());
-    ExceptionCode ec = 0;
-    {
-    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 1));
-    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
-    if (!callStack)
-        return v8::Undefined();
-    EXCEPTION_BLOCK(log*, intArg, V8log::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8log::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
-    imp->customArgsAndException(intArg, scriptArguments, callStack, ec);
-    if (UNLIKELY(ec))
-        goto fail;
-    return v8::Handle<v8::Value>();
-    }
-    fail:
-    V8Proxy::setDOMException(ec);
-    return v8::Handle<v8::Value>();
-}
-
 static v8::Handle<v8::Value> addEventListenerCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.addEventListener()");
@@ -1123,6 +1215,68 @@ static v8::Handle<v8::Value> withScriptExecutionContextCallback(const v8::Argume
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptState");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EmptyScriptState state;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    imp->withScriptExecutionContextAndScriptState(&state, scriptContext);
+    if (state.hadException())
+        return throwError(state.exception());
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateObjExceptionCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateObjException");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    ExceptionCode ec = 0;
+    {
+    EmptyScriptState state;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    RefPtr<TestObj> result = imp->withScriptExecutionContextAndScriptStateObjException(&state, scriptContext, ec);
+    if (UNLIKELY(ec))
+        goto fail;
+    if (state.hadException())
+        return throwError(state.exception());
+    return toV8(result.release());
+    }
+    fail:
+    V8Proxy::setDOMException(ec);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateWithSpacesCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateWithSpaces");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EmptyScriptState state;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    RefPtr<TestObj> result = imp->withScriptExecutionContextAndScriptStateWithSpaces(&state, scriptContext);
+    if (state.hadException())
+        return throwError(state.exception());
+    return toV8(result.release());
+}
+
+static v8::Handle<v8::Value> withScriptArgumentsAndCallStackCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptArgumentsAndCallStack");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 0));
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
+    if (!callStack)
+        return v8::Undefined();
+    imp->withScriptArgumentsAndCallStack(scriptArguments, callStack);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> methodWithOptionalArgCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.methodWithOptionalArg");
@@ -1131,7 +1285,7 @@ static v8::Handle<v8::Value> methodWithOptionalArgCallback(const v8::Arguments&
         imp->methodWithOptionalArg();
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->methodWithOptionalArg(opt);
     return v8::Handle<v8::Value>();
 }
@@ -1142,12 +1296,12 @@ static v8::Handle<v8::Value> methodWithNonOptionalArgAndOptionalArgCallback(cons
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1) {
         imp->methodWithNonOptionalArgAndOptionalArg(nonOpt);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     imp->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
     return v8::Handle<v8::Value>();
 }
@@ -1158,21 +1312,52 @@ static v8::Handle<v8::Value> methodWithNonOptionalArgAndTwoOptionalArgsCallback(
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1) {
         imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt1, toInt32(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt1, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     if (args.Length() <= 2) {
         imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt2, toInt32(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt2, toInt32(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)));
     imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> methodWithOptionalStringCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithOptionalString");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    if (args.Length() <= 0) {
+        imp->methodWithOptionalString();
+        return v8::Handle<v8::Value>();
+    }
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    imp->methodWithOptionalString(str);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> methodWithOptionalStringIsUndefinedCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithOptionalStringIsUndefined");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    imp->methodWithOptionalStringIsUndefined(str);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> methodWithOptionalStringIsNullStringCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithOptionalStringIsNullString");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsNullString));
+    imp->methodWithOptionalStringIsNullString(str);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> methodWithCallbackArgCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.methodWithCallbackArg");
@@ -1192,7 +1377,7 @@ static v8::Handle<v8::Value> methodWithNonCallbackArgAndCallbackArgCallback(cons
     if (args.Length() < 2)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, nonCallback, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, nonCallback, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1 || !args[1]->IsObject())
         return throwError(TYPE_MISMATCH_ERR);
     RefPtr<TestCallback> callback = V8TestCallback::create(args[1], getScriptExecutionContext());
@@ -1255,8 +1440,8 @@ static v8::Handle<v8::Value> overloadedMethod1Callback(const v8::Arguments& args
     if (args.Length() < 2)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     imp->overloadedMethod(objArg, strArg);
     return v8::Handle<v8::Value>();
 }
@@ -1267,12 +1452,12 @@ static v8::Handle<v8::Value> overloadedMethod2Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     if (args.Length() <= 1) {
         imp->overloadedMethod(objArg);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     imp->overloadedMethod(objArg, intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1283,7 +1468,7 @@ static v8::Handle<v8::Value> overloadedMethod3Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->overloadedMethod(strArg);
     return v8::Handle<v8::Value>();
 }
@@ -1294,7 +1479,7 @@ static v8::Handle<v8::Value> overloadedMethod4Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1318,7 +1503,7 @@ static v8::Handle<v8::Value> overloadedMethod6Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<DOMStringList>, listArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(RefPtr<DOMStringList>, listArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(listArg);
     return v8::Handle<v8::Value>();
 }
@@ -1329,7 +1514,7 @@ static v8::Handle<v8::Value> overloadedMethod7Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(arrayArg);
     return v8::Handle<v8::Value>();
 }
@@ -1368,7 +1553,7 @@ static v8::Handle<v8::Value> classMethodWithOptionalCallback(const v8::Arguments
     if (args.Length() <= 0) {
         return v8::Integer::New(TestObj::classMethodWithOptional());
     }
-    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     return v8::Integer::New(TestObj::classMethodWithOptional(arg));
 }
 
@@ -1379,7 +1564,7 @@ static v8::Handle<v8::Value> overloadedMethod11Callback(const v8::Arguments& arg
     INC_STATS("DOM.TestObj.overloadedMethod11");
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
-    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     TestObj::overloadedMethod1(arg);
     return v8::Handle<v8::Value>();
 }
@@ -1393,7 +1578,7 @@ static v8::Handle<v8::Value> overloadedMethod12Callback(const v8::Arguments& arg
     INC_STATS("DOM.TestObj.overloadedMethod12");
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, type, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, type, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     TestObj::overloadedMethod1(type);
     return v8::Handle<v8::Value>();
 }
@@ -1421,7 +1606,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeMethod1Callback(const v8::Arguments
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->enabledAtRuntimeMethod1(intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1432,7 +1617,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeMethod2Callback(const v8::Arguments
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->enabledAtRuntimeMethod2(intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1461,7 +1646,7 @@ static v8::Handle<v8::Value> convert1Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(a*, , V8a::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8a::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(a*, , V8a::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8a::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert1();
     return v8::Handle<v8::Value>();
 }
@@ -1472,7 +1657,7 @@ static v8::Handle<v8::Value> convert2Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(b*, , V8b::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8b::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(b*, , V8b::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8b::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert2();
     return v8::Handle<v8::Value>();
 }
@@ -1483,7 +1668,7 @@ static v8::Handle<v8::Value> convert3Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(c*, , V8c::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8c::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(c*, , V8c::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8c::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert3();
     return v8::Handle<v8::Value>();
 }
@@ -1494,7 +1679,7 @@ static v8::Handle<v8::Value> convert4Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(d*, , V8d::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8d::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(d*, , V8d::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8d::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert4();
     return v8::Handle<v8::Value>();
 }
@@ -1505,7 +1690,7 @@ static v8::Handle<v8::Value> convert5Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(e*, , V8e::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8e::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(e*, , V8e::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8e::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert5();
     return v8::Handle<v8::Value>();
 }
@@ -1540,9 +1725,9 @@ static v8::Handle<v8::Value> strictFunctionCallback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    EXCEPTION_BLOCK(float, a, static_cast<float>(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)->NumberValue()));
-    EXCEPTION_BLOCK(int, b, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    EXCEPTION_BLOCK(float, a, static_cast<float>(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)->NumberValue()));
+    EXCEPTION_BLOCK(int, b, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     RefPtr<bool> result = imp->strictFunction(str, a, b, ec);
     if (UNLIKELY(ec))
         goto fail;
@@ -1616,8 +1801,14 @@ static const BatchedAttribute TestObjAttrs[] = {
     {"withScriptStateAttributeRaises", TestObjInternal::withScriptStateAttributeRaisesAttrGetter, TestObjInternal::withScriptStateAttributeRaisesAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'withScriptExecutionContextAttributeRaises' (Type: 'attribute' ExtAttr: 'CallWith')
     {"withScriptExecutionContextAttributeRaises", TestObjInternal::withScriptExecutionContextAttributeRaisesAttrGetter, TestObjInternal::withScriptExecutionContextAttributeRaisesAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
-    // Attribute 'scriptStringAttr' (Type: 'readonly attribute' ExtAttr: 'ConvertScriptString')
-    {"scriptStringAttr", TestObjInternal::scriptStringAttrAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptExecutionContextAndScriptStateAttribute' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptExecutionContextAndScriptStateAttribute", TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrGetter, TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptExecutionContextAndScriptStateAttributeRaises' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptExecutionContextAndScriptStateAttributeRaises", TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter, TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptExecutionContextAndScriptStateWithSpacesAttribute' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptExecutionContextAndScriptStateWithSpacesAttribute", TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter, TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptArgumentsAndCallStackAttribute' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptArgumentsAndCallStackAttribute", TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrGetter, TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 #if ENABLE(Condition1)
     // Attribute 'conditionalAttr1' (Type: 'attribute' ExtAttr: 'Conditional')
     {"conditionalAttr1", TestObjInternal::conditionalAttr1AttrGetter, TestObjInternal::conditionalAttr1AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
@@ -1650,7 +1841,7 @@ static const BatchedAttribute TestObjAttrs[] = {
     {"floatArray", TestObjInternal::floatArrayAttrGetter, TestObjInternal::floatArrayAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'doubleArray' (Type: 'attribute' ExtAttr: '')
     {"doubleArray", TestObjInternal::doubleArrayAttrGetter, TestObjInternal::doubleArrayAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
-    // Attribute 'contentDocument' (Type: 'readonly attribute' ExtAttr: 'CheckAccessToNode')
+    // Attribute 'contentDocument' (Type: 'readonly attribute' ExtAttr: 'CheckSecurityForNode')
     {"contentDocument", TestObjInternal::contentDocumentAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'mutablePoint' (Type: 'attribute' ExtAttr: '')
     {"mutablePoint", TestObjInternal::mutablePointAttrGetter, TestObjInternal::mutablePointAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
@@ -1683,9 +1874,16 @@ static const BatchedCallback TestObjCallbacks[] = {
     {"withScriptStateVoidException", TestObjInternal::withScriptStateVoidExceptionCallback},
     {"withScriptStateObjException", TestObjInternal::withScriptStateObjExceptionCallback},
     {"withScriptExecutionContext", TestObjInternal::withScriptExecutionContextCallback},
+    {"withScriptExecutionContextAndScriptState", TestObjInternal::withScriptExecutionContextAndScriptStateCallback},
+    {"withScriptExecutionContextAndScriptStateObjException", TestObjInternal::withScriptExecutionContextAndScriptStateObjExceptionCallback},
+    {"withScriptExecutionContextAndScriptStateWithSpaces", TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesCallback},
+    {"withScriptArgumentsAndCallStack", TestObjInternal::withScriptArgumentsAndCallStackCallback},
     {"methodWithOptionalArg", TestObjInternal::methodWithOptionalArgCallback},
     {"methodWithNonOptionalArgAndOptionalArg", TestObjInternal::methodWithNonOptionalArgAndOptionalArgCallback},
     {"methodWithNonOptionalArgAndTwoOptionalArgs", TestObjInternal::methodWithNonOptionalArgAndTwoOptionalArgsCallback},
+    {"methodWithOptionalString", TestObjInternal::methodWithOptionalStringCallback},
+    {"methodWithOptionalStringIsUndefined", TestObjInternal::methodWithOptionalStringIsUndefinedCallback},
+    {"methodWithOptionalStringIsNullString", TestObjInternal::methodWithOptionalStringIsNullStringCallback},
     {"methodWithCallbackArg", TestObjInternal::methodWithCallbackArgCallback},
     {"methodWithNonCallbackArgAndCallbackArg", TestObjInternal::methodWithNonCallbackArgAndCallbackArgCallback},
     {"methodWithCallbackAndOptionalArg", TestObjInternal::methodWithCallbackAndOptionalArgCallback},
@@ -1765,7 +1963,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestObj", v8::Persistent<v8::FunctionTemplate>(), V8TestObj::internalFieldCount,
+    defaultSignature = configureTemplate(desc, "TestObject", v8::Persistent<v8::FunctionTemplate>(), V8TestObj::internalFieldCount,
         TestObjAttrs, WTF_ARRAY_LENGTH(TestObjAttrs),
         TestObjCallbacks, WTF_ARRAY_LENGTH(TestObjCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -1811,12 +2009,6 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     v8::Handle<v8::FunctionTemplate> methodThatRequiresAllArgsAndThrowsArgv[methodThatRequiresAllArgsAndThrowsArgc] = { v8::Handle<v8::FunctionTemplate>(), V8TestObj::GetRawTemplate() };
     v8::Handle<v8::Signature> methodThatRequiresAllArgsAndThrowsSignature = v8::Signature::New(desc, methodThatRequiresAllArgsAndThrowsArgc, methodThatRequiresAllArgsAndThrowsArgv);
     proto->Set(v8::String::New("methodThatRequiresAllArgsAndThrows"), v8::FunctionTemplate::New(TestObjInternal::methodThatRequiresAllArgsAndThrowsCallback, v8::Handle<v8::Value>(), methodThatRequiresAllArgsAndThrowsSignature));
-
-    // Custom Signature 'customArgsAndException'
-    const int customArgsAndExceptionArgc = 1;
-    v8::Handle<v8::FunctionTemplate> customArgsAndExceptionArgv[customArgsAndExceptionArgc] = { V8log::GetRawTemplate() };
-    v8::Handle<v8::Signature> customArgsAndExceptionSignature = v8::Signature::New(desc, customArgsAndExceptionArgc, customArgsAndExceptionArgv);
-    proto->Set(v8::String::New("customArgsAndException"), v8::FunctionTemplate::New(TestObjInternal::customArgsAndExceptionCallback, v8::Handle<v8::Value>(), customArgsAndExceptionSignature));
     desc->Set(v8::String::New("classMethod"), v8::FunctionTemplate::New(TestObjInternal::classMethodCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
     desc->Set(v8::String::New("classMethodWithOptional"), v8::FunctionTemplate::New(TestObjInternal::classMethodWithOptionalCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
 #if ENABLE(Condition1)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index 27e51b230..aaf298e3c 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -127,7 +127,7 @@ v8::Handle<v8::Value> V8TestSerializedScriptValueInterface::constructorCallback(
         return args.Holder();
     if (args.Length() < 2)
         return throwError("Not enough arguments", V8Proxy::TypeError);
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, hello, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, hello, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     bool valueDidThrow = false;
     RefPtr<SerializedScriptValue> value = SerializedScriptValue::create(args[1], 0, 0, valueDidThrow);
     if (valueDidThrow)
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index d0fb1ce38..b4ee695fb 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -31,9 +31,11 @@
 #include "IDBDatabaseException.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
+#include "IDBTracing.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8IDBKey.h"
+#include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -46,7 +48,7 @@ static PassRefPtr<IDBKey> createIDBKeyFromValue(v8::Handle<v8::Value> value, Vec
         return IDBKey::createNumber(value->NumberValue());
     if (value->IsString())
         return IDBKey::createString(v8ValueToWebCoreString(value));
-    if (value->IsDate())
+    if (value->IsDate() && !isnan(value->NumberValue()))
         return IDBKey::createDate(value->NumberValue());
     if (value->IsArray()) {
         v8::Handle<v8::Array> array = v8::Handle<v8::Array>::Cast(value);
@@ -148,6 +150,7 @@ v8::Handle<v8::Value> ensureNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue,
 
 PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
+    IDB_TRACE("createIDBKeyFromSerializedValueAndKeyPath");
     V8LocalContext localContext;
     v8::Handle<v8::Value> v8Value(value->deserialize());
     v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPath, keyPath.size()));
@@ -158,6 +161,7 @@ PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<Serializ
 
 PassRefPtr<SerializedScriptValue> injectIDBKeyIntoSerializedValue(PassRefPtr<IDBKey> key, PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
+    IDB_TRACE("injectIDBKeyIntoSerializedValue");
     V8LocalContext localContext;
     if (!keyPath.size())
         return 0;
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index 5fe394303..b705523b7 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -268,9 +268,9 @@ ScriptValue ScriptDebugServer::currentCallFrame()
     return ScriptValue(toV8(currentCallFrame.release()));
 }
 
-void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task)
+void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task, v8::Isolate* isolate)
 {
-    v8::Debug::DebugBreakForCommand(new ClientDataImpl(task));
+    v8::Debug::DebugBreakForCommand(new ClientDataImpl(task), isolate);
 }
 
 void ScriptDebugServer::runPendingTasks()
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index 0afaae8b1..de8465140 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -89,7 +89,7 @@ public:
         virtual ~Task() { }
         virtual void run() = 0;
     };
-    static void interruptAndRun(PassOwnPtr<Task>);
+    static void interruptAndRun(PassOwnPtr<Task>, v8::Isolate* = 0);
     void runPendingTasks();
 
     bool isPaused();
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 9181b73f5..c6738cdc4 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -397,10 +397,10 @@ public:
 #endif
         if (arrayBufferView.isByteArray())
             append(ByteArrayTag);
-        else if (arrayBufferView.isUnsignedByteArray())
-            append(UnsignedByteArrayTag);
         else if (arrayBufferView.isUnsignedByteClampedArray())
             append(UnsignedByteClampedArrayTag);
+        else if (arrayBufferView.isUnsignedByteArray())
+            append(UnsignedByteArrayTag);
         else if (arrayBufferView.isShortArray())
             append(ShortArrayTag);
         else if (arrayBufferView.isUnsignedShortArray())
@@ -2258,4 +2258,14 @@ v8::Handle<v8::Value> SerializedScriptValue::deserialize(MessagePortArray* messa
     return deserializer.deserialize();
 }
 
+#if ENABLE(INSPECTOR)
+ScriptValue SerializedScriptValue::deserializeForInspector(ScriptState* scriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Context::Scope contextScope(scriptState->context());
+
+    return ScriptValue(deserialize());
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index d3a668b98..68b1954d5 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -76,6 +76,10 @@ public:
     // case of failure.
     v8::Handle<v8::Value> deserialize(MessagePortArray* = 0);
 
+#if ENABLE(INSPECTOR)
+    ScriptValue deserializeForInspector(ScriptState*);
+#endif
+
 private:
     enum StringDataMode {
         StringValue,
diff --git a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 6e27eeb16..9c56440c4 100644
--- a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -35,6 +35,7 @@
 #include "Document.h"
 #include "Event.h"
 #include "Frame.h"
+#include "InspectorCounters.h"
 #include "V8Binding.h"
 #include "V8Event.h"
 #include "V8EventListenerList.h"
@@ -57,6 +58,7 @@ V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, const WorldCo
     , m_isAttribute(isAttribute)
     , m_worldContext(worldContext)
 {
+    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 V8AbstractEventListener::~V8AbstractEventListener()
@@ -67,6 +69,7 @@ V8AbstractEventListener::~V8AbstractEventListener()
         V8EventListenerList::clearWrapper(listener, m_isAttribute);
     }
     disposeListenerObject();
+    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 528b4fbcb..0bb5e936b 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -511,9 +511,9 @@ namespace WebCore {
         return V8ParameterBase::prepareBase();
     }
 
-    enum ParameterMissingPolicy {
-        MissingIsUndefined,
-        MissingIsEmpty
+    enum ParameterDefaultPolicy {
+        DefaultIsUndefined,
+        DefaultIsNullString
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index a2fceb004..8d16a1037 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -577,6 +577,18 @@ void V8DOMWindowShell::namedItemAdded(HTMLDocument* doc, const AtomicString& nam
 
 void V8DOMWindowShell::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)
 {
+    if (doc->hasNamedItem(name.impl()) || doc->hasExtraNamedItem(name.impl()))
+        return;
+
+    if (!initContextIfNeeded())
+        return;
+
+    v8::HandleScope handleScope;
+    v8::Context::Scope contextScope(m_context);
+
+    ASSERT(!m_document.IsEmpty());
+    checkDocumentWrapper(m_document, doc);
+    m_document->Delete(v8String(name));
 }
 
 void V8DOMWindowShell::updateSecurityOrigin()
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index 8a45b71ec..4cf3c9a46 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -72,6 +72,20 @@ namespace WebCore {
 typedef HashMap<Node*, v8::Object*> DOMNodeMap;
 typedef HashMap<void*, v8::Object*> DOMObjectMap;
 
+static ALWAYS_INLINE v8::Handle<v8::Object> getExistingWrapperInline(Node* node)
+{
+    V8IsolatedContext* context = V8IsolatedContext::getEntered();
+    if (LIKELY(!context)) {
+        v8::Persistent<v8::Object>* wrapper = node->wrapper();
+        if (!wrapper)
+            return v8::Handle<v8::Object>();
+        return *wrapper;
+    }
+    DOMDataStore* store = context->world()->domDataStore();
+    DOMNodeMapping& domNodeMap = node->isActiveNode() ? store->activeDomNodeMap() : store->domNodeMap();
+    return domNodeMap.get(node);
+}
+
 // The caller must have increased obj's ref count.
 void V8DOMWrapper::setJSWrapperForDOMObject(void* object, v8::Persistent<v8::Object> wrapper)
 {
@@ -292,18 +306,17 @@ bool V8DOMWrapper::isWrapperOfType(v8::Handle<v8::Value> value, WrapperTypeInfo*
     return typeInfo == type;
 }
 
-v8::Handle<v8::Object> V8DOMWrapper::getWrapperSlow(Node* node)
+v8::Handle<v8::Object> V8DOMWrapper::getExistingWrapperSlow(Node* node)
 {
-    V8IsolatedContext* context = V8IsolatedContext::getEntered();
-    if (LIKELY(!context)) {
-        v8::Persistent<v8::Object>* wrapper = node->wrapper();
-        if (!wrapper)
-            return v8::Handle<v8::Object>();
-        return *wrapper;
-    }
-    DOMDataStore* store = context->world()->domDataStore();
-    DOMNodeMapping& domNodeMap = node->isActiveNode() ? store->activeDomNodeMap() : store->domNodeMap();
-    return domNodeMap.get(node);
+    return getExistingWrapperInline(node);
+}
+
+v8::Handle<v8::Value> V8DOMWrapper::getWrapperSlow(Node* node)
+{
+    v8::Handle<v8::Object> wrapper = getExistingWrapperInline(node);
+    if (!wrapper.IsEmpty())
+        return wrapper;
+    return toV8Slow(node, false);
 }
 
 #define TRY_TO_WRAP_WITH_INTERFACE(interfaceName) \
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.h b/Source/WebCore/bindings/v8/V8DOMWrapper.h
index 748e827c5..d3ca51e06 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.h
@@ -124,19 +124,31 @@ namespace WebCore {
 
         static v8::Local<v8::Object> instantiateV8Object(V8Proxy* proxy, WrapperTypeInfo*, void* impl);
 
-        static v8::Handle<v8::Object> getWrapper(Node* node)
+        static v8::Handle<v8::Object> getExistingWrapper(Node* node)
         {
             ASSERT(isMainThread());
             if (LIKELY(!IsolatedWorld::count())) {
                 v8::Persistent<v8::Object>* wrapper = node->wrapper();
-                if (wrapper)
+                if (LIKELY(!!wrapper))
+                    return *wrapper;
+            }
+            return getExistingWrapperSlow(node);
+        }
+
+        static v8::Handle<v8::Value> getWrapper(Node* node)
+        {
+            ASSERT(isMainThread());
+            if (LIKELY(!IsolatedWorld::count())) {
+                v8::Persistent<v8::Object>* wrapper = node->wrapper();
+                if (LIKELY(!!wrapper))
                     return *wrapper;
             }
             return getWrapperSlow(node);
         }
 
     private:
-        static v8::Handle<v8::Object> getWrapperSlow(Node*);
+        static v8::Handle<v8::Object> getExistingWrapperSlow(Node*);
+        static v8::Handle<v8::Value> getWrapperSlow(Node*);
     };
 
 }
diff --git a/Source/WebCore/bindings/v8/V8EventListener.cpp b/Source/WebCore/bindings/v8/V8EventListener.cpp
index 811013bc0..b04f1695a 100644
--- a/Source/WebCore/bindings/v8/V8EventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8EventListener.cpp
@@ -79,10 +79,6 @@ v8::Local<v8::Value> V8EventListener::callListenerFunction(ScriptExecutionContex
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-#if PLATFORM(CHROMIUM)
-    TRACE_EVENT("V8EventListener::callListenerFunction", this, 0);
-#endif
-
     if (V8Proxy* proxy = V8Proxy::retrieve(context)) {
         Frame* frame = static_cast<Document*>(context)->frame();
         if (frame->script()->canExecuteScripts(AboutToExecuteScript))
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
index deba4a51d..c8f53527f 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -43,7 +43,8 @@ namespace WebCore {
     V(devtoolsInjectedScript) \
     V(sleepFunction) \
     V(toStringString) \
-    V(event)
+    V(event) \
+    V(state)
 
 
     class V8HiddenPropertyName {
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index 376e12f51..e3dc00b3f 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -71,6 +71,10 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/text/WTFString.h>
 
+#if PLATFORM(CHROMIUM)
+#include "TraceEvent.h"
+#endif
+
 namespace WebCore {
 
 static V8Extensions& staticExtensionsList()
@@ -335,7 +339,7 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
         // Compile the script.
         v8::Local<v8::String> code = v8ExternalString(source.source());
 #if PLATFORM(CHROMIUM)
-        PlatformSupport::traceEventBegin("v8.compile", node, "");
+        TRACE_EVENT_BEGIN0("v8", "v8.compile");
 #endif
         OwnPtr<v8::ScriptData> scriptData = precompileScript(code, source.cachedScript());
 
@@ -343,15 +347,11 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
         // 1, whereas v8 starts at 0.
         v8::Handle<v8::Script> script = compileScript(code, source.url(), source.startPosition(), scriptData.get());
 #if PLATFORM(CHROMIUM)
-        PlatformSupport::traceEventEnd("v8.compile", node, "");
-
-        PlatformSupport::traceEventBegin("v8.run", node, "");
+        TRACE_EVENT_END0("v8", "v8.compile");
+        TRACE_EVENT0("v8", "v8.run");
 #endif
         result = runScript(script);
     }
-#if PLATFORM(CHROMIUM)
-    PlatformSupport::traceEventEnd("v8.run", node, "");
-#endif
 
     InspectorInstrumentation::didEvaluateScript(cookie);
 
@@ -428,6 +428,9 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
 
     v8::Local<v8::Value> result;
     {
+#if PLATFORM(CHROMIUM)
+        TRACE_EVENT0("v8", "v8.callFunction");
+#endif
         V8RecursionScope recursionScope(frame ? frame->document() : 0);
         result = function->Call(receiver, argc, args);
     }
@@ -442,6 +445,10 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
 
 v8::Local<v8::Value> V8Proxy::newInstance(v8::Handle<v8::Function> constructor, int argc, v8::Handle<v8::Value> args[])
 {
+#if PLATFORM(CHROMIUM)
+    TRACE_EVENT0("v8", "v8.newInstance");
+#endif
+
     // No artificial limitations on the depth of recursion, see comment in
     // V8Proxy::callFunction.
     v8::Local<v8::Value> result;
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
index 58d6311e4..1860ddc8d 100755
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -34,9 +34,6 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
 
 #include "ScriptDebugListener.h"
-#include "V8DOMWrapper.h"
-#include "V8DedicatedWorkerContext.h"
-#include "V8SharedWorkerContext.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WorkerDebuggerAgent.h"
@@ -44,52 +41,33 @@
 #include <v8.h>
 #include <wtf/MessageQueue.h>
 
-namespace WebCore {
 
-static WorkerContext* retrieveWorkerContext(v8::Handle<v8::Context> context)
-{
-    v8::Handle<v8::Object> global = context->Global();
-    ASSERT(!global.IsEmpty());
-
-    v8::Handle<v8::Object> prototype = v8::Handle<v8::Object>::Cast(global->GetPrototype());
-    ASSERT(!prototype.IsEmpty());
-
-    prototype = v8::Handle<v8::Object>::Cast(prototype->GetPrototype());
-    ASSERT(!prototype.IsEmpty());
-
-    WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(prototype);
-    if (&V8DedicatedWorkerContext::info == typeInfo)
-        return V8DedicatedWorkerContext::toNative(prototype);
-#if ENABLE(SHARED_WORKERS)
-    if (&V8SharedWorkerContext::info == typeInfo)
-        return V8SharedWorkerContext::toNative(prototype);
-#endif
-    ASSERT_NOT_REACHED();
-    return 0;
-}
+namespace WebCore {
 
-WorkerScriptDebugServer::WorkerScriptDebugServer()
+WorkerScriptDebugServer::WorkerScriptDebugServer(WorkerContext* workerContext)
     : ScriptDebugServer()
-    , m_pausedWorkerContext(0)
+    , m_listener(0)
+    , m_workerContext(workerContext)
+    , m_isolate(v8::Isolate::GetCurrent())
 {
+    ASSERT(m_isolate);
 }
 
-void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener, WorkerContext* workerContext)
+void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener)
 {
     v8::HandleScope scope;
     v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
     v8::Context::Scope contextScope(debuggerContext);
 
-    if (!m_listenersMap.size()) {
-        // FIXME: synchronize access to this code.
-        ensureDebuggerScriptCompiled();
-        ASSERT(!m_debuggerScript.get()->IsUndefined());
-        v8::Debug::SetDebugEventListener2(&WorkerScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
-    }
-    m_listenersMap.set(workerContext, listener);
+    ASSERT(!m_listener);
+    m_listener = listener;
+
+    ensureDebuggerScriptCompiled();
+    ASSERT(!m_debuggerScript.get()->IsUndefined());
+    v8::Debug::SetDebugEventListener2(&WorkerScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
     
     // TODO: Should we remove |proxy|? It looks like unused now.
-    WorkerContextExecutionProxy* proxy = workerContext->script()->proxy();
+    WorkerContextExecutionProxy* proxy = m_workerContext->script()->proxy();
     if (!proxy)
         return;
 
@@ -104,45 +82,36 @@ void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener, WorkerC
         dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
 }
 
-void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener, WorkerContext* workerContext)
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener)
 {
-    if (!m_listenersMap.contains(workerContext))
-        return;
-
-    if (m_pausedWorkerContext == workerContext)
-        continueProgram();
-
-    m_listenersMap.remove(workerContext);
-
-    if (m_listenersMap.isEmpty())
-        v8::Debug::SetDebugEventListener2(0);
+    ASSERT(m_listener == listener);
+    continueProgram();
+    m_listener = 0;
+    v8::Debug::SetDebugEventListener2(0);
 }
 
-ScriptDebugListener* WorkerScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context> context)
+void WorkerScriptDebugServer::interruptAndRunTask(PassOwnPtr<Task> task)
 {
-    WorkerContext* workerContext = retrieveWorkerContext(context);
-    if (!workerContext)
-        return 0;
-    return m_listenersMap.get(workerContext);
+    interruptAndRun(task, m_isolate);
 }
 
-void WorkerScriptDebugServer::runMessageLoopOnPause(v8::Handle<v8::Context> context)
+ScriptDebugListener* WorkerScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context>)
 {
-    WorkerContext* workerContext = retrieveWorkerContext(context);
-    WorkerThread* workerThread = workerContext->thread();
-
-    m_pausedWorkerContext = workerContext;
+    // There is only one worker context in isolate.
+    return m_listener;
+}
 
+void WorkerScriptDebugServer::runMessageLoopOnPause(v8::Handle<v8::Context>)
+{
     MessageQueueWaitResult result;
     do {
-        result = workerThread->runLoop().runInMode(workerContext, WorkerDebuggerAgent::debuggerTaskMode);
+        result = m_workerContext->thread()->runLoop().runInMode(m_workerContext, WorkerDebuggerAgent::debuggerTaskMode);
     // Keep waiting until execution is resumed.
     } while (result == MessageQueueMessageReceived && isPaused());
-    m_pausedWorkerContext = 0;
     
     // The listener may have been removed in the nested loop.
-    if (ScriptDebugListener* listener = m_listenersMap.get(workerContext))
-        listener->didContinue();
+    if (m_listener)
+        m_listener->didContinue();
 }
 
 void WorkerScriptDebugServer::quitMessageLoopOnPause()
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
index 6264c68cb..a3276abd1 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
@@ -35,18 +35,25 @@
 
 #include "ScriptDebugServer.h"
 
+namespace v8 {
+class Isolate;
+}
+
 namespace WebCore {
 
 class WorkerContext;
+class WorkerThread;
 
 class WorkerScriptDebugServer : public ScriptDebugServer {
     WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
 public:
-    WorkerScriptDebugServer();
+    explicit WorkerScriptDebugServer(WorkerContext*);
     ~WorkerScriptDebugServer() { }
 
-    void addListener(ScriptDebugListener*, WorkerContext*);
-    void removeListener(ScriptDebugListener*, WorkerContext*);
+    void addListener(ScriptDebugListener*);
+    void removeListener(ScriptDebugListener*);
+
+    void interruptAndRunTask(PassOwnPtr<Task>);
 
 private:
     virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>);
@@ -54,8 +61,9 @@ private:
     virtual void quitMessageLoopOnPause();
 
     typedef HashMap<WorkerContext*, ScriptDebugListener*> ListenersMap;
-    ListenersMap m_listenersMap;
-    WorkerContext* m_pausedWorkerContext;
+    ScriptDebugListener* m_listener;
+    WorkerContext* m_workerContext;
+    v8::Isolate* m_isolate;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8BindingMacros.h b/Source/WebCore/bindings/v8/custom/V8BindingMacros.h
index 7242a36f0..ce5170647 100644
--- a/Source/WebCore/bindings/v8/custom/V8BindingMacros.h
+++ b/Source/WebCore/bindings/v8/custom/V8BindingMacros.h
@@ -48,4 +48,4 @@
         return;
 
 #define MAYBE_MISSING_PARAMETER(args, index, policy) \
-    (((policy) == MissingIsEmpty && (index) >= (args).Length()) ? (v8::Local<v8::Value>()) : ((args)[(index)]))
+    (((policy) == DefaultIsNullString && (index) >= (args).Length()) ? (v8::Local<v8::Value>()) : ((args)[(index)]))
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index d85d7a06c..51d6f2c72 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -44,24 +44,6 @@
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Clipboard::typesAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
-{
-    INC_STATS("DOM.Clipboard.types()");
-    Clipboard* clipboard = V8Clipboard::toNative(info.Holder());
-
-    HashSet<String> types = clipboard->types();
-    if (types.isEmpty())
-        return v8::Null();
-
-    v8::Local<v8::Array> result = v8::Array::New(types.size());
-    HashSet<String>::const_iterator end = types.end();
-    int index = 0;
-    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it, ++index)
-        result->Set(v8::Integer::New(index), v8String(*it));
-
-    return result;
-}
-
 v8::Handle<v8::Value> V8Clipboard::clearDataCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Clipboard.clearData()");
diff --git a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index 40ff2b141..7ade8688d 100644
--- a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -79,7 +79,7 @@ v8::Handle<v8::Value> V8Console::assertCallback(const v8::Arguments& args)
     RefPtr<ScriptCallStack> callStack(createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture));
     bool condition = args[0]->BooleanValue();
     RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 1));
-    imp->assertCondition(condition, scriptArguments.release(), callStack);
+    imp->assertCondition(scriptArguments.release(), callStack, condition);
     return v8::Handle<v8::Value>();
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index 8e7f6b053..2799ae2c8 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -84,4 +84,19 @@ v8::Handle<v8::Value> V8DOMStringMap::namedPropertySetter(v8::Local<v8::String>
     return value;
 }
 
+v8::Handle<v8::Value> toV8(DOMStringMap* impl)
+{
+    if (!impl)
+        return v8::Null();
+    v8::Handle<v8::Object> wrapper = V8DOMStringMap::wrap(impl);
+    // Add a hidden reference from the element to the DOMStringMap.
+    Element* element = impl->element();
+    if (!wrapper.IsEmpty() && element) {
+        v8::Handle<v8::Value> elementValue = toV8(element);
+        if (!elementValue.IsEmpty() && elementValue->IsObject())
+            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domStringMap", wrapper);
+    }
+    return wrapper;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
new file mode 100644
index 000000000..08051abd5
--- /dev/null
+++ b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8DOMTokenList.h"
+
+#include "DOMTokenList.h"
+#include "V8Binding.h"
+#include "V8DOMWrapper.h"
+#include "V8Element.h"
+
+namespace WebCore {
+
+v8::Handle<v8::Value> toV8(DOMTokenList* impl)
+{
+    if (!impl)
+        return v8::Null();
+    v8::Handle<v8::Object> wrapper = V8DOMTokenList::wrap(impl);
+    // Add a hidden reference from the element to the DOMTokenList.
+    Element* element = impl->element();
+    if (!wrapper.IsEmpty() && element) {
+        v8::Handle<v8::Value> elementValue = toV8(element);
+        if (!elementValue.IsEmpty() && elementValue->IsObject())
+            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domTokenList", wrapper);
+    }
+    return wrapper;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index fb7628eb7..cbae11300 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -476,7 +476,7 @@ v8::Handle<v8::Value> V8DOMWindow::indexedPropertyGetter(uint32_t index, const v
     if (!frame)
         return notHandledByInterceptor();
 
-    Frame* child = frame->tree()->child(index);
+    Frame* child = frame->tree()->scopedChild(index);
     if (child)
         return toV8(child->domWindow());
 
@@ -499,7 +499,7 @@ v8::Handle<v8::Value> V8DOMWindow::namedPropertyGetter(v8::Local<v8::String> nam
 
     // Search sub-frames.
     AtomicString propName = v8StringToAtomicWebCoreString(name);
-    Frame* child = frame->tree()->child(propName);
+    Frame* child = frame->tree()->scopedChild(propName);
     if (child)
         return toV8(child->domWindow());
 
@@ -556,14 +556,15 @@ bool V8DOMWindow::namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::V
         DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__"));
 
         String name = toWebCoreString(key);
+        Frame* childFrame = target->tree()->scopedChild(name);
         // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
         // because that would generate infinite recursion.
-        if (type == v8::ACCESS_HAS && target->tree()->child(name))
+        if (type == v8::ACCESS_HAS && childFrame)
             return true;
         // We need to explicitly compare against nameOfProtoProperty because
         // V8's JSObject::LocalLookup finds __proto__ before
         // interceptors and even when __proto__ isn't a "real named property".
-        if (type == v8::ACCESS_GET && target->tree()->child(name) && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
+        if (type == v8::ACCESS_GET && childFrame && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
             return true;
     }
 
@@ -583,12 +584,13 @@ bool V8DOMWindow::indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t inde
     Frame* target = targetWindow->frame();
     if (!target)
         return false;
+    Frame* childFrame =  target->tree()->scopedChild(index);
 
     // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
     // because that would generate infinite recursion.
-    if (type == v8::ACCESS_HAS && target->tree()->child(index))
+    if (type == v8::ACCESS_HAS && childFrame)
         return true;
-    if (type == v8::ACCESS_GET && target->tree()->child(index) && !host->HasRealIndexedProperty(index))
+    if (type == v8::ACCESS_GET && childFrame && !host->HasRealIndexedProperty(index))
         return true;
 
     return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, false);
diff --git a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
index a1bd76b2a..abaddcaa1 100644
--- a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
@@ -37,6 +37,7 @@
 #include "V8Binding.h"
 #include "V8BindingState.h"
 #include "V8DOMWindow.h"
+#include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
@@ -46,15 +47,14 @@ v8::Handle<v8::Value> V8History::stateAccessorGetter(v8::Local<v8::String> name,
     INC_STATS("DOM.History.state");
     History* history = V8History::toNative(info.Holder());
 
-    v8::Handle<v8::String> propertyName = v8::String::NewSymbol("state");
-    v8::Handle<v8::Value> value = info.Holder()->GetHiddenValue(propertyName);
+    v8::Handle<v8::Value> value = info.Holder()->GetHiddenValue(V8HiddenPropertyName::state());
 
     if (!value.IsEmpty() && !history->stateChanged())
         return value;
 
     SerializedScriptValue* serialized = history->state();
     value = serialized ? serialized->deserialize() : v8::Handle<v8::Value>(v8::Null());
-    info.Holder()->SetHiddenValue(propertyName, value);
+    info.Holder()->SetHiddenValue(V8HiddenPropertyName::state(), value);
 
     return value;
 }
@@ -80,7 +80,7 @@ v8::Handle<v8::Value> V8History::pushStateCallback(const v8::Arguments& args)
     ExceptionCode ec = 0;
     History* history = V8History::toNative(args.Holder());
     history->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
-    args.Holder()->DeleteHiddenValue(v8::String::NewSymbol("state"));
+    args.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state());
     return throwError(ec);
 }
 
@@ -105,7 +105,7 @@ v8::Handle<v8::Value> V8History::replaceStateCallback(const v8::Arguments& args)
     ExceptionCode ec = 0;
     History* history = V8History::toNative(args.Holder());
     history->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
-    args.Holder()->DeleteHiddenValue(v8::String::NewSymbol("state"));
+    args.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state());
     return throwError(ec);
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 3aa444c9d..951f18969 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -66,19 +66,20 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(toV8(node));
 }
 
-v8::Handle<v8::Value> V8InjectedScriptHost::inspectedNodeCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8InjectedScriptHost::inspectedObjectCallback(const v8::Arguments& args)
 {
-    INC_STATS("InjectedScriptHost.inspectedNode()");
+    INC_STATS("InjectedScriptHost.inspectedObject()");
     if (args.Length() < 1)
         return v8::Undefined();
 
-    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
-
-    Node* node = host->inspectedNode(args[0]->ToInt32()->Value());
-    if (!node)
+    if (!args[0]->IsInt32()) {
+        throwError("argument has to be an integer");
         return v8::Undefined();
+    }
 
-    return toV8(node);
+    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
+    InjectedScriptHost::InspectableObject* object = host->inspectedObject(args[0]->ToInt32()->Value());
+    return object->get(ScriptState::current()).v8Value();
 }
 
 v8::Handle<v8::Value> V8InjectedScriptHost::internalConstructorNameCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
index 90e8fd626..4782dcc32 100644
--- a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2012 Google Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -71,4 +71,16 @@ v8::Handle<v8::Value> V8NamedNodeMap::namedPropertyGetter(v8::Local<v8::String>
     return toV8(result.release());
 }
 
+v8::Handle<v8::Value> toV8(NamedNodeMap* impl)
+{
+    if (!impl)
+        return v8::Null();
+    v8::Handle<v8::Object> wrapper = V8NamedNodeMap::wrap(impl);
+    // Add a hidden reference from named node map to its owner node.
+    Element* element = impl->element();
+    if (!wrapper.IsEmpty() && element)
+        V8DOMWrapper::setNamedHiddenReference(wrapper, "ownerNode", toV8(element));
+    return wrapper;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 4ad13d4af..449031558 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -137,7 +137,7 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
         return v8::Null();
 
     if (!forceNewObject) {
-        v8::Handle<v8::Value> wrapper = V8DOMWrapper::getWrapper(impl);
+        v8::Handle<v8::Value> wrapper = V8DOMWrapper::getExistingWrapper(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     }
@@ -147,7 +147,7 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
     case Node::ATTRIBUTE_NODE:
         return toV8(static_cast<Attr*>(impl), forceNewObject);
     case Node::TEXT_NODE:
-        return toV8(static_cast<Text*>(impl), forceNewObject);
+        return toV8(toText(impl), forceNewObject);
     case Node::CDATA_SECTION_NODE:
         return toV8(static_cast<CDATASection*>(impl), forceNewObject);
     case Node::ENTITY_REFERENCE_NODE:
@@ -166,7 +166,6 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
         return toV8(static_cast<DocumentFragment*>(impl), forceNewObject);
     case Node::NOTATION_NODE:
         return toV8(static_cast<Notation*>(impl), forceNewObject);
-    case Node::SHADOW_ROOT_NODE: // There's no IDL class for ShadowRoot, fall-through to default and use Node instead.
     default: break; // XPATH_NAMESPACE_NODE
     }
     return V8Node::wrap(impl, forceNewObject);
diff --git a/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
index 57ce238fe..c0f3e3589 100644
--- a/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
@@ -31,23 +31,60 @@
 #include "config.h"
 #include "V8PopStateEvent.h"
 
+#include "History.h"
 #include "PopStateEvent.h"
 #include "SerializedScriptValue.h"
+#include "V8HiddenPropertyName.h"
+#include "V8History.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
+// Save the state value to a hidden attribute in the V8PopStateEvent, and return it, for convenience.
+static v8::Handle<v8::Value> cacheState(v8::Handle<v8::Object> popStateEvent, v8::Handle<v8::Value> state)
+{
+    popStateEvent->SetHiddenValue(V8HiddenPropertyName::state(), state);
+    return state;
+}
+
 v8::Handle<v8::Value> V8PopStateEvent::stateAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.PopStateEvent.state");
 
+    v8::Handle<v8::Value> result = info.Holder()->GetHiddenValue(V8HiddenPropertyName::state());
+
+    if (!result.IsEmpty())
+        return result;
+
     PopStateEvent* event = V8PopStateEvent::toNative(info.Holder());
-    SerializedScriptValue* serializedState = event->serializedState();
-    if (serializedState)
-        return serializedState->deserialize();
     if (!event->state().hasNoValue())
-        return event->state().v8Value();
-    return v8::Null();
+        return cacheState(info.Holder(), event->state().v8Value());
+
+    History* history = event->history();
+    if (!history || !event->serializedState())
+        return cacheState(info.Holder(), v8::Null());
+
+    // There's no cached value from a previous invocation, nor a state value was provided by the
+    // event, but there is a history object, so first we need to see if the state object has been
+    // deserialized through the history object already.
+    // The current history state object might've changed in the meantime, so we need to take care
+    // of using the correct one, and always share the same deserialization with history.state.
+
+    bool isSameState = history->isSameAsCurrentState(event->serializedState());
+
+    if (isSameState) {
+        v8::Handle<v8::Object> v8History = toV8(history).As<v8::Object>();
+        if (!history->stateChanged()) {
+            result = v8History->GetHiddenValue(V8HiddenPropertyName::state());
+            if (!result.IsEmpty())
+                return cacheState(info.Holder(), result);
+        }
+        result = event->serializedState()->deserialize();
+        v8History->SetHiddenValue(V8HiddenPropertyName::state(), result);
+    } else
+        result = event->serializedState()->deserialize();
+
+    return cacheState(info.Holder(), result);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bridge/jsc/BridgeJSC.cpp b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
index 1d67041c8..3bcb29b2b 100644
--- a/Source/WebCore/bridge/jsc/BridgeJSC.cpp
+++ b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
@@ -95,7 +95,7 @@ JSObject* Instance::createRuntimeObject(ExecState* exec)
 
     JSLock lock(SilenceAssertionsOnly);
     RuntimeObject* newObject = newRuntimeObject(exec);
-    m_runtimeObject.set(exec->globalData(), newObject, 0);
+    m_runtimeObject = PassWeak<RuntimeObject>(exec->globalData(), newObject);
     m_rootObject->addRuntimeObject(exec->globalData(), newObject);
     return newObject;
 }
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 7022c02b4..83a9ef51b 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -972,7 +972,7 @@ void QtRuntimeMethod::finishCreation(ExecState* exec, const Identifier& identifi
     Base::finishCreation(exec->globalData(), identifier);
     QW_D(QtRuntimeMethod);
     d->m_instance = instance;
-    d->m_finalizer.set(exec->globalData(), this, d);
+    d->m_finalizer = PassWeak<QtRuntimeMethod>(exec->globalData(), this, d);
 }
 
 QtRuntimeMethod::~QtRuntimeMethod()
diff --git a/Source/WebCore/bridge/runtime_root.cpp b/Source/WebCore/bridge/runtime_root.cpp
index d8b478af2..e884e61b1 100644
--- a/Source/WebCore/bridge/runtime_root.cpp
+++ b/Source/WebCore/bridge/runtime_root.cpp
@@ -181,7 +181,7 @@ void RootObject::addRuntimeObject(JSGlobalData& globalData, RuntimeObject* objec
     ASSERT(m_isValid);
     ASSERT(!m_runtimeObjects.get(object));
 
-    m_runtimeObjects.set(object, JSC::Weak<RuntimeObject>(globalData, object, this));
+    m_runtimeObjects.set(object, JSC::PassWeak<RuntimeObject>(globalData, object, this));
 }
 
 void RootObject::removeRuntimeObject(RuntimeObject* object)
@@ -199,6 +199,7 @@ void RootObject::finalize(JSC::Handle<JSC::Unknown> handle, void*)
     RuntimeObject* object = static_cast<RuntimeObject*>(asObject(handle.get()));
     ASSERT(m_runtimeObjects.contains(object));
 
+    RefPtr<RootObject> protect(this);
     object->invalidate();
     m_runtimeObjects.remove(object);
 }
diff --git a/Source/WebCore/config.h b/Source/WebCore/config.h
index 2e0feec8d..04e516f34 100644
--- a/Source/WebCore/config.h
+++ b/Source/WebCore/config.h
@@ -77,6 +77,8 @@
 #undef delete
 #include <wtf/FastMalloc.h>
 
+#include <ciso646>
+
 #endif
 
 // On MSW, wx headers need to be included before windows.h is.
@@ -90,7 +92,7 @@
 // are used from wx headers. On GTK+ for Mac many GTK+ files include <libintl.h>
 // or <glib/gi18n-lib.h>, which in turn include <xlocale/_ctype.h> which uses
 // isacii(). 
-#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !(OS(DARWIN) && PLATFORM(GTK))
+#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !(OS(DARWIN) && PLATFORM(GTK)) && !defined(_LIBCPP_VERSION)
 #include <wtf/DisallowCType.h>
 #endif
 
diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
index 972d62b31..87fa73782 100755
--- a/Source/WebCore/css/CSSCalculationValue.cpp
+++ b/Source/WebCore/css/CSSCalculationValue.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -76,10 +76,20 @@ String CSSCalcValue::customCssText() const
 {
     return "";
 }
-
+    
+double CSSCalcValue::clampToPermittedRange(double value) const
+{
+    return m_nonNegative && value < 0 ? 0 : value;
+}    
+    
 double CSSCalcValue::doubleValue() const 
 { 
-    return m_expression->doubleValue();
+    return clampToPermittedRange(m_expression->doubleValue());
+}
+
+double CSSCalcValue::computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier, bool computingFontSize) const
+{
+    return clampToPermittedRange(m_expression->computeLengthPx(currentStyle, rootStyle, multiplier, computingFontSize));
 }
     
 CSSCalcExpressionNode::~CSSCalcExpressionNode() 
@@ -94,6 +104,11 @@ public:
         return adoptRef(new CSSCalcPrimitiveValue(value, isInteger));
     }
     
+    virtual bool isZero() const
+    {
+        return !m_value->getDoubleValue();
+    }
+
     virtual String cssText() const
     {
         return m_value->cssText();
@@ -113,7 +128,25 @@ public:
             break;
         }
         return 0;
-    }    
+    }
+    
+    virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier, bool computingFontSize) const
+    {
+        switch (m_category) {
+        case CalcLength:
+            return m_value->computeLength<double>(currentStyle, rootStyle, multiplier, computingFontSize);
+        case CalcPercent:
+        case CalcNumber:
+            return m_value->getDoubleValue();
+        case CalcPercentLength:
+        case CalcPercentNumber:
+        case CalcOther:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+        return 0;        
+    }
+    
 private:
     explicit CSSCalcPrimitiveValue(CSSPrimitiveValue* value, bool isInteger)
         : CSSCalcExpressionNode(unitCategory((CSSPrimitiveValue::UnitTypes)value->primitiveType()), isInteger)
@@ -158,7 +191,6 @@ public:
             break;
                 
         case CalcDivide:
-        case CalcMod:
             if (rightCategory != CalcNumber || rightSide->isZero())
                 return 0;
             newCategory = leftCategory;
@@ -171,10 +203,22 @@ public:
         return adoptRef(new CSSCalcBinaryOperation(leftSide, rightSide, op, newCategory));
     }
     
+    virtual bool isZero() const
+    {
+        return !doubleValue();
+    }
+
     virtual double doubleValue() const 
     {
         return evaluate(m_leftSide->doubleValue(), m_rightSide->doubleValue());
     }
+    
+    virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier, bool computingFontSize) const
+    {
+        const double leftValue = m_leftSide->computeLengthPx(currentStyle, rootStyle, multiplier, computingFontSize);
+        const double rightValue = m_rightSide->computeLengthPx(currentStyle, rootStyle, multiplier, computingFontSize);
+        return evaluate(leftValue, rightValue);
+    }
 
 private:
     CSSCalcBinaryOperation(PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide, CalcOperator op, CalculationCategory category)
@@ -198,10 +242,6 @@ private:
             if (rightValue)
                 return leftValue / rightValue;
             return std::numeric_limits<double>::quiet_NaN();
-        case CalcMod:
-            // FIXME calc() : mod has been removed from the spec, need to remove
-            // this enum value
-            return 0;
         }
         return 0;
     }
@@ -296,7 +336,7 @@ private:
 
         while (*index < tokens->size() - 1) {
             char operatorCharacter = operatorValue(tokens, *index);
-            if (operatorCharacter != CalcMultiply && operatorCharacter != CalcDivide && operatorCharacter != CalcMod)
+            if (operatorCharacter != CalcMultiply && operatorCharacter != CalcDivide)
                 break;
             ++*index;
 
@@ -346,7 +386,7 @@ private:
     }
 };
 
-PassRefPtr<CSSCalcValue> CSSCalcValue::create(CSSParserString name, CSSParserValueList* parserValueList)
+PassRefPtr<CSSCalcValue> CSSCalcValue::create(CSSParserString name, CSSParserValueList* parserValueList, CalculationPermittedValueRange range)
 {    
     CSSCalcExpressionNodeParser parser;    
     RefPtr<CSSCalcExpressionNode> expression;
@@ -355,7 +395,7 @@ PassRefPtr<CSSCalcValue> CSSCalcValue::create(CSSParserString name, CSSParserVal
         expression = parser.parseCalc(parserValueList);    
     // FIXME calc (http://webkit.org/b/16662) Add parsing for min and max here
 
-    return expression ? adoptRef(new CSSCalcValue(expression)) : 0;
+    return expression ? adoptRef(new CSSCalcValue(expression, range)) : 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCalculationValue.h b/Source/WebCore/css/CSSCalculationValue.h
index b33b30f9f..7c3667125 100755
--- a/Source/WebCore/css/CSSCalculationValue.h
+++ b/Source/WebCore/css/CSSCalculationValue.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -59,11 +59,12 @@ class CSSCalcExpressionNode : public RefCounted<CSSCalcExpressionNode> {
 public:
     
     virtual ~CSSCalcExpressionNode() = 0;  
-    virtual double doubleValue() const = 0;  
+    virtual bool isZero() const = 0;
+    virtual double doubleValue() const = 0;
+    virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const = 0;
     
     CalculationCategory category() const { return m_category; }    
     bool isInteger() const { return m_isInteger; }
-    bool isZero() const { return false; }
     
 protected:
     CSSCalcExpressionNode(CalculationCategory category, bool isInteger)
@@ -78,22 +79,28 @@ protected:
         
 class CSSCalcValue : public CSSValue {
 public:
-    static PassRefPtr<CSSCalcValue> create(CSSParserString name, CSSParserValueList*);
+    static PassRefPtr<CSSCalcValue> create(CSSParserString name, CSSParserValueList*, CalculationPermittedValueRange);
 
     CalculationCategory category() const { return m_expression->category(); }
     bool isInt() const { return m_expression->isInteger(); }    
     double doubleValue() const;
+    bool isNegative() const { return m_expression->doubleValue() < 0; }
+    double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const;
         
     String customCssText() const;
     
 private:    
-    CSSCalcValue(PassRefPtr<CSSCalcExpressionNode> expression)
+    CSSCalcValue(PassRefPtr<CSSCalcExpressionNode> expression, CalculationPermittedValueRange range)
         : CSSValue(CalculationClass)
         , m_expression(expression)
+        , m_nonNegative(range == CalculationRangeNonNegative)
     {
     }
     
+    double clampToPermittedRange(double) const;
+
     const RefPtr<CSSCalcExpressionNode> m_expression;
+    const bool m_nonNegative;
 };
     
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCharsetRule.idl b/Source/WebCore/css/CSSCharsetRule.idl
index be23871d0..3cdaf4a78 100644
--- a/Source/WebCore/css/CSSCharsetRule.idl
+++ b/Source/WebCore/css/CSSCharsetRule.idl
@@ -23,9 +23,9 @@ module css {
     // Introduced in DOM Level 2:
     interface CSSCharsetRule : CSSRule {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        readonly attribute [ConvertNullStringTo=Null] DOMString encoding;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString encoding;
 #else
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString encoding
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString encoding
                      setter raises(DOMException);
 #endif
     };
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index d0131eed0..04f72c86e 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -239,11 +239,12 @@ static const int computedProperties[] = {
     CSSPropertyWebkitHyphenateLimitBefore,
     CSSPropertyWebkitHyphenateLimitLines,
     CSSPropertyWebkitHyphens,
+    CSSPropertyWebkitLineAlign,
     CSSPropertyWebkitLineBoxContain,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
     CSSPropertyWebkitLineGrid,
-    CSSPropertyWebkitLineGridSnap,
+    CSSPropertyWebkitLineSnap,
     CSSPropertyWebkitLocale,
     CSSPropertyWebkitMarginBeforeCollapse,
     CSSPropertyWebkitMarginAfterCollapse,
@@ -266,6 +267,9 @@ static const int computedProperties[] = {
     CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskSize,
     CSSPropertyWebkitNbspMode,
+#if ENABLE(OVERFLOW_SCROLLING)
+    CSSPropertyWebkitOverflowScrolling,
+#endif
     CSSPropertyWebkitPerspective,
     CSSPropertyWebkitPerspectiveOrigin,
     CSSPropertyWebkitPrintColorAdjust,
@@ -979,6 +983,7 @@ static PassRefPtr<CSSValue> createLineBoxContainValue(CSSValuePool* cssValuePool
 CSSComputedStyleDeclaration::CSSComputedStyleDeclaration(PassRefPtr<Node> n, bool allowVisitedStyle, const String& pseudoElementName)
     : m_node(n)
     , m_allowVisitedStyle(allowVisitedStyle)
+    , m_refCount(1)
 {
     unsigned nameWithoutColonsStart = pseudoElementName[0] == ':' ? (pseudoElementName[1] == ':' ? 2 : 1) : 0;
     m_pseudoElementSpecifier = CSSSelector::pseudoId(CSSSelector::parsePseudoType(
@@ -989,6 +994,18 @@ CSSComputedStyleDeclaration::~CSSComputedStyleDeclaration()
 {
 }
 
+void CSSComputedStyleDeclaration::ref()
+{
+    ++m_refCount;
+}
+
+void CSSComputedStyleDeclaration::deref()
+{
+    ASSERT(m_refCount);
+    if (!--m_refCount)
+        delete this;
+}
+
 String CSSComputedStyleDeclaration::cssText() const
 {
     String result("");
@@ -1133,7 +1150,7 @@ static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepea
     return list.release();
 }
 
-static PassRefPtr<CSSValue> fillSizeToCSSValue(const FillSize& fillSize, CSSValuePool* cssValuePool)
+static PassRefPtr<CSSValue> fillSizeToCSSValue(const FillSize& fillSize, const RenderStyle* style, CSSValuePool* cssValuePool)
 {
     if (fillSize.type == Contain)
         return cssValuePool->createIdentifierValue(CSSValueContain);
@@ -1142,11 +1159,11 @@ static PassRefPtr<CSSValue> fillSizeToCSSValue(const FillSize& fillSize, CSSValu
         return cssValuePool->createIdentifierValue(CSSValueCover);
 
     if (fillSize.size.height().isAuto())
-        return cssValuePool->createValue(fillSize.size.width());
+        return zoomAdjustedPixelValueForLength(fillSize.size.width(), style, cssValuePool);
 
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-    list->append(cssValuePool->createValue(fillSize.size.width()));
-    list->append(cssValuePool->createValue(fillSize.size.height()));
+    list->append(zoomAdjustedPixelValueForLength(fillSize.size.width(), style, cssValuePool));
+    list->append(zoomAdjustedPixelValueForLength(fillSize.size.height(), style, cssValuePool));
     return list.release();
 }
 
@@ -1324,11 +1341,11 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitMaskSize: {
             const FillLayer* layers = propertyID == CSSPropertyWebkitMaskSize ? style->maskLayers() : style->backgroundLayers();
             if (!layers->next())
-                return fillSizeToCSSValue(layers->size(), cssValuePool);
+                return fillSizeToCSSValue(layers->size(), style.get(), cssValuePool);
 
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             for (const FillLayer* currLayer = layers; currLayer; currLayer = currLayer->next())
-                list->append(fillSizeToCSSValue(currLayer->size(), cssValuePool));
+                list->append(fillSizeToCSSValue(currLayer->size(), style.get(), cssValuePool));
 
             return list.release();
         }
@@ -1394,16 +1411,16 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             const FillLayer* layers = propertyID == CSSPropertyWebkitMaskPosition ? style->maskLayers() : style->backgroundLayers();
             if (!layers->next()) {
                 RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-                list->append(cssValuePool->createValue(layers->xPosition()));
-                list->append(cssValuePool->createValue(layers->yPosition()));
+                list->append(zoomAdjustedPixelValueForLength(layers->xPosition(), style.get(), cssValuePool));
+                list->append(zoomAdjustedPixelValueForLength(layers->yPosition(), style.get(), cssValuePool));
                 return list.release();
             }
 
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             for (const FillLayer* currLayer = layers; currLayer; currLayer = currLayer->next()) {
                 RefPtr<CSSValueList> positionList = CSSValueList::createSpaceSeparated();
-                positionList->append(cssValuePool->createValue(currLayer->xPosition()));
-                positionList->append(cssValuePool->createValue(currLayer->yPosition()));
+                positionList->append(zoomAdjustedPixelValueForLength(currLayer->xPosition(), style.get(), cssValuePool));
+                positionList->append(zoomAdjustedPixelValueForLength(currLayer->yPosition(), style.get(), cssValuePool));
                 list->append(positionList);
             }
 
@@ -1571,8 +1588,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitFlexAlign:
             return cssValuePool->createValue(style->flexAlign());
         case CSSPropertyWebkitFlexItemAlign:
-            // FIXME: If flex-item-align:auto, then we should return the parent's flex-align.
-            // http://webkit.org/b/76326
+            if (style->flexItemAlign() == AlignAuto && m_node && m_node->parentNode() && m_node->parentNode()->computedStyle())
+                return cssValuePool->createValue(m_node->parentNode()->computedStyle()->flexAlign());
             return cssValuePool->createValue(style->flexItemAlign());
         case CSSPropertyWebkitFlexDirection:
             return cssValuePool->createValue(style->flexDirection());
@@ -1741,18 +1758,18 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             const Length& maxHeight = style->maxHeight();
             if (maxHeight.isUndefined())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
-            return cssValuePool->createValue(maxHeight);
+            return zoomAdjustedPixelValueForLength(maxHeight, style.get(), cssValuePool);
         }
         case CSSPropertyMaxWidth: {
             const Length& maxWidth = style->maxWidth();
             if (maxWidth.isUndefined())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
-            return cssValuePool->createValue(maxWidth);
+            return zoomAdjustedPixelValueForLength(maxWidth, style.get(), cssValuePool);
         }
         case CSSPropertyMinHeight:
-            return cssValuePool->createValue(style->minHeight());
+            return zoomAdjustedPixelValueForLength(style->minHeight(), style.get(), cssValuePool);
         case CSSPropertyMinWidth:
-            return cssValuePool->createValue(style->minWidth());
+            return zoomAdjustedPixelValueForLength(style->minWidth(), style.get(), cssValuePool);
         case CSSPropertyOpacity:
             return cssValuePool->createValue(style->opacity(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyOrphans:
@@ -1776,19 +1793,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyPaddingTop:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingTop(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingTop());
+            return zoomAdjustedPixelValueForLength(style->paddingTop(), style.get(), cssValuePool);
         case CSSPropertyPaddingRight:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingRight(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingRight());
+            return zoomAdjustedPixelValueForLength(style->paddingRight(), style.get(), cssValuePool);
         case CSSPropertyPaddingBottom:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingBottom(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingBottom());
+            return zoomAdjustedPixelValueForLength(style->paddingBottom(), style.get(), cssValuePool);
         case CSSPropertyPaddingLeft:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingLeft(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingLeft());
+            return zoomAdjustedPixelValueForLength(style->paddingLeft(), style.get(), cssValuePool);
         case CSSPropertyPageBreakAfter:
             return cssValuePool->createValue(style->pageBreakAfter());
         case CSSPropertyPageBreakBefore:
@@ -1839,7 +1856,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             }
             }
         case CSSPropertyTextIndent:
-            return cssValuePool->createValue(style->textIndent());
+            return zoomAdjustedPixelValueForLength(style->textIndent(), style.get(), cssValuePool);
         case CSSPropertyTextShadow:
             return valueForShadow(style->textShadow(), propertyID, style.get());
         case CSSPropertyTextRendering:
@@ -2106,6 +2123,12 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitMarginTopCollapse:
         case CSSPropertyWebkitMarginBeforeCollapse:
             return cssValuePool->createValue(style->marginBeforeCollapse());
+#if ENABLE(OVERFLOW_SCROLLING)
+        case CSSPropertyWebkitOverflowScrolling:
+            if (!style->useTouchOverflowScrolling())
+                return cssValuePool->createIdentifierValue(CSSValueAuto);
+            return cssValuePool->createIdentifierValue(CSSValueTouch);
+#endif
         case CSSPropertyWebkitPerspective:
             if (!style->hasPerspective())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
@@ -2207,8 +2230,10 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (style->lineGrid().isNull())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
             return cssValuePool->createValue(style->lineGrid(), CSSPrimitiveValue::CSS_STRING);
-        case CSSPropertyWebkitLineGridSnap:
-            return CSSPrimitiveValue::create(style->lineGridSnap());
+        case CSSPropertyWebkitLineSnap:
+            return CSSPrimitiveValue::create(style->lineSnap());
+        case CSSPropertyWebkitLineAlign:
+            return CSSPrimitiveValue::create(style->lineAlign());
         case CSSPropertyWebkitWritingMode:
             return cssValuePool->createValue(style->writingMode());
         case CSSPropertyWebkitTextCombine:
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.h b/Source/WebCore/css/CSSComputedStyleDeclaration.h
index 2c504acb8..de4494194 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.h
@@ -47,9 +47,15 @@ enum EUpdateLayout { DoNotUpdateLayout = false, UpdateLayout = true };
 
 class CSSComputedStyleDeclaration : public CSSStyleDeclaration {
 public:
-    friend PassRefPtr<CSSComputedStyleDeclaration> computedStyle(PassRefPtr<Node>, bool allowVisitedStyle, const String& pseudoElementName);
+    static PassRefPtr<CSSComputedStyleDeclaration> create(PassRefPtr<Node> node, bool allowVisitedStyle = false, const String& pseudoElementName = String())
+    {
+        return adoptRef(new CSSComputedStyleDeclaration(node, allowVisitedStyle, pseudoElementName));
+    }
     virtual ~CSSComputedStyleDeclaration();
 
+    virtual void ref() OVERRIDE;
+    virtual void deref() OVERRIDE;
+
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID) const;
     String getPropertyValue(int propertyID) const;
     bool getPropertyPriority(int propertyID) const;
@@ -109,13 +115,9 @@ private:
     RefPtr<Node> m_node;
     PseudoId m_pseudoElementSpecifier;
     bool m_allowVisitedStyle;
+    unsigned m_refCount;
 };
 
-inline PassRefPtr<CSSComputedStyleDeclaration> computedStyle(PassRefPtr<Node> node,  bool allowVisitedStyle = false, const String& pseudoElementName = String())
-{
-    return adoptRef(new CSSComputedStyleDeclaration(node, allowVisitedStyle, pseudoElementName));
-}
-
 } // namespace WebCore
 
 #endif // CSSComputedStyleDeclaration_h
diff --git a/Source/WebCore/css/CSSFontFaceRule.cpp b/Source/WebCore/css/CSSFontFaceRule.cpp
index 8f50c26ac..0972a4b47 100644
--- a/Source/WebCore/css/CSSFontFaceRule.cpp
+++ b/Source/WebCore/css/CSSFontFaceRule.cpp
@@ -34,7 +34,7 @@ CSSFontFaceRule::CSSFontFaceRule(CSSStyleSheet* parent)
 CSSFontFaceRule::~CSSFontFaceRule()
 {
     if (m_style)
-        m_style->clearParentRule();
+        m_style->clearParentRule(this);
 }
 
 String CSSFontFaceRule::cssText() const
@@ -49,7 +49,7 @@ String CSSFontFaceRule::cssText() const
 void CSSFontFaceRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
 {
     if (m_style)
-        m_style->addSubresourceStyleURLs(urls);
+        m_style->addSubresourceStyleURLs(urls, parentStyleSheet());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSFontFaceRule.h b/Source/WebCore/css/CSSFontFaceRule.h
index 2ca0a1069..ab858f298 100644
--- a/Source/WebCore/css/CSSFontFaceRule.h
+++ b/Source/WebCore/css/CSSFontFaceRule.h
@@ -42,7 +42,7 @@ public:
 
     ~CSSFontFaceRule();
 
-    CSSStyleDeclaration* style() const { return m_style->ensureCSSStyleDeclaration(); }
+    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
 
     String cssText() const;
 
diff --git a/Source/WebCore/css/CSSFontSelector.cpp b/Source/WebCore/css/CSSFontSelector.cpp
index 02977422e..6d22fdccd 100644
--- a/Source/WebCore/css/CSSFontSelector.cpp
+++ b/Source/WebCore/css/CSSFontSelector.cpp
@@ -42,7 +42,6 @@
 #include "CachedResourceLoader.h"
 #include "Document.h"
 #include "FontCache.h"
-#include "FontFamilyValue.h"
 #include "Frame.h"
 #include "RenderObject.h"
 #include "Settings.h"
@@ -63,6 +62,7 @@ namespace WebCore {
 CSSFontSelector::CSSFontSelector(Document* document)
     : m_document(document)
     , m_beginLoadingTimer(this, &CSSFontSelector::beginLoadTimerFired)
+    , m_version(0)
 {
     // FIXME: An old comment used to say there was no need to hold a reference to m_document
     // because "we are guaranteed to be destroyed before the document". But there does not
@@ -106,94 +106,65 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
     unsigned traitsMask = 0;
 
     if (RefPtr<CSSValue> fontStyle = style->getPropertyCSSValue(CSSPropertyFontStyle)) {
-        if (fontStyle->isPrimitiveValue()) {
-            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-            list->append(fontStyle);
-            fontStyle = list;
-        } else if (!fontStyle->isValueList())
-            return;
-
-        CSSValueList* styleList = static_cast<CSSValueList*>(fontStyle.get());
-        unsigned numStyles = styleList->length();
-        if (!numStyles)
+        if (!fontStyle->isPrimitiveValue())
             return;
 
-        for (unsigned i = 0; i < numStyles; ++i) {
-            switch (static_cast<CSSPrimitiveValue*>(styleList->itemWithoutBoundsCheck(i))->getIdent()) {
-                case CSSValueAll:
-                    traitsMask |= FontStyleMask;
-                    break;
-                case CSSValueNormal:
-                    traitsMask |= FontStyleNormalMask;
-                    break;
-                case CSSValueItalic:
-                case CSSValueOblique:
-                    traitsMask |= FontStyleItalicMask;
-                    break;
-                default:
-                    break;
-            }
+        switch (static_cast<CSSPrimitiveValue*>(fontStyle.get())->getIdent()) {
+        case CSSValueNormal:
+            traitsMask |= FontStyleNormalMask;
+            break;
+        case CSSValueItalic:
+        case CSSValueOblique:
+            traitsMask |= FontStyleItalicMask;
+            break;
+        default:
+            break;
         }
     } else
-        traitsMask |= FontStyleMask;
+        traitsMask |= FontStyleNormalMask;
 
     if (RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight)) {
-        if (fontWeight->isPrimitiveValue()) {
-            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-            list->append(fontWeight);
-            fontWeight = list;
-        } else if (!fontWeight->isValueList())
+        if (!fontWeight->isPrimitiveValue())
             return;
 
-        CSSValueList* weightList = static_cast<CSSValueList*>(fontWeight.get());
-        unsigned numWeights = weightList->length();
-        if (!numWeights)
-            return;
-
-        for (unsigned i = 0; i < numWeights; ++i) {
-            switch (static_cast<CSSPrimitiveValue*>(weightList->itemWithoutBoundsCheck(i))->getIdent()) {
-                case CSSValueAll:
-                    traitsMask |= FontWeightMask;
-                    break;
-                case CSSValueBolder:
-                case CSSValueBold:
-                case CSSValue700:
-                    traitsMask |= FontWeight700Mask;
-                    break;
-                case CSSValueNormal:
-                case CSSValue400:
-                    traitsMask |= FontWeight400Mask;
-                    break;
-                case CSSValue900:
-                    traitsMask |= FontWeight900Mask;
-                    break;
-                case CSSValue800:
-                    traitsMask |= FontWeight800Mask;
-                    break;
-                case CSSValue600:
-                    traitsMask |= FontWeight600Mask;
-                    break;
-                case CSSValue500:
-                    traitsMask |= FontWeight500Mask;
-                    break;
-                case CSSValue300:
-                    traitsMask |= FontWeight300Mask;
-                    break;
-                case CSSValueLighter:
-                case CSSValue200:
-                    traitsMask |= FontWeight200Mask;
-                    break;
-                case CSSValue100:
-                    traitsMask |= FontWeight100Mask;
-                    break;
-                default:
-                    break;
-            }
+        switch (static_cast<CSSPrimitiveValue*>(fontWeight.get())->getIdent()) {
+        case CSSValueBold:
+        case CSSValue700:
+            traitsMask |= FontWeight700Mask;
+            break;
+        case CSSValueNormal:
+        case CSSValue400:
+            traitsMask |= FontWeight400Mask;
+            break;
+        case CSSValue900:
+            traitsMask |= FontWeight900Mask;
+            break;
+        case CSSValue800:
+            traitsMask |= FontWeight800Mask;
+            break;
+        case CSSValue600:
+            traitsMask |= FontWeight600Mask;
+            break;
+        case CSSValue500:
+            traitsMask |= FontWeight500Mask;
+            break;
+        case CSSValue300:
+            traitsMask |= FontWeight300Mask;
+            break;
+        case CSSValue200:
+            traitsMask |= FontWeight200Mask;
+            break;
+        case CSSValue100:
+            traitsMask |= FontWeight100Mask;
+            break;
+        default:
+            break;
         }
     } else
-        traitsMask |= FontWeightMask;
+        traitsMask |= FontWeight400Mask;
 
     if (RefPtr<CSSValue> fontVariant = style->getPropertyCSSValue(CSSPropertyFontVariant)) {
+        // font-variant descriptor can be a value list.
         if (fontVariant->isPrimitiveValue()) {
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             list->append(fontVariant);
@@ -208,9 +179,6 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
 
         for (unsigned i = 0; i < numVariants; ++i) {
             switch (static_cast<CSSPrimitiveValue*>(variantList->itemWithoutBoundsCheck(i))->getIdent()) {
-                case CSSValueAll:
-                    traitsMask |= FontVariantMask;
-                    break;
                 case CSSValueNormal:
                     traitsMask |= FontVariantNormalMask;
                     break;
@@ -286,11 +254,10 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
         CSSPrimitiveValue* item = static_cast<CSSPrimitiveValue*>(familyList->itemWithoutBoundsCheck(i));
         String familyName;
         if (item->isString())
-            familyName = static_cast<FontFamilyValue*>(item)->familyName();
+            familyName = item->getStringValue();
         else if (item->isIdent()) {
             // We need to use the raw text for all the generic family types, since @font-face is a way of actually
             // defining what font to use for those types.
-            String familyName;
             switch (item->getIdent()) {
                 case CSSValueSerif:
                     familyName = serifFamily;
@@ -341,6 +308,8 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
         }
 
         familyFontFaces->append(fontFace);
+        
+        ++m_version;
     }
 }
 
@@ -365,7 +334,7 @@ void CSSFontSelector::dispatchInvalidationCallbacks()
     if (!m_document)
         return;
     if (CSSStyleSelector* styleSelector = m_document->styleSelectorIfExists())
-        styleSelector->invalidateMatchedDeclarationCache();
+        styleSelector->invalidateMatchedPropertiesCache();
     if (m_document->inPageCache() || !m_document->renderer())
         return;
     m_document->scheduleForcedStyleRecalc();
@@ -427,6 +396,7 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
     if (firstHasDesiredVariant != secondHasDesiredVariant)
         return firstHasDesiredVariant;
 
+    // We need to check font-variant css property for CSS2.1 compatibility.
     if ((desiredTraitsMaskForComparison & FontVariantSmallCapsMask) && !first->isLocalFallback() && !second->isLocalFallback()) {
         // Prefer a font that has indicated that it can only support small-caps to a font that claims to support
         // all variants.  The specialized font is more likely to be true small-caps and not require synthesis.
@@ -456,12 +426,11 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
     if (firstTraitsMask & desiredTraitsMaskForComparison & FontWeightMask)
         return true;
 
-    // http://www.w3.org/TR/2002/WD-css3-webfonts-20020802/#q46 says: "If there are fewer then 9 weights in the family, the default algorithm
-    // for filling the "holes" is as follows. If '500' is unassigned, it will be assigned the same font as '400'. If any of the values '600',
-    // '700', '800', or '900' remains unassigned, they are assigned to the same face as the next darker assigned keyword, if any, or the next
-    // lighter one otherwise. If any of '300', '200', or '100' remains unassigned, it is assigned to the next lighter assigned keyword, if any,
-    // or the next darker otherwise."
-    // For '400', we made up our own rule (which then '500' follows).
+    // http://www.w3.org/TR/2011/WD-css3-fonts-20111004/#font-matching-algorithm says :
+    //   - If the desired weight is less than 400, weights below the desired weight are checked in descending order followed by weights above the desired weight in ascending order until a match is found.
+    //   - If the desired weight is greater than 500, weights above the desired weight are checked in ascending order followed by weights below the desired weight in descending order until a match is found.
+    //   - If the desired weight is 400, 500 is checked first and then the rule for desired weights less than 400 is used.
+    //   - If the desired weight is 500, 400 is checked first and then the rule for desired weights less than 400 is used.
 
     static const unsigned fallbackRuleSets = 9;
     static const unsigned rulesPerSet = 8;
@@ -469,8 +438,8 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
         { FontWeight200Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight100Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight200Mask, FontWeight100Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
-        { FontWeight500Mask, FontWeight300Mask, FontWeight600Mask, FontWeight200Mask, FontWeight700Mask, FontWeight100Mask, FontWeight800Mask, FontWeight900Mask },
-        { FontWeight400Mask, FontWeight300Mask, FontWeight600Mask, FontWeight200Mask, FontWeight700Mask, FontWeight100Mask, FontWeight800Mask, FontWeight900Mask },
+        { FontWeight500Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
+        { FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight700Mask, FontWeight800Mask, FontWeight900Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask },
         { FontWeight800Mask, FontWeight900Mask, FontWeight600Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask },
         { FontWeight900Mask, FontWeight700Mask, FontWeight600Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask },
diff --git a/Source/WebCore/css/CSSFontSelector.h b/Source/WebCore/css/CSSFontSelector.h
index 3e992cc74..a5f8db5d2 100644
--- a/Source/WebCore/css/CSSFontSelector.h
+++ b/Source/WebCore/css/CSSFontSelector.h
@@ -51,6 +51,8 @@ public:
         return adoptRef(new CSSFontSelector(document));
     }
     virtual ~CSSFontSelector();
+    
+    virtual unsigned version() const OVERRIDE { return m_version; }
 
     virtual FontData* getFontData(const FontDescription& fontDescription, const AtomicString& familyName);
 
@@ -85,6 +87,8 @@ private:
 
     Vector<CachedResourceHandle<CachedFont> > m_fontsToBeginLoading;
     Timer<CSSFontSelector> m_beginLoadingTimer;
+    
+    unsigned m_version;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index 705c36be0..a57edf3d1 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -1530,12 +1530,6 @@ calc_func_operator:
     | '/' maybe_space {
         $$ = '/';
     }
-    | IDENT maybe_space {
-        if (equalIgnoringCase("mod", $1.characters, $1.length))
-            $$ = '%';
-        else
-            $$ = 0;
-    }
   ;
 
 calc_func_paren_expr:
diff --git a/Source/WebCore/css/CSSImportRule.idl b/Source/WebCore/css/CSSImportRule.idl
index 05654fe27..ddd0a8bff 100644
--- a/Source/WebCore/css/CSSImportRule.idl
+++ b/Source/WebCore/css/CSSImportRule.idl
@@ -22,7 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface CSSImportRule : CSSRule {
-        readonly attribute [ConvertNullStringTo=Null] DOMString href;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString href;
         readonly attribute MediaList media;
         readonly attribute CSSStyleSheet styleSheet;
     };
diff --git a/Source/WebCore/css/CSSMediaRule.idl b/Source/WebCore/css/CSSMediaRule.idl
index c62ac9b77..f52a6cec8 100644
--- a/Source/WebCore/css/CSSMediaRule.idl
+++ b/Source/WebCore/css/CSSMediaRule.idl
@@ -25,10 +25,10 @@ module css {
         readonly attribute MediaList media;
         readonly attribute CSSRuleList cssRules;
         
-        [ObjCLegacyUnnamedParameters] unsigned long      insertRule(in [Optional=CallWithDefaultValue] DOMString rule, 
-                                                     in [Optional=CallWithDefaultValue] unsigned long index)
+        [ObjCLegacyUnnamedParameters] unsigned long      insertRule(in [Optional=DefaultIsUndefined] DOMString rule, 
+                                                     in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
-        void               deleteRule(in [Optional=CallWithDefaultValue] unsigned long index)
+        void               deleteRule(in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/css/CSSPageRule.cpp b/Source/WebCore/css/CSSPageRule.cpp
index 359d0fbcd..d067e46c5 100644
--- a/Source/WebCore/css/CSSPageRule.cpp
+++ b/Source/WebCore/css/CSSPageRule.cpp
@@ -1,7 +1,7 @@
 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2002, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2002, 2005, 2006, 2008, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,20 +22,29 @@
 #include "config.h"
 #include "CSSPageRule.h"
 
+#include "CSSParser.h"
+#include "CSSSelector.h"
+#include "Document.h"
 #include "StylePropertySet.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 CSSPageRule::CSSPageRule(CSSStyleSheet* parent, int sourceLine)
-    : CSSStyleRule(parent, sourceLine, CSSRule::PAGE_RULE)
+    : CSSRule(parent, CSSRule::PAGE_RULE)
 {
+    setSourceLine(sourceLine);
 }
 
-String CSSPageRule::pageSelectorText() const
+CSSPageRule::~CSSPageRule()
+{
+    m_style->clearParentRule(this);
+}
+
+String CSSPageRule::selectorText() const
 {
     String text = "@page";
-    CSSSelector* selector = selectorList().first();
+    const CSSSelector* selector = this->selector();
     if (selector) {
         String pageSpecification = selector->selectorText();
         if (!pageSpecification.isEmpty() && pageSpecification != starAtom)
@@ -44,4 +53,35 @@ String CSSPageRule::pageSelectorText() const
     return text;
 }
 
+void CSSPageRule::setSelectorText(const String& selectorText)
+{
+    Document* doc = 0;
+    if (CSSStyleSheet* styleSheet = parentStyleSheet())
+        doc = styleSheet->findDocument();
+    if (!doc)
+        return;
+    
+    CSSParser p;
+    CSSSelectorList selectorList;
+    p.parseSelector(selectorText, doc, selectorList);
+    if (!selectorList.first())
+        return;
+    
+    String oldSelectorText = this->selectorText();
+    m_selectorList.adopt(selectorList);
+    
+    if (this->selectorText() == oldSelectorText)
+        return;
+    doc->styleSelectorChanged(DeferRecalcStyle);
+}
+
+String CSSPageRule::cssText() const
+{
+    String result = selectorText();
+    result += " { ";
+    result += m_style->asText();
+    result += "}";
+    return result;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSPageRule.h b/Source/WebCore/css/CSSPageRule.h
index 687114968..7b09665b3 100644
--- a/Source/WebCore/css/CSSPageRule.h
+++ b/Source/WebCore/css/CSSPageRule.h
@@ -22,7 +22,9 @@
 #ifndef CSSPageRule_h
 #define CSSPageRule_h
 
-#include "CSSStyleRule.h"
+#include "CSSRule.h"
+#include "CSSSelectorList.h"
+#include "StylePropertySet.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -31,17 +33,32 @@ namespace WebCore {
 class CSSSelector;
 class CSSSelectorList;
 
-class CSSPageRule : public CSSStyleRule {
+class CSSPageRule : public CSSRule {
 public:
     static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent, int sourceLine)
     {
         return adoptRef(new CSSPageRule(parent, sourceLine));
     }
+    ~CSSPageRule();
 
-    String pageSelectorText() const;
+    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
+
+    String selectorText() const;
+    void setSelectorText(const String&);
+
+    String cssText() const;
+    
+    const CSSSelector* selector() const { return m_selectorList.first(); }
+    StylePropertySet* properties() const { return m_style.get(); }
+    
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
+    void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
 
 private:
     CSSPageRule(CSSStyleSheet* parent, int sourceLine);
+
+    RefPtr<StylePropertySet> m_style;
+    CSSSelectorList m_selectorList;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSPageRule.idl b/Source/WebCore/css/CSSPageRule.idl
index 4f3747ea0..b3ea22850 100644
--- a/Source/WebCore/css/CSSPageRule.idl
+++ b/Source/WebCore/css/CSSPageRule.idl
@@ -23,7 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface CSSPageRule : CSSRule {
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString selectorText;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString selectorText;
 
         readonly attribute CSSStyleDeclaration style;
 
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 8a1075171..52a80418d 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -61,7 +61,6 @@
 #include "Counter.h"
 #include "Document.h"
 #include "FloatConversion.h"
-#include "FontFamilyValue.h"
 #include "FontFeatureValue.h"
 #include "FontValue.h"
 #include "HTMLParserIdioms.h"
@@ -326,7 +325,7 @@ static inline bool isColorPropertyID(int propertyId)
     }
 }
 
-static bool parseColorValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet = 0)
+static bool parseColorValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet)
 {
     if (!string.length())
         return false;
@@ -346,22 +345,25 @@ static bool parseColorValue(StylePropertySet* declaration, int propertyId, const
         validPrimitive = true;
     }
 
-    CSSStyleSheet* styleSheet = contextStyleSheet ? contextStyleSheet : declaration->contextStyleSheet();
-    if (!styleSheet)
-        return false;
-    Document* document = styleSheet->findDocument();
-    if (!document)
-        return false;
+    Document* document = contextStyleSheet->findDocument();
     if (validPrimitive) {
-        CSSProperty property(propertyId, document->cssValuePool()->createIdentifierValue(valueID), important);
-        declaration->addParsedProperty(property);
+        RefPtr<CSSValue> value;
+        if (document)
+            value = document->cssValuePool()->createIdentifierValue(valueID);
+        else
+            value = CSSPrimitiveValue::createIdentifier(valueID);
+        declaration->addParsedProperty(CSSProperty(propertyId, value.release(), important));
         return true;
     }
     RGBA32 color;
     if (!CSSParser::fastParseColor(color, string, strict && string[0] != '#'))
         return false;
-    CSSProperty property(propertyId, document->cssValuePool()->createColorValue(color), important);
-    declaration->addParsedProperty(property);
+    RefPtr<CSSValue> value;
+    if (document)
+        value = document->cssValuePool()->createColorValue(color);
+    else
+        value = CSSPrimitiveValue::createColor(color);
+    declaration->addParsedProperty(CSSProperty(propertyId, value.release(), important));
     return true;
 }
 
@@ -409,7 +411,7 @@ static inline bool isSimpleLengthPropertyID(int propertyId, bool& acceptsNegativ
     }
 }
 
-static bool parseSimpleLengthValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict)
+static bool parseSimpleLengthValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet)
 {
     bool acceptsNegativeNumbers;
     unsigned length = string.length();
@@ -473,33 +475,37 @@ static bool parseSimpleLengthValue(StylePropertySet* declaration, int propertyId
     if (number < 0 && !acceptsNegativeNumbers)
         return false;
 
-    CSSStyleSheet* styleSheet = declaration->contextStyleSheet();
-    if (!styleSheet)
-        return false;
-    Document* document = styleSheet->findDocument();
-    if (!document)
-        return false;
-    CSSProperty property(propertyId, document->cssValuePool()->createValue(number, unit), important);
-    declaration->addParsedProperty(property);
+    Document* document = contextStyleSheet->findDocument();
+    RefPtr<CSSValue> value;
+    if (document)
+        value = document->cssValuePool()->createValue(number, unit);
+    else
+        value = CSSPrimitiveValue::create(number, unit);
+    declaration->addParsedProperty(CSSProperty(propertyId, value.release(), important));
     return true;
 }
 
-bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict)
+PassRefPtr<CSSValueList> CSSParser::parseFontFaceValue(const AtomicString& string, CSSStyleSheet* contextStyleSheet)
 {
-    if (parseSimpleLengthValue(declaration, propertyId, string, important, strict))
+    RefPtr<StylePropertySet> dummyStyle = StylePropertySet::create();
+    if (!parseValue(dummyStyle.get(), CSSPropertyFontFamily, string, false, false, contextStyleSheet))
+        return 0;
+    return static_pointer_cast<CSSValueList>(dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily));
+}
+
+bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet)
+{
+    if (parseSimpleLengthValue(declaration, propertyId, string, important, strict, contextStyleSheet))
         return true;
-    if (parseColorValue(declaration, propertyId, string, important, strict))
+    if (parseColorValue(declaration, propertyId, string, important, strict, contextStyleSheet))
         return true;
     CSSParser parser(strict);
-    return parser.parseValue(declaration, propertyId, string, important);
+    return parser.parseValue(declaration, propertyId, string, important, contextStyleSheet);
 }
 
 bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, CSSStyleSheet* contextStyleSheet)
 {
-    if (contextStyleSheet)
-        setStyleSheet(contextStyleSheet);
-    else
-        setStyleSheet(declaration->contextStyleSheet());
+    setStyleSheet(contextStyleSheet);
 
     setupParser("@-webkit-value{", string, "} ");
 
@@ -599,10 +605,8 @@ bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& st
     // Length of the "@-webkit-decls{" prefix.
     static const unsigned prefixLength = 15;
 
-    if (contextStyleSheet)
-        setStyleSheet(contextStyleSheet);
-    else
-        setStyleSheet(declaration->contextStyleSheet());
+    setStyleSheet(contextStyleSheet);
+
     if (styleSourceData) {
         m_currentRuleData = CSSRuleSourceData::create();
         m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
@@ -707,7 +711,9 @@ Document* CSSParser::findDocument() const
 
 bool CSSParser::validCalculationUnit(CSSParserValue* value, Units unitflags)
 {
-    if (!parseCalculation(value))
+    bool mustBeNonNegative = unitflags & FNonNeg;
+
+    if (!parseCalculation(value, mustBeNonNegative ? CalculationRangeNonNegative : CalculationRangeAll))
         return false;
 
     bool b = false;
@@ -717,17 +723,15 @@ bool CSSParser::validCalculationUnit(CSSParserValue* value, Units unitflags)
         break;
     case CalcPercent:
         b = (unitflags & FPercent);
-        // FIXME calc (http://webkit.org/b/16662): test FNonNeg here, eg
-        // if (b && (unitflags & FNonNeg) && m_parsedCalculation->doubleValue() < 0)
-        //    b = false;
+        if (b && mustBeNonNegative && m_parsedCalculation->isNegative())
+            b = false;
         break;
     case CalcNumber:
         b = (unitflags & FNumber);
         if (!b && (unitflags & FInteger) && m_parsedCalculation->isInt())
             b = true;
-        // FIXME calc (http://webkit.org/b/16662): test FNonNeg here, eg
-        // if (b && (unitflags & FNonNeg) && m_parsedCalculation->doubleValue() < 0)
-        //    b = false;
+        if (b && mustBeNonNegative && m_parsedCalculation->isNegative())
+            b = false;
         break;
     case CalcPercentLength:
         b = (unitflags & FPercent) && (unitflags & FLength);
@@ -800,10 +804,7 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::createPrimitiveNumericValue(CSSP
 {
     if (m_parsedCalculation) {
         ASSERT(isCalculation(value));
-        // FIXME calc() http://webkit.org/b/16662: create a CSSPrimitiveValue here, ie
-        // return CSSPrimitiveValue::create(m_parsedCalculation.release());
-        m_parsedCalculation.release();
-        return 0;
+        return CSSPrimitiveValue::create(m_parsedCalculation.release());
     }
                
     ASSERT((value->unit >= CSSPrimitiveValue::CSS_NUMBER && value->unit <= CSSPrimitiveValue::CSS_KHZ)
@@ -904,9 +905,7 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::parseValidPrimitive(int id, CSSP
     if (value->unit >= CSSParserValue::Q_EMS)
         return CSSPrimitiveValue::createAllowingMarginQuirk(value->fValue, CSSPrimitiveValue::CSS_EMS);
     if (isCalculation(value))
-        // FIXME calc()  http://webkit.org/b/16662: create a primitive value here, ie
-        // return CSSPrimitiveValue::create(m_parsedCalculation.release());
-        m_parsedCalculation.release();
+        return CSSPrimitiveValue::create(m_parsedCalculation.release());
 
     return 0;
 }
@@ -996,14 +995,14 @@ bool CSSParser::parseValue(int propId, bool important)
             || id == CSSValueAvoid
             || id == CSSValueLeft
             || id == CSSValueRight)
-            validPrimitive = true;
+            validPrimitive = ((propId == CSSPropertyWebkitRegionBreakAfter) || (propId == CSSPropertyWebkitRegionBreakBefore)) ? cssRegionsEnabled() : true;
         break;
 
     case CSSPropertyPageBreakInside:     // avoid | auto | inherit
     case CSSPropertyWebkitColumnBreakInside:
     case CSSPropertyWebkitRegionBreakInside:
         if (id == CSSValueAuto || id == CSSValueAvoid)
-            validPrimitive = true;
+            validPrimitive = (propId == CSSPropertyWebkitRegionBreakInside) ? cssRegionsEnabled() : true;
         break;
 
     case CSSPropertyEmptyCells:          // show | hide | inherit
@@ -1411,7 +1410,9 @@ bool CSSParser::parseValue(int propId, bool important)
         break;
 
     case CSSPropertyFontStyle:           // normal | italic | oblique | inherit
-        return parseFontStyle(important);
+        if (id == CSSValueNormal || id == CSSValueItalic || id == CSSValueOblique)
+            validPrimitive = true;
+        break;
 
     case CSSPropertyFontVariant:         // normal | small-caps | inherit
         return parseFontVariant(important);
@@ -1722,7 +1723,7 @@ bool CSSParser::parseValue(int propId, bool important)
         validPrimitive = id == CSSValueRow || id == CSSValueRowReverse || id == CSSValueColumn || id == CSSValueColumnReverse;
         break;
     case CSSPropertyWebkitFlexWrap:
-        validPrimitive = id == CSSValueNowrap || id == CSSValueWrap || id == CSSValueWrapReverse;
+        validPrimitive = id == CSSValueNone || id == CSSValueWrap || id == CSSValueWrapReverse;
         break;
     case CSSPropertyWebkitMarquee: {
         const int properties[5] = { CSSPropertyWebkitMarqueeDirection, CSSPropertyWebkitMarqueeIncrement,
@@ -1759,11 +1760,15 @@ bool CSSParser::parseValue(int propId, bool important)
             validPrimitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
         break;
     case CSSPropertyWebkitFlowInto:
+        if (!cssRegionsEnabled())
+            return false;
         return parseFlowThread(propId, important);
     case CSSPropertyWebkitFlowFrom:
+        if (!cssRegionsEnabled())
+            return false;
         return parseRegionThread(propId, important);
     case CSSPropertyWebkitRegionOverflow:
-        if (id == CSSValueAuto || id == CSSValueBreak)
+        if (cssRegionsEnabled() && (id == CSSValueAuto || id == CSSValueBreak))
             validPrimitive = true;
         break;
 
@@ -2049,10 +2054,14 @@ bool CSSParser::parseValue(int propId, bool important)
             }
         }
         break;
-    case CSSPropertyWebkitLineGridSnap:
+    case CSSPropertyWebkitLineSnap:
         if (id == CSSValueNone || id == CSSValueBaseline || id == CSSValueContain)
             validPrimitive = true;
         break;
+    case CSSPropertyWebkitLineAlign:
+        if (id == CSSValueNone || id == CSSValueEdges)
+            validPrimitive = true;
+        break;
     case CSSPropertyWebkitLocale:
         if (id == CSSValueAuto || value->unit == CSSPrimitiveValue::CSS_STRING)
             validPrimitive = true;
@@ -2095,6 +2104,14 @@ bool CSSParser::parseValue(int propId, bool important)
         }
         break;
 #endif
+
+#if ENABLE(OVERFLOW_SCROLLING)
+    case CSSPropertyWebkitOverflowScrolling:
+        if (id == CSSValueAuto || id == CSSValueTouch)
+            validPrimitive = true;
+        break;
+#endif
+
         /* shorthand properties */
     case CSSPropertyBackground: {
         // Position must come before color in this array because a plain old "0" is a legal color
@@ -2471,23 +2488,20 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             return false;
     }
 
-    // Fill in any remaining properties with the initial value.
-    for (i = 0; i < numProperties; ++i) {
+    // Now add all of the properties we found.
+    for (i = 0; i < numProperties; i++) {
+        // Fill in any remaining properties with the initial value.
         if (!parsedProperty[i]) {
             addFillValue(values[i], cssValuePool()->createImplicitInitialValue());
             if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                 addFillValue(positionYValue, cssValuePool()->createImplicitInitialValue());
             if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
                 addFillValue(repeatYValue, cssValuePool()->createImplicitInitialValue());
-            if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
+            if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin)) {
                 // If background-origin wasn't present, then reset background-clip also.
                 addFillValue(clipValue, cssValuePool()->createImplicitInitialValue());
             }
         }
-    }
-
-    // Now add all of the properties we found.
-    for (i = 0; i < numProperties; i++) {
         if (properties[i] == CSSPropertyBackgroundPosition) {
             addProperty(CSSPropertyBackgroundPositionX, values[i].release(), important);
             // it's OK to call positionYValue.release() since we only see CSSPropertyBackgroundPosition once
@@ -2664,16 +2678,15 @@ bool CSSParser::parseShorthand(int propId, const int *properties, int numPropert
     ShorthandScope scope(this, propId);
 
     bool found = false;
-    bool fnd[6]; // Trust me ;)
-    for (int i = 0; i < numProperties; i++)
-        fnd[i] = false;
+    int propertiesParsed = 0;
+    bool fnd[6]= { false, false, false, false, false, false }; // 6 is enough size.
 
     while (m_valueList->current()) {
         found = false;
         for (int propIndex = 0; !found && propIndex < numProperties; ++propIndex) {
-            if (!fnd[propIndex]) {
-                if (parseValue(properties[propIndex], important))
+            if (!fnd[propIndex] && parseValue(properties[propIndex], important)) {
                     fnd[propIndex] = found = true;
+                    propertiesParsed++;
             }
         }
 
@@ -2683,6 +2696,9 @@ bool CSSParser::parseShorthand(int propId, const int *properties, int numPropert
             return false;
     }
 
+    if (propertiesParsed == numProperties)
+        return true;
+
     // Fill in any remaining properties with the initial value.
     ImplicitScope implicitScope(this, PropertyImplicit);
     for (int i = 0; i < numProperties; ++i) {
@@ -4150,6 +4166,8 @@ bool CSSParser::parseFont(bool important)
     // Optional font-style, font-variant and font-weight.
     while (value) {
         int id = value->id;
+        if (id == CSSValueInitial || id == CSSValueInherit)
+            return false;
         if (id) {
             if (id == CSSValueNormal) {
                 // It's the initial value for all three, so mark the corresponding longhand as explicit.
@@ -4219,6 +4237,9 @@ bool CSSParser::parseFont(bool important)
     if (!value)
         return false;
 
+    if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+        return false;
+
     // Set undefined values to default.
     if (!font->style)
         font->style = cssValuePool()->createIdentifierValue(CSSValueNormal);
@@ -4237,6 +4258,9 @@ bool CSSParser::parseFont(bool important)
     if (!font->size || !value)
         return false;
 
+    if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+        return false;
+
     if (value->unit == CSSParserValue::Operator && value->iValue == '/') {
         // The line-height property.
         value = m_valueList->next();
@@ -4255,6 +4279,9 @@ bool CSSParser::parseFont(bool important)
             return false;
     }
 
+    if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+        return false;
+
     if (!font->lineHeight)
         font->lineHeight = cssValuePool()->createIdentifierValue(CSSValueNormal);
 
@@ -4279,13 +4306,46 @@ bool CSSParser::parseFont(bool important)
     return true;
 }
 
+class FontFamilyValueBuilder {
+public:
+    FontFamilyValueBuilder(CSSValueList* list, CSSValuePool* pool)
+        : m_list(list)
+        , m_cssValuePool(pool)
+    {
+    }
+
+    void add(const CSSParserString& string)
+    {
+        if (!m_builder.isEmpty())
+            m_builder.append(' ');
+        m_builder.append(string.characters, string.length);
+    }
+
+    void commit()
+    {
+        if (m_builder.isEmpty())
+            return;
+        m_list->append(m_cssValuePool->createFontFamilyValue(m_builder.toString()));
+        m_builder.clear();
+    }
+
+private:
+    StringBuilder m_builder;
+    CSSValueList* m_list;
+    CSSValuePool* m_cssValuePool;
+};
+
 PassRefPtr<CSSValueList> CSSParser::parseFontFamily()
 {
     RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
     CSSParserValue* value = m_valueList->current();
 
-    FontFamilyValue* currFamily = 0;
+    FontFamilyValueBuilder familyBuilder(list.get(), cssValuePool());
+    bool inFamily = false;
+
     while (value) {
+        if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+            return 0;
         CSSParserValue* nextValue = m_valueList->next();
         bool nextValBreaksFont = !nextValue ||
                                  (nextValue->unit == CSSParserValue::Operator && nextValue->iValue == ',');
@@ -4294,28 +4354,29 @@ PassRefPtr<CSSValueList> CSSParser::parseFontFamily()
             (nextValue->unit == CSSPrimitiveValue::CSS_STRING || nextValue->unit == CSSPrimitiveValue::CSS_IDENT));
 
         if (value->id >= CSSValueSerif && value->id <= CSSValueWebkitBody) {
-            if (currFamily)
-                currFamily->appendSpaceSeparated(value->string.characters, value->string.length);
+            if (inFamily)
+                familyBuilder.add(value->string);
             else if (nextValBreaksFont || !nextValIsFontName)
                 list->append(cssValuePool()->createIdentifierValue(value->id));
             else {
-                RefPtr<FontFamilyValue> newFamily = FontFamilyValue::create(value->string);
-                currFamily = newFamily.get();
-                list->append(newFamily.release());
+                familyBuilder.commit();
+                familyBuilder.add(value->string);
+                inFamily = true;
             }
         } else if (value->unit == CSSPrimitiveValue::CSS_STRING) {
             // Strings never share in a family name.
-            currFamily = 0;
-            list->append(FontFamilyValue::create(value->string));
+            inFamily = false;
+            familyBuilder.commit();
+            list->append(cssValuePool()->createFontFamilyValue(value->string));
         } else if (value->unit == CSSPrimitiveValue::CSS_IDENT) {
-            if (currFamily)
-                currFamily->appendSpaceSeparated(value->string.characters, value->string.length);
+            if (inFamily)
+                familyBuilder.add(value->string);
             else if (nextValBreaksFont || !nextValIsFontName)
-                list->append(FontFamilyValue::create(value->string));
+                list->append(cssValuePool()->createFontFamilyValue(value->string));
             else {
-                RefPtr<FontFamilyValue> newFamily = FontFamilyValue::create(value->string);
-                currFamily = newFamily.get();
-                list->append(newFamily.release());
+                familyBuilder.commit();
+                familyBuilder.add(value->string);
+                inFamily = true;
             }
         } else {
             break;
@@ -4326,65 +4387,21 @@ PassRefPtr<CSSValueList> CSSParser::parseFontFamily()
 
         if (nextValBreaksFont) {
             value = m_valueList->next();
-            currFamily = 0;
+            familyBuilder.commit();
+            inFamily = false;
         }
         else if (nextValIsFontName)
             value = nextValue;
         else
             break;
     }
+    familyBuilder.commit();
+
     if (!list->length())
         list = 0;
     return list.release();
 }
 
-bool CSSParser::parseFontStyle(bool important)
-{
-    RefPtr<CSSValueList> values;
-    if (m_valueList->size() > 1)
-        values = CSSValueList::createCommaSeparated();
-    CSSParserValue* val;
-    bool expectComma = false;
-    while ((val = m_valueList->current())) {
-        RefPtr<CSSPrimitiveValue> parsedValue;
-        if (!expectComma) {
-            expectComma = true;
-            if (val->id == CSSValueNormal || val->id == CSSValueItalic || val->id == CSSValueOblique)
-                parsedValue = cssValuePool()->createIdentifierValue(val->id);
-            else if (val->id == CSSValueAll && !values) {
-                // 'all' is only allowed in @font-face and with no other values. Make a value list to
-                // indicate that we are in the @font-face case.
-                values = CSSValueList::createCommaSeparated();
-                parsedValue = cssValuePool()->createIdentifierValue(val->id);
-            }
-        } else if (val->unit == CSSParserValue::Operator && val->iValue == ',') {
-            expectComma = false;
-            m_valueList->next();
-            continue;
-        }
-
-        if (!parsedValue)
-            return false;
-
-        m_valueList->next();
-
-        if (values)
-            values->append(parsedValue.release());
-        else {
-            addProperty(CSSPropertyFontStyle, parsedValue.release(), important);
-            return true;
-        }
-    }
-
-    if (values && values->length()) {
-        m_hasFontFaceOnlyValues = true;
-        addProperty(CSSPropertyFontStyle, values.release(), important);
-        return true;
-    }
-
-    return false;
-}
-
 bool CSSParser::parseFontVariant(bool important)
 {
     RefPtr<CSSValueList> values;
@@ -4434,54 +4451,20 @@ bool CSSParser::parseFontVariant(bool important)
 
 bool CSSParser::parseFontWeight(bool important)
 {
-    RefPtr<CSSValueList> values;
-    if (m_valueList->size() > 1)
-        values = CSSValueList::createCommaSeparated();
-    CSSParserValue* val;
-    bool expectComma = false;
-    while ((val = m_valueList->current())) {
-        RefPtr<CSSPrimitiveValue> parsedValue;
-        if (!expectComma) {
-            expectComma = true;
-            if (val->unit == CSSPrimitiveValue::CSS_IDENT) {
-                if (val->id >= CSSValueNormal && val->id <= CSSValue900)
-                    parsedValue = cssValuePool()->createIdentifierValue(val->id);
-                else if (val->id == CSSValueAll && !values) {
-                    // 'all' is only allowed in @font-face and with no other values. Make a value list to
-                    // indicate that we are in the @font-face case.
-                    values = CSSValueList::createCommaSeparated();
-                    parsedValue = cssValuePool()->createIdentifierValue(val->id);
-                }
-            } else if (validUnit(val, FInteger | FNonNeg, false)) {
-                int weight = static_cast<int>(val->fValue);
-                if (!(weight % 100) && weight >= 100 && weight <= 900)
-                    parsedValue = cssValuePool()->createIdentifierValue(CSSValue100 + weight / 100 - 1);
-            }
-        } else if (val->unit == CSSParserValue::Operator && val->iValue == ',') {
-            expectComma = false;
-            m_valueList->next();
-            continue;
-        }
-
-        if (!parsedValue)
-            return false;
-
-        m_valueList->next();
+    if (m_valueList->size() != 1)
+        return false;
 
-        if (values)
-            values->append(parsedValue.release());
-        else {
-            addProperty(CSSPropertyFontWeight, parsedValue.release(), important);
-            return true;
-        }
+    CSSParserValue* value = m_valueList->current();
+    if ((value->id >= CSSValueNormal) && (value->id <= CSSValue900)) {
+        addProperty(CSSPropertyFontWeight, cssValuePool()->createIdentifierValue(value->id), important);
+        return true;
     }
-
-    if (values && values->length()) {
-        m_hasFontFaceOnlyValues = true;
-        addProperty(CSSPropertyFontWeight, values.release(), important);
+    if (validUnit(value, FInteger | FNonNeg, false)) {
+        int weight = static_cast<int>(value->fValue);
+        if (!(weight % 100) && weight >= 100 && weight <= 900)
+            addProperty(CSSPropertyFontWeight, cssValuePool()->createIdentifierValue(CSSValue100 + weight / 100 - 1), important);
         return true;
     }
-
     return false;
 }
 
@@ -7091,10 +7074,19 @@ static bool validFlowName(const String& flowName)
     return true;
 }
 
+bool CSSParser::cssRegionsEnabled() const
+{
+    if (Document* document = findDocument())
+        return document->cssRegionsEnabled();
+
+    return false;
+}
+
 // auto | <ident>
 bool CSSParser::parseFlowThread(int propId, bool important)
 {
     ASSERT(propId == CSSPropertyWebkitFlowInto);
+    ASSERT(cssRegionsEnabled());
 
     if (m_valueList->size() != 1)
         return false;
@@ -7126,6 +7118,7 @@ bool CSSParser::parseFlowThread(int propId, bool important)
 bool CSSParser::parseRegionThread(int propId, bool important)
 {
     ASSERT(propId == CSSPropertyWebkitFlowFrom);
+    ASSERT(cssRegionsEnabled());
 
     if (m_valueList->size() != 1)
         return false;
@@ -7428,7 +7421,7 @@ bool CSSParser::parseFontVariantLigatures(bool important)
     return true;
 }
 
-bool CSSParser::parseCalculation(CSSParserValue* value) 
+bool CSSParser::parseCalculation(CSSParserValue* value, CalculationPermittedValueRange range) 
 {
     ASSERT(isCalculation(value));
     
@@ -7437,7 +7430,7 @@ bool CSSParser::parseCalculation(CSSParserValue* value)
         return false;
 
     ASSERT(!m_parsedCalculation);
-    m_parsedCalculation = CSSCalcValue::create(value->function->name, args);
+    m_parsedCalculation = CSSCalcValue::create(value->function->name, args, range);
     
     if (!m_parsedCalculation)
         return false;
@@ -8253,8 +8246,8 @@ int CSSParser::lex(void* yylvalWithoutType)
     UChar* result;
     bool hasEscape;
 
-    // The input buffer is terminated by two \0, so
-    // it is safe to read two characters ahead anytime.
+    // The input buffer is terminated by a \0 character, so
+    // it is safe to read one character ahead of a known non-null.
 
 #ifndef NDEBUG
     // In debug we check with an ASSERT that the length is > 0 for string types.
@@ -8525,9 +8518,9 @@ restartAfterComment:
         if (*m_currentCharacter == '*') {
             ++m_currentCharacter;
             while (m_currentCharacter[0] != '*' || m_currentCharacter[1] != '/') {
-                if (m_currentCharacter[0] == '\n')
+                if (*m_currentCharacter == '\n')
                     ++m_lineNumber;
-                if (m_currentCharacter[0] == '\0' && m_currentCharacter[1] == '\0') {
+                if (*m_currentCharacter == '\0') {
                     // Unterminated comments are simply ignored.
                     m_currentCharacter -= 2;
                     break;
@@ -8831,7 +8824,7 @@ CSSRule* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selector
         rule->adoptSelectorVector(*selectors);
         if (m_hasFontFaceOnlyValues)
             deleteFontFaceOnlyValues();
-        rule->setDeclaration(StylePropertySet::create(rule.get(), m_parsedProperties, m_numParsedProperties));
+        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
         result = rule.get();
         m_parsedRules.append(rule.release());
         if (m_ruleRangeMap) {
@@ -8856,7 +8849,7 @@ CSSRule* CSSParser::createFontFaceRule()
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
-        if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isPrimitiveValue()) {
+        if (id == CSSPropertyFontVariant && property->value()->isPrimitiveValue()) {
             RefPtr<CSSValue> value = property->m_value.release();
             property->m_value = CSSValueList::createCommaSeparated();
             static_cast<CSSValueList*>(property->value())->append(value.release());
@@ -8870,7 +8863,7 @@ CSSRule* CSSParser::createFontFaceRule()
         }
     }
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
-    rule->setDeclaration(StylePropertySet::create(rule.get(), m_parsedProperties, m_numParsedProperties));
+    rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
     clearProperties();
     CSSFontFaceRule* result = rule.get();
     m_parsedRules.append(rule.release());
@@ -8941,7 +8934,7 @@ CSSRule* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelector)
         Vector<OwnPtr<CSSParserSelector> > selectorVector;
         selectorVector.append(pageSelector);
         rule->adoptSelectorVector(selectorVector);
-        rule->setDeclaration(StylePropertySet::create(rule.get(), m_parsedProperties, m_numParsedProperties));
+        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
         pageRule = rule.get();
         m_parsedRules.append(rule.release());
     }
@@ -8957,7 +8950,7 @@ void CSSParser::setReusableRegionSelectorVector(Vector<OwnPtr<CSSParserSelector>
 
 CSSRule* CSSParser::createRegionRule(Vector<OwnPtr<CSSParserSelector> >* regionSelector, CSSRuleList* rules)
 {
-    if (!regionSelector || !rules)
+    if (!cssRegionsEnabled() || !regionSelector || !rules)
         return 0;
 
     m_allowImportRules = m_allowNamespaceDeclarations = false;
@@ -9001,7 +8994,7 @@ void CSSParser::deleteFontFaceOnlyValues()
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
-        if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isValueList()) {
+        if (id == CSSPropertyFontVariant && property->value()->isValueList()) {
             delete property;
             deletedProperties++;
         } else if (deletedProperties)
@@ -9025,7 +9018,7 @@ WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
 
     RefPtr<WebKitCSSKeyframeRule> keyframe = WebKitCSSKeyframeRule::create(m_styleSheet);
     keyframe->setKeyText(keyString);
-    keyframe->setDeclaration(StylePropertySet::create(keyframe.get(), m_parsedProperties, m_numParsedProperties));
+    keyframe->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
 
     clearProperties();
 
@@ -9148,14 +9141,8 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
             memcpy(buffer, "-webkit", 7);
             ++length;
         }
-
 #if PLATFORM(IOS)
-        if (!strcmp(buffer, "-webkit-hyphenate-locale")) {
-            // Worked in iOS 4.2.
-            const char* const webkitLocale = "-webkit-locale";
-            name = webkitLocale;
-            length = strlen(webkitLocale);
-        }
+        cssPropertyNameIOSAliasing(buffer, name, length);
 #endif
     }
 
@@ -9173,6 +9160,18 @@ int cssPropertyID(const CSSParserString& string)
     return cssPropertyID(string.characters, string.length);
 }
 
+#if PLATFORM(IOS)
+void cssPropertyNameIOSAliasing(const char* propertyName, const char*& propertyNameAlias, unsigned& newLength)
+{
+    if (!strcmp(propertyName, "-webkit-hyphenate-locale")) {
+        // Worked in iOS 4.2.
+        static const char* const webkitLocale = "-webkit-locale";
+        propertyNameAlias = webkitLocale;
+        newLength = strlen(webkitLocale);
+    }
+}
+#endif
+
 int cssValueKeywordID(const CSSParserString& string)
 {
     unsigned length = string.length;
@@ -9260,6 +9259,11 @@ static bool isCSSTokenizerURL(const String& string)
 // We use single quotes for now because markup.cpp uses double quotes.
 String quoteCSSString(const String& string)
 {
+    // This function expands each character to at most 3 characters ('\u0010' -> '\' '1' '0') as well as adds
+    // 2 quote characters (before and after). Make sure the resulting size (3 * length + 2) will not overflow unsigned.
+    if (string.length() >= (std::numeric_limits<unsigned>::max() / 3) - 2)
+        return "";
+
     // For efficiency, we first pre-calculate the length of the quoted string, then we build the actual one.
     // Please see below for the actual logic.
     unsigned quotedStringSize = 2; // Two quotes surrounding the entire string.
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 5527d3616..5d766be88 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -69,11 +69,12 @@ public:
     void parseSheet(CSSStyleSheet*, const String&, int startLineNumber = 0, StyleRuleRangeMap* ruleRangeMap = 0);
     PassRefPtr<CSSRule> parseRule(CSSStyleSheet*, const String&);
     PassRefPtr<WebKitCSSKeyframeRule> parseKeyframeRule(CSSStyleSheet*, const String&);
-    static bool parseValue(StylePropertySet*, int propId, const String&, bool important, bool strict);
+    static bool parseValue(StylePropertySet*, int propId, const String&, bool important, bool strict, CSSStyleSheet* contextStyleSheet);
     static bool parseColor(RGBA32& color, const String&, bool strict = false);
     static bool parseSystemColor(RGBA32& color, const String&, Document*);
+    static PassRefPtr<CSSValueList> parseFontFaceValue(const AtomicString&, CSSStyleSheet* contextStyleSheet);
     PassRefPtr<CSSPrimitiveValue> parseValidPrimitive(int propId, CSSParserValue*);
-    bool parseDeclaration(StylePropertySet*, const String&, RefPtr<CSSStyleSourceData>* = 0, CSSStyleSheet* contextStyleSheet = 0);
+    bool parseDeclaration(StylePropertySet*, const String&, RefPtr<CSSStyleSourceData>*, CSSStyleSheet* contextStyleSheet);
     bool parseMediaQuery(MediaList*, const String&);
 
     Document* findDocument() const;
@@ -156,7 +157,6 @@ public:
 
     static bool fastParseColor(RGBA32&, const String&, bool strict);
 
-    bool parseFontStyle(bool important);
     bool parseFontVariant(bool important);
     bool parseFontWeight(bool important);
     bool parseFontFaceSrc();
@@ -209,11 +209,12 @@ public:
     bool parseTextEmphasisStyle(bool important);
 
     bool parseLineBoxContain(bool important);
-    bool parseCalculation(CSSParserValue*);
+    bool parseCalculation(CSSParserValue*, CalculationPermittedValueRange);
 
     bool parseFontFeatureTag(CSSValueList*);
     bool parseFontFeatureSettings(bool important);
 
+    bool cssRegionsEnabled() const;
     bool parseFlowThread(int propId, bool important);
     bool parseRegionThread(int propId, bool important);
 
@@ -355,7 +356,7 @@ private:
     bool isGeneratedImageValue(CSSParserValue*) const;
     bool parseGeneratedImage(CSSParserValueList*, RefPtr<CSSValue>&);
 
-    bool parseValue(StylePropertySet*, int propId, const String&, bool important, CSSStyleSheet* contextStyleSheet = 0);
+    bool parseValue(StylePropertySet*, int propId, const String&, bool important, CSSStyleSheet* contextStyleSheet);
 
     enum SizeParameterType {
         None,
@@ -449,6 +450,9 @@ private:
 int cssPropertyID(const CSSParserString&);
 int cssPropertyID(const String&);
 int cssValueKeywordID(const CSSParserString&);
+#if PLATFORM(IOS)
+void cssPropertyNameIOSAliasing(const char* propertyName, const char*& propertyNameAlias, unsigned& newLength);
+#endif
 
 class ShorthandScope {
     WTF_MAKE_FAST_ALLOCATED;
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index 9021a6353..fc14e8206 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -21,12 +21,14 @@
 #include "config.h"
 #include "CSSPrimitiveValue.h"
 
+#include "CSSCalculationValue.h"
 #include "CSSHelper.h"
 #include "CSSParser.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
 #include "CSSWrapShapes.h"
+#include "CalculationValue.h"
 #include "Color.h"
 #include "Counter.h"
 #include "ExceptionCode.h"
@@ -52,6 +54,9 @@ namespace WebCore {
 static inline bool isValidCSSUnitTypeForDoubleConversion(CSSPrimitiveValue::UnitTypes unitType)
 {
     switch (unitType) {
+    case CSSPrimitiveValue:: CSS_CALC:
+    case CSSPrimitiveValue:: CSS_CALC_PERCENTAGE_WITH_NUMBER:
+    case CSSPrimitiveValue:: CSS_CALC_PERCENTAGE_WITH_LENGTH:
     case CSSPrimitiveValue:: CSS_CM:
     case CSSPrimitiveValue:: CSS_DEG:
     case CSSPrimitiveValue:: CSS_DIMENSION:
@@ -137,6 +142,27 @@ static CSSTextCache& cssTextCache()
     return cache;
 }
 
+unsigned short CSSPrimitiveValue::primitiveType() const 
+{
+    if (m_primitiveUnitType != CSSPrimitiveValue::CSS_CALC)
+        return m_primitiveUnitType; 
+    
+    switch (m_value.calc->category()) {
+    case CalcNumber:
+        return CSSPrimitiveValue::CSS_NUMBER;
+    case CalcPercent:
+        return CSSPrimitiveValue::CSS_PERCENTAGE;
+    case CalcLength:
+        return CSSPrimitiveValue::CSS_PX;
+    case CalcPercentNumber:
+        return CSSPrimitiveValue::CSS_CALC_PERCENTAGE_WITH_NUMBER;
+    case CalcPercentLength:
+        return CSSPrimitiveValue::CSS_CALC_PERCENTAGE_WITH_LENGTH;
+    case CalcOther:
+        return CSSPrimitiveValue::CSS_UNKNOWN;
+    }
+    return CSSPrimitiveValue::CSS_UNKNOWN;
+}
 static const AtomicString& valueOrPropertyName(int valueOrPropertyID)
 {
     ASSERT_ARG(valueOrPropertyID, valueOrPropertyID >= 0);
@@ -284,6 +310,13 @@ void CSSPrimitiveValue::init(PassRefPtr<Pair> p)
     m_value.pair = p.leakRef();
 }
 
+void CSSPrimitiveValue::init(PassRefPtr<CSSCalcValue> c)
+{
+    m_primitiveUnitType = CSS_CALC;
+    m_hasCachedCSSText = false;
+    m_value.calc = c.leakRef();
+}
+
 void CSSPrimitiveValue::init(PassRefPtr<CSSWrapShape> shape)
 {
     m_primitiveUnitType = CSS_SHAPE;
@@ -324,6 +357,9 @@ void CSSPrimitiveValue::cleanup()
                 m_value.region->deref();
             break;
 #endif
+        case CSS_CALC:
+            m_value.calc->deref();
+            break;
         case CSS_SHAPE:
             m_value.shape->deref();
             break;
@@ -437,12 +473,23 @@ double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* r
             // 1 pc == 12 pt
             factor = cssPixelsPerInch * 12.0 / 72.0;
             break;
+        case CSS_CALC_PERCENTAGE_WITH_LENGTH:
+        case CSS_CALC_PERCENTAGE_WITH_NUMBER:
+            ASSERT_NOT_REACHED();
+            return -1.0;
         default:
             ASSERT_NOT_REACHED();
             return -1.0;
     }
 
-    double result = getDoubleValue() * factor;
+    double computedValue;
+    if (m_primitiveUnitType == CSS_CALC)
+        // The multiplier is passed in as 1.0 here to ensure it is only applied once
+        computedValue = m_value.calc->computeLengthPx(style, rootStyle, 1.0, computingFontSize);
+    else
+        computedValue = getDoubleValue();
+    
+    double result = computedValue * factor;
     if (!applyZoomMultiplier || multiplier == 1.0f)
         return result;
 
@@ -528,6 +575,11 @@ double CSSPrimitiveValue::getDoubleValue(unsigned short unitType) const
     return result;
 }
 
+double CSSPrimitiveValue::getDoubleValue() const
+{ 
+    return m_primitiveUnitType != CSS_CALC ? m_value.num : m_value.calc->doubleValue();
+}
+
 CSSPrimitiveValue::UnitTypes CSSPrimitiveValue::canonicalUnitTypeForCategory(UnitCategory category)
 {
     // The canonical unit type is chosen according to the way CSSParser::validUnit() chooses the default unit
@@ -554,12 +606,13 @@ bool CSSPrimitiveValue::getDoubleValueInternal(UnitTypes requestedUnitType, doub
 {
     if (!isValidCSSUnitTypeForDoubleConversion(static_cast<UnitTypes>(m_primitiveUnitType)) || !isValidCSSUnitTypeForDoubleConversion(requestedUnitType))
         return false;
-    if (requestedUnitType == static_cast<UnitTypes>(m_primitiveUnitType) || requestedUnitType == CSS_DIMENSION) {
-        *result = m_value.num;
+
+    UnitTypes sourceUnitType = static_cast<UnitTypes>(primitiveType());
+    if (requestedUnitType == sourceUnitType || requestedUnitType == CSS_DIMENSION) {
+        *result = getDoubleValue();
         return true;
     }
 
-    UnitTypes sourceUnitType = static_cast<UnitTypes>(m_primitiveUnitType);
     UnitCategory sourceCategory = unitCategory(sourceUnitType);
     ASSERT(sourceCategory != UOther);
 
@@ -585,7 +638,7 @@ bool CSSPrimitiveValue::getDoubleValueInternal(UnitTypes requestedUnitType, doub
             return false;
     }
 
-    double convertedValue = m_value.num;
+    double convertedValue = getDoubleValue();
 
     // First convert the value from m_primitiveUnitType to canonical type.
     double factor = conversionToCanonicalUnitsScaleFactor(sourceUnitType);
@@ -958,6 +1011,9 @@ String CSSPrimitiveValue::customCssText() const
         case CSS_PARSER_IDENTIFIER:
             text = quoteCSSStringIfNeeded(m_value.string);
             break;
+        case CSS_CALC:
+            text = m_value.calc->cssText();
+            break;
         case CSS_SHAPE:
             text = m_value.shape->cssText();
             break;
diff --git a/Source/WebCore/css/CSSPrimitiveValue.h b/Source/WebCore/css/CSSPrimitiveValue.h
index 3f15ff78d..13e576a3e 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.h
+++ b/Source/WebCore/css/CSSPrimitiveValue.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class CSSCalcValue;
 class Counter;
 class DashboardRegion;
 class Pair;
@@ -102,7 +103,11 @@ public:
         CSS_SHAPE = 110,
 
         // Used by border images.
-        CSS_QUAD = 111
+        CSS_QUAD = 111,
+
+        CSS_CALC = 112,
+        CSS_CALC_PERCENTAGE_WITH_NUMBER = 113,
+        CSS_CALC_PERCENTAGE_WITH_LENGTH = 114
     };
 
     // This enum follows the CSSParser::Units enum augmented with UNIT_FREQUENCY for frequencies.
@@ -133,19 +138,21 @@ public:
     bool isIdent() const { return m_primitiveUnitType == CSS_IDENT; }
     bool isLength() const
     {
-        return (m_primitiveUnitType >= CSS_EMS && m_primitiveUnitType <= CSS_PC)
-               || m_primitiveUnitType == CSS_REMS;
+        unsigned short type = primitiveType();
+        return (type >= CSS_EMS && type <= CSS_PC) || type == CSS_REMS;
     }
-    bool isNumber() const { return m_primitiveUnitType == CSS_NUMBER; }
-    bool isPercentage() const { return m_primitiveUnitType == CSS_PERCENTAGE; }
-    bool isPx() const { return m_primitiveUnitType == CSS_PX; }
+    bool isNumber() const { return primitiveType() == CSS_NUMBER; }
+    bool isPercentage() const { return primitiveType() == CSS_PERCENTAGE; }
+    bool isPx() const { return primitiveType() == CSS_PX; }
     bool isRect() const { return m_primitiveUnitType == CSS_RECT; }
     bool isRGBColor() const { return m_primitiveUnitType == CSS_RGBCOLOR; }
     bool isShape() const { return m_primitiveUnitType == CSS_SHAPE; }
     bool isString() const { return m_primitiveUnitType == CSS_STRING; }
     bool isTime() const { return m_primitiveUnitType == CSS_S || m_primitiveUnitType == CSS_MS; }
     bool isURI() const { return m_primitiveUnitType == CSS_URI; }
-
+    bool isCalculated() const { return m_primitiveUnitType == CSS_CALC; }
+    bool isCalculatedPercentageWithNumber() const { return primitiveType() == CSS_CALC_PERCENTAGE_WITH_NUMBER; }
+    bool isCalculatedPercentageWithLength() const { return primitiveType() == CSS_CALC_PERCENTAGE_WITH_LENGTH; }
 
     static PassRefPtr<CSSPrimitiveValue> createIdentifier(int identifier) { return adoptRef(new CSSPrimitiveValue(identifier)); }
     static PassRefPtr<CSSPrimitiveValue> createColor(unsigned rgbValue) { return adoptRef(new CSSPrimitiveValue(rgbValue)); }
@@ -172,7 +179,7 @@ public:
 
     void cleanup();
 
-    unsigned short primitiveType() const { return m_primitiveUnitType; }
+    unsigned short primitiveType() const;
 
     double computeDegrees();
 
@@ -211,7 +218,7 @@ public:
 
     double getDoubleValue(unsigned short unitType, ExceptionCode&) const;
     double getDoubleValue(unsigned short unitType) const;
-    double getDoubleValue() const { return m_value.num; }
+    double getDoubleValue() const;
 
     void setFloatValue(unsigned short unitType, double floatValue, ExceptionCode&);
     float getFloatValue(unsigned short unitType, ExceptionCode& ec) const { return getValue<float>(unitType, ec); }
@@ -224,7 +231,7 @@ public:
 
     template<typename T> inline T getValue(unsigned short unitType, ExceptionCode& ec) const { return clampTo<T>(getDoubleValue(unitType, ec)); }
     template<typename T> inline T getValue(unsigned short unitType) const { return clampTo<T>(getDoubleValue(unitType)); }
-    template<typename T> inline T getValue() const { return clampTo<T>(m_value.num); }
+    template<typename T> inline T getValue() const { return clampTo<T>(getDoubleValue()); }
 
     void setStringValue(unsigned short stringType, const String& stringValue, ExceptionCode&);
     String getStringValue(ExceptionCode&) const;
@@ -248,6 +255,8 @@ public:
     DashboardRegion* getDashboardRegionValue() const { return m_primitiveUnitType != CSS_DASHBOARD_REGION ? 0 : m_value.region; }
 
     CSSWrapShape* getShapeValue() const { return m_primitiveUnitType != CSS_SHAPE ? 0 : m_value.shape; }
+    
+    CSSCalcValue* cssCalcValue() const { return m_primitiveUnitType != CSS_CALC ? 0 : m_value.calc; }
 
     int getIdent() const { return m_primitiveUnitType == CSS_IDENT ? m_value.ident : 0; }
 
@@ -301,7 +310,7 @@ private:
     void init(PassRefPtr<Quad>);
     void init(PassRefPtr<DashboardRegion>); // FIXME: Dashboard region should not be a primitive value.
     void init(PassRefPtr<CSSWrapShape>);
-
+    void init(PassRefPtr<CSSCalcValue>);
     bool getDoubleValueInternal(UnitTypes targetUnitType, double* result) const;
 
     double computeLengthDouble(RenderStyle* currentStyle, RenderStyle* rootStyle, float multiplier, bool computingFontSize);
@@ -317,6 +326,7 @@ private:
         Pair* pair;
         DashboardRegion* region;
         CSSWrapShape* shape;
+        CSSCalcValue* calc;
     } m_value;
 };
 
diff --git a/Source/WebCore/css/CSSPrimitiveValue.idl b/Source/WebCore/css/CSSPrimitiveValue.idl
index 8d44737e9..517aba226 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.idl
+++ b/Source/WebCore/css/CSSPrimitiveValue.idl
@@ -51,13 +51,13 @@ module css {
 
         readonly attribute unsigned short primitiveType;
 
-        [ObjCLegacyUnnamedParameters] void setFloatValue(in [Optional=CallWithDefaultValue] unsigned short unitType,
-                                          in [Optional=CallWithDefaultValue] float floatValue)
+        [ObjCLegacyUnnamedParameters] void setFloatValue(in [Optional=DefaultIsUndefined] unsigned short unitType,
+                                          in [Optional=DefaultIsUndefined] float floatValue)
             raises(DOMException);
-        float getFloatValue(in [Optional=CallWithDefaultValue] unsigned short unitType)
+        float getFloatValue(in [Optional=DefaultIsUndefined] unsigned short unitType)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters] void setStringValue(in [Optional=CallWithDefaultValue] unsigned short stringType, 
-                                           in [Optional=CallWithDefaultValue] DOMString stringValue)
+        [ObjCLegacyUnnamedParameters] void setStringValue(in [Optional=DefaultIsUndefined] unsigned short stringType, 
+                                           in [Optional=DefaultIsUndefined] DOMString stringValue)
             raises(DOMException);
         DOMString getStringValue()
             raises(DOMException);
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index a2434dde7..73491c30d 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1288,8 +1288,8 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFlexWrap e)
 {
     m_primitiveUnitType = CSS_IDENT;
     switch (e) {
-    case FlexNoWrap:
-        m_value.ident = CSSValueNowrap;
+    case FlexWrapNone:
+        m_value.ident = CSSValueNone;
         break;
     case FlexWrap:
         m_value.ident = CSSValueWrap;
@@ -1303,15 +1303,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFlexWrap e)
 template<> inline CSSPrimitiveValue::operator EFlexWrap() const
 {
     switch (m_value.ident) {
-    case CSSValueNowrap:
-        return FlexNoWrap;
+    case CSSValueNone:
+        return FlexWrapNone;
     case CSSValueWrap:
         return FlexWrap;
     case CSSValueWrapReverse:
         return FlexWrapReverse;
     default:
         ASSERT_NOT_REACHED();
-        return FlexNoWrap;
+        return FlexWrapNone;
     }
 }
 
@@ -3158,35 +3158,62 @@ template<> inline CSSPrimitiveValue::operator Hyphens() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineGridSnap gridSnap)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineSnap gridSnap)
     : CSSValue(PrimitiveClass)
 {
     m_primitiveUnitType = CSS_IDENT;
     switch (gridSnap) {
-    case LineGridSnapNone:
+    case LineSnapNone:
         m_value.ident = CSSValueNone;
         break;
-    case LineGridSnapBaseline:
+    case LineSnapBaseline:
         m_value.ident = CSSValueBaseline;
         break;
-    case LineGridSnapContain:
+    case LineSnapContain:
         m_value.ident = CSSValueContain;
         break;
     }
 }
 
-template<> inline CSSPrimitiveValue::operator LineGridSnap() const
+template<> inline CSSPrimitiveValue::operator LineSnap() const
 {
     switch (m_value.ident) {
     case CSSValueNone:
-        return LineGridSnapNone;
+        return LineSnapNone;
     case CSSValueBaseline:
-        return LineGridSnapBaseline;
+        return LineSnapBaseline;
     case CSSValueContain:
-        return LineGridSnapContain;
+        return LineSnapContain;
+    default:
+        ASSERT_NOT_REACHED();
+        return LineSnapNone;
+    }
+}
+
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineAlign lineAlign)
+    : CSSValue(PrimitiveClass)
+{
+    m_primitiveUnitType = CSS_IDENT;
+    switch (lineAlign) {
+    case LineAlignNone:
+        m_value.ident = CSSValueNone;
+        break;
+    case LineAlignEdges:
+        m_value.ident = CSSValueEdges;
+        break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator LineAlign() const
+{
+    switch (m_value.ident) {
+    case CSSValueNone:
+        return LineAlignNone;
+    case CSSValueEdges:
+        return LineAlignEdges;
     default:
         ASSERT_NOT_REACHED();
-        return LineGridSnapNone;
+        return LineAlignNone;
     }
 }
 
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index 1071bbef4..fd85e9bae 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -328,11 +328,15 @@ bool CSSProperty::isInheritedProperty(unsigned propertyID)
     case CSSPropertyWebkitHyphenateLimitBefore:
     case CSSPropertyWebkitHyphenateLimitLines:
     case CSSPropertyWebkitHyphens:
+    case CSSPropertyWebkitLineAlign:
     case CSSPropertyWebkitLineBoxContain:
     case CSSPropertyWebkitLineBreak:
     case CSSPropertyWebkitLineGrid:
-    case CSSPropertyWebkitLineGridSnap:
+    case CSSPropertyWebkitLineSnap:
     case CSSPropertyWebkitNbspMode:
+#if ENABLE(OVERFLOW_SCROLLING)
+    case CSSPropertyWebkitOverflowScrolling:
+#endif
     case CSSPropertyWebkitPrintColorAdjust:
     case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index 92070f69e..9afda37a7 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -271,10 +271,11 @@ z-index
 -webkit-hyphens
 -epub-hyphens = -webkit-hyphens
 -webkit-line-box-contain
+-webkit-line-align
 -webkit-line-break
 -webkit-line-clamp
 -webkit-line-grid
--webkit-line-grid-snap
+-webkit-line-snap
 -webkit-logical-width
 -webkit-logical-height
 -webkit-margin-after-collapse
@@ -379,3 +380,6 @@ z-index
 #if defined(ENABLE_DASHBOARD_SUPPORT) && ENABLE_DASHBOARD_SUPPORT
 -webkit-dashboard-region
 #endif
+#if defined(ENABLE_OVERFLOW_SCROLLING)
+-webkit-overflow-scrolling
+#endif
diff --git a/Source/WebCore/css/CSSRule.cpp b/Source/WebCore/css/CSSRule.cpp
index 5399848da..13ad50ad3 100644
--- a/Source/WebCore/css/CSSRule.cpp
+++ b/Source/WebCore/css/CSSRule.cpp
@@ -54,8 +54,9 @@ String CSSRule::cssText() const
     case UNKNOWN_RULE:
         return String();
     case STYLE_RULE:
-    case PAGE_RULE:
         return static_cast<const CSSStyleRule*>(this)->cssText();
+    case PAGE_RULE:
+        return static_cast<const CSSPageRule*>(this)->cssText();
     case CHARSET_RULE:
         return static_cast<const CSSCharsetRule*>(this)->cssText();
     case IMPORT_RULE:
diff --git a/Source/WebCore/css/CSSRule.h b/Source/WebCore/css/CSSRule.h
index 4f3ca3b74..5f5627417 100644
--- a/Source/WebCore/css/CSSRule.h
+++ b/Source/WebCore/css/CSSRule.h
@@ -49,10 +49,12 @@ public:
         MEDIA_RULE,
         FONT_FACE_RULE,
         PAGE_RULE,
-        // 7 used to be VARIABLES_RULE
-        WEBKIT_KEYFRAMES_RULE = 8,
+        // 7 was VARIABLES_RULE; we now match other browsers with 7 as
+        // KEYFRAMES_RULE:
+        // <https://bugs.webkit.org/show_bug.cgi?id=71293>.
+        WEBKIT_KEYFRAMES_RULE,
         WEBKIT_KEYFRAME_RULE,
-        WEBKIT_REGION_RULE
+        WEBKIT_REGION_RULE = 10
     };
 
     Type type() const { return static_cast<Type>(m_type); }
diff --git a/Source/WebCore/css/CSSRule.idl b/Source/WebCore/css/CSSRule.idl
index 279752662..dc65688d7 100644
--- a/Source/WebCore/css/CSSRule.idl
+++ b/Source/WebCore/css/CSSRule.idl
@@ -24,7 +24,7 @@ module css {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
-        JSCustomToJS,
+        CustomToJSObject,
         ObjCPolymorphic,
         V8DependentLifetime
     ] CSSRule {
@@ -37,13 +37,13 @@ module css {
         const unsigned short MEDIA_RULE = 4;
         const unsigned short FONT_FACE_RULE = 5;
         const unsigned short PAGE_RULE = 6;
-        const unsigned short WEBKIT_KEYFRAMES_RULE = 8;
-        const unsigned short WEBKIT_KEYFRAME_RULE = 9;
+        const unsigned short WEBKIT_KEYFRAMES_RULE = 7;
+        const unsigned short WEBKIT_KEYFRAME_RULE = 8;
         const unsigned short WEBKIT_REGION_RULE = 10;
 
         readonly attribute unsigned short   type;
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        cssText
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        cssText
                      setter raises (DOMException);
 
         readonly attribute CSSStyleSheet    parentStyleSheet;
diff --git a/Source/WebCore/css/CSSRuleList.idl b/Source/WebCore/css/CSSRuleList.idl
index eff029339..7ac533b8a 100644
--- a/Source/WebCore/css/CSSRuleList.idl
+++ b/Source/WebCore/css/CSSRuleList.idl
@@ -32,7 +32,7 @@ module css {
         V8DependentLifetime
     ] CSSRuleList {
         readonly attribute unsigned long    length;
-        CSSRule           item(in [Optional=CallWithDefaultValue] unsigned long index);
+        CSSRule           item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.cpp b/Source/WebCore/css/CSSStyleApplyProperty.cpp
index 524ed773c..274ceb482 100644
--- a/Source/WebCore/css/CSSStyleApplyProperty.cpp
+++ b/Source/WebCore/css/CSSStyleApplyProperty.cpp
@@ -440,11 +440,19 @@ public:
         Length radiusHeight;
         if (pair->first()->isPercentage())
             radiusWidth = Length(pair->first()->getDoubleValue(), Percent);
-        else
+        else if (pair->first()->isCalculatedPercentageWithLength()) {
+            // FIXME calc(): http://webkit.org/b/16662
+            // handle this case
+            return;
+        } else
             radiusWidth = Length(max(intMinForLength, min(intMaxForLength, pair->first()->computeLength<int>(selector->style(), selector->rootElementStyle(), selector->style()->effectiveZoom()))), Fixed);
         if (pair->second()->isPercentage())
             radiusHeight = Length(pair->second()->getDoubleValue(), Percent);
-        else
+        else if (pair->second()->isCalculatedPercentageWithLength()) {
+            // FIXME calc(): http://webkit.org/b/16662
+            // handle this case
+            return;
+        } else
             radiusHeight = Length(max(intMinForLength, min(intMaxForLength, pair->second()->computeLength<int>(selector->style(), selector->rootElementStyle(), selector->style()->effectiveZoom()))), Fixed);
         int width = radiusWidth.value();
         int height = radiusHeight.value();
@@ -1742,6 +1750,9 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitMaskRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
 
     setPropertyHandler(CSSPropertyBackgroundColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor, &RenderStyle::setVisitedLinkBackgroundColor, &RenderStyle::invalidColor>::createHandler());
+
+    setPropertyHandler(CSSPropertyBorderCollapse, ApplyPropertyDefault<EBorderCollapse, &RenderStyle::borderCollapse, EBorderCollapse, &RenderStyle::setBorderCollapse, EBorderCollapse, &RenderStyle::initialBorderCollapse>::createHandler());
+
     setPropertyHandler(CSSPropertyBorderBottomColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderBottomColor, &RenderStyle::setBorderBottomColor, &RenderStyle::setVisitedLinkBorderBottomColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyBorderLeftColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderLeftColor, &RenderStyle::setBorderLeftColor, &RenderStyle::setVisitedLinkBorderLeftColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyBorderRightColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderRightColor, &RenderStyle::setBorderRightColor, &RenderStyle::setVisitedLinkBorderRightColor, &RenderStyle::color>::createHandler());
@@ -1799,6 +1810,9 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyLetterSpacing, ApplyPropertyComputeLength<int, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
     setPropertyHandler(CSSPropertyWordSpacing, ApplyPropertyComputeLength<int, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
 
+    setPropertyHandler(CSSPropertyCaptionSide, ApplyPropertyDefault<ECaptionSide, &RenderStyle::captionSide, ECaptionSide, &RenderStyle::setCaptionSide, ECaptionSide, &RenderStyle::initialCaptionSide>::createHandler());
+    setPropertyHandler(CSSPropertyClear, ApplyPropertyDefault<EClear, &RenderStyle::clear, EClear, &RenderStyle::setClear, EClear, &RenderStyle::initialClear>::createHandler());
+
     setPropertyHandler(CSSPropertyClip, ApplyPropertyClip::createHandler());
 
     setPropertyHandler(CSSPropertyCursor, ApplyPropertyCursor::createHandler());
@@ -1806,6 +1820,8 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyCounterIncrement, ApplyPropertyCounter<Increment>::createHandler());
     setPropertyHandler(CSSPropertyCounterReset, ApplyPropertyCounter<Reset>::createHandler());
 
+    setPropertyHandler(CSSPropertyEmptyCells, ApplyPropertyDefault<EEmptyCell, &RenderStyle::emptyCells, EEmptyCell, &RenderStyle::setEmptyCells, EEmptyCell, &RenderStyle::initialEmptyCells>::createHandler());
+
     setPropertyHandler(CSSPropertyWebkitFlexOrder, ApplyPropertyDefault<int, &RenderStyle::flexOrder, int, &RenderStyle::setFlexOrder, int, &RenderStyle::initialFlexOrder>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexPack, ApplyPropertyDefault<EFlexPack, &RenderStyle::flexPack, EFlexPack, &RenderStyle::setFlexPack, EFlexPack, &RenderStyle::initialFlexPack>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexAlign, EFlexAlign, &RenderStyle::setFlexAlign, EFlexAlign, &RenderStyle::initialFlexAlign>::createHandler());
@@ -1814,6 +1830,8 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
 
+    setPropertyHandler(CSSPropertyFloat, ApplyPropertyDefault<EFloat, &RenderStyle::floating, EFloat, &RenderStyle::setFloating, EFloat, &RenderStyle::initialFloating>::createHandler());
+
     setPropertyHandler(CSSPropertyFontSize, ApplyPropertyFontSize::createHandler());
     setPropertyHandler(CSSPropertyFontStyle, ApplyPropertyFont<FontItalic, &FontDescription::italic, &FontDescription::setItalic, FontItalicOff>::createHandler());
     setPropertyHandler(CSSPropertyFontVariant, ApplyPropertyFont<FontSmallCaps, &FontDescription::smallCaps, &FontDescription::setSmallCaps, FontSmallCapsOff>::createHandler());
@@ -1828,7 +1846,7 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyTextDecoration, ApplyPropertyTextDecoration::createHandler());
 
     setPropertyHandler(CSSPropertyOutlineStyle, ApplyPropertyOutlineStyle::createHandler());
-    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<InheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyOutlineOffset, ApplyPropertyComputeLength<int, &RenderStyle::outlineOffset, &RenderStyle::setOutlineOffset, &RenderStyle::initialOutlineOffset>::createHandler());
 
     setPropertyHandler(CSSPropertyOutline, ApplyPropertyExpanding<SuppressValue, CSSPropertyOutlineWidth, CSSPropertyOutlineColor, CSSPropertyOutlineStyle>::createHandler());
@@ -1882,19 +1900,22 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyPaddingLeft, ApplyPropertyLength<&RenderStyle::paddingLeft, &RenderStyle::setPaddingLeft, &RenderStyle::initialPadding>::createHandler());
     setPropertyHandler(CSSPropertyPadding, ApplyPropertyExpanding<SuppressValue, CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft>::createHandler());
 
-    setPropertyHandler(CSSPropertyResize, ApplyPropertyResize::createHandler());
+    setPropertyHandler(CSSPropertyPageBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakAfter, EPageBreak, &RenderStyle::setPageBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyPageBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakBefore, EPageBreak, &RenderStyle::setPageBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyPageBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakInside, EPageBreak, &RenderStyle::setPageBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
 
-    setPropertyHandler(CSSPropertyVerticalAlign, ApplyPropertyVerticalAlign::createHandler());
+    setPropertyHandler(CSSPropertyPosition, ApplyPropertyDefault<EPosition, &RenderStyle::position, EPosition, &RenderStyle::setPosition, EPosition, &RenderStyle::initialPosition>::createHandler());
 
+    setPropertyHandler(CSSPropertyResize, ApplyPropertyResize::createHandler());
     setPropertyHandler(CSSPropertySize, ApplyPropertyPageSize::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginX, ApplyPropertyLength<&RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX, &RenderStyle::initialPerspectiveOriginX>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginY, ApplyPropertyLength<&RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY, &RenderStyle::initialPerspectiveOriginY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitPerspectiveOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitPerspectiveOriginX, CSSPropertyWebkitPerspectiveOriginY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOriginX, ApplyPropertyLength<&RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX, &RenderStyle::initialTransformOriginX>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOriginY, ApplyPropertyLength<&RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY, &RenderStyle::initialTransformOriginY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOriginZ, ApplyPropertyComputeLength<float, &RenderStyle::transformOriginZ, &RenderStyle::setTransformOriginZ, &RenderStyle::initialTransformOriginZ>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitTransformOriginX, CSSPropertyWebkitTransformOriginY, CSSPropertyWebkitTransformOriginZ>::createHandler());
+    setPropertyHandler(CSSPropertyTableLayout, ApplyPropertyDefault<ETableLayout, &RenderStyle::tableLayout, ETableLayout, &RenderStyle::setTableLayout, ETableLayout, &RenderStyle::initialTableLayout>::createHandler());
+    setPropertyHandler(CSSPropertyTextTransform, ApplyPropertyDefault<ETextTransform, &RenderStyle::textTransform, ETextTransform, &RenderStyle::setTextTransform, ETextTransform, &RenderStyle::initialTextTransform>::createHandler());
+    setPropertyHandler(CSSPropertyUnicodeBidi, ApplyPropertyDefault<EUnicodeBidi, &RenderStyle::unicodeBidi, EUnicodeBidi, &RenderStyle::setUnicodeBidi, EUnicodeBidi, &RenderStyle::initialUnicodeBidi>::createHandler());
+    setPropertyHandler(CSSPropertyVerticalAlign, ApplyPropertyVerticalAlign::createHandler());
+    setPropertyHandler(CSSPropertyVisibility, ApplyPropertyDefault<EVisibility, &RenderStyle::visibility, EVisibility, &RenderStyle::setVisibility, EVisibility, &RenderStyle::initialVisibility>::createHandler());
+    setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
+    setPropertyHandler(CSSPropertyWordBreak, ApplyPropertyDefault<EWordBreak, &RenderStyle::wordBreak, EWordBreak, &RenderStyle::setWordBreak, EWordBreak, &RenderStyle::initialWordBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWordWrap, ApplyPropertyDefault<EWordWrap, &RenderStyle::wordWrap, EWordWrap, &RenderStyle::setWordWrap, EWordWrap, &RenderStyle::initialWordWrap>::createHandler());
 
     setPropertyHandler(CSSPropertyWebkitAnimationDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationDirection, ApplyPropertyAnimation<Animation::AnimationDirection, &Animation::direction, &Animation::setDirection, &Animation::isDirectionSet, &Animation::clearDirection, &Animation::initialAnimationDirection, &CSSStyleSelector::mapAnimationDirection, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
@@ -1904,39 +1925,66 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitAnimationName, ApplyPropertyAnimation<const String&, &Animation::name, &Animation::setName, &Animation::isNameSet, &Animation::clearName, &Animation::initialAnimationName, &CSSStyleSelector::mapAnimationName, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationPlayState, ApplyPropertyAnimation<EAnimPlayState, &Animation::playState, &Animation::setPlayState, &Animation::isPlayStateSet, &Animation::clearPlayState, &Animation::initialAnimationPlayState, &CSSStyleSelector::mapAnimationPlayState, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitTransitionDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransitionDuration, ApplyPropertyAnimation<double, &Animation::duration, &Animation::setDuration, &Animation::isDurationSet, &Animation::clearDuration, &Animation::initialAnimationDuration, &CSSStyleSelector::mapAnimationDuration, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransitionProperty, ApplyPropertyAnimation<int, &Animation::property, &Animation::setProperty, &Animation::isPropertySet, &Animation::clearProperty, &Animation::initialAnimationProperty, &CSSStyleSelector::mapAnimationProperty, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransitionTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitAppearance, ApplyPropertyDefault<ControlPart, &RenderStyle::appearance, ControlPart, &RenderStyle::setAppearance, ControlPart, &RenderStyle::initialAppearance>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBackfaceVisibility, ApplyPropertyDefault<EBackfaceVisibility, &RenderStyle::backfaceVisibility, EBackfaceVisibility, &RenderStyle::setBackfaceVisibility, EBackfaceVisibility, &RenderStyle::initialBackfaceVisibility>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxAlign, ApplyPropertyDefault<EBoxAlignment, &RenderStyle::boxAlign, EBoxAlignment, &RenderStyle::setBoxAlign, EBoxAlignment, &RenderStyle::initialBoxAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxDirection, ApplyPropertyDefault<EBoxDirection, &RenderStyle::boxDirection, EBoxDirection, &RenderStyle::setBoxDirection, EBoxDirection, &RenderStyle::initialBoxDirection>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxFlex, ApplyPropertyDefault<float, &RenderStyle::boxFlex, float, &RenderStyle::setBoxFlex, float, &RenderStyle::initialBoxFlex>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxFlexGroup, ApplyPropertyDefault<unsigned int, &RenderStyle::boxFlexGroup, unsigned int, &RenderStyle::setBoxFlexGroup, unsigned int, &RenderStyle::initialBoxFlexGroup>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxLines, ApplyPropertyDefault<EBoxLines, &RenderStyle::boxLines, EBoxLines, &RenderStyle::setBoxLines, EBoxLines, &RenderStyle::initialBoxLines>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxOrdinalGroup, ApplyPropertyDefault<unsigned int, &RenderStyle::boxOrdinalGroup, unsigned int, &RenderStyle::setBoxOrdinalGroup, unsigned int, &RenderStyle::initialBoxOrdinalGroup>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxOrient, ApplyPropertyDefault<EBoxOrient, &RenderStyle::boxOrient, EBoxOrient, &RenderStyle::setBoxOrient, EBoxOrient, &RenderStyle::initialBoxOrient>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxPack, ApplyPropertyDefault<EBoxPack, &RenderStyle::boxPack, EBoxPack, &RenderStyle::setBoxPack, EBoxPack, &RenderStyle::initialBoxPack>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnCount, ApplyPropertyAuto<unsigned short, &RenderStyle::columnCount, &RenderStyle::setColumnCount, &RenderStyle::hasAutoColumnCount, &RenderStyle::setHasAutoColumnCount>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnGap, ApplyPropertyAuto<float, &RenderStyle::columnGap, &RenderStyle::setColumnGap, &RenderStyle::hasNormalColumnGap, &RenderStyle::setHasNormalColumnGap, ComputeLength, CSSValueNormal>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitColumnWidth, ApplyPropertyAuto<float, &RenderStyle::columnWidth, &RenderStyle::setColumnWidth, &RenderStyle::hasAutoColumnWidth, &RenderStyle::setHasAutoColumnWidth, ComputeLength>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumns, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapAutoToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnSpan, ApplyPropertyDefault<ColumnSpan, &RenderStyle::columnSpan, ColumnSpan, &RenderStyle::setColumnSpan, ColumnSpan, &RenderStyle::initialColumnSpan>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnWidth, ApplyPropertyAuto<float, &RenderStyle::columnWidth, &RenderStyle::setColumnWidth, &RenderStyle::hasAutoColumnWidth, &RenderStyle::setHasAutoColumnWidth, ComputeLength>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlowFrom, ApplyPropertyString<MapNoneToNull, &RenderStyle::regionThread, &RenderStyle::setRegionThread, &RenderStyle::initialRegionThread>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapAutoToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHighlight, ApplyPropertyString<MapNoneToNull, &RenderStyle::highlight, &RenderStyle::setHighlight, &RenderStyle::initialHighlight>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateCharacter, ApplyPropertyString<MapAutoToNull, &RenderStyle::hyphenationString, &RenderStyle::setHyphenationString, &RenderStyle::initialHyphenationString>::createHandler());
-
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitAfter, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitAfter, &RenderStyle::setHyphenationLimitAfter, &RenderStyle::initialHyphenationLimitAfter>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitBefore, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitBefore, &RenderStyle::setHyphenationLimitBefore, &RenderStyle::initialHyphenationLimitBefore>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitLines, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitLines, &RenderStyle::setHyphenationLimitLines, &RenderStyle::initialHyphenationLimitLines, CSSValueNoLimit>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitLineAlign, ApplyPropertyDefault<LineAlign, &RenderStyle::lineAlign, LineAlign, &RenderStyle::setLineAlign, LineAlign, &RenderStyle::initialLineAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitLineBreak, ApplyPropertyDefault<EKHTMLLineBreak, &RenderStyle::khtmlLineBreak, EKHTMLLineBreak, &RenderStyle::setKHTMLLineBreak, EKHTMLLineBreak, &RenderStyle::initialKHTMLLineBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineGrid, ApplyPropertyString<MapNoneToNull, &RenderStyle::lineGrid, &RenderStyle::setLineGrid, &RenderStyle::initialLineGrid>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitLineGridSnap, ApplyPropertyDefault<LineGridSnap, &RenderStyle::lineGridSnap, LineGridSnap, &RenderStyle::setLineGridSnap, LineGridSnap, &RenderStyle::initialLineGridSnap>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitLineSnap, ApplyPropertyDefault<LineSnap, &RenderStyle::lineSnap, LineSnap, &RenderStyle::setLineSnap, LineSnap, &RenderStyle::initialLineSnap>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarqueeDirection, ApplyPropertyDefault<EMarqueeDirection, &RenderStyle::marqueeDirection, EMarqueeDirection, &RenderStyle::setMarqueeDirection, EMarqueeDirection, &RenderStyle::initialMarqueeDirection>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarqueeStyle, ApplyPropertyDefault<EMarqueeBehavior, &RenderStyle::marqueeBehavior, EMarqueeBehavior, &RenderStyle::setMarqueeBehavior, EMarqueeBehavior, &RenderStyle::initialMarqueeBehavior>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMatchNearestMailBlockquoteColor, ApplyPropertyDefault<EMatchNearestMailBlockquoteColor, &RenderStyle::matchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::setMatchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::initialMatchNearestMailBlockquoteColor>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitNbspMode, ApplyPropertyDefault<ENBSPMode, &RenderStyle::nbspMode, ENBSPMode, &RenderStyle::setNBSPMode, ENBSPMode, &RenderStyle::initialNBSPMode>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPerspectiveOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitPerspectiveOriginX, CSSPropertyWebkitPerspectiveOriginY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginX, ApplyPropertyLength<&RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX, &RenderStyle::initialPerspectiveOriginX>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginY, ApplyPropertyLength<&RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY, &RenderStyle::initialPerspectiveOriginY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPrintColorAdjust, ApplyPropertyDefault<PrintColorAdjust, &RenderStyle::printColorAdjust, PrintColorAdjust, &RenderStyle::setPrintColorAdjust, PrintColorAdjust, &RenderStyle::initialPrintColorAdjust>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionOverflow, ApplyPropertyDefault<RegionOverflow, &RenderStyle::regionOverflow, RegionOverflow, &RenderStyle::setRegionOverflow, RegionOverflow, &RenderStyle::initialRegionOverflow>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRtlOrdering, ApplyPropertyDefault<Order, &RenderStyle::rtlOrdering, Order, &RenderStyle::setRTLOrdering, Order, &RenderStyle::initialRTLOrdering>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextCombine, ApplyPropertyDefault<TextCombine, &RenderStyle::textCombine, TextCombine, &RenderStyle::setTextCombine, TextCombine, &RenderStyle::initialTextCombine>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisPosition, ApplyPropertyDefault<TextEmphasisPosition, &RenderStyle::textEmphasisPosition, TextEmphasisPosition, &RenderStyle::setTextEmphasisPosition, TextEmphasisPosition, &RenderStyle::initialTextEmphasisPosition>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisStyle, ApplyPropertyTextEmphasisStyle::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitTextSecurity, ApplyPropertyDefault<ETextSecurity, &RenderStyle::textSecurity, ETextSecurity, &RenderStyle::setTextSecurity, ETextSecurity, &RenderStyle::initialTextSecurity>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitTransformOriginX, CSSPropertyWebkitTransformOriginY, CSSPropertyWebkitTransformOriginZ>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOriginX, ApplyPropertyLength<&RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX, &RenderStyle::initialTransformOriginX>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOriginY, ApplyPropertyLength<&RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY, &RenderStyle::initialTransformOriginY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOriginZ, ApplyPropertyComputeLength<float, &RenderStyle::transformOriginZ, &RenderStyle::setTransformOriginZ, &RenderStyle::initialTransformOriginZ>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformStyle, ApplyPropertyDefault<ETransformStyle3D, &RenderStyle::transformStyle3D, ETransformStyle3D, &RenderStyle::setTransformStyle3D, ETransformStyle3D, &RenderStyle::initialTransformStyle3D>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionDuration, ApplyPropertyAnimation<double, &Animation::duration, &Animation::setDuration, &Animation::isDurationSet, &Animation::clearDuration, &Animation::initialAnimationDuration, &CSSStyleSelector::mapAnimationDuration, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionProperty, ApplyPropertyAnimation<int, &Animation::property, &Animation::setProperty, &Animation::isPropertySet, &Animation::clearProperty, &Animation::initialAnimationProperty, &CSSStyleSelector::mapAnimationProperty, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitUserDrag, ApplyPropertyDefault<EUserDrag, &RenderStyle::userDrag, EUserDrag, &RenderStyle::setUserDrag, EUserDrag, &RenderStyle::initialUserDrag>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitUserModify, ApplyPropertyDefault<EUserModify, &RenderStyle::userModify, EUserModify, &RenderStyle::setUserModify, EUserModify, &RenderStyle::initialUserModify>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitUserSelect, ApplyPropertyDefault<EUserSelect, &RenderStyle::userSelect, EUserSelect, &RenderStyle::setUserSelect, EUserSelect, &RenderStyle::initialUserSelect>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitWrap, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitWrapFlow, CSSPropertyWebkitWrapMargin, CSSPropertyWebkitWrapPadding>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitWrapFlow, ApplyPropertyDefault<WrapFlow, &RenderStyle::wrapFlow, WrapFlow, &RenderStyle::setWrapFlow, WrapFlow, &RenderStyle::initialWrapFlow>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapMargin, ApplyPropertyLength<&RenderStyle::wrapMargin, &RenderStyle::setWrapMargin, &RenderStyle::initialWrapMargin>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapPadding, ApplyPropertyLength<&RenderStyle::wrapPadding, &RenderStyle::setWrapPadding, &RenderStyle::initialWrapPadding>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitWrapFlow, ApplyPropertyDefault<WrapFlow, &RenderStyle::wrapFlow, WrapFlow, &RenderStyle::setWrapFlow, WrapFlow, &RenderStyle::initialWrapFlow>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapThrough, ApplyPropertyDefault<WrapThrough, &RenderStyle::wrapThrough, WrapThrough, &RenderStyle::setWrapThrough, WrapThrough, &RenderStyle::initialWrapThrough>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitWrap, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitWrapFlow, CSSPropertyWebkitWrapMargin, CSSPropertyWebkitWrapPadding>::createHandler());
+
+    setPropertyHandler(CSSPropertyWidows, ApplyPropertyDefault<short, &RenderStyle::widows, short, &RenderStyle::setWidows, short, &RenderStyle::initialWidows>::createHandler());
+    setPropertyHandler(CSSPropertyOrphans, ApplyPropertyDefault<short, &RenderStyle::orphans, short, &RenderStyle::setOrphans, short, &RenderStyle::initialOrphans>::createHandler());
 
     setPropertyHandler(CSSPropertyZIndex, ApplyPropertyAuto<int, &RenderStyle::zIndex, &RenderStyle::setZIndex, &RenderStyle::hasAutoZIndex, &RenderStyle::setHasAutoZIndex>::createHandler());
     setPropertyHandler(CSSPropertyZoom, ApplyPropertyZoom::createHandler());
diff --git a/Source/WebCore/css/CSSStyleDeclaration.h b/Source/WebCore/css/CSSStyleDeclaration.h
index e5e7cb957..50bcef25e 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.h
+++ b/Source/WebCore/css/CSSStyleDeclaration.h
@@ -35,11 +35,14 @@ class StyledElement;
 
 typedef int ExceptionCode;
 
-class CSSStyleDeclaration : public RefCounted<CSSStyleDeclaration> {
-    WTF_MAKE_NONCOPYABLE(CSSStyleDeclaration);
+class CSSStyleDeclaration {
+    WTF_MAKE_NONCOPYABLE(CSSStyleDeclaration); WTF_MAKE_FAST_ALLOCATED;
 public:
     virtual ~CSSStyleDeclaration() { }
 
+    virtual void ref() = 0;
+    virtual void deref() = 0;
+
     virtual CSSRule* parentRule() const = 0;
     virtual String cssText() const = 0;
     virtual void setCssText(const String&, ExceptionCode&) = 0;
@@ -64,7 +67,7 @@ public:
 
     virtual bool cssPropertyMatches(const CSSProperty*) const = 0;
     virtual CSSStyleSheet* parentStyleSheet() const { return 0; }
- 
+
 #ifndef NDEBUG
     void showStyle();
 #endif
diff --git a/Source/WebCore/css/CSSStyleDeclaration.idl b/Source/WebCore/css/CSSStyleDeclaration.idl
index 14683d1f1..8be67e4a6 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.idl
+++ b/Source/WebCore/css/CSSStyleDeclaration.idl
@@ -23,33 +23,33 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         JSCustomMarkFunction,
-        JSGenerateIsReachable=ImplRoot,
+        JSGenerateIsReachable,
         CustomNamedSetter,
         NamedGetter,
         IndexedGetter,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         V8DependentLifetime
     ] CSSStyleDeclaration {
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        cssText
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        cssText
                      setter raises(DOMException);
 
-        [ConvertNullStringTo=Null] DOMString          getPropertyValue(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        [JSCustom] CSSValue           getPropertyCSSValue(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        [ConvertNullStringTo=Null] DOMString          removeProperty(in [Optional=CallWithDefaultValue] DOMString propertyName)
+        [TreatReturnedNullStringAs=Null] DOMString          getPropertyValue(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        [JSCustom] CSSValue           getPropertyCSSValue(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        [TreatReturnedNullStringAs=Null] DOMString          removeProperty(in [Optional=DefaultIsUndefined] DOMString propertyName)
             raises(DOMException);
-        [ConvertNullStringTo=Null] DOMString          getPropertyPriority(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        [ObjCLegacyUnnamedParameters] void setProperty(in [Optional=CallWithDefaultValue] DOMString propertyName, 
-                                        in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString value, 
-                                        in [Optional=CallWithDefaultValue] DOMString priority)
+        [TreatReturnedNullStringAs=Null] DOMString          getPropertyPriority(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        [ObjCLegacyUnnamedParameters] void setProperty(in [Optional=DefaultIsUndefined] DOMString propertyName, 
+                                        in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString value, 
+                                        in [Optional=DefaultIsUndefined] DOMString priority)
             raises(DOMException);
 
         readonly attribute unsigned long    length;
-        DOMString          item(in [Optional=CallWithDefaultValue] unsigned long index);
+        DOMString          item(in [Optional=DefaultIsUndefined] unsigned long index);
         readonly attribute CSSRule          parentRule;
 
         // Extensions
-        [ConvertNullStringTo=Null] DOMString          getPropertyShorthand(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        boolean            isPropertyImplicit(in [Optional=CallWithDefaultValue] DOMString propertyName);
+        [TreatReturnedNullStringAs=Null] DOMString          getPropertyShorthand(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        boolean            isPropertyImplicit(in [Optional=DefaultIsUndefined] DOMString propertyName);
     };
 
 }
diff --git a/Source/WebCore/css/CSSStyleRule.cpp b/Source/WebCore/css/CSSStyleRule.cpp
index ae56df9f9..7a1d66fca 100644
--- a/Source/WebCore/css/CSSStyleRule.cpp
+++ b/Source/WebCore/css/CSSStyleRule.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line, CSSRule::Type type)
-    : CSSRule(parent, type)
+CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line)
+    : CSSRule(parent, CSSRule::STYLE_RULE)
 {
     setSourceLine(line);
 
@@ -47,7 +47,7 @@ CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line, CSSRule::Type type)
 CSSStyleRule::~CSSStyleRule()
 {
     if (m_style)
-        m_style->clearParentRule();
+        m_style->clearParentRule(this);
     cleanup();
 }
 
@@ -68,17 +68,13 @@ inline void CSSStyleRule::cleanup()
 
 String CSSStyleRule::generateSelectorText() const
 {
-    if (isPageRule())
-        return static_cast<const CSSPageRule*>(this)->pageSelectorText();
-    else {
-        StringBuilder builder;
-        for (CSSSelector* s = selectorList().first(); s; s = CSSSelectorList::next(s)) {
-            if (s != selectorList().first())
-                builder.append(", ");
-            builder.append(s->selectorText());
-        }
-        return builder.toString();
+    StringBuilder builder;
+    for (CSSSelector* s = selectorList().first(); s; s = CSSSelectorList::next(s)) {
+        if (s != selectorList().first())
+            builder.append(", ");
+        builder.append(s->selectorText());
     }
+    return builder.toString();
 }
 
 String CSSStyleRule::selectorText() const
@@ -137,7 +133,7 @@ String CSSStyleRule::cssText() const
 void CSSStyleRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
 {
     if (m_style)
-        m_style->addSubresourceStyleURLs(urls);
+        m_style->addSubresourceStyleURLs(urls, parentStyleSheet());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleRule.h b/Source/WebCore/css/CSSStyleRule.h
index 7fd12a162..f70b9b231 100644
--- a/Source/WebCore/css/CSSStyleRule.h
+++ b/Source/WebCore/css/CSSStyleRule.h
@@ -43,12 +43,12 @@ public:
     String selectorText() const;
     void setSelectorText(const String&);
 
-    CSSStyleDeclaration* style() const { return m_style->ensureCSSStyleDeclaration(); }
+    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
 
     String cssText() const;
 
     void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
-    void setDeclaration(PassRefPtr<StylePropertySet> style) { ASSERT(style->parentRuleInternal() == this); m_style = style; }
+    void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
 
     const CSSSelectorList& selectorList() const { return m_selectorList; }
     StylePropertySet* declaration() const { return m_style.get(); }
@@ -57,10 +57,9 @@ public:
 
     using CSSRule::sourceLine;
 
-protected:
-    CSSStyleRule(CSSStyleSheet* parent, int sourceLine, CSSRule::Type = CSSRule::STYLE_RULE);
-
 private:
+    CSSStyleRule(CSSStyleSheet* parent, int sourceLine);
+
     void cleanup();
     String generateSelectorText() const;
 
diff --git a/Source/WebCore/css/CSSStyleRule.idl b/Source/WebCore/css/CSSStyleRule.idl
index c0a5e6822..c57632942 100644
--- a/Source/WebCore/css/CSSStyleRule.idl
+++ b/Source/WebCore/css/CSSStyleRule.idl
@@ -23,7 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface CSSStyleRule : CSSRule {
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString selectorText;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString selectorText;
 
         readonly attribute CSSStyleDeclaration style;
 
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 7d84a81a5..b172c4733 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -54,7 +54,6 @@
 #include "CSSTimingFunctionValue.h"
 #include "CSSValueList.h"
 #include "CursorList.h"
-#include "FontFamilyValue.h"
 #include "FontFeatureValue.h"
 #include "FontValue.h"
 #include "Frame.h"
@@ -88,6 +87,7 @@
 #include "RenderStyleConstants.h"
 #include "RenderTheme.h"
 #include "RotateTransformOperation.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScaleTransformOperation.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -173,7 +173,7 @@ if (primitiveValue) \
 
 class RuleData {
 public:
-    RuleData(CSSStyleRule*, CSSSelector*, unsigned position);
+    RuleData(CSSStyleRule*, CSSSelector*, unsigned position, bool canUseFastCheckSelector = true);
 
     unsigned position() const { return m_position; }
     CSSStyleRule* rule() const { return m_rule; }
@@ -225,8 +225,8 @@ public:
 
     void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0, const Element* = 0);
 
-    void addStyleRule(CSSStyleRule*);
-    void addRule(CSSStyleRule*, CSSSelector*);
+    void addStyleRule(CSSStyleRule*, bool canUseFastCheckSelector = true);
+    void addRule(CSSStyleRule*, CSSSelector*, bool canUseFastCheckSelector = true);
     void addPageRule(CSSPageRule*);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap&, const RuleData&);
     void addRegionRule(WebKitCSSRegionRule*);
@@ -242,7 +242,7 @@ public:
     const Vector<RuleData>* linkPseudoClassRules() const { return &m_linkPseudoClassRules; }
     const Vector<RuleData>* focusPseudoClassRules() const { return &m_focusPseudoClassRules; }
     const Vector<RuleData>* universalRules() const { return &m_universalRules; }
-    const Vector<RuleData>* pageRules() const { return &m_pageRules; }
+    const Vector<CSSPageRule*>& pageRules() const { return m_pageRules; }
 
 public:
     AtomRuleMap m_idRules;
@@ -252,7 +252,7 @@ public:
     Vector<RuleData> m_linkPseudoClassRules;
     Vector<RuleData> m_focusPseudoClassRules;
     Vector<RuleData> m_universalRules;
-    Vector<RuleData> m_pageRules;
+    Vector<CSSPageRule*> m_pageRules;
     unsigned m_ruleCount;
     bool m_autoShrinkToFitEnabled;
     CSSStyleSelector::Features m_features;
@@ -318,7 +318,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
                                    bool strictParsing, bool matchAuthorAndUserStyles)
     : m_hasUAAppearance(false)
     , m_backgroundData(BackgroundFillLayer)
-    , m_matchedDeclarationCacheAdditionsSinceLastSweep(0)
+    , m_matchedPropertiesCacheAdditionsSinceLastSweep(0)
     , m_checker(document, strictParsing)
     , m_parentStyle(0)
     , m_rootElementStyle(0)
@@ -443,10 +443,13 @@ void CSSStyleSelector::collectFeatures()
 }
 
 #if ENABLE(STYLE_SCOPED)
-Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sheet)
+const Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sheet)
 {
     ASSERT(sheet);
 
+    if (!RuntimeEnabledFeatures::styleScopedEnabled())
+        return 0;
+
     Node* ownerNode = sheet->findStyleSheetOwnerNode();
     if (!ownerNode || !ownerNode->isHTMLElement() || !ownerNode->hasTagName(HTMLNames::styleTag))
         return 0;
@@ -572,25 +575,25 @@ CSSStyleSelector::~CSSStyleSelector()
     m_fontSelector->clearDocument();
 }
 
-void CSSStyleSelector::sweepMatchedDeclarationCache()
+void CSSStyleSelector::sweepMatchedPropertiesCache()
 {
     // Look for cache entries containing a style declaration with a single ref and remove them.
     // This may happen when an element attribute mutation causes it to swap out its Attribute::decl()
     // for another CSSMappedAttributeDeclaration, potentially leaving this cache with the last ref.
     Vector<unsigned, 16> toRemove;
-    MatchedStyleDeclarationCache::iterator it = m_matchedStyleDeclarationCache.begin();
-    MatchedStyleDeclarationCache::iterator end = m_matchedStyleDeclarationCache.end();
+    MatchedPropertiesCache::iterator it = m_matchedPropertiesCache.begin();
+    MatchedPropertiesCache::iterator end = m_matchedPropertiesCache.end();
     for (; it != end; ++it) {
-        Vector<MatchedStyleDeclaration>& matchedStyleDeclarations = it->second.matchedStyleDeclarations;
-        for (size_t i = 0; i < matchedStyleDeclarations.size(); ++i) {
-            if (matchedStyleDeclarations[i].styleDeclaration->hasOneRef()) {
+        Vector<MatchedProperties>& matchedProperties = it->second.matchedProperties;
+        for (size_t i = 0; i < matchedProperties.size(); ++i) {
+            if (matchedProperties[i].properties->hasOneRef()) {
                 toRemove.append(it->first);
                 break;
             }
         }
     }
     for (size_t i = 0; i < toRemove.size(); ++i)
-        m_matchedStyleDeclarationCache.remove(toRemove[i]);
+        m_matchedPropertiesCache.remove(toRemove[i]);
 }
 
 CSSStyleSelector::Features::Features()
@@ -747,15 +750,16 @@ static void ensureDefaultStyleSheetsForElement(Element* element)
     ASSERT_UNUSED(loadedMathMLUserAgentSheet, loadedMathMLUserAgentSheet || defaultStyle->features().siblingRules.isEmpty());
 }
 
-void CSSStyleSelector::addMatchedDeclaration(StylePropertySet* styleDeclaration, unsigned linkMatchType)
+void CSSStyleSelector::addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule, unsigned linkMatchType)
 {
-    m_matchedDecls.grow(m_matchedDecls.size() + 1);
-    MatchedStyleDeclaration& newDeclaration = m_matchedDecls.last();
-    newDeclaration.styleDeclaration = styleDeclaration;
-    newDeclaration.linkMatchType = linkMatchType;
+    matchResult.matchedProperties.grow(matchResult.matchedProperties.size() + 1);
+    MatchedProperties& newProperties = matchResult.matchedProperties.last();
+    newProperties.properties = properties;
+    newProperties.linkMatchType = linkMatchType;
+    matchResult.matchedRules.append(rule);
 }
 
-void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     ASSERT(rules);
     ASSERT(m_element);
@@ -763,28 +767,28 @@ void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex,
     // We need to collect the rules for id, class, tag, and everything else into a buffer and
     // then sort the buffer.
     if (m_element->hasID())
-        collectMatchingRulesForList(rules->idRules(m_element->idForStyleResolution().impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->idRules(m_element->idForStyleResolution().impl()), firstRuleIndex, lastRuleIndex, options);
     if (m_element->hasClass()) {
         ASSERT(m_styledElement);
         const SpaceSplitString& classNames = m_styledElement->classNames();
         size_t size = classNames.size();
         for (size_t i = 0; i < size; ++i)
-            collectMatchingRulesForList(rules->classRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+            collectMatchingRulesForList(rules->classRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex, options);
     }
     const AtomicString& pseudoId = m_element->shadowPseudoId();
     if (!pseudoId.isEmpty()) {
         ASSERT(m_styledElement);
-        collectMatchingRulesForList(rules->shadowPseudoElementRules(pseudoId.impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->shadowPseudoElementRules(pseudoId.impl()), firstRuleIndex, lastRuleIndex, options);
     }
     if (m_element->isLink())
-        collectMatchingRulesForList(rules->linkPseudoClassRules(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->linkPseudoClassRules(), firstRuleIndex, lastRuleIndex, options);
     if (m_checker.matchesFocusPseudoClass(m_element))
-        collectMatchingRulesForList(rules->focusPseudoClassRules(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForList(rules->tagRules(m_element->localName().impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForList(rules->universalRules(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->focusPseudoClassRules(), firstRuleIndex, lastRuleIndex, options);
+    collectMatchingRulesForList(rules->tagRules(m_element->localName().impl()), firstRuleIndex, lastRuleIndex, options);
+    collectMatchingRulesForList(rules->universalRules(), firstRuleIndex, lastRuleIndex, options);
 }
 
-void CSSStyleSelector::collectMatchingRulesForRegion(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::collectMatchingRulesForRegion(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     if (!m_regionForStyling)
         return;
@@ -795,12 +799,12 @@ void CSSStyleSelector::collectMatchingRulesForRegion(RuleSet* rules, int& firstR
         if (checkRegionSelector(regionSelector, static_cast<Element*>(m_regionForStyling->node()))) {
             RuleSet* regionRules = rules->m_regionSelectorsAndRuleSets.at(i).ruleSet.get();
             ASSERT(regionRules);
-            collectMatchingRules(regionRules, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+            collectMatchingRules(regionRules, firstRuleIndex, lastRuleIndex, options);
         }
     }
 }
 
-void CSSStyleSelector::sortAndTransferMatchedRules()
+void CSSStyleSelector::sortAndTransferMatchedRules(MatchResult& result)
 {
     if (m_matchedRules.isEmpty())
         return;
@@ -824,64 +828,81 @@ void CSSStyleSelector::sortAndTransferMatchedRules()
         unsigned linkMatchType = m_matchedRules[i]->linkMatchType();
         if (swapVisitedUnvisited && linkMatchType && linkMatchType != SelectorChecker::MatchAll)
             linkMatchType = (linkMatchType == SelectorChecker::MatchVisited) ? SelectorChecker::MatchLink : SelectorChecker::MatchVisited;
-        addMatchedDeclaration(m_matchedRules[i]->rule()->declaration(), linkMatchType);
+        addMatchedProperties(result, m_matchedRules[i]->rule()->declaration(), m_matchedRules[i]->rule(), linkMatchType);
     }
 }
 
-void CSSStyleSelector::matchScopedAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::matchScopedAuthorRules(MatchResult& result, bool includeEmptyRules)
 {
 #if ENABLE(STYLE_SCOPED)
     if (m_scopedAuthorStyles.isEmpty())
         return;
 
+    MatchOptions options(includeEmptyRules);
+
     // Match scoped author rules by traversing the scoped element stack (rebuild it if it got inconsistent).
     const Element* parent = m_element->parentOrHostElement();
     if (!scopingElementStackIsConsistent(parent))
         setupScopingElementStack(parent);
     for (size_t i = m_scopingElementStack.size(); i; --i) {
-        collectMatchingRules(m_scopingElementStack[i - 1].m_ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
-        collectMatchingRulesForRegion(m_scopingElementStack[i - 1].m_ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        const ScopeStackFrame& frame = m_scopingElementStack[i - 1];
+        options.scope = frame.m_element;
+        collectMatchingRules(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+        collectMatchingRulesForRegion(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
     }
     // Also include the current element.
     RuleSet* ruleSet = scopedRuleSetForElement(m_element);
     if (ruleSet) {
-        collectMatchingRules(ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
-        collectMatchingRulesForRegion(ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        options.scope = m_element;
+        collectMatchingRules(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+        collectMatchingRulesForRegion(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
     }
 #else
-    UNUSED_PARAM(firstRuleIndex);
-    UNUSED_PARAM(lastRuleIndex);
+    UNUSED_PARAM(result);
     UNUSED_PARAM(includeEmptyRules);
 #endif
 }
 
-void CSSStyleSelector::matchAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::matchAuthorRules(MatchResult& result, bool includeEmptyRules)
 {
     m_matchedRules.clear();
+    result.ranges.lastAuthorRule = result.matchedProperties.size() - 1;
 
     if (!m_element)
         return;
 
     // Match global author rules.
-    collectMatchingRules(m_authorStyle.get(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForRegion(m_authorStyle.get(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+    MatchOptions options(includeEmptyRules);
+    collectMatchingRules(m_authorStyle.get(), result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+    collectMatchingRulesForRegion(m_authorStyle.get(), result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
 
-    matchScopedAuthorRules(firstRuleIndex, lastRuleIndex, includeEmptyRules);
+    matchScopedAuthorRules(result, includeEmptyRules);
 
-    sortAndTransferMatchedRules();
+    sortAndTransferMatchedRules(result);
 }
 
-void CSSStyleSelector::matchRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::matchUserRules(MatchResult& result, bool includeEmptyRules)
 {
+    if (!m_userStyle)
+        return;
+    
     m_matchedRules.clear();
 
-    if (!rules || !m_element)
-        return;
+    result.ranges.lastUserRule = result.matchedProperties.size() - 1;
+    collectMatchingRules(m_userStyle.get(), result.ranges.firstUserRule, result.ranges.lastUserRule, includeEmptyRules);
+    collectMatchingRulesForRegion(m_userStyle.get(), result.ranges.firstUserRule, result.ranges.lastUserRule, includeEmptyRules);
 
-    collectMatchingRules(rules, firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForRegion(rules, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+    sortAndTransferMatchedRules(result);
+}
 
-    sortAndTransferMatchedRules();
+void CSSStyleSelector::matchUARules(MatchResult& result, RuleSet* rules)
+{
+    m_matchedRules.clear();
+    
+    result.ranges.lastUARule = result.matchedProperties.size() - 1;
+    collectMatchingRules(rules, result.ranges.firstUARule, result.ranges.lastUARule, false);
+
+    sortAndTransferMatchedRules(result);
 }
 
 class MatchingUARulesScope {
@@ -913,12 +934,7 @@ inline bool MatchingUARulesScope::isMatchingUARules()
 
 bool MatchingUARulesScope::m_matchingUARules = false;
 
-inline static bool matchesInTreeScope(TreeScope* treeScope, bool ruleReachesIntoShadowDOM)
-{
-    return MatchingUARulesScope::isMatchingUARules() || treeScope->applyAuthorSheets() || ruleReachesIntoShadowDOM;
-}
-
-void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     if (!rules)
         return;
@@ -934,14 +950,30 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
 
         CSSStyleRule* rule = ruleData.rule();
         InspectorInstrumentationCookie cookie = InspectorInstrumentation::willMatchRule(document(), rule);
+#if ENABLE(STYLE_SCOPED)
+        if (checkSelector(ruleData, options.scope)) {
+#else
         if (checkSelector(ruleData)) {
-            if (!matchesInTreeScope(m_element->treeScope(), m_checker.hasUnknownPseudoElements())) {
+#endif
+            // Check whether the rule is applicable in the current tree scope. Criteria for this:
+            // a) it's a UA rule
+            // b) the tree scope allows author rules
+            // c) the rules comes from a scoped style sheet within the same tree scope
+            // d) the rule contains shadow-ID pseudo elements
+            TreeScope* treeScope = m_element->treeScope();
+            if (!MatchingUARulesScope::isMatchingUARules()
+                && !treeScope->applyAuthorSheets()
+#if ENABLE(STYLE_SCOPED)
+                && (!options.scope || options.scope->treeScope() != treeScope)
+#endif
+                && !m_checker.hasUnknownPseudoElements()) {
+
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
             // If the rule has no properties to apply, then ignore it in the non-debug mode.
             StylePropertySet* decl = rule->declaration();
-            if (!decl || (decl->isEmpty() && !includeEmptyRules)) {
+            if (!decl || (decl->isEmpty() && !options.includeEmptyRules)) {
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
@@ -960,7 +992,7 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
                     m_style->setHasPseudoStyle(m_dynamicPseudo);
             } else {
                 // Update our first/last rule indices in the matched rules array.
-                lastRuleIndex = m_matchedDecls.size() + m_matchedRules.size();
+                ++lastRuleIndex;
                 if (firstRuleIndex == -1)
                     firstRuleIndex = lastRuleIndex;
 
@@ -992,18 +1024,15 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
 
     // Now we check user sheet rules.
     if (m_matchAuthorAndUserStyles)
-        matchRules(m_userStyle.get(), result.ranges.firstUserRule, result.ranges.lastUserRule, false);
+        matchUserRules(result, false);
         
     // Now check author rules, beginning first with presentational attributes mapped from HTML.
     if (m_styledElement) {
         if (StylePropertySet* attributeStyle = m_styledElement->attributeStyle()) {
-            if (!attributeStyle->isEmpty()) {
-                result.ranges.lastAuthorRule = m_matchedRules.size();
-                if (result.ranges.firstAuthorRule == -1)
-                    result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-                addMatchedDeclaration(attributeStyle);
-                result.isCacheable = false;
-            }
+            result.ranges.lastAuthorRule = m_matchedRules.size();
+            if (result.ranges.firstAuthorRule == -1)
+                result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
+            addMatchedProperties(result, attributeStyle);
         }
 
         // Now we check additional mapped declarations.
@@ -1011,9 +1040,9 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
         // after all attributes, since their mapped style depends on the values of multiple attributes.
         if (StylePropertySet* additionalStyle = m_styledElement->additionalAttributeStyle()) {
             if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = m_matchedDecls.size();
-            result.ranges.lastAuthorRule = m_matchedDecls.size();
-            addMatchedDeclaration(additionalStyle);
+                result.ranges.firstAuthorRule = result.matchedProperties.size();
+            result.ranges.lastAuthorRule = result.ranges.firstAuthorRule;
+            addMatchedProperties(result, additionalStyle);
             result.isCacheable = false;
         }
 
@@ -1021,27 +1050,27 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
             bool isAuto;
             TextDirection textDirection = toHTMLElement(m_styledElement)->directionalityIfhasDirAutoAttribute(isAuto);
             if (isAuto)
-                addMatchedDeclaration(textDirection == LTR ? leftToRightDeclaration() : rightToLeftDeclaration());
+                addMatchedProperties(result, textDirection == LTR ? leftToRightDeclaration() : rightToLeftDeclaration());
         }
     }
     
     // Check the rules in author sheets next.
     if (m_matchAuthorAndUserStyles)
-        matchAuthorRules(result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, false);
+        matchAuthorRules(result, false);
 
     // Now check our inline style attribute.
     if (m_matchAuthorAndUserStyles && m_styledElement) {
         StylePropertySet* inlineDecl = m_styledElement->inlineStyleDecl();
         if (inlineDecl) {
-            result.ranges.lastAuthorRule = m_matchedDecls.size();
+            result.ranges.lastAuthorRule = result.matchedProperties.size();
             if (result.ranges.firstAuthorRule == -1)
                 result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-            addMatchedDeclaration(inlineDecl);
+            addMatchedProperties(result, inlineDecl);
             result.isCacheable = false;
         }
     }
 }
-    
+
 inline void CSSStyleSelector::initElement(Element* e)
 {
     if (m_element != e) {
@@ -1072,8 +1101,6 @@ inline void CSSStyleSelector::initForStyleResolve(Element* e, RenderStyle* paren
 
     m_style = 0;
 
-    m_matchedDecls.clear();
-
     m_pendingImageProperties.clear();
 
     m_ruleList = 0;
@@ -1129,11 +1156,16 @@ Node* CSSStyleSelector::locateCousinList(Element* parent, unsigned& visitedNodeC
 
 bool CSSStyleSelector::matchesRuleSet(RuleSet* ruleSet)
 {
-    int firstSiblingRule = -1, lastSiblingRule = -1;
-    matchRules(ruleSet, firstSiblingRule, lastSiblingRule, false);
-    if (m_matchedDecls.isEmpty())
+    if (!ruleSet)
+        return false;
+    m_matchedRules.clear();
+
+    int firstRuleIndex = -1, lastRuleIndex = -1;
+    collectMatchingRules(ruleSet, firstRuleIndex, lastRuleIndex, false);
+
+    if (m_matchedRules.isEmpty())
         return false;
-    m_matchedDecls.clear();
+    m_matchedRules.clear();
     return true;
 }
 
@@ -1190,6 +1222,13 @@ bool CSSStyleSelector::canShareStyleWithControl(StyledElement* element) const
             return false;
     }
 
+    if (element->fastGetAttribute(typeAttr) != m_element->fastGetAttribute(typeAttr))
+        return false;
+
+    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
+        return false;
+
+
     return true;
 }
 
@@ -1235,10 +1274,6 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (!!element->attributeStyle() != !!m_styledElement->attributeStyle())
         return false;
-    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
-    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
-    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
-        return false;
     if (element->isLink() != m_element->isLink())
         return false;
     if (style->affectedByUncommonAttributeSelectors())
@@ -1249,40 +1284,19 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element->focused() != m_element->focused())
         return false;
-    if (element->shadowPseudoId() != m_element->shadowPseudoId())
-        return false;
     if (element == element->document()->cssTarget())
         return false;
     if (m_element == m_element->document()->cssTarget())
         return false;
-    if (element->getAttribute(typeAttr) != m_element->getAttribute(typeAttr))
-        return false;
-    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
-        return false;
-    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
+    if (style->transitions() || style->animations())
         return false;
-    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
+    if (element->isLink() && m_elementLinkState != style->insideLink())
         return false;
-    if (element->fastGetAttribute(cellpaddingAttr) != m_element->fastGetAttribute(cellpaddingAttr))
+    if (element->shadowPseudoId() != m_element->shadowPseudoId())
         return false;
-
     if (element->hasID() && m_features.idsInRules.contains(element->idForStyleResolution().impl()))
         return false;
-
-#if ENABLE(STYLE_SCOPED)
-    if (element->hasScopedHTMLStyleChild())
-        return false;
-#endif
-
-    bool isControl = element->isFormControlElement();
-
-    if (isControl != m_element->isFormControlElement())
-        return false;
-
-    if (isControl && !canShareStyleWithControl(element))
-        return false;
-
-    if (style->transitions() || style->animations())
+    if (m_element->isFormControlElement() && !canShareStyleWithControl(element))
         return false;
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1303,14 +1317,26 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
     if (element->hasClass() && m_element->getAttribute(classAttr) != element->getAttribute(classAttr))
         return false;
 
+    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
+    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
+    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
+        return false;
+
+    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
+        return false;
+    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
+        return false;
+
     if (element->attributeStyle() && !attributeStylesEqual(element->attributeStyle(), m_styledElement->attributeStyle()))
         return false;
 
     if (additionalAttributeStyleA && !attributeStylesEqual(additionalAttributeStyleA, additionalAttributeStyleB))
         return false;
 
-    if (element->isLink() && m_elementLinkState != style->insideLink())
+#if ENABLE(STYLE_SCOPED)
+    if (element->hasScopedHTMLStyleChild())
         return false;
+#endif
 
     return true;
 }
@@ -1390,17 +1416,17 @@ void CSSStyleSelector::matchUARules(MatchResult& result)
         result.isCacheable = false;
     RuleSet* userAgentStyleSheet = m_medium->mediaTypeMatchSpecific("print")
         ? defaultPrintStyle : defaultStyle;
-    matchRules(userAgentStyleSheet, result.ranges.firstUARule, result.ranges.lastUARule, false);
+    matchUARules(result, userAgentStyleSheet);
 
     // In quirks mode, we match rules from the quirks user agent sheet.
     if (!m_checker.strictParsing())
-        matchRules(defaultQuirksStyle, result.ranges.firstUARule, result.ranges.lastUARule, false);
+        matchUARules(result, defaultQuirksStyle);
 
     // If document uses view source styles (in view source mode or in xml viewer mode), then we match rules from the view source style sheet.
     if (m_checker.document()->isViewSource()) {
         if (!defaultViewSourceStyle)
             loadViewSourceStyle();
-        matchRules(defaultViewSourceStyle, result.ranges.firstUARule, result.ranges.lastUARule, false);
+        matchUARules(result, defaultViewSourceStyle);
     }
 }
 
@@ -1528,7 +1554,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* element, Rend
     else
         matchAllRules(matchResult);
 
-    applyMatchedDeclarations(matchResult);
+    applyMatchedProperties(matchResult);
 
     // Clean up our style object's display and text decorations (among other fixups).
     adjustRenderStyle(style(), m_parentStyle, element);
@@ -1541,8 +1567,9 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* element, Rend
 
 PassRefPtr<RenderStyle> CSSStyleSelector::styleForKeyframe(const RenderStyle* elementStyle, const WebKitCSSKeyframeRule* keyframeRule, KeyframeValue& keyframe)
 {
+    MatchResult result;
     if (keyframeRule->declaration())
-        addMatchedDeclaration(keyframeRule->declaration());
+        addMatchedProperties(result, keyframeRule->declaration());
 
     ASSERT(!m_style);
 
@@ -1555,7 +1582,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForKeyframe(const RenderStyle* el
     // decl, there's nothing to override. So just add the first properties.
     bool inheritedOnly = false;
     if (keyframeRule->style())
-        applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+        applyMatchedProperties<true>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied, go ahead and update it now.
     updateFont();
@@ -1566,7 +1593,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForKeyframe(const RenderStyle* el
 
     // Now do rest of the properties.
     if (keyframeRule->style())
-        applyDeclarations<false>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+        applyMatchedProperties<false>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied by one of the non-essential font props,
     // go ahead and update it a second time.
@@ -1672,16 +1699,16 @@ PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(PseudoId pseudo,
     matchUARules(matchResult);
 
     if (m_matchAuthorAndUserStyles) {
-        matchRules(m_userStyle.get(), matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, false);
-        matchAuthorRules(matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, false);
+        matchUserRules(matchResult, false);
+        matchAuthorRules(matchResult, false);
     }
 
-    if (m_matchedDecls.isEmpty())
+    if (matchResult.matchedProperties.isEmpty())
         return 0;
 
     m_style->setStyleType(pseudo);
 
-    applyMatchedDeclarations(matchResult);
+    applyMatchedProperties(matchResult);
 
     // Clean up our style object's display and text decorations (among other fixups).
     adjustRenderStyle(style(), parentStyle, 0);
@@ -1708,13 +1735,15 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForPage(int pageIndex)
     const bool isLeft = isLeftPage(pageIndex);
     const bool isFirst = isFirstPage(pageIndex);
     const String page = pageName(pageIndex);
-    matchPageRules(defaultPrintStyle, isLeft, isFirst, page);
-    matchPageRules(m_userStyle.get(), isLeft, isFirst, page);
+    
+    MatchResult result;
+    matchPageRules(result, defaultPrintStyle, isLeft, isFirst, page);
+    matchPageRules(result, m_userStyle.get(), isLeft, isFirst, page);
     // Only consider the global author RuleSet for @page rules, as per the HTML5 spec.
-    matchPageRules(m_authorStyle.get(), isLeft, isFirst, page);
+    matchPageRules(result, m_authorStyle.get(), isLeft, isFirst, page);
     m_lineHeightValue = 0;
     bool inheritedOnly = false;
-    applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+    applyMatchedProperties<true>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied, go ahead and update it now.
     updateFont();
@@ -1723,7 +1752,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForPage(int pageIndex)
     if (m_lineHeightValue)
         applyProperty(CSSPropertyLineHeight, m_lineHeightValue);
 
-    applyDeclarations<false>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+    applyMatchedProperties<false>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // Start loading images referenced by this style.
     loadPendingImages();
@@ -1896,7 +1925,12 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
     // cases where objects that should be blended as a single unit end up with a non-transparent
     // object wedged in between them.  Auto z-index also becomes 0 for objects that specify transforms/masks/reflections.
     if (style->hasAutoZIndex() && ((e && e->document()->documentElement() == e) || style->opacity() < 1.0f
-        || style->hasTransformRelatedProperty() || style->hasMask() || style->boxReflect() || style->hasFilter()))
+        || style->hasTransformRelatedProperty() || style->hasMask() || style->boxReflect() || style->hasFilter()
+#if ENABLE(OVERFLOW_SCROLLING)
+        // Touch overflow scrolling creates a stacking context.
+        || style->useTouchOverflowScrolling()
+#endif
+        ))
         style->setZIndex(0);
 
     // Textarea considers overflow visible as auto.
@@ -2052,14 +2086,14 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element* e,
 
         // Now we check user sheet rules.
         if (m_matchAuthorAndUserStyles)
-            matchRules(m_userStyle.get(), dummy.ranges.firstUserRule, dummy.ranges.lastUserRule, rulesToInclude & EmptyCSSRules);
+            matchUserRules(dummy, rulesToInclude & EmptyCSSRules);
     }
 
     if (m_matchAuthorAndUserStyles && (rulesToInclude & AuthorCSSRules)) {
         m_sameOriginOnly = !(rulesToInclude & CrossOriginCSSRules);
 
         // Check the rules in author sheets.
-        matchAuthorRules(dummy.ranges.firstAuthorRule, dummy.ranges.lastAuthorRule, rulesToInclude & EmptyCSSRules);
+        matchAuthorRules(dummy, rulesToInclude & EmptyCSSRules);
 
         m_sameOriginOnly = false;
     }
@@ -2069,7 +2103,7 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element* e,
     return m_ruleList.release();
 }
 
-inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData)
+inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData, const Element* scope)
 {
     m_dynamicPseudo = NOPSEUDO;
     m_checker.clearHasUnknownPseudoElements();
@@ -2092,7 +2126,10 @@ inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData)
     }
 
     // Slow path.
-    SelectorChecker::SelectorCheckingContext context(ruleData.selector(), m_element, SelectorChecker::VisitedMatchEnabled, style(), m_parentNode ? m_parentNode->renderStyle() : 0);
+    SelectorChecker::SelectorCheckingContext context(ruleData.selector(), m_element, SelectorChecker::VisitedMatchEnabled);
+    context.elementStyle = style();
+    context.elementParentStyle = m_parentNode ? m_parentNode->renderStyle() : 0;
+    context.scope = scope;
     SelectorChecker::SelectorMatch match = m_checker.checkSelector(context, m_dynamicPseudo);
     if (match != SelectorChecker::SelectorMatches)
         return false;
@@ -2173,7 +2210,7 @@ static inline bool selectorListContainsUncommonAttributeSelector(const CSSSelect
 
 static inline bool isCommonAttributeSelectorAttribute(const QualifiedName& attribute)
 {
-    // These are explicitly tested for equality in canShareStyleWithElement.
+    // These are explicitly tested for equality in canShareStyleWithControl.
     return attribute == typeAttr || attribute == readonlyAttr;
 }
 
@@ -2199,12 +2236,12 @@ static inline bool containsUncommonAttributeSelector(const CSSSelector* selector
     return false;
 }
 
-RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position)
+RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position, bool canUseFastCheckSelector)
     : m_rule(rule)
     , m_selector(selector)
     , m_specificity(selector->specificity())
     , m_position(position)
-    , m_hasFastCheckableSelector(SelectorChecker::isFastCheckableSelector(selector))
+    , m_hasFastCheckableSelector(canUseFastCheckSelector && SelectorChecker::isFastCheckableSelector(selector))
     , m_hasMultipartSelector(!!selector->tagHistory())
     , m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector))
     , m_containsUncommonAttributeSelector(WebCore::containsUncommonAttributeSelector(selector))
@@ -2273,9 +2310,9 @@ void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map, const RuleDa
     rules->append(ruleData);
 }
 
-void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector)
+void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector, bool canUseFastCheckSelector)
 {
-    RuleData ruleData(rule, selector, m_ruleCount++);
+    RuleData ruleData(rule, selector, m_ruleCount++, canUseFastCheckSelector);
     collectFeaturesFromRuleData(m_features, ruleData);
 
     if (selector->m_match == CSSSelector::Id) {
@@ -2315,7 +2352,7 @@ void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector)
 
 void RuleSet::addPageRule(CSSPageRule* rule)
 {
-    m_pageRules.append(RuleData(rule, rule->selectorList().first(), m_pageRules.size()));
+    m_pageRules.append(rule);
 }
 
 void RuleSet::addRegionRule(WebKitCSSRegionRule* rule)
@@ -2352,7 +2389,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
     for (int i = 0; i < len; i++) {
         CSSRule* rule = sheet->item(i);
         if (rule->isStyleRule())
-            addStyleRule(static_cast<CSSStyleRule*>(rule));
+            addStyleRule(static_cast<CSSStyleRule*>(rule), !scope);
         else if (rule->isPageRule())
             addPageRule(static_cast<CSSPageRule*>(rule));
         else if (rule->isImportRule()) {
@@ -2369,7 +2406,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                 for (unsigned j = 0; j < rules->length(); j++) {
                     CSSRule *childItem = rules->item(j);
                     if (childItem->isStyleRule())
-                        addStyleRule(static_cast<CSSStyleRule*>(childItem));
+                        addStyleRule(static_cast<CSSStyleRule*>(childItem), !scope);
                     else if (childItem->isPageRule())
                         addPageRule(static_cast<CSSPageRule*>(childItem));
                     else if (childItem->isFontFaceRule() && styleSelector) {
@@ -2379,7 +2416,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                             continue;
                         const CSSFontFaceRule* fontFaceRule = static_cast<CSSFontFaceRule*>(childItem);
                         styleSelector->fontSelector()->addFontFaceRule(fontFaceRule);
-                        styleSelector->invalidateMatchedDeclarationCache();
+                        styleSelector->invalidateMatchedPropertiesCache();
                     } else if (childItem->isKeyframesRule() && styleSelector) {
                         // Add this keyframe rule to our set.
                         // FIXME(BUG 72462): We don't add @keyframe rules of scoped style sheets for the moment.
@@ -2396,7 +2433,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                 continue;
             const CSSFontFaceRule* fontFaceRule = static_cast<CSSFontFaceRule*>(rule);
             styleSelector->fontSelector()->addFontFaceRule(fontFaceRule);
-            styleSelector->invalidateMatchedDeclarationCache();
+            styleSelector->invalidateMatchedPropertiesCache();
         } else if (rule->isKeyframesRule()) {
             // FIXME (BUG 72462): We don't add @keyframe rules of scoped style sheets for the moment.
             if (scope)
@@ -2413,10 +2450,10 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
         shrinkToFit();
 }
 
-void RuleSet::addStyleRule(CSSStyleRule* rule)
+void RuleSet::addStyleRule(CSSStyleRule* rule, bool canUseFastCheckSelector)
 {
     for (CSSSelector* s = rule->selectorList().first(); s; s = CSSSelectorList::next(s))
-        addRule(rule, s);
+        addRule(rule, s, canUseFastCheckSelector);
 }
 
 static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
@@ -2479,28 +2516,26 @@ static Length convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyl
     return convertToLength(primitiveValue, style, rootStyle, true, multiplier, ok);
 }
 
-static inline bool isInsideRegionRule(StylePropertySet* styleDeclaration)
+static inline bool isInsideRegionRule(CSSRule* rule)
 {
-    ASSERT(styleDeclaration);
-
-    CSSRule* parentRule = styleDeclaration->parentRuleInternal();
-    while (parentRule) {
-        if (parentRule->isRegionRule())
+    // FIXME: Cache this bit somewhere.
+    while (rule) {
+        if (rule->isRegionRule())
             return true;
-        parentRule = parentRule->parentRule();
+        rule = rule->parentRule();
     }
     return false;
 }
 
 template <bool applyFirst>
-void CSSStyleSelector::applyDeclaration(StylePropertySet* styleDeclaration, bool isImportant, bool inheritedOnly)
+void CSSStyleSelector::applyProperties(const StylePropertySet* properties, CSSStyleRule* rule, bool isImportant, bool inheritedOnly)
 {
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willProcessRule(document(), styleDeclaration->parentRuleInternal());
-    bool styleDeclarationInsideRegionRule = m_regionForStyling ? isInsideRegionRule(styleDeclaration) : false;
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willProcessRule(document(), rule);
+    bool styleDeclarationInsideRegionRule = m_regionForStyling && isInsideRegionRule(rule);
 
-    unsigned propertyCount = styleDeclaration->propertyCount();
+    unsigned propertyCount = properties->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
-        const CSSProperty& current = styleDeclaration->propertyAt(i);
+        const CSSProperty& current = properties->propertyAt(i);
         if (isImportant != current.isImportant())
             continue;
         if (inheritedOnly && !current.isInherited()) {
@@ -2538,32 +2573,32 @@ void CSSStyleSelector::applyDeclaration(StylePropertySet* styleDeclaration, bool
 }
 
 template <bool applyFirst>
-void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int endIndex, bool inheritedOnly)
+void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult, bool isImportant, int startIndex, int endIndex, bool inheritedOnly)
 {
     if (startIndex == -1)
         return;
 
     if (m_style->insideLink() != NotInsideLink) {
         for (int i = startIndex; i <= endIndex; ++i) {
-            StylePropertySet* styleDeclaration = m_matchedDecls[i].styleDeclaration.get();
-            unsigned linkMatchType = m_matchedDecls[i].linkMatchType;
+            unsigned linkMatchType = matchResult.matchedProperties[i].linkMatchType;
             // FIXME: It would be nicer to pass these as arguments but that requires changes in many places.
             m_applyPropertyToRegularStyle = linkMatchType & SelectorChecker::MatchLink;
             m_applyPropertyToVisitedLinkStyle = linkMatchType & SelectorChecker::MatchVisited;
 
-            applyDeclaration<applyFirst>(styleDeclaration, isImportant, inheritedOnly);
+            applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
         }
         m_applyPropertyToRegularStyle = true;
         m_applyPropertyToVisitedLinkStyle = false;
         return;
     }
     for (int i = startIndex; i <= endIndex; ++i)
-        applyDeclaration<applyFirst>(m_matchedDecls[i].styleDeclaration.get(), isImportant, inheritedOnly);
+        applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
 }
 
-unsigned CSSStyleSelector::computeDeclarationHash(MatchedStyleDeclaration* declarations, unsigned size)
+unsigned CSSStyleSelector::computeMatchedPropertiesHash(const MatchedProperties* properties, unsigned size)
 {
-    return StringHasher::hashMemory(declarations, sizeof(MatchedStyleDeclaration) * size);
+    
+    return StringHasher::hashMemory(properties, sizeof(MatchedProperties) * size);
 }
 
 bool operator==(const CSSStyleSelector::MatchRanges& a, const CSSStyleSelector::MatchRanges& b)
@@ -2581,30 +2616,30 @@ bool operator!=(const CSSStyleSelector::MatchRanges& a, const CSSStyleSelector::
     return !(a == b);
 }
 
-bool operator==(const CSSStyleSelector::MatchedStyleDeclaration& a, const CSSStyleSelector::MatchedStyleDeclaration& b)
+bool operator==(const CSSStyleSelector::MatchedProperties& a, const CSSStyleSelector::MatchedProperties& b)
 {
-    return a.styleDeclaration == b.styleDeclaration && a.linkMatchType == b.linkMatchType;
+    return a.properties == b.properties && a.linkMatchType == b.linkMatchType;
 }
 
-bool operator!=(const CSSStyleSelector::MatchedStyleDeclaration& a, const CSSStyleSelector::MatchedStyleDeclaration& b)
+bool operator!=(const CSSStyleSelector::MatchedProperties& a, const CSSStyleSelector::MatchedProperties& b)
 {
     return !(a == b);
 }
 
-const CSSStyleSelector::MatchedStyleDeclarationCacheItem* CSSStyleSelector::findFromMatchedDeclarationCache(unsigned hash, const MatchResult& matchResult)
+const CSSStyleSelector::MatchedPropertiesCacheItem* CSSStyleSelector::findFromMatchedPropertiesCache(unsigned hash, const MatchResult& matchResult)
 {
     ASSERT(hash);
 
-    MatchedStyleDeclarationCache::iterator it = m_matchedStyleDeclarationCache.find(hash);
-    if (it == m_matchedStyleDeclarationCache.end())
+    MatchedPropertiesCache::iterator it = m_matchedPropertiesCache.find(hash);
+    if (it == m_matchedPropertiesCache.end())
         return 0;
-    MatchedStyleDeclarationCacheItem& cacheItem = it->second;
+    MatchedPropertiesCacheItem& cacheItem = it->second;
 
-    size_t size = m_matchedDecls.size();
-    if (size != cacheItem.matchedStyleDeclarations.size())
+    size_t size = matchResult.matchedProperties.size();
+    if (size != cacheItem.matchedProperties.size())
         return 0;
     for (size_t i = 0; i < size; ++i) {
-        if (m_matchedDecls[i] != cacheItem.matchedStyleDeclarations[i])
+        if (matchResult.matchedProperties[i] != cacheItem.matchedProperties[i])
             return 0;
     }
     if (cacheItem.ranges != matchResult.ranges)
@@ -2612,31 +2647,31 @@ const CSSStyleSelector::MatchedStyleDeclarationCacheItem* CSSStyleSelector::find
     return &cacheItem;
 }
 
-void CSSStyleSelector::addToMatchedDeclarationCache(const RenderStyle* style, const RenderStyle* parentStyle, unsigned hash, const MatchResult& matchResult)
+void CSSStyleSelector::addToMatchedPropertiesCache(const RenderStyle* style, const RenderStyle* parentStyle, unsigned hash, const MatchResult& matchResult)
 {
     static unsigned matchedDeclarationCacheAdditionsBetweenSweeps = 100;
-    if (++m_matchedDeclarationCacheAdditionsSinceLastSweep >= matchedDeclarationCacheAdditionsBetweenSweeps) {
-        sweepMatchedDeclarationCache();
-        m_matchedDeclarationCacheAdditionsSinceLastSweep = 0;
+    if (++m_matchedPropertiesCacheAdditionsSinceLastSweep >= matchedDeclarationCacheAdditionsBetweenSweeps) {
+        sweepMatchedPropertiesCache();
+        m_matchedPropertiesCacheAdditionsSinceLastSweep = 0;
     }
 
     ASSERT(hash);
-    MatchedStyleDeclarationCacheItem cacheItem;
-    cacheItem.matchedStyleDeclarations.append(m_matchedDecls);
+    MatchedPropertiesCacheItem cacheItem;
+    cacheItem.matchedProperties.append(matchResult.matchedProperties);
     cacheItem.ranges = matchResult.ranges;
     // Note that we don't cache the original RenderStyle instance. It may be further modified.
     // The RenderStyle in the cache is really just a holder for the substructures and never used as-is.
     cacheItem.renderStyle = RenderStyle::clone(style);
     cacheItem.parentRenderStyle = RenderStyle::clone(parentStyle);
-    m_matchedStyleDeclarationCache.add(hash, cacheItem);
+    m_matchedPropertiesCache.add(hash, cacheItem);
 }
-    
-void CSSStyleSelector::invalidateMatchedDeclarationCache()
+
+void CSSStyleSelector::invalidateMatchedPropertiesCache()
 {
-    m_matchedStyleDeclarationCache.clear();
+    m_matchedPropertiesCache.clear();
 }
 
-static bool isCacheableInMatchedDeclarationCache(const RenderStyle* style, const RenderStyle* parentStyle)
+static bool isCacheableInMatchedPropertiesCache(const RenderStyle* style, const RenderStyle* parentStyle)
 {
     if (style->unique() || (style->styleType() != NOPSEUDO && parentStyle->unique()))
         return false;
@@ -2650,12 +2685,12 @@ static bool isCacheableInMatchedDeclarationCache(const RenderStyle* style, const
     return true;
 }
 
-void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
+void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult)
 {
-    unsigned cacheHash = matchResult.isCacheable ? computeDeclarationHash(m_matchedDecls.data(), m_matchedDecls.size()) : 0;
+    unsigned cacheHash = matchResult.isCacheable ? computeMatchedPropertiesHash(matchResult.matchedProperties.data(), matchResult.matchedProperties.size()) : 0;
     bool applyInheritedOnly = false;
-    const MatchedStyleDeclarationCacheItem* cacheItem = 0;
-    if (cacheHash && (cacheItem = findFromMatchedDeclarationCache(cacheHash, matchResult))) {
+    const MatchedPropertiesCacheItem* cacheItem = 0;
+    if (cacheHash && (cacheItem = findFromMatchedPropertiesCache(cacheHash, matchResult))) {
         // We can build up the style by copying non-inherited properties from an earlier style object built using the same exact
         // style declarations. We then only need to apply the inherited properties, if any, as their values can depend on the 
         // element context. This is fast and saves memory by reusing the style data structures.
@@ -2676,10 +2711,10 @@ void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
     // The order is (1) high-priority not important, (2) high-priority important, (3) normal not important
     // and (4) normal important.
     m_lineHeightValue = 0;
-    applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1, applyInheritedOnly);
-    applyDeclarations<true>(true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
-    applyDeclarations<true>(true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
-    applyDeclarations<true>(true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, false, 0, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
 
     if (cacheItem && cacheItem->renderStyle->effectiveZoom() != m_style->effectiveZoom()) {
         m_fontDirty = true;
@@ -2698,16 +2733,16 @@ void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
         applyInheritedOnly = false;
 
     // Now do the normal priority UA properties.
-    applyDeclarations<false>(false, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, false, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
     
     // Cache our border and background so that we can examine them later.
     cacheBorderAndBackground();
     
     // Now do the author and user normal priority properties and all the !important properties.
-    applyDeclarations<false>(false, matchResult.ranges.lastUARule + 1, m_matchedDecls.size() - 1, applyInheritedOnly);
-    applyDeclarations<false>(true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
-    applyDeclarations<false>(true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
-    applyDeclarations<false>(true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, false, matchResult.ranges.lastUARule + 1, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
     
     loadPendingImages();
     
@@ -2719,57 +2754,53 @@ void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
     
     if (cacheItem || !cacheHash)
         return;
-    if (!isCacheableInMatchedDeclarationCache(m_style.get(), m_parentStyle))
+    if (!isCacheableInMatchedPropertiesCache(m_style.get(), m_parentStyle))
         return;
-    addToMatchedDeclarationCache(m_style.get(), m_parentStyle, cacheHash, matchResult);
+    addToMatchedPropertiesCache(m_style.get(), m_parentStyle, cacheHash, matchResult);
 }
 
-void CSSStyleSelector::matchPageRules(RuleSet* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+static inline bool comparePageRules(const CSSPageRule* r1, const CSSPageRule* r2)
 {
-    m_matchedRules.clear();
+    return r1->selector()->specificity() < r2->selector()->specificity();
+}
 
+void CSSStyleSelector::matchPageRules(MatchResult& result, RuleSet* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+{
     if (!rules)
         return;
 
-    matchPageRulesForList(rules->pageRules(), isLeftPage, isFirstPage, pageName);
-
-    // If we didn't match any rules, we're done.
-    if (m_matchedRules.isEmpty())
+    Vector<CSSPageRule*> matchedPageRules;
+    matchPageRulesForList(matchedPageRules, rules->pageRules(), isLeftPage, isFirstPage, pageName);
+    if (matchedPageRules.isEmpty())
         return;
 
-    // Sort the set of matched rules.
-    sortMatchedRules();
+    std::stable_sort(matchedPageRules.begin(), matchedPageRules.end(), comparePageRules);
 
-    // Now transfer the set of matched rules over to our list of decls.
-    for (unsigned i = 0; i < m_matchedRules.size(); i++)
-        addMatchedDeclaration(m_matchedRules[i]->rule()->declaration());
+    for (unsigned i = 0; i < matchedPageRules.size(); i++)
+        addMatchedProperties(result, matchedPageRules[i]->properties());
 }
 
-void CSSStyleSelector::matchPageRulesForList(const Vector<RuleData>* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+void CSSStyleSelector::matchPageRulesForList(Vector<CSSPageRule*>& matchedRules, const Vector<CSSPageRule*>& rules, bool isLeftPage, bool isFirstPage, const String& pageName)
 {
-    if (!rules)
-        return;
-
-    unsigned size = rules->size();
+    unsigned size = rules.size();
     for (unsigned i = 0; i < size; ++i) {
-        const RuleData& ruleData = rules->at(i);
-        CSSStyleRule* rule = ruleData.rule();
-        const AtomicString& selectorLocalName = ruleData.selector()->tag().localName();
+        CSSPageRule* rule = rules[i];
+        const AtomicString& selectorLocalName = rule->selector()->tag().localName();
         if (selectorLocalName != starAtom && selectorLocalName != pageName)
             continue;
-        CSSSelector::PseudoType pseudoType = ruleData.selector()->pseudoType();
+        CSSSelector::PseudoType pseudoType = rule->selector()->pseudoType();
         if ((pseudoType == CSSSelector::PseudoLeftPage && !isLeftPage)
             || (pseudoType == CSSSelector::PseudoRightPage && isLeftPage)
             || (pseudoType == CSSSelector::PseudoFirstPage && !isFirstPage))
             continue;
 
         // If the rule has no properties to apply, then ignore it.
-        StylePropertySet* decl = rule->declaration();
-        if (!decl || decl->isEmpty())
+        StylePropertySet* properties = rule->properties();
+        if (!properties || properties->isEmpty())
             continue;
 
         // Add this rule to our list of matched rules.
-        addMatchedRule(&ruleData);
+        matchedRules.append(rule);
     }
 }
 
@@ -2960,72 +2991,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     // RenderStyle values.  Shorthands (e.g. border, background) occur in this list as well and
     // are only hit when mapping "inherit" or "initial" into front-end values.
     switch (property) {
-// ident only properties
-    case CSSPropertyBorderCollapse:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(borderCollapse, BorderCollapse)
-        return;
-    case CSSPropertyCaptionSide:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(captionSide, CaptionSide)
-        return;
-    case CSSPropertyClear:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(clear, Clear)
-        return;
-    case CSSPropertyEmptyCells:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
-        return;
-    case CSSPropertyFloat:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(floating, Floating)
-        return;
-    case CSSPropertyPageBreakBefore:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
-        return;
-    case CSSPropertyPageBreakAfter:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
-        return;
-    case CSSPropertyPageBreakInside:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakInside, PageBreakInside, PageBreak)
-        return;
-    case CSSPropertyPosition:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(position, Position)
-        return;
-    case CSSPropertyTableLayout:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(tableLayout, TableLayout)
-        return;
-    case CSSPropertyUnicodeBidi:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(unicodeBidi, UnicodeBidi)
-        return;
-    case CSSPropertyTextTransform:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textTransform, TextTransform)
-        return;
-    case CSSPropertyVisibility:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(visibility, Visibility)
-        return;
-    case CSSPropertyWhiteSpace:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(whiteSpace, WhiteSpace)
-        return;
-// uri || inherit
-    case CSSPropertyWordBreak:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordBreak, WordBreak)
-        return;
-    case CSSPropertyWordWrap:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordWrap, WordWrap)
-        return;
-    case CSSPropertyWebkitNbspMode:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(nbspMode, NBSPMode)
-        return;
-    case CSSPropertyWebkitLineBreak:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(khtmlLineBreak, KHTMLLineBreak)
-        return;
-    case CSSPropertyWebkitMatchNearestMailBlockquoteColor:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
-        return;
-    case CSSPropertyWidows:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(widows, Widows)
-        return;
-    case CSSPropertyOrphans:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(orphans, Orphans)
-        return;
-
 // lists
     case CSSPropertyContent:
         // list of string, uri, counter, attr, i
@@ -3182,10 +3147,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             CSSPrimitiveValue* contentValue = static_cast<CSSPrimitiveValue*>(item);
             AtomicString face;
             Settings* settings = m_checker.document()->settings();
-            if (contentValue->isString()) {
-                if (contentValue->isFontFamilyValue())
-                    face = static_cast<FontFamilyValue*>(contentValue)->familyName();
-            } else if (settings) {
+            if (contentValue->isString())
+                face = contentValue->getStringValue();
+            else if (settings) {
                 switch (contentValue->getIdent()) {
                     case CSSValueWebkitBody:
                         face = settings->standardFontFamily();
@@ -3328,9 +3292,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
 
     // CSS3 Properties
-    case CSSPropertyWebkitAppearance:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(appearance, Appearance)
-        return;
     case CSSPropertyImageRendering:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(imageRendering, ImageRendering);
         return;
@@ -3403,43 +3364,13 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         // Clamp opacity to the range 0-1
         m_style->setOpacity(clampTo<float>(primitiveValue->getDoubleValue(), 0, 1));
         return;
-    case CSSPropertyWebkitBoxAlign:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxAlign, BoxAlign)
-        return;
     case CSSPropertySrc: // Only used in @font-face rules.
         return;
     case CSSPropertyUnicodeRange: // Only used in @font-face rules.
         return;
-    case CSSPropertyWebkitBackfaceVisibility:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(backfaceVisibility, BackfaceVisibility)
-        return;
-    case CSSPropertyWebkitBoxDirection:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxDirection, BoxDirection)
-        return;
-    case CSSPropertyWebkitBoxLines:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxLines, BoxLines)
-        return;
-    case CSSPropertyWebkitBoxOrient:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxOrient, BoxOrient)
-        return;
-    case CSSPropertyWebkitBoxPack:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxPack, BoxPack)
-        return;
-    case CSSPropertyWebkitBoxFlex:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxFlex, BoxFlex)
-        return;
-    case CSSPropertyWebkitBoxFlexGroup:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxFlexGroup, BoxFlexGroup)
-        return;
-    case CSSPropertyWebkitBoxOrdinalGroup:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxOrdinalGroup, BoxOrdinalGroup)
-        return;
     case CSSPropertyBoxSizing:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxSizing, BoxSizing);
         return;
-    case CSSPropertyWebkitColumnSpan:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(columnSpan, ColumnSpan)
-        return;
     case CSSPropertyWebkitColumnRuleStyle:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
         return;
@@ -3535,25 +3466,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     }
-    case CSSPropertyWebkitMarqueeStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)
-        return;
-    case CSSPropertyWebkitRegionOverflow:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(regionOverflow, RegionOverflow);
-        return;
-    case CSSPropertyWebkitMarqueeDirection:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
-        return;
-    case CSSPropertyWebkitUserDrag:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userDrag, UserDrag)
-        return;
-    case CSSPropertyWebkitUserModify:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userModify, UserModify)
-        return;
-    case CSSPropertyWebkitUserSelect:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userSelect, UserSelect)
-        return;
-
     case CSSPropertyTextOverflow: {
         // This property is supported by WinIE, and so we leave off the "-webkit-" in order to
         // work with WinIE-specific pages that use the property.
@@ -3594,10 +3506,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         setTextSizeAdjust(primitiveValue->getIdent() == CSSValueAuto);
         return;
     }
-    case CSSPropertyWebkitTextSecurity:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textSecurity, TextSecurity)
-        return;
-
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion: {
         HANDLE_INHERIT_AND_INITIAL(dashboardRegions, DashboardRegions)
@@ -3631,9 +3539,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
-    case CSSPropertyWebkitRtlOrdering:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(rtlOrdering, RTLOrdering)
-        return;
     case CSSPropertyWebkitTextStrokeWidth: {
         HANDLE_INHERIT_AND_INITIAL(textStrokeWidth, TextStrokeWidth)
         float width = 0;
@@ -3663,12 +3568,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setTransform(operations);
         return;
     }
-    case CSSPropertyWebkitTransformStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(transformStyle3D, TransformStyle3D)
-        return;
-    case CSSPropertyWebkitPrintColorAdjust:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(printColorAdjust, PrintColorAdjust);
-        return;
     case CSSPropertyWebkitPerspective: {
         HANDLE_INHERIT_AND_INITIAL(perspective, Perspective)
         if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
@@ -3724,6 +3623,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    case CSSPropertyWebkitOverflowScrolling: {
+        HANDLE_INHERIT_AND_INITIAL(useTouchOverflowScrolling, UseTouchOverflowScrolling);
+        if (!primitiveValue)
+            break;
+        m_style->setUseTouchOverflowScrolling(primitiveValue->getIdent() == CSSValueTouch);
+        return;
+    }
+#endif
     case CSSPropertyWebkitColorCorrection:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(colorSpace, ColorSpace);
         return;
@@ -3899,150 +3807,115 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 #endif
 
     // These properties are implemented in the CSSStyleApplyProperty lookup table.
-    case CSSPropertyColor:
-    case CSSPropertyDirection:
-    case CSSPropertyDisplay:
     case CSSPropertyBackgroundAttachment:
     case CSSPropertyBackgroundClip:
-    case CSSPropertyWebkitBackgroundClip:
-    case CSSPropertyWebkitBackgroundComposite:
-    case CSSPropertyBackgroundOrigin:
-    case CSSPropertyWebkitBackgroundOrigin:
+    case CSSPropertyBackgroundColor:
     case CSSPropertyBackgroundImage:
-    case CSSPropertyWebkitAspectRatio:
+    case CSSPropertyBackgroundOrigin:
+    case CSSPropertyBackgroundPosition:
+    case CSSPropertyBackgroundPositionX:
+    case CSSPropertyBackgroundPositionY:
+    case CSSPropertyBackgroundRepeat:
+    case CSSPropertyBackgroundRepeatX:
+    case CSSPropertyBackgroundRepeatY:
     case CSSPropertyBackgroundSize:
-    case CSSPropertyWebkitBackgroundSize:
-    case CSSPropertyWebkitMaskAttachment:
-    case CSSPropertyWebkitMaskClip:
-    case CSSPropertyWebkitMaskComposite:
-    case CSSPropertyWebkitMaskOrigin:
-    case CSSPropertyWebkitMaskImage:
-    case CSSPropertyWebkitMaskSize:
-    case CSSPropertyBackgroundColor:
+    case CSSPropertyBorder:
+    case CSSPropertyBorderBottom:
     case CSSPropertyBorderBottomColor:
-    case CSSPropertyBorderLeftColor:
-    case CSSPropertyBorderRightColor:
-    case CSSPropertyBorderTopColor:
-    case CSSPropertyBorderTopStyle:
-    case CSSPropertyBorderRightStyle:
+    case CSSPropertyBorderBottomLeftRadius:
+    case CSSPropertyBorderBottomRightRadius:
     case CSSPropertyBorderBottomStyle:
-    case CSSPropertyBorderLeftStyle:
-    case CSSPropertyBorderTopWidth:
-    case CSSPropertyBorderRightWidth:
     case CSSPropertyBorderBottomWidth:
-    case CSSPropertyBorderLeftWidth:
-    case CSSPropertyBorder:
-    case CSSPropertyBorderStyle:
-    case CSSPropertyBorderWidth:
+    case CSSPropertyBorderCollapse:
     case CSSPropertyBorderColor:
     case CSSPropertyBorderImage:
-    case CSSPropertyWebkitBorderImage:
-    case CSSPropertyWebkitMaskBoxImage:
     case CSSPropertyBorderImageOutset:
-    case CSSPropertyWebkitMaskBoxImageOutset:
     case CSSPropertyBorderImageRepeat:
-    case CSSPropertyWebkitMaskBoxImageRepeat:
     case CSSPropertyBorderImageSlice:
-    case CSSPropertyWebkitMaskBoxImageSlice:
-    case CSSPropertyBorderImageWidth:
-    case CSSPropertyWebkitMaskBoxImageWidth:
     case CSSPropertyBorderImageSource:
-    case CSSPropertyWebkitMaskBoxImageSource:
-    case CSSPropertyBorderTop:
-    case CSSPropertyBorderRight:
-    case CSSPropertyBorderBottom:
+    case CSSPropertyBorderImageWidth:
     case CSSPropertyBorderLeft:
+    case CSSPropertyBorderLeftColor:
+    case CSSPropertyBorderLeftStyle:
+    case CSSPropertyBorderLeftWidth:
     case CSSPropertyBorderRadius:
-    case CSSPropertyWebkitBorderRadius:
+    case CSSPropertyBorderRight:
+    case CSSPropertyBorderRightColor:
+    case CSSPropertyBorderRightStyle:
+    case CSSPropertyBorderRightWidth:
+    case CSSPropertyBorderSpacing:
+    case CSSPropertyBorderStyle:
+    case CSSPropertyBorderTop:
+    case CSSPropertyBorderTopColor:
     case CSSPropertyBorderTopLeftRadius:
     case CSSPropertyBorderTopRightRadius:
-    case CSSPropertyBorderBottomLeftRadius:
-    case CSSPropertyBorderBottomRightRadius:
-    case CSSPropertyBorderSpacing:
-    case CSSPropertyWebkitBorderHorizontalSpacing:
-    case CSSPropertyWebkitBorderVerticalSpacing:
+    case CSSPropertyBorderTopStyle:
+    case CSSPropertyBorderTopWidth:
+    case CSSPropertyBorderWidth:
+    case CSSPropertyBottom:
+    case CSSPropertyCaptionSide:
+    case CSSPropertyClear:
     case CSSPropertyClip:
+    case CSSPropertyColor:
     case CSSPropertyCounterIncrement:
     case CSSPropertyCounterReset:
-    case CSSPropertyLetterSpacing:
-    case CSSPropertyWordSpacing:
-    case CSSPropertyWebkitFlexOrder:
-    case CSSPropertyWebkitFlexPack:
-    case CSSPropertyWebkitFlexAlign:
-    case CSSPropertyWebkitFlexItemAlign:
-    case CSSPropertyWebkitFlexDirection:
-    case CSSPropertyWebkitFlexFlow:
-    case CSSPropertyWebkitFlexWrap:
+    case CSSPropertyCursor:
+    case CSSPropertyDirection:
+    case CSSPropertyDisplay:
+    case CSSPropertyEmptyCells:
+    case CSSPropertyFloat:
     case CSSPropertyFontSize:
     case CSSPropertyFontStyle:
     case CSSPropertyFontVariant:
-    case CSSPropertyTextRendering:
-    case CSSPropertyWebkitTextOrientation:
-    case CSSPropertyWebkitFontSmoothing:
     case CSSPropertyFontWeight:
-    case CSSPropertyOutline:
-    case CSSPropertyOutlineStyle:
-    case CSSPropertyOutlineWidth:
-    case CSSPropertyOutlineOffset:
-    case CSSPropertyWebkitColumnRuleWidth:
-    case CSSPropertyOutlineColor:
-    case CSSPropertyWebkitColumnRuleColor:
-    case CSSPropertyWebkitTextEmphasisColor:
-    case CSSPropertyWebkitTextFillColor:
-    case CSSPropertyWebkitTextStrokeColor:
-    case CSSPropertyBackgroundPosition:
-    case CSSPropertyBackgroundPositionX:
-    case CSSPropertyBackgroundPositionY:
-    case CSSPropertyWebkitMaskPosition:
-    case CSSPropertyWebkitMaskPositionX:
-    case CSSPropertyWebkitMaskPositionY:
-    case CSSPropertyBackgroundRepeat:
-    case CSSPropertyBackgroundRepeatX:
-    case CSSPropertyBackgroundRepeatY:
-    case CSSPropertyWebkitMaskRepeat:
-    case CSSPropertyWebkitMaskRepeatX:
-    case CSSPropertyWebkitMaskRepeatY:
-    case CSSPropertyOverflow:
-    case CSSPropertyOverflowX:
-    case CSSPropertyOverflowY:
-    case CSSPropertyMaxWidth:
-    case CSSPropertyTop:
+    case CSSPropertyHeight:
     case CSSPropertyLeft:
-    case CSSPropertyRight:
-    case CSSPropertyBottom:
-    case CSSPropertyWidth:
-    case CSSPropertyMinWidth:
+    case CSSPropertyLetterSpacing:
     case CSSPropertyLineHeight:
     case CSSPropertyListStyle:
     case CSSPropertyListStyleImage:
     case CSSPropertyListStylePosition:
     case CSSPropertyListStyleType:
-    case CSSPropertyMarginTop:
-    case CSSPropertyMarginRight:
+    case CSSPropertyMargin:
     case CSSPropertyMarginBottom:
     case CSSPropertyMarginLeft:
-    case CSSPropertyMargin:
-    case CSSPropertyPaddingTop:
-    case CSSPropertyPaddingRight:
+    case CSSPropertyMarginRight:
+    case CSSPropertyMarginTop:
+    case CSSPropertyMaxHeight:
+    case CSSPropertyMaxWidth:
+    case CSSPropertyMinHeight:
+    case CSSPropertyMinWidth:
+    case CSSPropertyOrphans:
+    case CSSPropertyOutline:
+    case CSSPropertyOutlineColor:
+    case CSSPropertyOutlineOffset:
+    case CSSPropertyOutlineStyle:
+    case CSSPropertyOutlineWidth:
+    case CSSPropertyOverflow:
+    case CSSPropertyOverflowX:
+    case CSSPropertyOverflowY:
+    case CSSPropertyPadding:
     case CSSPropertyPaddingBottom:
     case CSSPropertyPaddingLeft:
-    case CSSPropertyPadding:
+    case CSSPropertyPaddingRight:
+    case CSSPropertyPaddingTop:
+    case CSSPropertyPageBreakAfter:
+    case CSSPropertyPageBreakBefore:
+    case CSSPropertyPageBreakInside:
+    case CSSPropertyPosition:
     case CSSPropertyResize:
+    case CSSPropertyRight:
     case CSSPropertySize:
+    case CSSPropertyTableLayout:
     case CSSPropertyTextAlign:
     case CSSPropertyTextDecoration:
     case CSSPropertyTextIndent:
-    case CSSPropertyMaxHeight:
-    case CSSPropertyHeight:
-    case CSSPropertyMinHeight:
+    case CSSPropertyTextRendering:
+    case CSSPropertyTextTransform:
+    case CSSPropertyTop:
+    case CSSPropertyUnicodeBidi:
     case CSSPropertyVerticalAlign:
-    case CSSPropertyWebkitTransformOriginX:
-    case CSSPropertyWebkitTransformOriginY:
-    case CSSPropertyWebkitTransformOriginZ:
-    case CSSPropertyWebkitTransformOrigin:
-    case CSSPropertyWebkitPerspectiveOriginX:
-    case CSSPropertyWebkitPerspectiveOriginY:
-    case CSSPropertyWebkitPerspectiveOrigin:
+    case CSSPropertyVisibility:
     case CSSPropertyWebkitAnimationDelay:
     case CSSPropertyWebkitAnimationDirection:
     case CSSPropertyWebkitAnimationDuration:
@@ -4051,34 +3924,112 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitAnimationName:
     case CSSPropertyWebkitAnimationPlayState:
     case CSSPropertyWebkitAnimationTimingFunction:
-    case CSSPropertyWebkitTransitionDelay:
-    case CSSPropertyWebkitTransitionDuration:
-    case CSSPropertyWebkitTransitionProperty:
-    case CSSPropertyWebkitTransitionTimingFunction:
-    case CSSPropertyCursor:
-    case CSSPropertyWebkitColumns:
+    case CSSPropertyWebkitAppearance:
+    case CSSPropertyWebkitAspectRatio:
+    case CSSPropertyWebkitBackfaceVisibility:
+    case CSSPropertyWebkitBackgroundClip:
+    case CSSPropertyWebkitBackgroundComposite:
+    case CSSPropertyWebkitBackgroundOrigin:
+    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyWebkitBorderHorizontalSpacing:
+    case CSSPropertyWebkitBorderImage:
+    case CSSPropertyWebkitBorderRadius:
+    case CSSPropertyWebkitBorderVerticalSpacing:
+    case CSSPropertyWebkitBoxAlign:
+    case CSSPropertyWebkitBoxDirection:
+    case CSSPropertyWebkitBoxFlex:
+    case CSSPropertyWebkitBoxFlexGroup:
+    case CSSPropertyWebkitBoxLines:
+    case CSSPropertyWebkitBoxOrdinalGroup:
+    case CSSPropertyWebkitBoxOrient:
+    case CSSPropertyWebkitBoxPack:
     case CSSPropertyWebkitColumnCount:
     case CSSPropertyWebkitColumnGap:
+    case CSSPropertyWebkitColumnRuleColor:
+    case CSSPropertyWebkitColumnRuleWidth:
+    case CSSPropertyWebkitColumns:
+    case CSSPropertyWebkitColumnSpan:
     case CSSPropertyWebkitColumnWidth:
-    case CSSPropertyWebkitFlowInto:
+    case CSSPropertyWebkitFlexAlign:
+    case CSSPropertyWebkitFlexDirection:
+    case CSSPropertyWebkitFlexFlow:
+    case CSSPropertyWebkitFlexItemAlign:
+    case CSSPropertyWebkitFlexOrder:
+    case CSSPropertyWebkitFlexPack:
+    case CSSPropertyWebkitFlexWrap:
     case CSSPropertyWebkitFlowFrom:
+    case CSSPropertyWebkitFlowInto:
     case CSSPropertyWebkitFontKerning:
+    case CSSPropertyWebkitFontSmoothing:
     case CSSPropertyWebkitFontVariantLigatures:
     case CSSPropertyWebkitHighlight:
     case CSSPropertyWebkitHyphenateCharacter:
     case CSSPropertyWebkitHyphenateLimitAfter:
     case CSSPropertyWebkitHyphenateLimitBefore:
     case CSSPropertyWebkitHyphenateLimitLines:
+    case CSSPropertyWebkitLineAlign:
+    case CSSPropertyWebkitLineBreak:
     case CSSPropertyWebkitLineGrid:
-    case CSSPropertyWebkitLineGridSnap:
+    case CSSPropertyWebkitLineSnap:
+    case CSSPropertyWebkitMarqueeDirection:
+    case CSSPropertyWebkitMarqueeStyle:
+    case CSSPropertyWebkitMaskAttachment:
+    case CSSPropertyWebkitMaskBoxImage:
+    case CSSPropertyWebkitMaskBoxImageOutset:
+    case CSSPropertyWebkitMaskBoxImageRepeat:
+    case CSSPropertyWebkitMaskBoxImageSlice:
+    case CSSPropertyWebkitMaskBoxImageSource:
+    case CSSPropertyWebkitMaskBoxImageWidth:
+    case CSSPropertyWebkitMaskClip:
+    case CSSPropertyWebkitMaskComposite:
+    case CSSPropertyWebkitMaskImage:
+    case CSSPropertyWebkitMaskOrigin:
+    case CSSPropertyWebkitMaskPosition:
+    case CSSPropertyWebkitMaskPositionX:
+    case CSSPropertyWebkitMaskPositionY:
+    case CSSPropertyWebkitMaskRepeat:
+    case CSSPropertyWebkitMaskRepeatX:
+    case CSSPropertyWebkitMaskRepeatY:
+    case CSSPropertyWebkitMaskSize:
+    case CSSPropertyWebkitMatchNearestMailBlockquoteColor:
+    case CSSPropertyWebkitNbspMode:
+    case CSSPropertyWebkitPerspectiveOrigin:
+    case CSSPropertyWebkitPerspectiveOriginX:
+    case CSSPropertyWebkitPerspectiveOriginY:
+    case CSSPropertyWebkitPrintColorAdjust:
+    case CSSPropertyWebkitRegionOverflow:
+    case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
+    case CSSPropertyWebkitTextEmphasisColor:
     case CSSPropertyWebkitTextEmphasisPosition:
     case CSSPropertyWebkitTextEmphasisStyle:
+    case CSSPropertyWebkitTextFillColor:
+    case CSSPropertyWebkitTextOrientation:
+    case CSSPropertyWebkitTextSecurity:
+    case CSSPropertyWebkitTextStrokeColor:
+    case CSSPropertyWebkitTransformOrigin:
+    case CSSPropertyWebkitTransformOriginX:
+    case CSSPropertyWebkitTransformOriginY:
+    case CSSPropertyWebkitTransformOriginZ:
+    case CSSPropertyWebkitTransformStyle:
+    case CSSPropertyWebkitTransitionDelay:
+    case CSSPropertyWebkitTransitionDuration:
+    case CSSPropertyWebkitTransitionProperty:
+    case CSSPropertyWebkitTransitionTimingFunction:
+    case CSSPropertyWebkitUserDrag:
+    case CSSPropertyWebkitUserModify:
+    case CSSPropertyWebkitUserSelect:
+    case CSSPropertyWebkitWrap:
+    case CSSPropertyWebkitWrapFlow:
     case CSSPropertyWebkitWrapMargin:
     case CSSPropertyWebkitWrapPadding:
-    case CSSPropertyWebkitWrapFlow:
     case CSSPropertyWebkitWrapThrough:
-    case CSSPropertyWebkitWrap:
+    case CSSPropertyWhiteSpace:
+    case CSSPropertyWidows:
+    case CSSPropertyWidth:
+    case CSSPropertyWordBreak:
+    case CSSPropertyWordSpacing:
+    case CSSPropertyWordWrap:
     case CSSPropertyZIndex:
     case CSSPropertyZoom:
         ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index 844235ae6..4db7f226d 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -106,10 +106,6 @@ public:
                      bool strictParsing, bool matchAuthorAndUserStyles);
     ~CSSStyleSelector();
 
-#if ENABLE(STYLE_SCOPED)
-    static Element* determineScopingElement(const CSSStyleSheet*);
-#endif
-
     // Using these during tree walk will allow style selector to optimize child and descendant selector lookups.
     void pushParent(Element* parent);
     void popParent(Element* parent);
@@ -217,7 +213,7 @@ public:
 
     static bool createTransformOperations(CSSValue* inValue, RenderStyle* inStyle, RenderStyle* rootStyle, TransformOperations& outOperations);
     
-    void invalidateMatchedDeclarationCache();
+    void invalidateMatchedPropertiesCache();
 
 #if ENABLE(CSS_FILTERS)
     bool createFilterOperations(CSSValue* inValue, RenderStyle* inStyle, RenderStyle* rootStyle, FilterOperations& outOperations);
@@ -259,7 +255,6 @@ private:
     void adjustRenderStyle(RenderStyle* styleToAdjust, RenderStyle* parentStyle, Element*);
 
     void addMatchedRule(const RuleData* rule) { m_matchedRules.append(rule); }
-    void addMatchedDeclaration(StylePropertySet*, unsigned linkMatchType = SelectorChecker::MatchAll);
 
     struct MatchRanges {
         MatchRanges() : firstUARule(-1), lastUARule(-1), firstAuthorRule(-1), lastAuthorRule(-1), firstUserRule(-1), lastUserRule(-1) { }
@@ -271,35 +266,58 @@ private:
         int lastUserRule;
     };
 
+    struct MatchedProperties {
+        MatchedProperties() : possiblyPaddedMember(0) { }
+        
+        RefPtr<StylePropertySet> properties;
+        union {
+            unsigned linkMatchType;
+            // Used to make sure all memory is zero-initialized since we compute the hash over the bytes of this object.
+            void* possiblyPaddedMember;
+        };
+    };
+
     struct MatchResult {
         MatchResult() : isCacheable(true) { }
+        Vector<MatchedProperties, 64> matchedProperties;
+        Vector<CSSStyleRule*, 64> matchedRules;
         MatchRanges ranges;
         bool isCacheable;
     };
+
+    struct MatchOptions {
+        MatchOptions(bool includeEmptyRules, const Element* scope = 0) : scope(scope), includeEmptyRules(includeEmptyRules) { }
+        const Element* scope;
+        bool includeEmptyRules;
+    };
+
+    static void addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule = 0, unsigned linkMatchType =  SelectorChecker::MatchAll);
+
     void matchAllRules(MatchResult&);
     void matchUARules(MatchResult&);
-    void matchRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void matchAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void matchScopedAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void collectMatchingRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void collectMatchingRulesForRegion(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void collectMatchingRulesForList(const Vector<RuleData>*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
+    void matchUARules(MatchResult&, RuleSet*);
+    void matchAuthorRules(MatchResult&, bool includeEmptyRules);
+    void matchUserRules(MatchResult&, bool includeEmptyRules);
+    void matchScopedAuthorRules(MatchResult&, bool includeEmptyRules);
+    void collectMatchingRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
+    void collectMatchingRulesForRegion(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
+    void collectMatchingRulesForList(const Vector<RuleData>*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
     bool fastRejectSelector(const RuleData&) const;
     void sortMatchedRules();
-    void sortAndTransferMatchedRules();
+    void sortAndTransferMatchedRules(MatchResult&);
 
-    bool checkSelector(const RuleData&);
+    bool checkSelector(const RuleData&, const Element* scope = 0);
     bool checkRegionSelector(CSSSelector* regionSelector, Element* regionElement);
-    void applyMatchedDeclarations(const MatchResult&);
+    void applyMatchedProperties(const MatchResult&);
     template <bool firstPass>
-    void applyDeclarations(bool important, int startIndex, int endIndex, bool inheritedOnly);
+    void applyMatchedProperties(const MatchResult&, bool important, int startIndex, int endIndex, bool inheritedOnly);
     template <bool firstPass>
-    void applyDeclaration(StylePropertySet*, bool isImportant, bool inheritedOnly);
+    void applyProperties(const StylePropertySet* properties, CSSStyleRule*, bool isImportant, bool inheritedOnly);
 
     static bool isValidRegionStyleProperty(int id);
 
-    void matchPageRules(RuleSet*, bool isLeftPage, bool isFirstPage, const String& pageName);
-    void matchPageRulesForList(const Vector<RuleData>*, bool isLeftPage, bool isFirstPage, const String& pageName);
+    void matchPageRules(MatchResult&, RuleSet*, bool isLeftPage, bool isFirstPage, const String& pageName);
+    void matchPageRulesForList(Vector<CSSPageRule*>& matchedRules, const Vector<CSSPageRule*>&, bool isLeftPage, bool isFirstPage, const String& pageName);
     bool isLeftPage(int pageIndex) const;
     bool isRightPage(int pageIndex) const { return !isLeftPage(pageIndex); }
     bool isFirstPage(int pageIndex) const;
@@ -372,39 +390,24 @@ private:
     PassRefPtr<StyleImage> loadPendingImage(StylePendingImage*);
     void loadPendingImages();
 
-    struct MatchedStyleDeclaration {
-        MatchedStyleDeclaration() : possiblyPaddedMember(0) { }
-
-        RefPtr<StylePropertySet> styleDeclaration;
-        union {
-            unsigned linkMatchType;
-            // Used to make sure all memory is zero-initialized since we compute the hash over the bytes of this object.
-            void* possiblyPaddedMember;
-        };
-    };
-    static unsigned computeDeclarationHash(MatchedStyleDeclaration*, unsigned size);
-    struct MatchedStyleDeclarationCacheItem {
-        Vector<MatchedStyleDeclaration> matchedStyleDeclarations;
+    static unsigned computeMatchedPropertiesHash(const MatchedProperties*, unsigned size);
+    struct MatchedPropertiesCacheItem {
+        Vector<MatchedProperties> matchedProperties;
         MatchRanges ranges;
         RefPtr<RenderStyle> renderStyle;
         RefPtr<RenderStyle> parentRenderStyle;
     };
-    const MatchedStyleDeclarationCacheItem* findFromMatchedDeclarationCache(unsigned hash, const MatchResult&);
-    void addToMatchedDeclarationCache(const RenderStyle*, const RenderStyle* parentStyle, unsigned hash, const MatchResult&);
+    const MatchedPropertiesCacheItem* findFromMatchedPropertiesCache(unsigned hash, const MatchResult&);
+    void addToMatchedPropertiesCache(const RenderStyle*, const RenderStyle* parentStyle, unsigned hash, const MatchResult&);
 
     // Every N additions to the matched declaration cache trigger a sweep where entries holding
     // the last reference to a style declaration are garbage collected.
-    void sweepMatchedDeclarationCache();
+    void sweepMatchedPropertiesCache();
 
-    // We collect the set of decls that match in |m_matchedDecls|. We then walk the
-    // set of matched decls four times, once for those properties that others depend on (like font-size),
-    // and then a second time for all the remaining properties. We then do the same two passes
-    // for any !important rules.
-    Vector<MatchedStyleDeclaration, 64> m_matchedDecls;
-    unsigned m_matchedDeclarationCacheAdditionsSinceLastSweep;
+    unsigned m_matchedPropertiesCacheAdditionsSinceLastSweep;
 
-    typedef HashMap<unsigned, MatchedStyleDeclarationCacheItem> MatchedStyleDeclarationCache;
-    MatchedStyleDeclarationCache m_matchedStyleDeclarationCache;
+    typedef HashMap<unsigned, MatchedPropertiesCacheItem> MatchedPropertiesCache;
+    MatchedPropertiesCache m_matchedPropertiesCache;
 
     // A buffer used to hold the set of matched rules for an element, and a temporary buffer used for
     // merge sorting.
@@ -446,6 +449,8 @@ private:
 #endif
 
 #if ENABLE(STYLE_SCOPED)
+    static const Element* determineScopingElement(const CSSStyleSheet*);
+
     typedef HashMap<const Element*, OwnPtr<RuleSet> > ScopedRuleSetMap;
 
     RuleSet* scopedRuleSetForElement(const Element*) const;
@@ -470,8 +475,8 @@ private:
 #endif
 
     friend class CSSStyleApplyProperty;
-    friend bool operator==(const MatchedStyleDeclaration&, const MatchedStyleDeclaration&);
-    friend bool operator!=(const MatchedStyleDeclaration&, const MatchedStyleDeclaration&);
+    friend bool operator==(const MatchedProperties&, const MatchedProperties&);
+    friend bool operator!=(const MatchedProperties&, const MatchedProperties&);
     friend bool operator==(const MatchRanges&, const MatchRanges&);
     friend bool operator!=(const MatchRanges&, const MatchRanges&);
 };
diff --git a/Source/WebCore/css/CSSStyleSheet.idl b/Source/WebCore/css/CSSStyleSheet.idl
index e2514f027..962c9dbdc 100644
--- a/Source/WebCore/css/CSSStyleSheet.idl
+++ b/Source/WebCore/css/CSSStyleSheet.idl
@@ -21,24 +21,26 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface CSSStyleSheet : StyleSheet {
+    interface [
+        V8CustomToJSObject
+    ] CSSStyleSheet : StyleSheet {
         readonly attribute CSSRule          ownerRule;
         readonly attribute CSSRuleList      cssRules;
 
-        [ObjCLegacyUnnamedParameters] unsigned long insertRule(in [Optional=CallWithDefaultValue] DOMString rule, 
-                                                in [Optional=CallWithDefaultValue] unsigned long index)
+        [ObjCLegacyUnnamedParameters] unsigned long insertRule(in [Optional=DefaultIsUndefined] DOMString rule, 
+                                                in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
-        void               deleteRule(in [Optional=CallWithDefaultValue] unsigned long index)
+        void               deleteRule(in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
 
         // IE Extensions
         readonly attribute CSSRuleList      rules;
 
-        long addRule(in [Optional=CallWithDefaultValue] DOMString selector,
-                     in [Optional=CallWithDefaultValue] DOMString style,
+        long addRule(in [Optional=DefaultIsUndefined] DOMString selector,
+                     in [Optional=DefaultIsUndefined] DOMString style,
                      in [Optional] unsigned long index)
             raises(DOMException);
-        void removeRule(in [Optional=CallWithDefaultValue] unsigned long index)
+        void removeRule(in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/css/CSSValue.cpp b/Source/WebCore/css/CSSValue.cpp
index 016cb0bba..aea4ee4fd 100644
--- a/Source/WebCore/css/CSSValue.cpp
+++ b/Source/WebCore/css/CSSValue.cpp
@@ -48,7 +48,6 @@
 #include "CSSUnicodeRangeValue.h"
 #include "CSSValueList.h"
 #include "FontValue.h"
-#include "FontFamilyValue.h"
 #include "FontFeatureValue.h"
 #include "ShadowValue.h"
 #include "SVGColor.h"
@@ -110,8 +109,6 @@ String CSSValue::cssText() const
         return static_cast<const FontValue*>(this)->customCssText();
     case FontFaceSrcClass:
         return static_cast<const CSSFontFaceSrcValue*>(this)->customCssText();
-    case FontFamilyClass:
-        return static_cast<const FontFamilyValue*>(this)->customCssText();
     case FontFeatureClass:
         return static_cast<const FontFeatureValue*>(this)->customCssText();
     case FunctionClass:
@@ -192,9 +189,6 @@ void CSSValue::destroy()
     case FontFaceSrcClass:
         delete static_cast<CSSFontFaceSrcValue*>(this);
         return;
-    case FontFamilyClass:
-        delete static_cast<FontFamilyValue*>(this);
-        return;
     case FontFeatureClass:
         delete static_cast<FontFeatureValue*>(this);
         return;
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index 61233212b..66a5943e0 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -62,7 +62,6 @@ public:
     bool isAspectRatioValue() const { return m_classType == AspectRatioClass; }
     bool isBorderImageSliceValue() const { return m_classType == BorderImageSliceClass; }
     bool isCursorImageValue() const { return m_classType == CursorImageClass; }
-    bool isFontFamilyValue() const { return m_classType == FontFamilyClass; }
     bool isFontFeatureValue() const { return m_classType == FontFeatureClass; }
     bool isFontValue() const { return m_classType == FontClass; }
     bool isImageGeneratorValue() const { return m_classType >= CanvasClass && m_classType <= RadialGradientClass; }
@@ -97,7 +96,6 @@ protected:
         // Primitive class types must appear before PrimitiveClass.
         ImageClass,
         CursorImageClass,
-        FontFamilyClass,
         PrimitiveClass,
 
         // Image generator classes.
diff --git a/Source/WebCore/css/CSSValue.idl b/Source/WebCore/css/CSSValue.idl
index c46267321..2b0ceb31f 100644
--- a/Source/WebCore/css/CSSValue.idl
+++ b/Source/WebCore/css/CSSValue.idl
@@ -21,7 +21,7 @@
 module css {
 
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         JSCustomIsReachable,
         JSCustomFinalize,
         ObjCPolymorphic,
@@ -34,7 +34,7 @@ module css {
         const unsigned short CSS_VALUE_LIST      = 2;
         const unsigned short CSS_CUSTOM          = 3;
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString cssText
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString cssText
                      setter raises(DOMException);
 
         readonly attribute unsigned short cssValueType;
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index dd5c27c83..d299391d8 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -501,7 +501,7 @@ row
 row-reverse
 column
 column-reverse
-// nowrap
+// none
 // wrap
 wrap-reverse
 
@@ -802,6 +802,12 @@ no-limit
 manual
 // auto
 
+#if defined(ENABLE_OVERFLOW_SCROLLING)
+// -webkit-overflow-scrolling
+// auto
+touch
+#endif
+
 // -webkit-writing-mode
 // SVG compatibility
 lr
@@ -882,6 +888,9 @@ maximum
 wrap
 // none
 
+// -webkit-line-align
+edges
+
 #if defined(ENABLE_CSS_FILTERS) && ENABLE_CSS_FILTERS
 // -webkit-filter
 #if defined(ENABLE_CSS_SHADERS) && ENABLE_CSS_SHADERS
diff --git a/Source/WebCore/css/CSSValueList.idl b/Source/WebCore/css/CSSValueList.idl
index 0a4051b7a..23e27ec16 100644
--- a/Source/WebCore/css/CSSValueList.idl
+++ b/Source/WebCore/css/CSSValueList.idl
@@ -30,7 +30,7 @@ module css {
         IndexedGetter
     ] CSSValueList : CSSValue {
         readonly attribute unsigned long    length;
-        CSSValue           item(in [Optional=CallWithDefaultValue] unsigned long index);
+        CSSValue           item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/css/CSSValuePool.cpp b/Source/WebCore/css/CSSValuePool.cpp
index 3d8893ea8..c46c7047c 100644
--- a/Source/WebCore/css/CSSValuePool.cpp
+++ b/Source/WebCore/css/CSSValuePool.cpp
@@ -25,7 +25,10 @@
 
 #include "config.h"
 #include "CSSValuePool.h"
+
+#include "CSSParser.h"
 #include "CSSValueKeywords.h"
+#include "CSSValueList.h"
 
 namespace WebCore {
 
@@ -120,4 +123,25 @@ PassRefPtr<CSSPrimitiveValue> CSSValuePool::createValue(double value, CSSPrimiti
     return entry.first->second;
 }
 
+PassRefPtr<CSSPrimitiveValue> CSSValuePool::createFontFamilyValue(const String& familyName)
+{
+    RefPtr<CSSPrimitiveValue>& value = m_fontFamilyValueCache.add(familyName, 0).first->second;
+    if (!value)
+        value = CSSPrimitiveValue::create(familyName, CSSPrimitiveValue::CSS_STRING);
+    return value;
+}
+
+PassRefPtr<CSSValueList> CSSValuePool::createFontFaceValue(const AtomicString& string, CSSStyleSheet* contextStyleSheet)
+{
+    // Just wipe out the cache and start rebuilding if it gets too big.
+    const int maximumFontFaceCacheSize = 128;
+    if (m_fontFaceValueCache.size() > maximumFontFaceCacheSize)
+        m_fontFaceValueCache.clear();
+
+    RefPtr<CSSValueList>& value = m_fontFaceValueCache.add(string, 0).first->second;
+    if (!value)
+        value = CSSParser::parseFontFaceValue(string, contextStyleSheet);
+    return value;
+}
+
 }
diff --git a/Source/WebCore/css/CSSValuePool.h b/Source/WebCore/css/CSSValuePool.h
index bc751ebf7..ade9fe066 100644
--- a/Source/WebCore/css/CSSValuePool.h
+++ b/Source/WebCore/css/CSSValuePool.h
@@ -29,16 +29,21 @@
 #include "CSSInheritedValue.h"
 #include "CSSInitialValue.h"
 #include "CSSPrimitiveValue.h"
+#include <wtf/text/AtomicStringHash.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+class CSSValueList;
+
 class CSSValuePool : public RefCounted<CSSValuePool> {
 public:
     static PassRefPtr<CSSValuePool> create() { return adoptRef(new CSSValuePool); }
     ~CSSValuePool();
 
+    PassRefPtr<CSSValueList> createFontFaceValue(const AtomicString&, CSSStyleSheet* contextStyleSheet);
+    PassRefPtr<CSSPrimitiveValue> createFontFamilyValue(const String&);
     PassRefPtr<CSSInheritedValue> createInheritedValue() { return m_inheritedValue; }
     PassRefPtr<CSSInitialValue> createImplicitInitialValue() { return m_implicitInitialValue; }
     PassRefPtr<CSSInitialValue> createExplicitInitialValue() { return m_explicitInitialValue; }
@@ -71,6 +76,12 @@ private:
     IntegerValueCache m_pixelValueCache;
     IntegerValueCache m_percentValueCache;
     IntegerValueCache m_numberValueCache;
+
+    typedef HashMap<AtomicString, RefPtr<CSSValueList> > FontFaceValueCache;
+    FontFaceValueCache m_fontFaceValueCache;
+
+    typedef HashMap<String, RefPtr<CSSPrimitiveValue> > FontFamilyValueCache;
+    FontFamilyValueCache m_fontFamilyValueCache;
 };
 
 }
diff --git a/Source/WebCore/css/FontFamilyValue.cpp b/Source/WebCore/css/FontFamilyValue.cpp
deleted file mode 100644
index 665895d3a..000000000
--- a/Source/WebCore/css/FontFamilyValue.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * (C) 1999-2003 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "FontFamilyValue.h"
-
-#include "CSSParser.h"
-
-namespace WebCore {
-
-FontFamilyValue::FontFamilyValue(const String& familyName)
-    : CSSPrimitiveValue(FontFamilyClass, String(), CSS_STRING)
-    , m_familyName(familyName)
-{
-    // If there is anything in parentheses or square brackets at the end, delete it.
-    // FIXME: Do we really need this? The original code mentioned "a language tag in
-    // braces at the end" and "[Xft] qualifiers", but it's not clear either of those
-    // is in active use on the web.
-    unsigned length = m_familyName.length();
-    while (length >= 3) {
-        UChar startCharacter = 0;
-        switch (m_familyName[length - 1]) {
-            case ']':
-                startCharacter = '[';
-                break;
-            case ')':
-                startCharacter = '(';
-                break;
-        }
-        if (!startCharacter)
-            break;
-        unsigned first = 0;
-        for (unsigned i = length - 2; i > 0; --i) {
-            if (m_familyName[i - 1] == ' ' && m_familyName[i] == startCharacter)
-                first = i - 1;
-        }
-        if (!first)
-            break;
-        length = first;
-    }
-    m_familyName.truncate(length);
-}
-
-void FontFamilyValue::appendSpaceSeparated(const UChar* characters, unsigned length)
-{
-    m_familyName.append(' ');
-    m_familyName.append(characters, length);
-}
-
-String FontFamilyValue::customCssText() const
-{
-    return quoteCSSStringIfNeeded(m_familyName);
-}
-
-}
diff --git a/Source/WebCore/css/MediaList.idl b/Source/WebCore/css/MediaList.idl
index ed0d2ba4d..35445a3dd 100644
--- a/Source/WebCore/css/MediaList.idl
+++ b/Source/WebCore/css/MediaList.idl
@@ -31,14 +31,14 @@ module stylesheets {
         IndexedGetter
     ] MediaList {
 
-                 attribute [TreatNullAs=NullString, ConvertNullStringTo=Null] DOMString mediaText
+                 attribute [TreatNullAs=NullString, TreatReturnedNullStringAs=Null] DOMString mediaText
                      setter raises(DOMException);
         readonly attribute unsigned long length;
 
-        [ConvertNullStringTo=Null] DOMString item(in [Optional=CallWithDefaultValue] unsigned long index);
-        void deleteMedium(in [Optional=CallWithDefaultValue] DOMString oldMedium)
+        [TreatReturnedNullStringAs=Null] DOMString item(in [Optional=DefaultIsUndefined] unsigned long index);
+        void deleteMedium(in [Optional=DefaultIsUndefined] DOMString oldMedium)
             raises(DOMException);
-        void appendMedium(in [Optional=CallWithDefaultValue] DOMString newMedium)
+        void appendMedium(in [Optional=DefaultIsUndefined] DOMString newMedium)
             raises(DOMException);
 
     };
diff --git a/Source/WebCore/css/MediaQueryList.idl b/Source/WebCore/css/MediaQueryList.idl
index 0d8b1f22d..b4f7b9581 100644
--- a/Source/WebCore/css/MediaQueryList.idl
+++ b/Source/WebCore/css/MediaQueryList.idl
@@ -21,7 +21,7 @@ module view {
     interface MediaQueryList {
         readonly attribute DOMString media;
         readonly attribute boolean matches;
-        void addListener(in [Optional=CallWithDefaultValue] MediaQueryListListener listener);
-        void removeListener(in [Optional=CallWithDefaultValue] MediaQueryListListener listener);
+        void addListener(in [Optional=DefaultIsUndefined] MediaQueryListListener listener);
+        void removeListener(in [Optional=DefaultIsUndefined] MediaQueryListListener listener);
     };
 }
diff --git a/Source/WebCore/css/MediaQueryListListener.idl b/Source/WebCore/css/MediaQueryListListener.idl
index cd499eacc..d8f383aae 100644
--- a/Source/WebCore/css/MediaQueryListListener.idl
+++ b/Source/WebCore/css/MediaQueryListListener.idl
@@ -24,6 +24,6 @@ module view {
         CPPPureInterface,
         OmitConstructor
     ] MediaQueryListListener {
-        void queryChanged(in [Optional=CallWithDefaultValue] MediaQueryList list);
+        void queryChanged(in [Optional=DefaultIsUndefined] MediaQueryList list);
     };
 }
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
new file mode 100644
index 000000000..428f1957b
--- /dev/null
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
@@ -0,0 +1,321 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PropertySetCSSStyleDeclaration.h"
+
+#include "CSSParser.h"
+#include "HTMLNames.h"
+#include "InspectorInstrumentation.h"
+#include "MutationObserverInterestGroup.h"
+#include "MutationRecord.h"
+#include "StylePropertySet.h"
+#include "StyledElement.h"
+
+using namespace std;
+
+namespace WebCore {
+
+namespace {
+
+class StyleAttributeMutationScope {
+    WTF_MAKE_NONCOPYABLE(StyleAttributeMutationScope);
+public:
+    StyleAttributeMutationScope(PropertySetCSSStyleDeclaration* decl)
+    {
+        ++s_scopeCount;
+
+        if (s_scopeCount != 1) {
+            ASSERT(s_currentDecl == decl);
+            return;
+        }
+
+        ASSERT(!s_currentDecl);
+        s_currentDecl = decl;
+
+#if ENABLE(MUTATION_OBSERVERS)
+        if (!s_currentDecl->parentElement())
+            return;
+        m_mutationRecipients = MutationObserverInterestGroup::createForAttributesMutation(s_currentDecl->parentElement(), HTMLNames::styleAttr);
+        if (!m_mutationRecipients)
+            return;
+
+        AtomicString oldValue = m_mutationRecipients->isOldValueRequested() ? s_currentDecl->parentElement()->getAttribute(HTMLNames::styleAttr) : nullAtom;
+        m_mutation = MutationRecord::createAttributes(s_currentDecl->parentElement(), HTMLNames::styleAttr, oldValue);
+#endif
+    }
+
+    ~StyleAttributeMutationScope()
+    {
+        --s_scopeCount;
+        if (s_scopeCount)
+            return;
+
+#if ENABLE(MUTATION_OBSERVERS)
+        if (m_mutation && s_shouldDeliver)
+            m_mutationRecipients->enqueueMutationRecord(m_mutation);
+        s_shouldDeliver = false;
+#endif
+        if (!s_shouldNotifyInspector) {
+            s_currentDecl = 0;
+            return;
+        }
+        // We have to clear internal state before calling Inspector's code.
+        PropertySetCSSStyleDeclaration* localCopyStyleDecl = s_currentDecl;
+        s_currentDecl = 0;
+        s_shouldNotifyInspector = false;
+        if (localCopyStyleDecl->parentElement() && localCopyStyleDecl->parentElement()->document())
+            InspectorInstrumentation::didInvalidateStyleAttr(localCopyStyleDecl->parentElement()->document(), localCopyStyleDecl->parentElement());
+    }
+
+#if ENABLE(MUTATION_OBSERVERS)
+    void enqueueMutationRecord()
+    {
+        s_shouldDeliver = true;
+    }
+#endif
+
+    void didInvalidateStyleAttr()
+    {
+        s_shouldNotifyInspector = true;
+    }
+
+private:
+    static unsigned s_scopeCount;
+    static PropertySetCSSStyleDeclaration* s_currentDecl;
+    static bool s_shouldNotifyInspector;
+#if ENABLE(MUTATION_OBSERVERS)
+    static bool s_shouldDeliver;
+
+    OwnPtr<MutationObserverInterestGroup> m_mutationRecipients;
+    RefPtr<MutationRecord> m_mutation;
+#endif
+};
+
+unsigned StyleAttributeMutationScope::s_scopeCount = 0;
+PropertySetCSSStyleDeclaration* StyleAttributeMutationScope::s_currentDecl = 0;
+bool StyleAttributeMutationScope::s_shouldNotifyInspector = false;
+#if ENABLE(MUTATION_OBSERVERS)
+bool StyleAttributeMutationScope::s_shouldDeliver = false;
+#endif
+
+} // namespace
+    
+void PropertySetCSSStyleDeclaration::ref()
+{ 
+    m_propertySet->ref();
+}
+
+void PropertySetCSSStyleDeclaration::deref()
+{ 
+    m_propertySet->deref(); 
+}
+
+unsigned PropertySetCSSStyleDeclaration::length() const
+{
+    return m_propertySet->propertyCount();
+}
+
+String PropertySetCSSStyleDeclaration::item(unsigned i) const
+{
+    if (i >= m_propertySet->propertyCount())
+        return "";
+    return getPropertyName(static_cast<CSSPropertyID>(m_propertySet->propertyAt(i).id()));
+}
+
+String PropertySetCSSStyleDeclaration::cssText() const
+{
+    return m_propertySet->asText();
+}
+    
+void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCode& ec)
+{
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    ec = 0;
+    // FIXME: Detect syntax errors and set ec.
+    m_propertySet->parseDeclaration(text, contextStyleSheet());
+
+    setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+    mutationScope.enqueueMutationRecord();    
+#endif
+}
+
+PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValue(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return 0;
+    return m_propertySet->getPropertyCSSValue(propertyID);
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    return m_propertySet->getPropertyValue(propertyID);
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    return m_propertySet->propertyIsImportant(propertyID) ? "important" : "";
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    int shorthandID = m_propertySet->getPropertyShorthand(propertyID);
+    if (!shorthandID)
+        return String();
+    return getPropertyName(static_cast<CSSPropertyID>(shorthandID));
+}
+
+bool PropertySetCSSStyleDeclaration::isPropertyImplicit(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return false;
+    return m_propertySet->isPropertyImplicit(propertyID);
+}
+
+void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
+{
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return;
+    bool important = priority.find("important", 0, false) != notFound;
+    ec = 0;
+    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
+    if (changed) {
+        // CSS DOM requires raising SYNTAX_ERR of parsing failed, but this is too dangerous for compatibility,
+        // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
+        setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+        mutationScope.enqueueMutationRecord();
+#endif
+    }
+}
+
+String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName, ExceptionCode& ec)
+{
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    ec = 0;
+    String result;
+    bool changes = m_propertySet->removeProperty(propertyID, &result);
+    if (changes) {
+        setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+        mutationScope.enqueueMutationRecord();
+#endif
+    }
+    return result;
+}
+
+PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal(CSSPropertyID propertyID)
+{ 
+    return m_propertySet->getPropertyCSSValue(propertyID); 
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyValueInternal(CSSPropertyID propertyID)
+{ 
+    return m_propertySet->getPropertyValue(propertyID); 
+}
+
+void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyID, const String& value, bool important, ExceptionCode& ec)
+{ 
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    ec = 0;
+    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
+    if (changed) {
+        setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+        mutationScope.enqueueMutationRecord();
+#endif
+    }
+}
+
+CSSStyleSheet* PropertySetCSSStyleDeclaration::parentStyleSheet() const
+{ 
+    return contextStyleSheet(); 
+}
+
+PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::copy() const
+{
+    return m_propertySet->copy();
+}
+
+PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::makeMutable()
+{
+    return m_propertySet;
+}
+
+bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
+{
+    return m_propertySet->propertyMatches(property);
+}
+
+void RuleCSSStyleDeclaration::setNeedsStyleRecalc()
+{
+    if (CSSStyleSheet* styleSheet = contextStyleSheet()) {
+        if (Document* document = styleSheet->findDocument())
+            document->styleSelectorChanged(DeferRecalcStyle);
+    }
+}
+    
+CSSStyleSheet* RuleCSSStyleDeclaration::contextStyleSheet() const
+{
+    return m_parentRule ? m_parentRule->parentStyleSheet() : 0;
+}
+
+void InlineCSSStyleDeclaration::setNeedsStyleRecalc()
+{
+    if (!m_parentElement)
+        return;
+    m_parentElement->setNeedsStyleRecalc(InlineStyleChange);
+    m_parentElement->invalidateStyleAttribute();
+    StyleAttributeMutationScope(this).didInvalidateStyleAttr();
+    return;
+}
+
+CSSStyleSheet* InlineCSSStyleDeclaration::contextStyleSheet() const
+{
+    return m_parentElement ? m_parentElement->document()->elementSheet() : 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
new file mode 100644
index 000000000..0edb98cf4
--- /dev/null
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PropertySetCSSStyleDeclaration_h
+#define PropertySetCSSStyleDeclaration_h
+
+#include "CSSStyleDeclaration.h"
+
+namespace WebCore {
+
+class CSSRule;
+class CSSProperty;
+class CSSStyleSheet;
+class CSSValue;
+class StylePropertySet;
+class StyledElement;
+
+class PropertySetCSSStyleDeclaration : public CSSStyleDeclaration {
+public:
+    PropertySetCSSStyleDeclaration(StylePropertySet* propertySet) : m_propertySet(propertySet) { }
+    
+    virtual StyledElement* parentElement() const { return 0; }
+    virtual void clearParentRule() { ASSERT_NOT_REACHED(); }
+    virtual void clearParentElement() { ASSERT_NOT_REACHED(); }
+    virtual CSSStyleSheet* contextStyleSheet() const { return 0; }
+    
+private:
+    virtual void ref() OVERRIDE;
+    virtual void deref() OVERRIDE;
+    
+    virtual CSSRule* parentRule() const OVERRIDE { return 0; };
+    virtual unsigned length() const OVERRIDE;
+    virtual String item(unsigned index) const OVERRIDE;
+    virtual PassRefPtr<CSSValue> getPropertyCSSValue(const String& propertyName) OVERRIDE;
+    virtual String getPropertyValue(const String& propertyName) OVERRIDE;
+    virtual String getPropertyPriority(const String& propertyName) OVERRIDE;
+    virtual String getPropertyShorthand(const String& propertyName) OVERRIDE;
+    virtual bool isPropertyImplicit(const String& propertyName) OVERRIDE;
+    virtual void setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode&) OVERRIDE;
+    virtual String removeProperty(const String& propertyName, ExceptionCode&) OVERRIDE;
+    virtual String cssText() const OVERRIDE;
+    virtual void setCssText(const String&, ExceptionCode&) OVERRIDE;
+    virtual PassRefPtr<CSSValue> getPropertyCSSValueInternal(CSSPropertyID) OVERRIDE;
+    virtual String getPropertyValueInternal(CSSPropertyID) OVERRIDE;
+    virtual void setPropertyInternal(CSSPropertyID, const String& value, bool important, ExceptionCode&) OVERRIDE;
+    
+    virtual bool cssPropertyMatches(const CSSProperty*) const OVERRIDE;
+    virtual CSSStyleSheet* parentStyleSheet() const OVERRIDE;
+    virtual PassRefPtr<StylePropertySet> copy() const OVERRIDE;
+    virtual PassRefPtr<StylePropertySet> makeMutable() OVERRIDE;
+    virtual void setNeedsStyleRecalc() { }    
+    
+protected:
+    StylePropertySet* m_propertySet;
+};
+
+class RuleCSSStyleDeclaration : public PropertySetCSSStyleDeclaration
+{
+public:
+    RuleCSSStyleDeclaration(StylePropertySet* propertySet, CSSRule* parentRule)
+        : PropertySetCSSStyleDeclaration(propertySet)
+        , m_parentRule(parentRule) 
+    {
+    }
+    
+private:    
+    virtual CSSRule* parentRule() const { return m_parentRule; };
+    virtual void clearParentRule() { m_parentRule = 0; }
+    virtual void setNeedsStyleRecalc();
+    virtual CSSStyleSheet* contextStyleSheet() const;
+    
+    CSSRule* m_parentRule;
+};
+
+class InlineCSSStyleDeclaration : public PropertySetCSSStyleDeclaration
+{
+public:
+    InlineCSSStyleDeclaration(StylePropertySet* propertySet, StyledElement* parentElement)
+        : PropertySetCSSStyleDeclaration(propertySet)
+        , m_parentElement(parentElement) 
+    {
+    }
+    
+private:
+    virtual StyledElement* parentElement() const { return m_parentElement; }
+    virtual void clearParentElement() { m_parentElement = 0; }
+    virtual void setNeedsStyleRecalc();
+    virtual CSSStyleSheet* contextStyleSheet() const;
+    
+    StyledElement* m_parentElement;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index d4636b710..bc216605d 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -468,6 +468,10 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
     nextContext.selector = historySelector;
 
     if (relation != CSSSelector::SubSelector) {
+        // Abort if the next selector would exceed the scope.
+        if (context.element == context.scope)
+            return SelectorFailsCompletely;
+
         // Bail-out if this selector is irrelevant for the pseudoStyle
         if (m_pseudoStyle != NOPSEUDO && m_pseudoStyle != dynamicPseudo)
             return SelectorFailsCompletely;
@@ -487,6 +491,8 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
             SelectorMatch match = checkSelector(nextContext, dynamicPseudo);
             if (match == SelectorMatches || match == SelectorFailsCompletely)
                 return match;
+            if (nextContext.element == nextContext.scope)
+                return SelectorFailsCompletely;
         }
         return SelectorFailsCompletely;
 
@@ -542,6 +548,9 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
 
     case CSSSelector::ShadowDescendant:
         {
+            // If we're in the same tree-scope as the scoping element, then following a shadow descendant combinator would escape that and thus the scope.
+            if (context.scope && context.scope->treeScope() == context.element->treeScope())
+                return SelectorFailsCompletely;
             Node* shadowHostNode = context.element->shadowAncestorNode();
             if (shadowHostNode == context.element || !shadowHostNode->isElementNode())
                 return SelectorFailsCompletely;
@@ -771,7 +780,7 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, P
                         break;
                     }
                     if (n->isTextNode()) {
-                        Text* textNode = static_cast<Text*>(n);
+                        Text* textNode = toText(n);
                         if (!textNode->data().isEmpty()) {
                             result = false;
                             break;
diff --git a/Source/WebCore/css/SelectorChecker.h b/Source/WebCore/css/SelectorChecker.h
index 06b619d87..7e80808dd 100644
--- a/Source/WebCore/css/SelectorChecker.h
+++ b/Source/WebCore/css/SelectorChecker.h
@@ -54,17 +54,19 @@ public:
 
     struct SelectorCheckingContext {
         // Initial selector constructor
-        SelectorCheckingContext(CSSSelector* selector, Element* element, VisitedMatchType visitedMatchType, RenderStyle* elementStyle = 0, RenderStyle* elementParentStyle = 0)
+        SelectorCheckingContext(CSSSelector* selector, Element* element, VisitedMatchType visitedMatchType)
             : selector(selector)
             , element(element)
+            , scope(0)
             , visitedMatchType(visitedMatchType)
-            , elementStyle(elementStyle)
-            , elementParentStyle(elementParentStyle)
+            , elementStyle(0)
+            , elementParentStyle(0)
             , isSubSelector(false)
         { }
 
         CSSSelector* selector;
         Element* element;
+        const Element* scope;
         VisitedMatchType visitedMatchType;
         RenderStyle* elementStyle;
         RenderStyle* elementParentStyle;
@@ -143,7 +145,7 @@ private:
         Vector<unsigned, 4> identifierHashes;
     };
     Vector<ParentStackFrame> m_parentStack;
-    
+
     // With 100 unique strings in the filter, 2^12 slot table has false positive rate of ~0.2%.
     static const unsigned bloomFilterKeyBits = 12;
     OwnPtr<BloomFilter<bloomFilterKeyBits> > m_ancestorIdentifierFilter;
diff --git a/Source/WebCore/css/StyleMedia.idl b/Source/WebCore/css/StyleMedia.idl
index 6ff457803..5dd58da1f 100644
--- a/Source/WebCore/css/StyleMedia.idl
+++ b/Source/WebCore/css/StyleMedia.idl
@@ -29,6 +29,6 @@ module view {
         JSGenerateIsReachable=ImplFrame
     ] StyleMedia {
         readonly attribute DOMString type;
-        boolean matchMedium(in [Optional=CallWithDefaultValue] DOMString mediaquery);
+        boolean matchMedium(in [Optional=DefaultIsUndefined] DOMString mediaquery);
     };
 }
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index 11ec77172..e8d97cacc 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -22,182 +22,44 @@
 #include "config.h"
 #include "StylePropertySet.h"
 
-#include "CSSImageValue.h"
 #include "CSSParser.h"
 #include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
-#include "CSSRule.h"
-#include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
+#include "CSSValuePool.h"
 #include "Document.h"
-#include "ExceptionCode.h"
-#include "HTMLNames.h"
-#include "InspectorInstrumentation.h"
-#include "MutationObserverInterestGroup.h"
-#include "MutationRecord.h"
-#include "StyledElement.h"
-#include "WebKitMutationObserver.h"
+#include "PropertySetCSSStyleDeclaration.h"
 #include <wtf/text/StringBuilder.h>
-#include <wtf/text/WTFString.h>
 
 using namespace std;
 
 namespace WebCore {
 
-class PropertySetCSSStyleDeclaration : public CSSStyleDeclaration {
-public:
-    static PassRefPtr<PropertySetCSSStyleDeclaration> create(PassRefPtr<StylePropertySet> propertySet)
-    {
-        return adoptRef(new PropertySetCSSStyleDeclaration(propertySet)); 
-    }
-
-private:
-    PropertySetCSSStyleDeclaration(PassRefPtr<StylePropertySet> propertySet) : m_propertySet(propertySet) { }
-    
-    virtual CSSRule* parentRule() const OVERRIDE;
-    virtual unsigned length() const OVERRIDE;
-    virtual String item(unsigned index) const;
-    virtual PassRefPtr<CSSValue> getPropertyCSSValue(const String& propertyName) OVERRIDE;
-    virtual String getPropertyValue(const String& propertyName) OVERRIDE;
-    virtual String getPropertyPriority(const String& propertyName) OVERRIDE;
-    virtual String getPropertyShorthand(const String& propertyName) OVERRIDE;
-    virtual bool isPropertyImplicit(const String& propertyName) OVERRIDE;
-    virtual void setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode&) OVERRIDE;
-    virtual String removeProperty(const String& propertyName, ExceptionCode&) OVERRIDE;
-    virtual String cssText() const OVERRIDE;
-    virtual void setCssText(const String&, ExceptionCode&);
-    virtual PassRefPtr<CSSValue> getPropertyCSSValueInternal(CSSPropertyID) OVERRIDE;
-    virtual String getPropertyValueInternal(CSSPropertyID) OVERRIDE;
-    virtual void setPropertyInternal(CSSPropertyID, const String& value, bool important, ExceptionCode&) OVERRIDE;
-    
-    virtual bool cssPropertyMatches(const CSSProperty*) const OVERRIDE;
-    virtual CSSStyleSheet* parentStyleSheet() const OVERRIDE;
-    virtual PassRefPtr<StylePropertySet> copy() const OVERRIDE;
-    virtual PassRefPtr<StylePropertySet> makeMutable() OVERRIDE;
-    
-    RefPtr<StylePropertySet> m_propertySet;
-};
-
-namespace {
-
-class StyleAttributeMutationScope {
-    WTF_MAKE_NONCOPYABLE(StyleAttributeMutationScope);
-public:
-    StyleAttributeMutationScope(StylePropertySet* decl)
-    {
-        ++s_scopeCount;
-
-        if (s_scopeCount != 1) {
-            ASSERT(s_currentDecl == decl);
-            return;
-        }
-
-        ASSERT(!s_currentDecl);
-        s_currentDecl = decl;
-
-#if ENABLE(MUTATION_OBSERVERS)
-        if (!s_currentDecl->isInlineStyleDeclaration())
-            return;
-        if (!s_currentDecl->parentElement())
-            return;
-        m_mutationRecipients = MutationObserverInterestGroup::createForAttributesMutation(s_currentDecl->parentElement(), HTMLNames::styleAttr);
-        if (!m_mutationRecipients)
-            return;
-
-        AtomicString oldValue = m_mutationRecipients->isOldValueRequested() ? s_currentDecl->parentElement()->getAttribute(HTMLNames::styleAttr) : nullAtom;
-        m_mutation = MutationRecord::createAttributes(s_currentDecl->parentElement(), HTMLNames::styleAttr, oldValue);
-#endif
-    }
-
-    ~StyleAttributeMutationScope()
-    {
-        --s_scopeCount;
-        if (s_scopeCount)
-            return;
-
-#if ENABLE(MUTATION_OBSERVERS)
-        if (m_mutation && s_shouldDeliver)
-            m_mutationRecipients->enqueueMutationRecord(m_mutation);
-        s_shouldDeliver = false;
-#endif
-        if (!s_shouldNotifyInspector) {
-            s_currentDecl = 0;
-            return;
-        }
-        // We have to clear internal state before calling Inspector's code.
-        StylePropertySet* localCopyStyleDecl = s_currentDecl;
-        s_currentDecl = 0;
-        s_shouldNotifyInspector = false;
-        if (localCopyStyleDecl->isInlineStyleDeclaration() && localCopyStyleDecl->parentElement() && localCopyStyleDecl->parentElement()->document())
-            InspectorInstrumentation::didInvalidateStyleAttr(localCopyStyleDecl->parentElement()->document(), localCopyStyleDecl->parentElement());
-    }
-
-#if ENABLE(MUTATION_OBSERVERS)
-    void enqueueMutationRecord()
-    {
-        s_shouldDeliver = true;
-    }
-#endif
-
-    void didInvalidateStyleAttr()
-    {
-        ASSERT(s_currentDecl->isInlineStyleDeclaration());
-        s_shouldNotifyInspector = true;
-    }
-
-private:
-    static unsigned s_scopeCount;
-    static StylePropertySet* s_currentDecl;
-    static bool s_shouldNotifyInspector;
-#if ENABLE(MUTATION_OBSERVERS)
-    static bool s_shouldDeliver;
-
-    OwnPtr<MutationObserverInterestGroup> m_mutationRecipients;
-    RefPtr<MutationRecord> m_mutation;
-#endif
-};
-
-unsigned StyleAttributeMutationScope::s_scopeCount = 0;
-StylePropertySet* StyleAttributeMutationScope::s_currentDecl = 0;
-bool StyleAttributeMutationScope::s_shouldNotifyInspector = false;
-#if ENABLE(MUTATION_OBSERVERS)
-bool StyleAttributeMutationScope::s_shouldDeliver = false;
-#endif
-
-} // namespace
-
-StylePropertySet::StylePropertySet()
-    : m_strictParsing(false)
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(static_cast<CSSRule*>(0))
+typedef HashMap<const StylePropertySet*, OwnPtr<PropertySetCSSStyleDeclaration> > PropertySetCSSOMWrapperMap;
+static PropertySetCSSOMWrapperMap& propertySetCSSOMWrapperMap()
 {
+    DEFINE_STATIC_LOCAL(PropertySetCSSOMWrapperMap, propertySetCSSOMWrapperMapInstance, ());
+    return propertySetCSSOMWrapperMapInstance;
 }
 
-StylePropertySet::StylePropertySet(CSSRule* parentRule)
-    : m_strictParsing(!parentRule || parentRule->useStrictParsing())
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(parentRule)
+StylePropertySet::StylePropertySet()
+    : m_strictParsing(false)
+    , m_hasCSSOMWrapper(false)
 {
 }
 
-StylePropertySet::StylePropertySet(CSSRule* parentRule, const Vector<CSSProperty>& properties)
+StylePropertySet::StylePropertySet(const Vector<CSSProperty>& properties)
     : m_properties(properties)
-    , m_strictParsing(!parentRule || parentRule->useStrictParsing())
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(parentRule)
+    , m_strictParsing(true)
+    , m_hasCSSOMWrapper(false)
 {
     m_properties.shrinkToFit();
 }
 
-StylePropertySet::StylePropertySet(CSSRule* parentRule, const CSSProperty* const * properties, int numProperties)
-    : m_strictParsing(!parentRule || parentRule->useStrictParsing())
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(parentRule)
+StylePropertySet::StylePropertySet(const CSSProperty* const * properties, int numProperties, bool useStrictParsing)
+    : m_strictParsing(useStrictParsing)
+    , m_hasCSSOMWrapper(false)
 {
     m_properties.reserveInitialCapacity(numProperties);
     HashMap<int, bool> candidates;
@@ -210,7 +72,7 @@ StylePropertySet::StylePropertySet(CSSRule* parentRule, const CSSProperty* const
         if (it != candidates.end()) {
             if (!important && it->second)
                 continue;
-            removeProperty(property->id(), false, false);
+            removeProperty(property->id());
         }
 
         m_properties.append(*property);
@@ -218,37 +80,11 @@ StylePropertySet::StylePropertySet(CSSRule* parentRule, const CSSProperty* const
     }
 }
 
-StylePropertySet::StylePropertySet(StyledElement* parentElement, bool isInlineStyle)
-    : m_strictParsing(false)
-    , m_parentIsElement(true)
-    , m_isInlineStyleDeclaration(isInlineStyle)
-    , m_parent(parentElement)
-{
-}
-
 StylePropertySet::~StylePropertySet()
 {
-}
-
-void StylePropertySet::deref()
-{
-    if (derefBase()) {
-        delete this;
-        return;
-    }
-    // StylePropertySet and CSSStyleDeclaration ref each other. When we have a declaration and
-    // our refcount drops to one we know it is the only thing keeping us alive.
-    if (m_cssStyleDeclaration && hasOneRef())
-        m_cssStyleDeclaration.clear();
-}
-
-CSSStyleSheet* StylePropertySet::contextStyleSheet() const
-{
-    if (m_parentIsElement) {
-        Document* document = m_parent.element ? m_parent.element->document() : 0;
-        return document ? document->elementSheet() : 0;
-    }
-    return m_parent.rule ? m_parent.rule->parentStyleSheet() : 0;
+    ASSERT(!m_hasCSSOMWrapper || propertySetCSSOMWrapperMap().contains(this));
+    if (m_hasCSSOMWrapper)
+        propertySetCSSOMWrapperMap().remove(this);
 }
 
 void StylePropertySet::copyPropertiesFrom(const StylePropertySet& other)
@@ -669,67 +505,38 @@ PassRefPtr<CSSValue> StylePropertySet::getPropertyCSSValue(int propertyID) const
     return property ? property->value() : 0;
 }
 
-bool StylePropertySet::removeShorthandProperty(int propertyID, bool notifyChanged)
+bool StylePropertySet::removeShorthandProperty(int propertyID)
 {
     CSSPropertyLonghand longhand = longhandForProperty(propertyID);
     if (!longhand.length())
         return false;
-    return removePropertiesInSet(longhand.properties(), longhand.length(), notifyChanged);
+    return removePropertiesInSet(longhand.properties(), longhand.length());
 }
 
-String StylePropertySet::removeProperty(int propertyID, bool notifyChanged, bool returnText)
+bool StylePropertySet::removeProperty(int propertyID, String* returnText)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
-    if (removeShorthandProperty(propertyID, notifyChanged)) {
+    if (removeShorthandProperty(propertyID)) {
         // FIXME: Return an equivalent shorthand when possible.
-        return String();
+        if (returnText)
+            *returnText = "";
+        return true;
     }
 
     CSSProperty* foundProperty = findPropertyWithId(propertyID);
-    if (!foundProperty)
-        return String();
+    if (!foundProperty) {
+        if (returnText)
+            *returnText = "";
+        return false;
+    }
 
-    String value = returnText ? foundProperty->value()->cssText() : String();
+    if (returnText)
+        *returnText = foundProperty->value()->cssText();
 
     // A more efficient removal strategy would involve marking entries as empty
     // and sweeping them when the vector grows too big.
     m_properties.remove(foundProperty - m_properties.data());
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    if (notifyChanged)
-        setNeedsStyleRecalc();
-
-    return value;
-}
-
-void StylePropertySet::setNeedsStyleRecalc()
-{
-    if (m_parentIsElement) {
-        StyledElement* element = parentElement();
-        if (!element)
-            return;
-
-        if (!m_isInlineStyleDeclaration) {
-            element->setNeedsStyleRecalc();
-            return;
-        }
-
-        element->setNeedsStyleRecalc(InlineStyleChange);
-        element->invalidateStyleAttribute();
-        StyleAttributeMutationScope(this).didInvalidateStyleAttr();
-        return;
-    }
-
-    if (CSSStyleSheet* styleSheet = contextStyleSheet()) {
-        if (Document* document = styleSheet->findDocument())
-            document->styleSelectorChanged(DeferRecalcStyle);
-    }
+    
+    return true;
 }
 
 bool StylePropertySet::propertyIsImportant(int propertyID) const
@@ -761,45 +568,38 @@ bool StylePropertySet::isPropertyImplicit(int propertyID) const
     return property ? property->isImplicit() : false;
 }
 
-bool StylePropertySet::setProperty(int propertyID, const String& value, bool important, bool notifyChanged)
+bool StylePropertySet::setProperty(int propertyID, const String& value, bool important, CSSStyleSheet* contextStyleSheet)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     // Setting the value to an empty string just removes the property in both IE and Gecko.
     // Setting it to null seems to produce less consistent results, but we treat it just the same.
     if (value.isEmpty()) {
-        removeProperty(propertyID, notifyChanged, false);
+        removeProperty(propertyID);
         return true;
     }
 
     // When replacing an existing property value, this moves the property to the end of the list.
     // Firefox preserves the position, and MSIE moves the property to the beginning.
-    bool success = CSSParser::parseValue(this, propertyID, value, important, useStrictParsing());
-    if (!success) {
-        // CSS DOM requires raising SYNTAX_ERR here, but this is too dangerous for compatibility,
-        // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
-        return false;
-    }
+    return CSSParser::parseValue(this, propertyID, value, important, useStrictParsing(), contextStyleSheet);
+}
 
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
+void StylePropertySet::setProperty(int propertyID, PassRefPtr<CSSValue> prpValue, bool important)
+{
+    CSSPropertyLonghand longhand = longhandForProperty(propertyID);
+    if (!longhand.length()) {
+        setProperty(CSSProperty(propertyID, prpValue, important));
+        return;
+    }
 
-    if (notifyChanged)
-        setNeedsStyleRecalc();
+    removePropertiesInSet(longhand.properties(), longhand.length());
 
-    return true;
+    RefPtr<CSSValue> value = prpValue;
+    for (unsigned i = 0; i < longhand.length(); ++i)
+        m_properties.append(CSSProperty(longhand.properties()[i], value, important));
 }
 
 void StylePropertySet::setProperty(const CSSProperty& property, CSSProperty* slot)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
-    if (!removeShorthandProperty(property.id(), false)) {
+    if (!removeShorthandProperty(property.id())) {
         CSSProperty* toReplace = slot ? slot : findPropertyWithId(property.id());
         if (toReplace) {
             *toReplace = property;
@@ -807,80 +607,41 @@ void StylePropertySet::setProperty(const CSSProperty& property, CSSProperty* slo
         }
     }
     m_properties.append(property);
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
 }
 
-bool StylePropertySet::setProperty(int propertyID, int value, bool important, bool notifyChanged)
+bool StylePropertySet::setProperty(int propertyID, int identifier, bool important, CSSStyleSheet* contextStyleSheet)
 {
-    CSSProperty property(propertyID, CSSPrimitiveValue::createIdentifier(value), important);
-    setProperty(property);
-    if (notifyChanged)
-        setNeedsStyleRecalc();
-    return true;
-}
+    RefPtr<CSSPrimitiveValue> value;    
+    if (Document* document = contextStyleSheet ? contextStyleSheet->findDocument() : 0)
+        value = document->cssValuePool()->createIdentifierValue(identifier);
+    else
+        value = CSSPrimitiveValue::createIdentifier(identifier);
 
-bool StylePropertySet::setProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes unit, bool important, bool notifyChanged)
-{
-    CSSProperty property(propertyID, CSSPrimitiveValue::create(value, unit), important);
-    setProperty(property);
-    if (notifyChanged)
-        setNeedsStyleRecalc();
+    setProperty(CSSProperty(propertyID, value.release(), important));
     return true;
 }
 
-void StylePropertySet::parseDeclaration(const String& styleDeclaration)
+void StylePropertySet::parseDeclaration(const String& styleDeclaration, CSSStyleSheet* contextStyleSheet)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     m_properties.clear();
     CSSParser parser(useStrictParsing());
-    parser.parseDeclaration(this, styleDeclaration);
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    setNeedsStyleRecalc();
+    parser.parseDeclaration(this, styleDeclaration, 0, contextStyleSheet);
 }
 
 void StylePropertySet::addParsedProperties(const CSSProperty* const* properties, int numProperties)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     m_properties.reserveCapacity(numProperties);
     for (int i = 0; i < numProperties; ++i)
         addParsedProperty(*properties[i]);
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
-    // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
 void StylePropertySet::addParsedProperty(const CSSProperty& property)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     // Only add properties that have no !important counterpart present
     if (!propertyIsImportant(property.id()) || property.isImportant()) {
-        removeProperty(property.id(), false, false);
+        removeProperty(property.id());
         m_properties.append(property);
     }
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
 }
 
 String StylePropertySet::asText() const
@@ -947,10 +708,6 @@ String StylePropertySet::asText() const
 
 void StylePropertySet::merge(const StylePropertySet* other, bool argOverridesOnConflict)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     unsigned size = other->m_properties.size();
     for (unsigned n = 0; n < size; ++n) {
         const CSSProperty& toMerge = other->m_properties[n];
@@ -962,21 +719,13 @@ void StylePropertySet::merge(const StylePropertySet* other, bool argOverridesOnC
         } else
             m_properties.append(toMerge);
     }
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
-    // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
-void StylePropertySet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
+void StylePropertySet::addSubresourceStyleURLs(ListHashSet<KURL>& urls, CSSStyleSheet* contextStyleSheet)
 {
-    CSSStyleSheet* sheet = contextStyleSheet();
     size_t size = m_properties.size();
     for (size_t i = 0; i < size; ++i)
-        m_properties[i].value()->addSubresourceStyleURLs(urls, sheet);
+        m_properties[i].value()->addSubresourceStyleURLs(urls, contextStyleSheet);
 }
 
 // This is the list of properties we want to copy in the copyBlockProperties() function.
@@ -1017,15 +766,11 @@ void StylePropertySet::removeBlockProperties()
     removePropertiesInSet(blockProperties, numBlockProperties);
 }
 
-bool StylePropertySet::removePropertiesInSet(const int* set, unsigned length, bool notifyChanged)
+bool StylePropertySet::removePropertiesInSet(const int* set, unsigned length)
 {
     if (m_properties.isEmpty())
         return false;
 
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     // FIXME: This is always used with static sets and in that case constructing the hash repeatedly is pretty pointless.
     HashSet<int> toRemove;
     for (unsigned i = 0; i < length; ++i)
@@ -1047,14 +792,6 @@ bool StylePropertySet::removePropertiesInSet(const int* set, unsigned length, bo
 
     bool changed = newProperties.size() != m_properties.size();
     m_properties = newProperties;
-
-    if (notifyChanged) {
-#if ENABLE(MUTATION_OBSERVERS)
-        mutationScope.enqueueMutationRecord();
-#endif
-        setNeedsStyleRecalc();
-    }
-
     return changed;
 }
 
@@ -1112,7 +849,7 @@ void StylePropertySet::removeEquivalentProperties(const CSSStyleDeclaration* sty
 
 PassRefPtr<StylePropertySet> StylePropertySet::copy() const
 {
-    return adoptRef(new StylePropertySet(0, m_properties));
+    return adoptRef(new StylePropertySet(m_properties));
 }
 
 PassRefPtr<StylePropertySet> StylePropertySet::copyPropertiesInSet(const int* set, unsigned length) const
@@ -1129,139 +866,61 @@ PassRefPtr<StylePropertySet> StylePropertySet::copyPropertiesInSet(const int* se
 
 CSSStyleDeclaration* StylePropertySet::ensureCSSStyleDeclaration() const
 {
-    if (!m_cssStyleDeclaration)
-        m_cssStyleDeclaration = PropertySetCSSStyleDeclaration::create(const_cast<StylePropertySet*>(this));
-    return m_cssStyleDeclaration.get();
-}
-
-unsigned PropertySetCSSStyleDeclaration::length() const
-{
-    return m_propertySet->propertyCount();
-}
-
-String PropertySetCSSStyleDeclaration::item(unsigned i) const
-{
-    if (i >= m_propertySet->propertyCount())
-        return "";
-    return getPropertyName(static_cast<CSSPropertyID>(m_propertySet->propertyAt(i).id()));
-}
-
-CSSRule* PropertySetCSSStyleDeclaration::parentRule() const
-{
-    return m_propertySet->parentRuleInternal();
-}
-
-String PropertySetCSSStyleDeclaration::cssText() const
-{
-    return m_propertySet->asText();
-}
-    
-void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCode& ec)
-{
-    ec = 0;
-    // FIXME: Detect syntax errors and set ec.
-    m_propertySet->parseDeclaration(text);
-}
-
-PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValue(const String& propertyName)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return 0;
-    return m_propertySet->getPropertyCSSValue(propertyID);
-}
-
-String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyName)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    return m_propertySet->getPropertyValue(propertyID);
-}
-
-String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propertyName)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    return m_propertySet->propertyIsImportant(propertyID) ? "important" : "";
+    if (m_hasCSSOMWrapper) {
+        ASSERT(!static_cast<CSSStyleDeclaration*>(propertySetCSSOMWrapperMap().get(this))->parentRule());
+        ASSERT(!propertySetCSSOMWrapperMap().get(this)->parentElement());
+        return propertySetCSSOMWrapperMap().get(this);
+    }
+    m_hasCSSOMWrapper = true;
+    PropertySetCSSStyleDeclaration* cssomWrapper = new PropertySetCSSStyleDeclaration(const_cast<StylePropertySet*>(this));
+    propertySetCSSOMWrapperMap().add(this, adoptPtr(cssomWrapper));
+    return cssomWrapper;
 }
 
-String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& propertyName)
+CSSStyleDeclaration* StylePropertySet::ensureRuleCSSStyleDeclaration(const CSSRule* parentRule) const
 {
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    int shorthandID = m_propertySet->getPropertyShorthand(propertyID);
-    if (!shorthandID)
-        return String();
-    return getPropertyName(static_cast<CSSPropertyID>(shorthandID));
+    if (m_hasCSSOMWrapper) {
+        ASSERT(static_cast<CSSStyleDeclaration*>(propertySetCSSOMWrapperMap().get(this))->parentRule() == parentRule);
+        return propertySetCSSOMWrapperMap().get(this);
+    }
+    m_hasCSSOMWrapper = true;
+    PropertySetCSSStyleDeclaration* cssomWrapper = new RuleCSSStyleDeclaration(const_cast<StylePropertySet*>(this), const_cast<CSSRule*>(parentRule));
+    propertySetCSSOMWrapperMap().add(this, adoptPtr(cssomWrapper));
+    return cssomWrapper;
 }
 
-bool PropertySetCSSStyleDeclaration::isPropertyImplicit(const String& propertyName)
+CSSStyleDeclaration* StylePropertySet::ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const
 {
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return false;
-    return m_propertySet->isPropertyImplicit(propertyID);
+    if (m_hasCSSOMWrapper) {
+        ASSERT(propertySetCSSOMWrapperMap().get(this)->parentElement() == parentElement);
+        return propertySetCSSOMWrapperMap().get(this);
+    }
+    m_hasCSSOMWrapper = true;
+    PropertySetCSSStyleDeclaration* cssomWrapper = new InlineCSSStyleDeclaration(const_cast<StylePropertySet*>(this), const_cast<StyledElement*>(parentElement));
+    propertySetCSSOMWrapperMap().add(this, adoptPtr(cssomWrapper));
+    return cssomWrapper;
 }
 
-void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
+void StylePropertySet::clearParentRule(CSSRule* rule)
 {
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
+    if (!m_hasCSSOMWrapper)
         return;
-    bool important = priority.find("important", 0, false) != notFound;
-    ec = 0;
-    m_propertySet->setProperty(propertyID, value, important, true);
-}
-
-String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName, ExceptionCode& ec)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    ec = 0;
-    return m_propertySet->removeProperty(propertyID, true, true);
-}
-
-PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal(CSSPropertyID propertyID)
-{ 
-    return m_propertySet->getPropertyCSSValue(propertyID); 
-}
-
-String PropertySetCSSStyleDeclaration::getPropertyValueInternal(CSSPropertyID propertyID)
-{ 
-    return m_propertySet->getPropertyValue(propertyID); 
+    ASSERT_UNUSED(rule, static_cast<CSSStyleDeclaration*>(propertySetCSSOMWrapperMap().get(this))->parentRule() == rule);
+    propertySetCSSOMWrapperMap().get(this)->clearParentRule();
 }
 
-void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyID, const String& value, bool important, ExceptionCode& ec)
-{ 
-    ec = 0;
-    m_propertySet->setProperty(propertyID, value, important, true);
-}
-
-CSSStyleSheet* PropertySetCSSStyleDeclaration::parentStyleSheet() const
-{ 
-    return m_propertySet->contextStyleSheet(); 
-}
-
-PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::copy() const
+void StylePropertySet::clearParentElement(StyledElement* element)
 {
-    return m_propertySet->copy();
-}
-
-PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::makeMutable()
-{
-    ASSERT(m_propertySet->m_cssStyleDeclaration == this || (!m_propertySet->m_cssStyleDeclaration && m_propertySet->hasOneRef()));
-    if (!m_propertySet->m_cssStyleDeclaration)
-        m_propertySet->m_cssStyleDeclaration = this;
-    return m_propertySet;
+    if (!m_hasCSSOMWrapper)
+        return;
+    ASSERT_UNUSED(element, propertySetCSSOMWrapperMap().get(this)->parentElement() == element);
+    propertySetCSSOMWrapperMap().get(this)->clearParentElement();
 }
 
-bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
-{
-    return m_propertySet->propertyMatches(property);
-}
+class SameSizeAsStylePropertySet : public RefCounted<SameSizeAsStylePropertySet> {
+    Vector<CSSProperty, 4> properties;
+    unsigned bitfield;
+};
+COMPILE_ASSERT(sizeof(StylePropertySet) == sizeof(SameSizeAsStylePropertySet), style_property_set_should_stay_small);
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index a61b3767d..9aeb2e4ae 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -23,18 +23,19 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
-#include "CSSStyleDeclaration.h"
-#include "KURLHash.h"
-#include "PlatformString.h"
 #include <wtf/ListHashSet.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
+class CSSRule;
+class CSSStyleDeclaration;
+class KURL;
 class PropertySetCSSStyleDeclaration;
 class StyledElement;
 
-class StylePropertySet : public WTF::RefCountedBase {
+class StylePropertySet : public RefCounted<StylePropertySet> {
 public:
     ~StylePropertySet();
 
@@ -42,67 +43,52 @@ public:
     {
         return adoptRef(new StylePropertySet);
     }
-    static PassRefPtr<StylePropertySet> create(CSSRule* parentRule)
+    static PassRefPtr<StylePropertySet> create(const CSSProperty* const* properties, int numProperties, bool useStrictParsing)
     {
-        return adoptRef(new StylePropertySet(parentRule));
-    }
-    static PassRefPtr<StylePropertySet> create(CSSRule* parentRule, const CSSProperty* const* properties, int numProperties)
-    {
-        return adoptRef(new StylePropertySet(parentRule, properties, numProperties));
+        return adoptRef(new StylePropertySet(properties, numProperties, useStrictParsing));
     }
     static PassRefPtr<StylePropertySet> create(const Vector<CSSProperty>& properties)
     {
-        return adoptRef(new StylePropertySet(0, properties));
-    }
-    static PassRefPtr<StylePropertySet> createInline(StyledElement* element)
-    {
-        return adoptRef(new StylePropertySet(element, /*isInlineStyle*/ true));
+        return adoptRef(new StylePropertySet(properties));
     }
-    static PassRefPtr<StylePropertySet> createAttributeStyle(StyledElement* element)
-    {
-        return adoptRef(new StylePropertySet(element, /*isInlineStyle*/ false));
-    }
-
-    void deref();
 
     unsigned propertyCount() const { return m_properties.size(); }
     bool isEmpty() const { return m_properties.isEmpty(); }
     const CSSProperty& propertyAt(unsigned index) const { return m_properties[index]; }
 
+    void shrinkToFit() { m_properties.shrinkToFit(); }
+
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID) const;
     String getPropertyValue(int propertyID) const;
     bool propertyIsImportant(int propertyID) const;
     int getPropertyShorthand(int propertyID) const;
     bool isPropertyImplicit(int propertyID) const;
 
-    bool setProperty(int propertyID, int value, bool important = false) { return setProperty(propertyID, value, important, true); }
-    bool setProperty(int propertyId, double value, CSSPrimitiveValue::UnitTypes unit, bool important = false) { return setProperty(propertyId, value, unit, important, true); }
-    bool setProperty(int propertyID, const String& value, bool important = false) { return setProperty(propertyID, value, important, true); }
+    // These expand shorthand properties into multiple properties.
+    bool setProperty(int propertyID, const String& value, bool important = false, CSSStyleSheet* contextStyleSheet = 0);
+    void setProperty(int propertyID, PassRefPtr<CSSValue>, bool important = false);
+
+    // These do not. FIXME: This is too messy, we can do better.
+    bool setProperty(int propertyID, int value, bool important = false, CSSStyleSheet* contextStyleSheet = 0);
     void setProperty(const CSSProperty&, CSSProperty* slot = 0);
     
-    void removeProperty(int propertyID) { removeProperty(propertyID, true, false); }
-    String removeProperty(int propertyID, bool notifyChanged, bool returnText);
+    bool removeProperty(int propertyID, String* returnText = 0);
 
-    // The following parses an entire new style declaration.
-    void parseDeclaration(const String& styleDeclaration);
+    void parseDeclaration(const String& styleDeclaration, CSSStyleSheet* contextStyleSheet);
 
-    // Besides adding the properties, this also removes any existing properties with these IDs.
-    // It does no notification since it's called by the parser.
     void addParsedProperties(const CSSProperty* const *, int numProperties);
-    // This does no change notifications since it's only called by createMarkup.
     void addParsedProperty(const CSSProperty&);
 
     PassRefPtr<StylePropertySet> copyBlockProperties() const;
     void removeBlockProperties();
-    void removePropertiesInSet(const int* set, unsigned length) { removePropertiesInSet(set, length, true); }
+    bool removePropertiesInSet(const int* set, unsigned length);
 
     void merge(const StylePropertySet*, bool argOverridesOnConflict = true);
 
     void setStrictParsing(bool b) { m_strictParsing = b; }
     bool useStrictParsing() const { return m_strictParsing; }
-    bool isInlineStyleDeclaration() const { return m_isInlineStyleDeclaration; }
 
-    void addSubresourceStyleURLs(ListHashSet<KURL>&);
+    void addSubresourceStyleURLs(ListHashSet<KURL>&, CSSStyleSheet* contextStyleSheet);
 
     PassRefPtr<StylePropertySet> copy() const;
     // Used by StyledElement::copyNonAttributeProperties().
@@ -112,25 +98,20 @@ public:
     void removeEquivalentProperties(const CSSStyleDeclaration*);
 
     PassRefPtr<StylePropertySet> copyPropertiesInSet(const int* set, unsigned length) const;
-
-    CSSRule* parentRuleInternal() const { return m_parentIsElement ? 0 : m_parent.rule; }
-    void clearParentRule() { ASSERT(!m_parentIsElement); m_parent.rule = 0; }
-
-    StyledElement* parentElement() const { ASSERT(m_parentIsElement); return m_parent.element; }
-    void clearParentElement() { ASSERT(m_parentIsElement); m_parent.element = 0; }
-
-    CSSStyleSheet* contextStyleSheet() const;
     
     String asText() const;
     
+    void clearParentRule(CSSRule*);
+    void clearParentElement(StyledElement*);
+
     CSSStyleDeclaration* ensureCSSStyleDeclaration() const;
+    CSSStyleDeclaration* ensureRuleCSSStyleDeclaration(const CSSRule* parentRule) const;
+    CSSStyleDeclaration* ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const;
 
 private:
     StylePropertySet();
-    StylePropertySet(CSSRule* parentRule);
-    StylePropertySet(CSSRule* parentRule, const Vector<CSSProperty>&);
-    StylePropertySet(CSSRule* parentRule, const CSSProperty* const *, int numProperties);
-    StylePropertySet(StyledElement*, bool isInlineStyle);
+    StylePropertySet(const Vector<CSSProperty>&);
+    StylePropertySet(const CSSProperty* const *, int numProperties, bool useStrictParsing);
 
     void setNeedsStyleRecalc();
 
@@ -146,30 +127,16 @@ private:
     template<size_t size> String getCommonValue(const int (&properties)[size]) const { return getCommonValue(properties, size); }
     template<size_t size> String getLayeredShorthandValue(const int (&properties)[size]) const { return getLayeredShorthandValue(properties, size); }
 
-    bool setProperty(int propertyID, int value, bool important, bool notifyChanged);
-    bool setProperty(int propertyId, double value, CSSPrimitiveValue::UnitTypes, bool important, bool notifyChanged);
-    bool setProperty(int propertyID, const String& value, bool important, bool notifyChanged);
-    bool removeShorthandProperty(int propertyID, bool notifyChanged);
-    bool removePropertiesInSet(const int* set, unsigned length, bool notifyChanged);
+    bool removeShorthandProperty(int propertyID);
     bool propertyMatches(const CSSProperty*) const;
 
-    const CSSProperty* findPropertyWithId(int propertyId) const;
-    CSSProperty* findPropertyWithId(int propertyId);
+    const CSSProperty* findPropertyWithId(int propertyID) const;
+    CSSProperty* findPropertyWithId(int propertyID);
 
     Vector<CSSProperty, 4> m_properties;
 
     bool m_strictParsing : 1;
-    bool m_parentIsElement : 1;
-    bool m_isInlineStyleDeclaration : 1;
-
-    union Parent {
-        Parent(CSSRule* rule) : rule(rule) { }
-        Parent(StyledElement* element) : element(element) { }
-        CSSRule* rule;
-        StyledElement* element;
-    } m_parent;
-    
-    mutable RefPtr<PropertySetCSSStyleDeclaration> m_cssStyleDeclaration;
+    mutable bool m_hasCSSOMWrapper : 1;
     
     friend class PropertySetCSSStyleDeclaration;
 };
diff --git a/Source/WebCore/css/StyleSheet.idl b/Source/WebCore/css/StyleSheet.idl
index cad4da4a1..9e20d84ac 100644
--- a/Source/WebCore/css/StyleSheet.idl
+++ b/Source/WebCore/css/StyleSheet.idl
@@ -24,16 +24,16 @@ module stylesheets {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
-        JSCustomToJS,
+        CustomToJSObject,
         ObjCPolymorphic,
         V8DependentLifetime
     ] StyleSheet {
-        readonly attribute [ConvertNullStringTo=Null] DOMString        type;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        type;
                  attribute boolean          disabled;
         readonly attribute Node             ownerNode;
         readonly attribute StyleSheet       parentStyleSheet;
-        readonly attribute [ConvertNullStringTo=Null] DOMString        href;
-        readonly attribute [ConvertNullStringTo=Null] DOMString        title;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        href;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        title;
         readonly attribute MediaList        media;
 
 #if defined(LANGUAGE_CPP) && LANGUAGE_CPP
diff --git a/Source/WebCore/css/StyleSheetList.idl b/Source/WebCore/css/StyleSheetList.idl
index 67390b2dd..3a7b185cd 100644
--- a/Source/WebCore/css/StyleSheetList.idl
+++ b/Source/WebCore/css/StyleSheetList.idl
@@ -28,7 +28,7 @@ module stylesheets {
         V8DependentLifetime
     ] StyleSheetList {
         readonly attribute unsigned long    length;
-        StyleSheet         item(in [Optional=CallWithDefaultValue] unsigned long index);
+        StyleSheet         item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/css/WebKitCSSKeyframeRule.cpp b/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
index 36742a9b3..59f650ff0 100644
--- a/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
+++ b/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
@@ -38,7 +38,7 @@ WebKitCSSKeyframeRule::WebKitCSSKeyframeRule(CSSStyleSheet* parent)
 WebKitCSSKeyframeRule::~WebKitCSSKeyframeRule()
 {
     if (m_style)
-        m_style->clearParentRule();
+        m_style->clearParentRule(this);
 }
 
 String WebKitCSSKeyframeRule::cssText() const
@@ -54,7 +54,6 @@ String WebKitCSSKeyframeRule::cssText() const
 
 void WebKitCSSKeyframeRule::setDeclaration(PassRefPtr<StylePropertySet> style)
 {
-    ASSERT(style->parentRuleInternal() == this);
     m_style = style;
 }
 
diff --git a/Source/WebCore/css/WebKitCSSKeyframeRule.h b/Source/WebCore/css/WebKitCSSKeyframeRule.h
index a3d3a2659..4a98573da 100644
--- a/Source/WebCore/css/WebKitCSSKeyframeRule.h
+++ b/Source/WebCore/css/WebKitCSSKeyframeRule.h
@@ -53,7 +53,7 @@ public:
 
     void getKeys(Vector<float>& keys) const   { parseKeyString(m_key, keys); }
 
-    CSSStyleDeclaration* style() const { return m_style ? m_style->ensureCSSStyleDeclaration() : 0; }
+    CSSStyleDeclaration* style() const { return m_style ? m_style->ensureRuleCSSStyleDeclaration(this) : 0; }
 
     String cssText() const;
 
diff --git a/Source/WebCore/css/WebKitCSSKeyframesRule.idl b/Source/WebCore/css/WebKitCSSKeyframesRule.idl
index daf2e7eba..fa0ea2a1b 100644
--- a/Source/WebCore/css/WebKitCSSKeyframesRule.idl
+++ b/Source/WebCore/css/WebKitCSSKeyframesRule.idl
@@ -33,12 +33,12 @@ module css {
         IndexedGetter
     ] WebKitCSSKeyframesRule : CSSRule {
 
-        attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString name;
+        attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString name;
         readonly attribute CSSRuleList cssRules;
         
-        void insertRule(in [Optional=CallWithDefaultValue] DOMString rule);
-        void deleteRule(in [Optional=CallWithDefaultValue] DOMString key);
-        WebKitCSSKeyframeRule findRule(in [Optional=CallWithDefaultValue] DOMString key);
+        void insertRule(in [Optional=DefaultIsUndefined] DOMString rule);
+        void deleteRule(in [Optional=DefaultIsUndefined] DOMString key);
+        WebKitCSSKeyframeRule findRule(in [Optional=DefaultIsUndefined] DOMString key);
     };
 
 }
diff --git a/Source/WebCore/css/WebKitCSSMatrix.cpp b/Source/WebCore/css/WebKitCSSMatrix.cpp
index 86e88b204..9aeea7715 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.cpp
+++ b/Source/WebCore/css/WebKitCSSMatrix.cpp
@@ -53,7 +53,7 @@ WebKitCSSMatrix::~WebKitCSSMatrix()
 void WebKitCSSMatrix::setMatrixValue(const String& string, ExceptionCode& ec)
 {
     RefPtr<StylePropertySet> styleDeclaration = StylePropertySet::create();
-    if (CSSParser::parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true, true)) {
+    if (CSSParser::parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true, true, 0)) {
         // Convert to TransformOperations. This can fail if a property
         // requires style (i.e., param uses 'ems' or 'exs')
         RefPtr<CSSValue> value = styleDeclaration->getPropertyCSSValue(CSSPropertyWebkitTransform);
diff --git a/Source/WebCore/css/WebKitCSSMatrix.idl b/Source/WebCore/css/WebKitCSSMatrix.idl
index c6adabfa4..08fd6641d 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.idl
+++ b/Source/WebCore/css/WebKitCSSMatrix.idl
@@ -28,7 +28,7 @@ module css {
     // Introduced in DOM Level ?:
     interface [
         ConstructorParameters=1,
-        Constructor(in [Optional=CallWithNullValue] DOMString cssValue),
+        Constructor(in [Optional=DefaultIsNullString] DOMString cssValue),
         ConstructorRaisesException,
     ] WebKitCSSMatrix {
 
@@ -57,49 +57,49 @@ module css {
         attribute double m43;
         attribute double m44;
 
-        void setMatrixValue(in [Optional=CallWithDefaultValue] DOMString string) raises (DOMException);
+        void setMatrixValue(in [Optional=DefaultIsUndefined] DOMString string) raises (DOMException);
         
         // Multiply this matrix by secondMatrix, on the right (result = this * secondMatrix)
-        [Immutable] WebKitCSSMatrix multiply(in [Optional=CallWithDefaultValue] WebKitCSSMatrix secondMatrix);
+        [Immutable] WebKitCSSMatrix multiply(in [Optional=DefaultIsUndefined] WebKitCSSMatrix secondMatrix);
         
         // Return the inverse of this matrix. Throw an exception if the matrix is not invertible
         [Immutable] WebKitCSSMatrix inverse() raises (DOMException);
         
         // Return this matrix translated by the passed values.
         // Passing a NaN will use a value of 0. This allows the 3D form to used for 2D operations    
-        [Immutable] WebKitCSSMatrix translate(in [Optional=CallWithDefaultValue] double x, 
-                                              in [Optional=CallWithDefaultValue] double y, 
-                                              in [Optional=CallWithDefaultValue] double z);
+        [Immutable] WebKitCSSMatrix translate(in [Optional=DefaultIsUndefined] double x, 
+                                              in [Optional=DefaultIsUndefined] double y, 
+                                              in [Optional=DefaultIsUndefined] double z);
         
         // Returns this matrix scaled by the passed values.
         // Passing scaleX or scaleZ as NaN uses a value of 1, but passing scaleY of NaN 
         // makes it the same as scaleX. This allows the 3D form to used for 2D operations
-        [Immutable] WebKitCSSMatrix scale(in [Optional=CallWithDefaultValue] double scaleX, 
-                                          in [Optional=CallWithDefaultValue] double scaleY, 
-                                          in [Optional=CallWithDefaultValue] double scaleZ);
+        [Immutable] WebKitCSSMatrix scale(in [Optional=DefaultIsUndefined] double scaleX, 
+                                          in [Optional=DefaultIsUndefined] double scaleY, 
+                                          in [Optional=DefaultIsUndefined] double scaleZ);
         
         // Returns this matrix rotated by the passed values.
         // If rotY and rotZ are NaN, rotate about Z (rotX=0, rotateY=0, rotateZ=rotX).
         // Otherwise use a rotation value of 0 for any passed NaN.    
-        [Immutable] WebKitCSSMatrix rotate(in [Optional=CallWithDefaultValue] double rotX, 
-                                           in [Optional=CallWithDefaultValue] double rotY, 
-                                           in [Optional=CallWithDefaultValue] double rotZ);
+        [Immutable] WebKitCSSMatrix rotate(in [Optional=DefaultIsUndefined] double rotX, 
+                                           in [Optional=DefaultIsUndefined] double rotY, 
+                                           in [Optional=DefaultIsUndefined] double rotZ);
         
         // Returns this matrix rotated about the passed axis by the passed angle.
         // Passing a NaN will use a value of 0. If the axis is (0,0,0) use a value
         // of (0,0,1).
-        [Immutable] WebKitCSSMatrix rotateAxisAngle(in [Optional=CallWithDefaultValue] double x, 
-                                                    in [Optional=CallWithDefaultValue] double y, 
-                                                    in [Optional=CallWithDefaultValue] double z, 
-                                                    in [Optional=CallWithDefaultValue] double angle);
+        [Immutable] WebKitCSSMatrix rotateAxisAngle(in [Optional=DefaultIsUndefined] double x, 
+                                                    in [Optional=DefaultIsUndefined] double y, 
+                                                    in [Optional=DefaultIsUndefined] double z, 
+                                                    in [Optional=DefaultIsUndefined] double angle);
 
         // Returns this matrix skewed along the X axis by the passed values.
         // Passing a NaN will use a value of 0.
-        [Immutable] WebKitCSSMatrix skewX(in [Optional=CallWithDefaultValue] double angle);
+        [Immutable] WebKitCSSMatrix skewX(in [Optional=DefaultIsUndefined] double angle);
 
         // Returns this matrix skewed along the Y axis by the passed values.
         // Passing a NaN will use a value of 0.
-        [Immutable] WebKitCSSMatrix skewY(in [Optional=CallWithDefaultValue] double angle);
+        [Immutable] WebKitCSSMatrix skewY(in [Optional=DefaultIsUndefined] double angle);
 
         [NotEnumerable] DOMString toString();
     };
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.cpp b/Source/WebCore/css/WebKitCSSShaderValue.cpp
index 51cf8a30f..ea930304b 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.cpp
+++ b/Source/WebCore/css/WebKitCSSShaderValue.cpp
@@ -33,6 +33,7 @@
 #include "WebKitCSSShaderValue.h"
 
 #include "CachedResourceLoader.h"
+#include "CSSParser.h"
 #include "Document.h"
 #include "StyleCachedShader.h"
 #include "StylePendingShader.h"
@@ -40,7 +41,8 @@
 namespace WebCore {
 
 WebKitCSSShaderValue::WebKitCSSShaderValue(const String& url)
-    : CSSPrimitiveValue(WebKitCSSShaderClass, url, CSS_URI)
+    : CSSValue(WebKitCSSShaderClass)
+    , m_url(url)
     , m_accessedShader(false)
 {
 }
@@ -56,7 +58,7 @@ StyleCachedShader* WebKitCSSShaderValue::cachedShader(CachedResourceLoader* load
     if (!m_accessedShader) {
         m_accessedShader = true;
 
-        ResourceRequest request(loader->document()->completeURL(getStringValue()));
+        ResourceRequest request(loader->document()->completeURL(m_url));
         if (CachedShader* cachedShader = loader->requestShader(request))
             m_shader = StyleCachedShader::create(cachedShader);
     }
@@ -72,6 +74,10 @@ StyleShader* WebKitCSSShaderValue::cachedOrPendingShader()
     return m_shader.get();
 }
 
+String WebKitCSSShaderValue::customCssText() const
+{
+    return "url(" + quoteCSSURLIfNeeded(m_url) + ")";
+}
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.h b/Source/WebCore/css/WebKitCSSShaderValue.h
index 825482db3..610922001 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.h
+++ b/Source/WebCore/css/WebKitCSSShaderValue.h
@@ -32,8 +32,7 @@
 
 #if ENABLE(CSS_SHADERS)
 
-#include "CachedResourceHandle.h"
-#include "CSSPrimitiveValue.h"
+#include "CSSValue.h"
 
 namespace WebCore {
 
@@ -41,17 +40,20 @@ class CachedResourceLoader;
 class StyleCachedShader;
 class StyleShader;
 
-class WebKitCSSShaderValue : public CSSPrimitiveValue {
+class WebKitCSSShaderValue : public CSSValue {
 public:
     static PassRefPtr<WebKitCSSShaderValue> create(const String& url) { return adoptRef(new WebKitCSSShaderValue(url)); }
     ~WebKitCSSShaderValue();
 
     StyleCachedShader* cachedShader(CachedResourceLoader*);
     StyleShader* cachedOrPendingShader();
-    
+
+    String customCssText() const;
+
 private:
     WebKitCSSShaderValue(const String& url);
-    
+
+    String m_url;
     RefPtr<StyleShader> m_shader;
     bool m_accessedShader;
 };
diff --git a/Source/WebCore/css/themeChromiumAndroid.css b/Source/WebCore/css/themeChromiumAndroid.css
new file mode 100644
index 000000000..346d836af
--- /dev/null
+++ b/Source/WebCore/css/themeChromiumAndroid.css
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* These styles override other user-agent styles for Chromium on Android. */
+
+select[size],
+select[multiple],
+select[size][multiple] {
+    -webkit-appearance: menulist;
+    -webkit-box-align: center;
+    border: 1px solid;
+    -webkit-border-radius: 5px;
+    white-space: pre;
+}
+
+input[type="date"], input[type="datetime"], input[type="datetime-local"], input[type="time"], input[type="month"] {
+    -webkit-appearance: menulist-button;
+}
diff --git a/Source/WebCore/dom/ActiveDOMObject.cpp b/Source/WebCore/dom/ActiveDOMObject.cpp
index 39a4c4c6b..bb2ec2209 100644
--- a/Source/WebCore/dom/ActiveDOMObject.cpp
+++ b/Source/WebCore/dom/ActiveDOMObject.cpp
@@ -60,6 +60,9 @@ void ContextDestructionObserver::contextDestroyed()
 ActiveDOMObject::ActiveDOMObject(ScriptExecutionContext* scriptExecutionContext, void* upcastPointer)
     : ContextDestructionObserver(scriptExecutionContext)
     , m_pendingActivityCount(0)
+#if !ASSERT_DISABLED
+    , m_suspendIfNeededCalled(false)
+#endif
 {
     if (!m_scriptExecutionContext)
         return;
@@ -73,10 +76,23 @@ ActiveDOMObject::~ActiveDOMObject()
     if (!m_scriptExecutionContext)
         return;
 
+    ASSERT(m_suspendIfNeededCalled);
     ASSERT(m_scriptExecutionContext->isContextThread());
     m_scriptExecutionContext->willDestroyActiveDOMObject(this);
 }
 
+void ActiveDOMObject::suspendIfNeeded()
+{
+#if !ASSERT_DISABLED
+    ASSERT(!m_suspendIfNeededCalled);
+    m_suspendIfNeededCalled = true;
+#endif
+    if (!m_scriptExecutionContext)
+        return;
+
+    m_scriptExecutionContext->suspendActiveDOMObjectIfNeeded(this);
+}
+
 bool ActiveDOMObject::hasPendingActivity() const
 {
     return m_pendingActivityCount;
diff --git a/Source/WebCore/dom/ActiveDOMObject.h b/Source/WebCore/dom/ActiveDOMObject.h
index db7ca66c0..dce6b56dd 100644
--- a/Source/WebCore/dom/ActiveDOMObject.h
+++ b/Source/WebCore/dom/ActiveDOMObject.h
@@ -51,6 +51,13 @@ namespace WebCore {
     public:
         ActiveDOMObject(ScriptExecutionContext*, void* upcastPointer);
 
+        // suspendIfNeeded() should be called exactly once after object construction to synchronize
+        // the suspend state with that in ScriptExecutionContext.
+        void suspendIfNeeded();
+#if !ASSERT_DISABLED
+        bool suspendIfNeededCalled() const { return m_suspendIfNeededCalled; }
+#endif
+
         virtual bool hasPendingActivity() const;
 
         // canSuspend() is used by the caller if there is a choice between suspending and stopping.
@@ -88,6 +95,9 @@ namespace WebCore {
 
     private:
         unsigned m_pendingActivityCount;
+#if !ASSERT_DISABLED
+        bool m_suspendIfNeededCalled;
+#endif
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index 6930fa1dc..e54c8d0df 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -181,7 +181,7 @@ void Attr::childrenChanged(bool changedByParser, Node* beforeChange, Node* after
     StringBuilder valueBuilder;
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
-            valueBuilder.append(static_cast<Text*>(n)->data());
+            valueBuilder.append(toText(n)->data());
     }
 
     AtomicString newValue = valueBuilder.toString();
diff --git a/Source/WebCore/dom/Attr.h b/Source/WebCore/dom/Attr.h
index 0209f9041..b70357495 100644
--- a/Source/WebCore/dom/Attr.h
+++ b/Source/WebCore/dom/Attr.h
@@ -39,6 +39,7 @@ class CSSStyleDeclaration;
 // destruction. however, this is not yet implemented.
 
 class Attr : public ContainerNode {
+    friend class ElementAttributeData;
     friend class NamedNodeMap;
 public:
     static PassRefPtr<Attr> create(Element*, Document*, PassRefPtr<Attribute>);
diff --git a/Source/WebCore/dom/Attr.idl b/Source/WebCore/dom/Attr.idl
index e3a802cf2..300896723 100644
--- a/Source/WebCore/dom/Attr.idl
+++ b/Source/WebCore/dom/Attr.idl
@@ -27,11 +27,11 @@ module core {
 
         // DOM Level 1
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString name;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString name;
 
         readonly attribute boolean specified;
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString value 
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString value 
                      setter raises(DOMException);
 
         // DOM Level 2
diff --git a/Source/WebCore/dom/CharacterData.idl b/Source/WebCore/dom/CharacterData.idl
index dcf796ae5..2bb3d4e49 100644
--- a/Source/WebCore/dom/CharacterData.idl
+++ b/Source/WebCore/dom/CharacterData.idl
@@ -26,24 +26,24 @@ module core {
 
         readonly attribute unsigned long length;
         
-        [ConvertNullStringTo=Null, ObjCLegacyUnnamedParameters] DOMString substringData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                                                         in [IsIndex,Optional=CallWithDefaultValue] unsigned long length)
+        [TreatReturnedNullStringAs=Null, ObjCLegacyUnnamedParameters] DOMString substringData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                                                         in [IsIndex,Optional=DefaultIsUndefined] unsigned long length)
             raises(DOMException);
 
-        void appendData(in [Optional=CallWithDefaultValue] DOMString data)
+        void appendData(in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void insertData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                       in [Optional=CallWithDefaultValue] DOMString data)
+        [ObjCLegacyUnnamedParameters] void insertData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                       in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void deleteData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                       in [IsIndex,Optional=CallWithDefaultValue] unsigned long length)
+        [ObjCLegacyUnnamedParameters] void deleteData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                       in [IsIndex,Optional=DefaultIsUndefined] unsigned long length)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void replaceData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                        in [IsIndex,Optional=CallWithDefaultValue] unsigned long length,
-                                        in [Optional=CallWithDefaultValue] DOMString data)
+        [ObjCLegacyUnnamedParameters] void replaceData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                        in [IsIndex,Optional=DefaultIsUndefined] unsigned long length,
+                                        in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
     
     };
diff --git a/Source/WebCore/dom/ClientRectList.idl b/Source/WebCore/dom/ClientRectList.idl
index 45d6f485f..02f055e6e 100644
--- a/Source/WebCore/dom/ClientRectList.idl
+++ b/Source/WebCore/dom/ClientRectList.idl
@@ -30,7 +30,7 @@ module view {
         IndexedGetter
     ] ClientRectList {
         readonly attribute unsigned long length;
-        ClientRect item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
+        ClientRect item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
         // FIXME: Fix list behavior to allow custom exceptions to be thrown.
     };
 
diff --git a/Source/WebCore/dom/Clipboard.cpp b/Source/WebCore/dom/Clipboard.cpp
index 027992515..2053292a1 100644
--- a/Source/WebCore/dom/Clipboard.cpp
+++ b/Source/WebCore/dom/Clipboard.cpp
@@ -27,6 +27,7 @@
 #include "Clipboard.h"
 
 #include "CachedImage.h"
+#include "DOMStringList.h"
 #include "FileList.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -147,7 +148,7 @@ bool Clipboard::hasStringOfType(const String& type) const
     if (m_policy != ClipboardReadable && m_policy != ClipboardTypesReadable)
         return false;
     
-    return types().contains(type); 
+    return types()->contains(type);
 }
     
 void Clipboard::setDropEffect(const String &effect)
diff --git a/Source/WebCore/dom/Clipboard.h b/Source/WebCore/dom/Clipboard.h
index a07ae9fc5..d33829a6c 100644
--- a/Source/WebCore/dom/Clipboard.h
+++ b/Source/WebCore/dom/Clipboard.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class DOMStringList;
     class DataTransferItemList;
     class DragData;
     class FileList;
@@ -66,7 +67,7 @@ namespace WebCore {
         virtual bool setData(const String& type, const String& data) = 0;
     
         // extensions beyond IE's API
-        virtual HashSet<String> types() const = 0;
+        virtual PassRefPtr<DOMStringList> types() const = 0;
         virtual PassRefPtr<FileList> files() const = 0;
 
         IntPoint dragLocation() const { return m_dragLoc; }
diff --git a/Source/WebCore/dom/Clipboard.idl b/Source/WebCore/dom/Clipboard.idl
index dc453f298..c1c5850ec 100644
--- a/Source/WebCore/dom/Clipboard.idl
+++ b/Source/WebCore/dom/Clipboard.idl
@@ -29,9 +29,9 @@
 module core {
 
     interface Clipboard {
-                 attribute [ConvertNullStringTo=Undefined] DOMString dropEffect;
-                 attribute [ConvertNullStringTo=Undefined] DOMString effectAllowed;
-        readonly attribute [CustomGetter] Array types;
+                 attribute [TreatReturnedNullStringAs=Undefined] DOMString dropEffect;
+                 attribute [TreatReturnedNullStringAs=Undefined] DOMString effectAllowed;
+        readonly attribute DOMStringList types;
         readonly attribute FileList files;
 
         [Custom] void clearData(in [Optional] DOMString type)
diff --git a/Source/WebCore/dom/CompositionEvent.idl b/Source/WebCore/dom/CompositionEvent.idl
index a28292c36..f66ed5ae4 100644
--- a/Source/WebCore/dom/CompositionEvent.idl
+++ b/Source/WebCore/dom/CompositionEvent.idl
@@ -30,11 +30,11 @@ module events {
 
         readonly attribute DOMString data;
 
-        void initCompositionEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                                  in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                                  in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                                  in [Optional=CallWithDefaultValue] DOMWindow viewArg, 
-                                  in [Optional=CallWithDefaultValue] DOMString dataArg);
+        void initCompositionEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                                  in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                                  in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                                  in [Optional=DefaultIsUndefined] DOMWindow viewArg, 
+                                  in [Optional=DefaultIsUndefined] DOMString dataArg);
 
     };
 
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index dbd2b7259..0a81c6dea 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -69,7 +69,7 @@ static inline void collectNodes(Node* node, NodeVector& nodes)
 
 static void collectTargetNodes(Node* node, NodeVector& nodes)
 {
-    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
+    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE || node->isShadowRoot()) {
         nodes.append(node);
         return;
     }
@@ -158,11 +158,6 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         if (ec)
             return false;
 
-        // FIXME: After sending the mutation events, "this" could be destroyed.
-        // We can prevent that by doing a "ref", but first we have to make sure
-        // that no callers call with ref count == 0 and parent = 0 (as of this
-        // writing, there are definitely callers who call that way).
-
         // Due to arbitrary code running in response to a DOM mutation event it's
         // possible that "next" is no longer a child of "this".
         // It's also possible that "child" has been inserted elsewhere.
@@ -293,12 +288,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
     if (ec)
         return false;
 
-    // FIXME: After sending the mutation events, "this" could be destroyed.
-    // We can prevent that by doing a "ref", but first we have to make sure
-    // that no callers call with ref count == 0 and parent = 0 (as of this
-    // writing, there are definitely callers who call that way).
-
-    bool isFragment = newChild->nodeType() == DOCUMENT_FRAGMENT_NODE;
+    bool isFragment = newChild->nodeType() == DOCUMENT_FRAGMENT_NODE && !newChild->isShadowRoot();
 
     // Add the new child(ren)
     RefPtr<Node> child = isFragment ? newChild->firstChild() : newChild;
@@ -469,24 +459,19 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
         return false;
     }
 
-    // FIXME: After sending the mutation events, "this" could be destroyed.
-    // We can prevent that by doing a "ref", but first we have to make sure
-    // that no callers call with ref count == 0 and parent = 0 (as of this
-    // writing, there are definitely callers who call that way).
-
     Node* prev = child->previousSibling();
     Node* next = child->nextSibling();
     removeBetween(prev, next, child.get());
 
-    // Dispatch post-removal mutation events
     childrenChanged(false, prev, next, -1);
-    dispatchSubtreeModifiedEvent();
 
     if (child->inDocument())
         child->removedFromDocument();
     else
         child->removedFromTree(true);
 
+    dispatchSubtreeModifiedEvent();
+
     return child;
 }
 
@@ -592,11 +577,10 @@ void ContainerNode::removeChildren()
             removedChild->detach();
     }
 
+    // FIXME: This should be just above dispatchSubtreeModifiedEvent();
     allowEventDispatch();
 
-    // Dispatch a single post-removal mutation event denoting a modified subtree.
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
-    dispatchSubtreeModifiedEvent();
 
     for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
@@ -606,6 +590,8 @@ void ContainerNode::removeChildren()
         // document. There is no explanation for this discrepancy between removeChild()
         // and its optimized version removeChildren().
     }
+
+    dispatchSubtreeModifiedEvent();
 }
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
diff --git a/Source/WebCore/dom/ContainerNodeAlgorithms.h b/Source/WebCore/dom/ContainerNodeAlgorithms.h
index 55095a72e..ee69afd16 100644
--- a/Source/WebCore/dom/ContainerNodeAlgorithms.h
+++ b/Source/WebCore/dom/ContainerNodeAlgorithms.h
@@ -135,8 +135,10 @@ namespace Private {
                     head = n;
 
                 tail = n;
-            } else
+            } else {
+                RefPtr<GenericNode> protect(n); // removedFromDocument may remove remove all references to this node.
                 NodeRemovalDispatcher<GenericNode, ShouldDispatchRemovalNotification<GenericNode>::value>::dispatch(n);
+            }
         }
 
         container->setFirstChild(0);
diff --git a/Source/WebCore/dom/CustomEvent.idl b/Source/WebCore/dom/CustomEvent.idl
index 53a1ffca8..9158d58a2 100644
--- a/Source/WebCore/dom/CustomEvent.idl
+++ b/Source/WebCore/dom/CustomEvent.idl
@@ -32,10 +32,10 @@ module events {
     ] CustomEvent : Event {
         readonly attribute [InitializedByEventConstructor] DOMObject detail;
 
-        void initCustomEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                             in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                             in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                             in [Optional=CallWithDefaultValue] DOMObject detailArg);
+        void initCustomEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                             in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                             in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                             in [Optional=DefaultIsUndefined] DOMObject detailArg);
     };
 #endif
 
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index 8b1ebbb88..8ec4bfb6b 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -33,6 +33,7 @@
 #include "CDATASection.cpp"
 #include "CharacterData.cpp"
 #include "CheckedRadioButtons.cpp"
+#include "ChildListMutationScope.cpp"
 #include "ChildNodeList.cpp"
 #include "ClassNodeList.cpp"
 #include "ClientRect.cpp"
@@ -88,6 +89,9 @@
 #include "MouseEvent.cpp"
 #include "MouseRelatedEvent.cpp"
 #include "MutationEvent.cpp"
+#include "MutationObserverInterestGroup.cpp"
+#include "MutationObserverRegistration.cpp"
+#include "MutationRecord.cpp"
 #include "NameNodeList.cpp"
 #include "NodeFilter.cpp"
 #include "NodeFilterCondition.cpp"
@@ -113,6 +117,7 @@
 #include "SecurityContext.cpp"
 #include "SelectorQuery.cpp"
 #include "ShadowRoot.cpp"
+#include "ShadowRootList.cpp"
 #include "SpaceSplitString.cpp"
 #include "StaticHashSetNodeList.cpp"
 #include "StaticNodeList.cpp"
@@ -135,6 +140,7 @@
 #include "UserTypingGestureIndicator.cpp"
 #include "ViewportArguments.cpp"
 #include "WebKitAnimationEvent.cpp"
+#include "WebKitMutationObserver.cpp"
 #include "WebKitNamedFlow.cpp"
 #include "WebKitTransitionEvent.cpp"
 #include "WheelEvent.cpp"
diff --git a/Source/WebCore/dom/DOMCoreException.idl b/Source/WebCore/dom/DOMCoreException.idl
index 3f25b021a..add5bd9a1 100644
--- a/Source/WebCore/dom/DOMCoreException.idl
+++ b/Source/WebCore/dom/DOMCoreException.idl
@@ -30,7 +30,8 @@ module core {
 
     interface [
         JSNoStaticTables,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        InterfaceName=DOMException
     ] DOMCoreException {
 
         readonly attribute unsigned short   code;
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index 33104097e..ae6d3665c 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -364,46 +364,37 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
     // Plugins cannot take HTML and XHTML from us, and we don't even need to initialize the plugin database for those.
     if (type == "text/html")
         return HTMLDocument::create(frame, url);
-
-    // Plugins cannot take text/plain from us either.
-    if (type == "text/plain")
-        return TextDocument::create(frame, url);
-
     if (type == "application/xhtml+xml")
         return Document::createXHTML(frame, url);
 
 #if ENABLE(FTPDIR)
-    // Plugins cannot take FTP from us either.
+    // Plugins cannot take FTP from us either
     if (type == "application/x-ftp-directory")
         return FTPDirectoryDocument::create(frame, url);
 #endif
 
-    // PDF is the only image type for which a plugin can override built-in support.
-    if (Image::supportsType(type) && type != "application/pdf" && type != "text/pdf")
-        return ImageDocument::create(frame, url);
-
-#if ENABLE(VIDEO)
-     // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument as
-     // this can not be taken by plugins either.
-     if (MediaPlayer::supportsType(ContentType(type)))
-         return MediaDocument::create(frame, url);
-#endif
-
-    // The plugin database is initialized at this point if plugins are enabled
-    // which is non-zero overhead.
     PluginData* pluginData = 0;
     if (frame && frame->page() && frame->loader()->subframeLoader()->allowPlugins(NotAboutToInstantiatePlugin))
         pluginData = frame->page()->pluginData();
 
-    // At this point anything that can be supported can be overridden by plugins.
-    if (pluginData && pluginData->supportsMimeType(type))
+    // PDF is one image type for which a plugin can override built-in support.
+    // We do not want QuickTime to take over all image types, obviously.
+    if ((type == "application/pdf" || type == "text/pdf") && pluginData && pluginData->supportsMimeType(type))
         return PluginDocument::create(frame, url);
-
-    // Handle PDF for instance if it was not handled by a plugin.
     if (Image::supportsType(type))
         return ImageDocument::create(frame, url);
 
-    // Handle a text document was not handled by a plugin.
+#if ENABLE(VIDEO)
+     // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument
+     if (MediaPlayer::supportsType(ContentType(type)))
+         return MediaDocument::create(frame, url);
+#endif
+
+    // Everything else except text/plain can be overridden by plugins. In particular, Adobe SVG Viewer should be used for SVG, if installed.
+    // Disallowing plug-ins to use text/plain prevents plug-ins from hijacking a fundamental type that the browser is expected to handle,
+    // and also serves as an optimization to prevent loading the plug-in database in the common case.
+    if (type != "text/plain" && pluginData && pluginData->supportsMimeType(type)) 
+        return PluginDocument::create(frame, url);
     if (isTextMIMEType(type))
         return TextDocument::create(frame, url);
 
diff --git a/Source/WebCore/dom/DOMImplementation.idl b/Source/WebCore/dom/DOMImplementation.idl
index 0a2368e52..cd5709906 100644
--- a/Source/WebCore/dom/DOMImplementation.idl
+++ b/Source/WebCore/dom/DOMImplementation.idl
@@ -27,29 +27,29 @@ module core {
 
         // DOM Level 1
 
-        [ObjCLegacyUnnamedParameters] boolean hasFeature(in [Optional=CallWithDefaultValue] DOMString feature, 
-                                          in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString version);
+        [ObjCLegacyUnnamedParameters] boolean hasFeature(in [Optional=DefaultIsUndefined] DOMString feature, 
+                                          in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString version);
 
         // DOM Level 2
 
-        [ObjCLegacyUnnamedParameters] DocumentType createDocumentType(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName,
-                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString publicId,
-                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString systemId)
+        [ObjCLegacyUnnamedParameters] DocumentType createDocumentType(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName,
+                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString publicId,
+                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString systemId)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters] Document createDocument(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI, 
-                                               in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName, 
-                                               in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DocumentType doctype)
+        [ObjCLegacyUnnamedParameters] Document createDocument(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI, 
+                                               in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName, 
+                                               in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DocumentType doctype)
             raises(DOMException);
 
         // DOMImplementationCSS interface from DOM Level 2 CSS
 
-        [ObjCLegacyUnnamedParameters] CSSStyleSheet createCSSStyleSheet(in [Optional=CallWithDefaultValue] DOMString title,
-                                                         in [Optional=CallWithDefaultValue] DOMString media)
+        [ObjCLegacyUnnamedParameters] CSSStyleSheet createCSSStyleSheet(in [Optional=DefaultIsUndefined] DOMString title,
+                                                         in [Optional=DefaultIsUndefined] DOMString media)
             raises(DOMException);
 
         // HTMLDOMImplementation interface from DOM Level 2 HTML
 
-        HTMLDocument createHTMLDocument(in [Optional=CallWithDefaultValue] DOMString title);
+        HTMLDocument createHTMLDocument(in [Optional=DefaultIsUndefined] DOMString title);
     };
 
 }
diff --git a/Source/WebCore/dom/DOMStringList.idl b/Source/WebCore/dom/DOMStringList.idl
index 8238575c6..8f059ae2b 100644
--- a/Source/WebCore/dom/DOMStringList.idl
+++ b/Source/WebCore/dom/DOMStringList.idl
@@ -29,8 +29,8 @@ module core {
         IndexedGetter
     ] DOMStringList {
         readonly attribute unsigned long length;
-        [ConvertNullStringTo=Null] DOMString item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
-        boolean contains(in [Optional=CallWithDefaultValue] DOMString string);
+        [TreatReturnedNullStringAs=Null] DOMString item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
+        boolean contains(in [Optional=DefaultIsUndefined] DOMString string);
     };
 
 }
diff --git a/Source/WebCore/dom/DOMStringMap.idl b/Source/WebCore/dom/DOMStringMap.idl
index dbda74dba..980d044cd 100644
--- a/Source/WebCore/dom/DOMStringMap.idl
+++ b/Source/WebCore/dom/DOMStringMap.idl
@@ -29,8 +29,9 @@ module core {
         JSGenerateIsReachable=ImplElementRoot,
         NamedGetter,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         CustomNamedSetter,
+        V8CustomToJSObject
     ] DOMStringMap {
     };
 
diff --git a/Source/WebCore/dom/DataTransferItem.idl b/Source/WebCore/dom/DataTransferItem.idl
index befd7e2b1..0dad33822 100644
--- a/Source/WebCore/dom/DataTransferItem.idl
+++ b/Source/WebCore/dom/DataTransferItem.idl
@@ -36,7 +36,7 @@ module core {
         readonly attribute DOMString kind;
         readonly attribute DOMString type;
 
-        void getAsString(in [Callback,Optional=CallWithDefaultValue] StringCallback callback);
+        void getAsString(in [Callback,Optional=DefaultIsUndefined] StringCallback callback);
         Blob getAsFile();
     };
 
diff --git a/Source/WebCore/dom/DataTransferItemList.idl b/Source/WebCore/dom/DataTransferItemList.idl
index 8fcc47ded..d1de50e79 100644
--- a/Source/WebCore/dom/DataTransferItemList.idl
+++ b/Source/WebCore/dom/DataTransferItemList.idl
@@ -39,12 +39,12 @@ module core {
 #endif
     ] DataTransferItemList {
         readonly attribute long length;
-        DataTransferItem item(in [Optional=CallWithDefaultValue] unsigned long index);
+        DataTransferItem item(in [Optional=DefaultIsUndefined] unsigned long index);
 
         void clear();
         void add(in File file);
-        void add(in [Optional=CallWithDefaultValue] DOMString data, 
-                 in [Optional=CallWithDefaultValue] DOMString type) raises(DOMException);
+        void add(in [Optional=DefaultIsUndefined] DOMString data, 
+                 in [Optional=DefaultIsUndefined] DOMString type) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/dom/DeviceMotionClient.h b/Source/WebCore/dom/DeviceMotionClient.h
index 45bf11aea..34e28e2b2 100644
--- a/Source/WebCore/dom/DeviceMotionClient.h
+++ b/Source/WebCore/dom/DeviceMotionClient.h
@@ -30,6 +30,7 @@ namespace WebCore {
 
 class DeviceMotionController;
 class DeviceMotionData;
+class Page;
 
 class DeviceMotionClient {
 public:
@@ -41,6 +42,8 @@ public:
     virtual void deviceMotionControllerDestroyed() = 0;
 };
 
+void provideDeviceMotionTo(Page*, DeviceMotionClient*);
+
 } // namespace WebCore
 
 #endif // DeviceMotionClient_h
diff --git a/Source/WebCore/dom/DeviceMotionController.cpp b/Source/WebCore/dom/DeviceMotionController.cpp
index d7ac3059f..79eacc5e9 100644
--- a/Source/WebCore/dom/DeviceMotionController.cpp
+++ b/Source/WebCore/dom/DeviceMotionController.cpp
@@ -135,4 +135,22 @@ void DeviceMotionController::didChangeDeviceMotion(DeviceMotionData* deviceMotio
         listenersVector[i]->dispatchEvent(event);
 }
 
+const AtomicString& DeviceMotionController::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("DeviceMotionController"));
+    return name;
+}
+
+bool DeviceMotionController::isActiveAt(Page* page)
+{
+    if (DeviceMotionController* self = DeviceMotionController::from(page))
+        return self->isActive();
+    return false;
+}
+
+void provideDeviceMotionTo(Page* page, DeviceMotionClient* client)
+{
+    PageSupplement::provideTo(page, DeviceMotionController::supplementName(), DeviceMotionController::create(client));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceMotionController.h b/Source/WebCore/dom/DeviceMotionController.h
index bb8cca961..996c98861 100644
--- a/Source/WebCore/dom/DeviceMotionController.h
+++ b/Source/WebCore/dom/DeviceMotionController.h
@@ -27,6 +27,7 @@
 #define DeviceMotionController_h
 
 #include "DOMWindow.h"
+#include "PageSupplement.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
 
@@ -35,7 +36,7 @@ namespace WebCore {
 class DeviceMotionData;
 class DeviceMotionClient;
 
-class DeviceMotionController {
+class DeviceMotionController : public PageSupplement {
 public:
     ~DeviceMotionController();
 
@@ -52,6 +53,11 @@ public:
 
     bool isActive() { return !m_listeners.isEmpty(); }
 
+    static const AtomicString& supplementName();
+    static DeviceMotionController* from(Frame* frame) { return static_cast<DeviceMotionController*>(PageSupplement::from(frame, supplementName())); }
+    static DeviceMotionController* from(Page* page) { return static_cast<DeviceMotionController*>(PageSupplement::from(page, supplementName())); }
+    static bool isActiveAt(Page*);
+
 private:
     DeviceMotionController(DeviceMotionClient*);
 
diff --git a/Source/WebCore/dom/DeviceMotionEvent.idl b/Source/WebCore/dom/DeviceMotionEvent.idl
index fe1b7503e..bb55f7cce 100644
--- a/Source/WebCore/dom/DeviceMotionEvent.idl
+++ b/Source/WebCore/dom/DeviceMotionEvent.idl
@@ -32,13 +32,13 @@ module core {
         readonly attribute [Custom] Acceleration accelerationIncludingGravity;
         readonly attribute [Custom] RotationRate rotationRate;
         readonly attribute [Custom] double interval;
-        [Custom] void initDeviceMotionEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                            in [Optional=CallWithDefaultValue] boolean bubbles, 
-                                            in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                            in [Optional=CallWithDefaultValue] Acceleration acceleration, 
-                                            in [Optional=CallWithDefaultValue] Acceleration accelerationIncludingGravity, 
-                                            in [Optional=CallWithDefaultValue] RotationRate rotationRate, 
-                                            in [Optional=CallWithDefaultValue] double interval);
+        [Custom] void initDeviceMotionEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                            in [Optional=DefaultIsUndefined] boolean bubbles, 
+                                            in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                            in [Optional=DefaultIsUndefined] Acceleration acceleration, 
+                                            in [Optional=DefaultIsUndefined] Acceleration accelerationIncludingGravity, 
+                                            in [Optional=DefaultIsUndefined] RotationRate rotationRate, 
+                                            in [Optional=DefaultIsUndefined] double interval);
     };
 
 }
diff --git a/Source/WebCore/dom/DeviceOrientationClient.h b/Source/WebCore/dom/DeviceOrientationClient.h
index 347c3b399..2c16b0cd8 100644
--- a/Source/WebCore/dom/DeviceOrientationClient.h
+++ b/Source/WebCore/dom/DeviceOrientationClient.h
@@ -30,6 +30,7 @@ namespace WebCore {
 
 class DeviceOrientation;
 class DeviceOrientationController;
+class Page;
 
 class DeviceOrientationClient {
 public:
@@ -42,6 +43,8 @@ public:
     virtual void deviceOrientationControllerDestroyed() = 0;
 };
 
+void provideDeviceOrientationTo(Page*, DeviceOrientationClient*);
+
 } // namespace WebCore
 
 #endif // DeviceOrientationClient_h
diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
index 68683fd05..d298b3f44 100644
--- a/Source/WebCore/dom/DeviceOrientationController.cpp
+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
@@ -137,4 +137,22 @@ void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientation*
         listenersVector[i]->dispatchEvent(event);
 }
 
+const AtomicString& DeviceOrientationController::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("DeviceOrientationController"));
+    return name;
+}
+
+bool DeviceOrientationController::isActiveAt(Page* page)
+{
+    if (DeviceOrientationController* self = DeviceOrientationController::from(page))
+        return self->isActive();
+    return false;
+}
+
+void provideDeviceOrientationTo(Page* page, DeviceOrientationClient* client)
+{
+    PageSupplement::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(page, client));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index 1b87998d9..d8efaca39 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -27,6 +27,7 @@
 #define DeviceOrientationController_h
 
 #include "DOMWindow.h"
+#include "PageSupplement.h"
 #include "Timer.h"
 
 #include <wtf/HashCountedSet.h>
@@ -37,7 +38,7 @@ class DeviceOrientation;
 class DeviceOrientationClient;
 class Page;
 
-class DeviceOrientationController {
+class DeviceOrientationController : public PageSupplement {
 public:
     ~DeviceOrientationController();
 
@@ -56,6 +57,11 @@ public:
 
     DeviceOrientationClient* client() const { return m_client; }
 
+    static const AtomicString& supplementName();
+    static DeviceOrientationController* from(Frame* frame) { return static_cast<DeviceOrientationController*>(PageSupplement::from(frame, supplementName())); }
+    static DeviceOrientationController* from(Page* page) { return static_cast<DeviceOrientationController*>(PageSupplement::from(page, supplementName())); }
+    static bool isActiveAt(Page*);
+
 private:
     DeviceOrientationController(Page*, DeviceOrientationClient*);
 
diff --git a/Source/WebCore/dom/DeviceOrientationEvent.idl b/Source/WebCore/dom/DeviceOrientationEvent.idl
index 11833be92..aed38ffe3 100644
--- a/Source/WebCore/dom/DeviceOrientationEvent.idl
+++ b/Source/WebCore/dom/DeviceOrientationEvent.idl
@@ -32,13 +32,13 @@ module core {
         readonly attribute [Custom] double beta;
         readonly attribute [Custom] double gamma;
         readonly attribute [Custom] boolean absolute;
-        [Custom] void initDeviceOrientationEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                                 in [Optional=CallWithDefaultValue] boolean bubbles, 
-                                                 in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                                 in [Optional=CallWithDefaultValue] double alpha, 
-                                                 in [Optional=CallWithDefaultValue] double beta, 
-                                                 in [Optional=CallWithDefaultValue] double gamma,
-                                                 in [Optional=CallWithDefaultValue] boolean absolute);
+        [Custom] void initDeviceOrientationEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                                 in [Optional=DefaultIsUndefined] boolean bubbles, 
+                                                 in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                                 in [Optional=DefaultIsUndefined] double alpha, 
+                                                 in [Optional=DefaultIsUndefined] double beta, 
+                                                 in [Optional=DefaultIsUndefined] double gamma,
+                                                 in [Optional=DefaultIsUndefined] boolean absolute);
     };
 
 }
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 7e9293672..e85d22f2c 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -33,6 +33,7 @@
 #include "Attr.h"
 #include "Attribute.h"
 #include "CDATASection.h"
+#include "CSSStyleDeclaration.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
@@ -78,6 +79,7 @@
 #include "GeolocationController.h"
 #include "HashChangeEvent.h"
 #include "HistogramSupport.h"
+#include "History.h"
 #include "HTMLAllCollection.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
@@ -100,6 +102,7 @@
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "ImageLoader.h"
+#include "InspectorCounters.h"
 #include "InspectorInstrumentation.h"
 #include "Logging.h"
 #include "MediaQueryList.h"
@@ -132,11 +135,13 @@
 #include "ScriptElement.h"
 #include "ScriptEventListener.h"
 #include "ScriptRunner.h"
+#include "ScrollingCoordinator.h"
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include "SegmentedString.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "StaticHashSetNodeList.h"
 #include "StyleSheetList.h"
 #include "TextResourceDecoder.h"
@@ -201,10 +206,6 @@
 #include "NodeRareData.h"
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 using namespace std;
 using namespace WTF;
 using namespace Unicode;
@@ -436,6 +437,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_writeRecursionIsTooDeep(false)
     , m_writeRecursionDepth(0)
     , m_wheelEventHandlerCount(0)
+    , m_touchEventHandlerCount(0)
     , m_pendingTasksTimer(this, &Document::pendingTasksTimerFired)
 {
     m_document = this;
@@ -508,6 +510,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 #ifndef NDEBUG
     m_updatingStyleSelector = false;
 #endif
+    InspectorCounters::incrementCounter(InspectorCounters::DocumentCounter);
 }
 
 static void histogramMutationEventUsage(const unsigned short& listenerTypes)
@@ -545,7 +548,6 @@ Document::~Document()
     ASSERT(!m_parser || m_parser->refCount() == 1);
     detachParser();
     m_document = 0;
-    m_cachedResourceLoader.clear();
 
     m_renderArena.clear();
 
@@ -578,10 +580,15 @@ Document::~Document()
     if (m_mediaQueryMatcher)
         m_mediaQueryMatcher->documentDestroyed();
 
+    clearStyleSelector(); // We need to destory CSSFontSelector before destroying m_cachedResourceLoader.
+    m_cachedResourceLoader.clear();
+
     // We must call clearRareData() here since a Document class inherits TreeScope
     // as well as Node. See a comment on TreeScope.h for the reason.
     if (hasRareData())
         clearRareData();
+
+    InspectorCounters::decrementCounter(InspectorCounters::DocumentCounter);
 }
 
 void Document::removedLastRef()
@@ -664,8 +671,11 @@ void Document::buildAccessKeyMap(TreeScope* scope)
         const AtomicString& accessKey = element->getAttribute(accesskeyAttr);
         if (!accessKey.isEmpty())
             m_elementsByAccessKey.set(accessKey.impl(), element);
-        if (ShadowRoot* shadowRoot = element->shadowRoot())
-            buildAccessKeyMap(shadowRoot);
+
+        if (element->hasShadowRoot()) {
+            for (ShadowRoot* root = element->shadowRootList()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+                buildAccessKeyMap(root);
+        }
     }
 }
 
@@ -874,6 +884,11 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
     case ATTRIBUTE_NODE:
         return Attr::create(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
     case DOCUMENT_FRAGMENT_NODE: {
+        if (importedNode->isShadowRoot()) {
+            // ShadowRoot nodes should not be explicitly importable.
+            // Either they are imported along with their host node, or created implicitly.
+            break;
+        }
         DocumentFragment* oldFragment = static_cast<DocumentFragment*>(importedNode);
         RefPtr<DocumentFragment> newFragment = createDocumentFragment();
         if (deep) {
@@ -896,9 +911,6 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
     case DOCUMENT_NODE:
     case DOCUMENT_TYPE_NODE:
     case XPATH_NAMESPACE_NODE:
-    case SHADOW_ROOT_NODE:
-        // ShadowRoot nodes should not be explicitly importable.
-        // Either they are imported along with their host node, or created implicitly.
         break;
     }
     ec = NOT_SUPPORTED_ERR;
@@ -1011,8 +1023,15 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
     return e.release();
 }
 
+bool Document::cssRegionsEnabled() const
+{
+    return settings() && settings()->cssRegionsEnabled(); 
+}
+
 PassRefPtr<WebKitNamedFlow> Document::webkitGetFlowByName(const String& flowName)
 {
+    if (!cssRegionsEnabled())
+        return 0;
     if (!renderer())
         return 0;
     if (RenderView* view = renderer()->view())
@@ -1944,10 +1963,11 @@ void Document::suspendActiveDOMObjects(ActiveDOMObject::ReasonForSuspension why)
     if (!page())
         return;
 
-    if (page()->deviceMotionController())
-        page()->deviceMotionController()->suspendEventsForAllListeners(domWindow());
-    if (page()->deviceOrientationController())
-        page()->deviceOrientationController()->suspendEventsForAllListeners(domWindow());
+    if (DeviceMotionController* controller = DeviceMotionController::from(page()))
+        controller->suspendEventsForAllListeners(domWindow());
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
+        controller->suspendEventsForAllListeners(domWindow());
+
 #endif
 }
 
@@ -1959,10 +1979,10 @@ void Document::resumeActiveDOMObjects()
     if (!page())
         return;
 
-    if (page()->deviceMotionController())
-        page()->deviceMotionController()->resumeEventsForAllListeners(domWindow());
-    if (page()->deviceOrientationController())
-        page()->deviceOrientationController()->resumeEventsForAllListeners(domWindow());
+    if (DeviceMotionController* controller = DeviceMotionController::from(page()))
+        controller->resumeEventsForAllListeners(domWindow());
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
+        controller->resumeEventsForAllListeners(domWindow());
 #endif
 }
 
@@ -2311,7 +2331,7 @@ void Document::implicitClose()
     }
 
     // If painting and compositing layer updates were suppressed pending the load event, do these actions now.
-    if (renderer() && settings() && settings()->suppressIncrementalRendering()) {
+    if (renderer() && settings() && settings()->suppressesIncrementalRendering()) {
 #if USE(ACCELERATED_COMPOSITING)
         view()->updateCompositingLayers();
 #endif
@@ -2853,7 +2873,6 @@ bool Document::childTypeAllowed(NodeType type) const
     case NOTATION_NODE:
     case TEXT_NODE:
     case XPATH_NAMESPACE_NODE:
-    case SHADOW_ROOT_NODE:
         return false;
     case COMMENT_NODE:
     case PROCESSING_INSTRUCTION_NODE:
@@ -2923,9 +2942,6 @@ bool Document::canReplaceChild(Node* newChild, Node* oldChild)
             case ELEMENT_NODE:
                 numElements++;
                 break;
-            case SHADOW_ROOT_NODE:
-                ASSERT_NOT_REACHED();
-                return false;
             }
         }
     } else {
@@ -2939,7 +2955,6 @@ bool Document::canReplaceChild(Node* newChild, Node* oldChild)
         case NOTATION_NODE:
         case TEXT_NODE:
         case XPATH_NAMESPACE_NODE:
-        case SHADOW_ROOT_NODE:
             return false;
         case COMMENT_NODE:
         case PROCESSING_INSTRUCTION_NODE:
@@ -5013,7 +5028,7 @@ void Document::enqueueHashchangeEvent(const String& oldURL, const String& newURL
 void Document::enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject)
 {
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36202 Popstate event needs to fire asynchronously
-    dispatchWindowEvent(PopStateEvent::create(stateObject));
+    dispatchWindowEvent(PopStateEvent::create(stateObject, domWindow() ? domWindow()->history() : 0));
 }
 
 void Document::addMediaCanStartListener(MediaCanStartListener* listener)
@@ -5366,7 +5381,6 @@ PassRefPtr<TouchList> Document::createTouchList(ExceptionCode&) const
 
 static void wheelEventHandlerCountChanged(Document* document)
 {
-#if ENABLE(THREADED_SCROLLING)
     Page* page = document->page();
     if (!page)
         return;
@@ -5380,9 +5394,6 @@ static void wheelEventHandlerCountChanged(Document* document)
         return;
 
     scrollingCoordinator->frameViewWheelEventHandlerCountChanged(frameView);
-#else
-    UNUSED_PARAM(document);
-#endif
 }
 
 void Document::didAddWheelEventHandler()
@@ -5406,10 +5417,27 @@ void Document::didRemoveWheelEventHandler()
     wheelEventHandlerCountChanged(this);
 }
 
+void Document::didAddTouchEventHandler()
+{
+    ++m_touchEventHandlerCount;
+    Frame* mainFrame = page() ? page()->mainFrame() : 0;
+    if (mainFrame)
+        mainFrame->notifyChromeClientTouchEventHandlerCountChanged();
+}
+
+void Document::didRemoveTouchEventHandler()
+{
+    ASSERT(m_touchEventHandlerCount > 0);
+    --m_touchEventHandlerCount;
+    Frame* mainFrame = page() ? page()->mainFrame() : 0;
+    if (mainFrame)
+        mainFrame->notifyChromeClientTouchEventHandlerCountChanged();
+}
+
 bool Document::visualUpdatesAllowed() const
 {
     return !settings()
-        || !settings()->suppressIncrementalRendering()
+        || !settings()->suppressesIncrementalRendering()
         || loadEventFinished();
 }
 
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index a4bdad685..772e4cd6b 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -36,6 +36,7 @@
 #include "DocumentEventQueue.h"
 #include "DocumentTiming.h"
 #include "IconURL.h"
+#include "InspectorCounters.h"
 #include "IntRect.h"
 #include "LayoutTypes.h"
 #include "PageVisibilityState.h"
@@ -350,6 +351,7 @@ public:
     virtual PassRefPtr<Element> createElementNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&);
     PassRefPtr<Element> createElement(const QualifiedName&, bool createdByParser);
 
+    bool cssRegionsEnabled() const;
     PassRefPtr<WebKitNamedFlow> webkitGetFlowByName(const String&);
 
     /**
@@ -1113,6 +1115,10 @@ public:
     void didAddWheelEventHandler();
     void didRemoveWheelEventHandler();
 
+    unsigned touchEventHandlerCount() const { return m_touchEventHandlerCount; }
+    void didAddTouchEventHandler();
+    void didRemoveTouchEventHandler();
+
     bool visualUpdatesAllowed() const;
 
 #if ENABLE(MICRODATA)
@@ -1449,6 +1455,7 @@ private:
     unsigned m_writeRecursionDepth;
     
     unsigned m_wheelEventHandlerCount;
+    unsigned m_touchEventHandlerCount;
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     RefPtr<ScriptedAnimationController> m_scriptedAnimationController;
@@ -1481,6 +1488,7 @@ inline Node::Node(Document* document, ConstructionType type)
 #if !defined(NDEBUG) || (defined(DUMP_NODE_STATISTICS) && DUMP_NODE_STATISTICS)
     trackForDebugging();
 #endif
+    InspectorCounters::incrementCounter(InspectorCounters::NodeCounter);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Document.idl b/Source/WebCore/dom/Document.idl
index de7b04df1..b3e0aa3a0 100644
--- a/Source/WebCore/dom/Document.idl
+++ b/Source/WebCore/dom/Document.idl
@@ -21,7 +21,7 @@
 module core {
 
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         JSGenerateToNativeObject,
         JSInlineGetOwnPropertySlot
     ] Document : Node {
@@ -31,55 +31,55 @@ module core {
         readonly attribute DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnNewObject] Element createElement(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString tagName)
+        [ReturnNewObject] Element createElement(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
-        [ReturnNewObject] Text createTextNode(in [Optional=CallWithDefaultValue] DOMString data);
-        [ReturnNewObject] Comment createComment(in [Optional=CallWithDefaultValue] DOMString data);
-        [ReturnNewObject] CDATASection createCDATASection(in [Optional=CallWithDefaultValue] DOMString data)
+        [ReturnNewObject] Text createTextNode(in [Optional=DefaultIsUndefined] DOMString data);
+        [ReturnNewObject] Comment createComment(in [Optional=DefaultIsUndefined] DOMString data);
+        [ReturnNewObject] CDATASection createCDATASection(in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] ProcessingInstruction createProcessingInstruction(in [Optional=CallWithDefaultValue] DOMString target,
-                                                                                     in [Optional=CallWithDefaultValue] DOMString data)
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] ProcessingInstruction createProcessingInstruction(in [Optional=DefaultIsUndefined] DOMString target,
+                                                                                     in [Optional=DefaultIsUndefined] DOMString data)
             raises (DOMException);
-        [ReturnNewObject] Attr createAttribute(in [Optional=CallWithDefaultValue] DOMString name)
+        [ReturnNewObject] Attr createAttribute(in [Optional=DefaultIsUndefined] DOMString name)
             raises (DOMException);
-        [ReturnNewObject] EntityReference createEntityReference(in [Optional=CallWithDefaultValue] DOMString name)
+        [ReturnNewObject] EntityReference createEntityReference(in [Optional=DefaultIsUndefined] DOMString name)
             raises(DOMException);
-        NodeList           getElementsByTagName(in [Optional=CallWithDefaultValue] DOMString tagname);
+        NodeList           getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString tagname);
 
         // Introduced in DOM Level 2:
 
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] Node importNode(in [Optional=CallWithDefaultValue] Node importedNode,
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] Node importNode(in [Optional=DefaultIsUndefined] Node importedNode,
                                                    in [Optional] boolean deep)
             raises (DOMException);
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] Element createElementNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                           in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName)
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] Element createElementNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                           in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName)
             raises (DOMException);
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] Attr createAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                          in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName)
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] Attr createAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                          in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName)
             raises (DOMException);
-        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                       in [Optional=CallWithDefaultValue] DOMString localName);
-        Element            getElementById(in [Optional=CallWithDefaultValue] DOMString elementId);
+        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                       in [Optional=DefaultIsUndefined] DOMString localName);
+        Element            getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
 
         // DOM Level 3 Core
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString inputEncoding;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString inputEncoding;
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString xmlEncoding;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString xmlVersion
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString xmlEncoding;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString xmlVersion
                     setter raises (DOMException);
                  attribute boolean xmlStandalone
                     setter raises (DOMException);
 
-        Node               adoptNode(in [Optional=CallWithDefaultValue] Node source)
+        Node               adoptNode(in [Optional=DefaultIsUndefined] Node source)
             raises (DOMException);
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString documentURI;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString documentURI;
 
         // DOM Level 2 Events (DocumentEvents interface)
 
-        Event              createEvent(in [Optional=CallWithDefaultValue] DOMString eventType)
+        Event              createEvent(in [Optional=DefaultIsUndefined] DOMString eventType)
             raises(DOMException);
 
         // DOM Level 2 Tranversal and Range (DocumentRange interface)
@@ -88,15 +88,15 @@ module core {
 
         // DOM Level 2 Tranversal and Range (DocumentTraversal interface)
 
-        [ObjCLegacyUnnamedParameters] NodeIterator createNodeIterator(in [Optional=CallWithDefaultValue] Node root,
-                                                       in [Optional=CallWithDefaultValue] unsigned long whatToShow,
-                                                       in [Optional=CallWithDefaultValue] NodeFilter filter,
-                                                       in [Optional=CallWithDefaultValue] boolean expandEntityReferences)
+        [ObjCLegacyUnnamedParameters] NodeIterator createNodeIterator(in [Optional=DefaultIsUndefined] Node root,
+                                                       in [Optional=DefaultIsUndefined] unsigned long whatToShow,
+                                                       in [Optional=DefaultIsUndefined] NodeFilter filter,
+                                                       in [Optional=DefaultIsUndefined] boolean expandEntityReferences)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters] TreeWalker createTreeWalker(in [Optional=CallWithDefaultValue] Node root,
-                                                   in [Optional=CallWithDefaultValue] unsigned long whatToShow,
-                                                   in [Optional=CallWithDefaultValue] NodeFilter filter,
-                                                   in [Optional=CallWithDefaultValue] boolean expandEntityReferences)
+        [ObjCLegacyUnnamedParameters] TreeWalker createTreeWalker(in [Optional=DefaultIsUndefined] Node root,
+                                                   in [Optional=DefaultIsUndefined] unsigned long whatToShow,
+                                                   in [Optional=DefaultIsUndefined] NodeFilter filter,
+                                                   in [Optional=DefaultIsUndefined] boolean expandEntityReferences)
             raises(DOMException);
 
         // DOM Level 2 Abstract Views (DocumentView interface)
@@ -109,26 +109,26 @@ module core {
 
         // DOM Level 2 Style (DocumentCSS interface)
 
-        [ObjCLegacyUnnamedParameters] CSSStyleDeclaration getOverrideStyle(in [Optional=CallWithDefaultValue] Element element,
-                                                            in [Optional=CallWithDefaultValue] DOMString pseudoElement);
+        [ObjCLegacyUnnamedParameters] CSSStyleDeclaration getOverrideStyle(in [Optional=DefaultIsUndefined] Element element,
+                                                            in [Optional=DefaultIsUndefined] DOMString pseudoElement);
 
         // DOM Level 3 XPath (XPathEvaluator interface)
-        [ObjCLegacyUnnamedParameters] XPathExpression createExpression(in [Optional=CallWithDefaultValue] DOMString expression,
-                                                        in [Optional=CallWithDefaultValue] XPathNSResolver resolver)
+        [ObjCLegacyUnnamedParameters] XPathExpression createExpression(in [Optional=DefaultIsUndefined] DOMString expression,
+                                                        in [Optional=DefaultIsUndefined] XPathNSResolver resolver)
             raises(DOMException);
         XPathNSResolver    createNSResolver(in Node nodeResolver);
-        [ObjCLegacyUnnamedParameters, V8Custom] XPathResult evaluate(in [Optional=CallWithDefaultValue] DOMString expression,
-                                                      in [Optional=CallWithDefaultValue] Node contextNode,
-                                                      in [Optional=CallWithDefaultValue] XPathNSResolver resolver,
-                                                      in [Optional=CallWithDefaultValue] unsigned short type,
-                                                      in [Optional=CallWithDefaultValue] XPathResult inResult)
+        [ObjCLegacyUnnamedParameters, V8Custom] XPathResult evaluate(in [Optional=DefaultIsUndefined] DOMString expression,
+                                                      in [Optional=DefaultIsUndefined] Node contextNode,
+                                                      in [Optional=DefaultIsUndefined] XPathNSResolver resolver,
+                                                      in [Optional=DefaultIsUndefined] unsigned short type,
+                                                      in [Optional=DefaultIsUndefined] XPathResult inResult)
             raises(DOMException);
 
         // Common extensions
 
-        boolean            execCommand(in [Optional=CallWithDefaultValue] DOMString command,
-                                       in [Optional=CallWithDefaultValue] boolean userInterface,
-                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString value);
+        boolean            execCommand(in [Optional=DefaultIsUndefined] DOMString command,
+                                       in [Optional=DefaultIsUndefined] boolean userInterface,
+                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString value);
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // FIXME: remove the these two versions once [Optional] is implemented for Objective-C.
@@ -137,11 +137,11 @@ module core {
         boolean            execCommand(in DOMString command);
 #endif
 
-        boolean            queryCommandEnabled(in [Optional=CallWithDefaultValue] DOMString command);
-        boolean            queryCommandIndeterm(in [Optional=CallWithDefaultValue] DOMString command);
-        boolean            queryCommandState(in [Optional=CallWithDefaultValue] DOMString command);
-        boolean            queryCommandSupported(in [Optional=CallWithDefaultValue] DOMString command);
-        [ConvertNullStringTo=False] DOMString queryCommandValue(in [Optional=CallWithDefaultValue] DOMString command);
+        boolean            queryCommandEnabled(in [Optional=DefaultIsUndefined] DOMString command);
+        boolean            queryCommandIndeterm(in [Optional=DefaultIsUndefined] DOMString command);
+        boolean            queryCommandState(in [Optional=DefaultIsUndefined] DOMString command);
+        boolean            queryCommandSupported(in [Optional=DefaultIsUndefined] DOMString command);
+        [TreatReturnedNullStringAs=False] DOMString queryCommandValue(in [Optional=DefaultIsUndefined] DOMString command);
 
         // Moved down from HTMLDocument
 
@@ -172,10 +172,10 @@ module core {
         readonly attribute HTMLCollection anchors;
         readonly attribute DOMString lastModified;
 
-        NodeList getElementsByName(in [Optional=CallWithDefaultValue] DOMString elementName);
+        NodeList getElementsByName(in [Optional=DefaultIsUndefined] DOMString elementName);
 
 #if defined(ENABLE_MICRODATA) && ENABLE_MICRODATA
-        NodeList getItems(in [TreatNullAs=NullString, TreatUndefinedAs=NullString, Optional=CallWithDefaultValue] DOMString typeNames);
+        NodeList getItems(in [TreatNullAs=NullString, TreatUndefinedAs=NullString, Optional=DefaultIsUndefined] DOMString typeNames);
 #endif
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -184,25 +184,25 @@ module core {
 
         // IE extensions
 
-                 attribute [ConvertNullStringTo=Undefined, TreatNullAs=NullString] DOMString charset;
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString defaultCharset;
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString readyState;
+                 attribute [TreatReturnedNullStringAs=Undefined, TreatNullAs=NullString] DOMString charset;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString defaultCharset;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString readyState;
 
-        Element            elementFromPoint(in [Optional=CallWithDefaultValue] long x, 
-                                            in [Optional=CallWithDefaultValue] long y);
-        Range              caretRangeFromPoint(in [Optional=CallWithDefaultValue] long x, 
-                                               in [Optional=CallWithDefaultValue] long y);
+        Element            elementFromPoint(in [Optional=DefaultIsUndefined] long x, 
+                                            in [Optional=DefaultIsUndefined] long y);
+        Range              caretRangeFromPoint(in [Optional=DefaultIsUndefined] long x, 
+                                               in [Optional=DefaultIsUndefined] long y);
 
         // Mozilla extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         DOMSelection       getSelection();
 #endif
-        readonly attribute [ConvertNullStringTo=Null] DOMString characterSet;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString characterSet;
 
         // WebKit extensions
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString preferredStylesheetSet;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString selectedStylesheetSet;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString preferredStylesheetSet;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString selectedStylesheetSet;
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         CSSStyleDeclaration createCSSStyleDeclaration();
@@ -230,7 +230,7 @@ module core {
 #endif
 
         // HTML 5
-        NodeList getElementsByClassName(in [Optional=CallWithDefaultValue] DOMString tagname);
+        NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString tagname);
 
         readonly attribute DOMString compatMode;
 
@@ -325,17 +325,17 @@ module core {
 #endif
 
 #if defined(ENABLE_TOUCH_EVENTS) && ENABLE_TOUCH_EVENTS
-        [ReturnNewObject, V8EnabledAtRuntime] Touch createTouch(in [Optional=CallWithDefaultValue] DOMWindow window,
-                                                         in [Optional=CallWithDefaultValue] EventTarget target,
-                                                         in [Optional=CallWithDefaultValue] long identifier,
-                                                         in [Optional=CallWithDefaultValue] long pageX,
-                                                         in [Optional=CallWithDefaultValue] long pageY,
-                                                         in [Optional=CallWithDefaultValue] long screenX,
-                                                         in [Optional=CallWithDefaultValue] long screenY,
-                                                         in [Optional=CallWithDefaultValue] long webkitRadiusX,
-                                                         in [Optional=CallWithDefaultValue] long webkitRadiusY,
-                                                         in [Optional=CallWithDefaultValue] float webkitRotationAngle,
-                                                         in [Optional=CallWithDefaultValue] float webkitForce)
+        [ReturnNewObject, V8EnabledAtRuntime] Touch createTouch(in [Optional=DefaultIsUndefined] DOMWindow window,
+                                                         in [Optional=DefaultIsUndefined] EventTarget target,
+                                                         in [Optional=DefaultIsUndefined] long identifier,
+                                                         in [Optional=DefaultIsUndefined] long pageX,
+                                                         in [Optional=DefaultIsUndefined] long pageY,
+                                                         in [Optional=DefaultIsUndefined] long screenX,
+                                                         in [Optional=DefaultIsUndefined] long screenY,
+                                                         in [Optional=DefaultIsUndefined] long webkitRadiusX,
+                                                         in [Optional=DefaultIsUndefined] long webkitRadiusY,
+                                                         in [Optional=DefaultIsUndefined] float webkitRotationAngle,
+                                                         in [Optional=DefaultIsUndefined] float webkitForce)
             raises (DOMException);
         [ReturnNewObject, V8EnabledAtRuntime, Custom] TouchList createTouchList()
             raises (DOMException);
diff --git a/Source/WebCore/dom/DocumentEventQueue.cpp b/Source/WebCore/dom/DocumentEventQueue.cpp
index 31023e28d..5b899b3f5 100644
--- a/Source/WebCore/dom/DocumentEventQueue.cpp
+++ b/Source/WebCore/dom/DocumentEventQueue.cpp
@@ -64,6 +64,7 @@ DocumentEventQueue::DocumentEventQueue(ScriptExecutionContext* context)
     : m_pendingEventTimer(adoptPtr(new DocumentEventQueueTimer(this, context)))
     , m_isClosed(false)
 {
+    m_pendingEventTimer->suspendIfNeeded();
 }
 
 DocumentEventQueue::~DocumentEventQueue()
diff --git a/Source/WebCore/dom/DocumentOrderedMap.cpp b/Source/WebCore/dom/DocumentOrderedMap.cpp
index 886b8bf08..bcb23b496 100644
--- a/Source/WebCore/dom/DocumentOrderedMap.cpp
+++ b/Source/WebCore/dom/DocumentOrderedMap.cpp
@@ -42,7 +42,7 @@ using namespace HTMLNames;
 
 inline bool keyMatchesId(AtomicStringImpl* key, Element* element)
 {
-    return element->hasID() && element->getIdAttribute().impl() == key;
+    return element->getIdAttribute().impl() == key;
 }
 
 inline bool keyMatchesMapName(AtomicStringImpl* key, Element* element)
diff --git a/Source/WebCore/dom/DocumentType.idl b/Source/WebCore/dom/DocumentType.idl
index ed146fa4f..729023271 100644
--- a/Source/WebCore/dom/DocumentType.idl
+++ b/Source/WebCore/dom/DocumentType.idl
@@ -31,9 +31,9 @@ module core {
 
         // DOM Level 2
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString internalSubset;        
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString publicId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString systemId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString internalSubset;        
 
     };
 
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 355f38adb..1b4d839db 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -57,6 +57,7 @@
 #include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderLayer.h"
+#include "RenderRegion.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "Settings.h"
@@ -616,27 +617,28 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
 
     const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
 
-    size_t index = ensureUpdatedAttributes()->getAttributeItemIndex(localName, false);
-    const QualifiedName& qName = index != notFound ? m_attributeMap->attributeItem(index)->name() : QualifiedName(nullAtom, localName, nullAtom);
+    size_t index = ensureUpdatedAttributeData()->getAttributeItemIndex(localName, false);
+    const QualifiedName& qName = index != notFound ? attributeItem(index)->name() : QualifiedName(nullAtom, localName, nullAtom);
     setAttributeInternal(index, qName, value);
 }
 
 void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
 {
-    setAttributeInternal(ensureUpdatedAttributes()->getAttributeItemIndex(name), name, value);
+    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value);
 }
 
 inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value)
 {
-    Attribute* old = index != notFound ? m_attributeMap->attributeItem(index) : 0;
+    ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
+    Attribute* old = index != notFound ? attributeData->attributeItem(index) : 0;
     if (value.isNull()) {
         if (old)
-            m_attributeMap->removeAttribute(index);
+            attributeData->removeAttribute(index, this);
         return;
     }
 
     if (!old) {
-        m_attributeMap->addAttribute(createAttribute(name, value));
+        attributeData->addAttribute(Attribute::create(name, value), this);
         return;
     }
 
@@ -650,11 +652,6 @@ inline void Element::setAttributeInternal(size_t index, const QualifiedName& nam
     didModifyAttribute(old);
 }
 
-PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const AtomicString& value)
-{
-    return Attribute::create(name, value);
-}
-
 void Element::attributeChanged(Attribute* attr)
 {
     if (isIdAttributeName(attr->name()))
@@ -662,12 +659,12 @@ void Element::attributeChanged(Attribute* attr)
     else if (attr->name() == HTMLNames::nameAttr)
         setHasName(!attr->isNull());
 
-    recalcStyleIfNeededAfterAttributeChanged(attr);
-    updateAfterAttributeChanged(attr);
-}
+    if (!needsStyleRecalc() && document()->attached()) {
+        CSSStyleSelector* styleSelector = document()->styleSelectorIfExists();
+        if (!styleSelector || styleSelector->hasSelectorForAttribute(attr->name().localName()))
+            setNeedsStyleRecalc();
+    }
 
-void Element::updateAfterAttributeChanged(Attribute* attr)
-{
     invalidateNodeListsCacheAfterAttributeChanged(attr->name());
 
     if (!AXObjectCache::accessibilityEnabled())
@@ -697,22 +694,9 @@ void Element::updateAfterAttributeChanged(Attribute* attr)
     else if (attrName == aria_invalidAttr)
         document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXInvalidStatusChanged, true);
 }
-    
-void Element::recalcStyleIfNeededAfterAttributeChanged(Attribute* attr)
-{
-    if (needsStyleRecalc())
-        return;
-    if (!document()->attached())
-        return;
-    CSSStyleSelector* styleSelector = document()->styleSelectorIfExists();
-    if (styleSelector && !styleSelector->hasSelectorForAttribute(attr->name().localName()))
-        return;
-    setNeedsStyleRecalc();
-}
 
 void Element::idAttributeChanged(Attribute* attr)
 {
-    setHasID(!attr->isNull());
     if (attributeData()) {
         if (attr->isNull())
             attributeData()->setIdForStyleResolution(nullAtom);
@@ -750,27 +734,28 @@ void Element::parserSetAttributeMap(PassOwnPtr<NamedNodeMap> list, FragmentScrip
     m_attributeMap = list;
 
     if (m_attributeMap) {
+        ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
         m_attributeMap->m_element = this;
         // If the element is created as result of a paste or drag-n-drop operation
         // we want to remove all the script and event handlers.
         if (scriptingPermission == FragmentScriptingNotAllowed) {
             unsigned i = 0;
             while (i < m_attributeMap->length()) {
-                const QualifiedName& attributeName = m_attributeMap->m_attributes[i]->name();
+                const QualifiedName& attributeName = attributeData->m_attributes[i]->name();
                 if (isEventHandlerAttribute(attributeName)) {
-                    m_attributeMap->m_attributes.remove(i);
+                    attributeData->m_attributes.remove(i);
                     continue;
                 }
 
-                if (isAttributeToRemove(attributeName, m_attributeMap->m_attributes[i]->value()))
-                    m_attributeMap->m_attributes[i]->setValue(nullAtom);
+                if (isAttributeToRemove(attributeName, attributeData->m_attributes[i]->value()))
+                    attributeData->m_attributes[i]->setValue(nullAtom);
                 i++;
             }
         }
         // Store the set of attributes that changed on the stack in case
         // attributeChanged mutates m_attributeMap.
         Vector<RefPtr<Attribute> > attributes;
-        m_attributeMap->copyAttributesToVector(attributes);
+        attributeData->copyAttributesToVector(attributes);
         for (Vector<RefPtr<Attribute> >::iterator iter = attributes.begin(); iter != attributes.end(); ++iter)
             attributeChanged(iter->get());
     }
@@ -862,6 +847,8 @@ void Element::willRemove()
     if (containsFullScreenElement())
         setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(false);
 #endif
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->willRemove();
     ContainerNode::willRemove();
 }
 
@@ -870,8 +857,8 @@ void Element::insertedIntoDocument()
     // need to do superclass processing first so inDocument() is true
     // by the time we reach updateId
     ContainerNode::insertedIntoDocument();
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->insertedIntoDocument();
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->insertedIntoDocument();
 
     if (m_attributeMap) {
         if (hasID()) {
@@ -903,8 +890,8 @@ void Element::removedFromDocument()
     }
 
     ContainerNode::removedFromDocument();
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->removedFromDocument();
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->removedFromDocument();
 }
 
 void Element::insertedIntoTree(bool deep)
@@ -912,8 +899,8 @@ void Element::insertedIntoTree(bool deep)
     ContainerNode::insertedIntoTree(deep);
     if (!deep)
         return;
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->insertedIntoTree(true);
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->insertedIntoTree(true);
 
 #if ENABLE(FULLSCREEN_API)
     if (containsFullScreenElement() && parentElement() && !parentElement()->containsFullScreenElement())
@@ -926,8 +913,8 @@ void Element::removedFromTree(bool deep)
     ContainerNode::removedFromTree(deep);
     if (!deep)
         return;
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->removedFromTree(true);
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->removedFromTree(true);
 }
 
 void Element::attach()
@@ -939,10 +926,9 @@ void Element::attach()
     StyleSelectorParentPusher parentPusher(this);
 
     // When a shadow root exists, it does the work of attaching the children.
-    if (ShadowRoot* shadow = shadowRoot()) {
+    if (hasShadowRoot()) {
         parentPusher.push();
-        Node::attach();
-        shadow->attach();
+        shadowRootList()->attach();
 
         // In a shadow tree, some of light children may be attached by 'content' element.
         // However, when there is no content element or content element does not select
@@ -951,6 +937,7 @@ void Element::attach()
             if (!child->attached())
                 child->attach();
         }
+        Node::attach();
     } else {
         if (firstChild())
             parentPusher.push();
@@ -978,8 +965,8 @@ void Element::detach()
     if (hasRareData())
         rareData()->resetComputedStyle();
     ContainerNode::detach();
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->detach();
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->detach();
 
     RenderWidget::resumeWidgetHierarchyUpdates();
 }
@@ -1121,7 +1108,7 @@ void Element::recalcStyle(StyleChange change)
     bool forceCheckOfAnyElementSibling = false;
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode()) {
-            static_cast<Text*>(n)->recalcTextStyle(change);
+            toText(n)->recalcTextStyle(change);
             continue;
         } 
         if (!n->isElementNode()) 
@@ -1138,10 +1125,11 @@ void Element::recalcStyle(StyleChange change)
         forceCheckOfAnyElementSibling = forceCheckOfAnyElementSibling || (childRulesChanged && hasIndirectAdjacentRules);
     }
     // FIXME: This does not care about sibling combinators. Will be necessary in XBL2 world.
-    if (ShadowRoot* shadow = shadowRoot()) {
-        if (change >= Inherit || shadow->childNeedsStyleRecalc() || shadow->needsStyleRecalc()) {
+    if (hasShadowRoot()) {
+        ShadowRootList* list = shadowRootList();
+        if (change >= Inherit || list->childNeedsStyleRecalc() || list->needsStyleRecalc()) {
             parentPusher.push();
-            shadow->recalcShadowTreeStyle(change);
+            list->recalcShadowTreeStyle(change);
         }
     }
 
@@ -1152,9 +1140,19 @@ void Element::recalcStyle(StyleChange change)
         didRecalcStyle(change);
 }
 
-ShadowRoot* Element::shadowRoot() const
+bool Element::hasShadowRoot() const
 {
-    return hasRareData() ? rareData()->m_shadowRoot : 0;
+    if (ShadowRootList* list = shadowRootList())
+        return list->hasShadowRoot();
+    return false;
+}
+
+ShadowRootList* Element::shadowRootList() const
+{
+    if (!hasRareData())
+        return 0;
+
+    return &rareData()->m_shadowRootList;
 }
 
 static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, ExceptionCode& ec)
@@ -1175,16 +1173,19 @@ static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, Excep
     return true;
 }
 
-void Element::setShadowRoot(PassRefPtr<ShadowRoot> prpShadowRoot, ExceptionCode& ec)
+void Element::setShadowRoot(PassRefPtr<ShadowRoot> shadowRoot, ExceptionCode& ec)
 {
-    RefPtr<ShadowRoot> shadowRoot = prpShadowRoot;
     if (!validateShadowRoot(document(), shadowRoot.get(), ec))
         return;
 
+    if (!hasRareData())
+        ensureRareData();
+
     removeShadowRoot();
 
-    ensureRareData()->m_shadowRoot = shadowRoot.get();
     shadowRoot->setShadowHost(this);
+    shadowRootList()->pushShadowRoot(shadowRoot.get());
+
     if (inDocument())
         shadowRoot->insertedIntoDocument();
     if (attached()) {
@@ -1196,23 +1197,20 @@ void Element::setShadowRoot(PassRefPtr<ShadowRoot> prpShadowRoot, ExceptionCode&
 
 ShadowRoot* Element::ensureShadowRoot()
 {
-    if (ShadowRoot* existingRoot = shadowRoot())
-        return existingRoot;
+    if (hasShadowRoot())
+        return shadowRootList()->oldestShadowRoot();
 
     return ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot).get();
 }
 
 void Element::removeShadowRoot()
 {
-    if (!hasRareData())
+    if (!hasShadowRoot())
         return;
 
-    ElementRareData* data = rareData();
-    if (RefPtr<ShadowRoot> oldRoot = data->m_shadowRoot) {
-        data->m_shadowRoot = 0;
+    while (RefPtr<ShadowRoot> oldRoot = shadowRootList()->popShadowRoot()) {
         document()->removeFocusedNodeOfSubtree(oldRoot.get());
 
-        // Remove from rendering tree
         if (oldRoot->attached())
             oldRoot->detach();
 
@@ -1223,9 +1221,10 @@ void Element::removeShadowRoot()
         else
             oldRoot->removedFromTree(true);
         if (attached()) {
-            for (Node* child = firstChild(); child; child = child->nextSibling())
+            for (Node* child = firstChild(); child; child = child->nextSibling()) {
                 if (!child->attached())
                     child->lazyAttach();
+            }
         }
     }
 }
@@ -1361,8 +1360,8 @@ void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* af
         checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
 
     if (hasRareData()) {
-        if (ShadowRoot* root = shadowRoot())
-            root->hostChildrenChanged();
+        if (hasShadowRoot())
+            shadowRootList()->hostChildrenChanged();
     }
 }
 
@@ -1473,15 +1472,16 @@ void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicStrin
 
 void Element::removeAttribute(const String& name)
 {
-    if (!m_attributeMap)
+    ElementAttributeData* attributeData = this->attributeData();
+    if (!attributeData)
         return;
 
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    size_t index = m_attributeMap->getAttributeItemIndex(localName, false);
+    size_t index = attributeData->getAttributeItemIndex(localName, false);
     if (index == notFound)
         return;
 
-    m_attributeMap->removeAttribute(index);
+    attributeData->removeAttribute(index, this);
 }
 
 void Element::removeAttributeNS(const String& namespaceURI, const String& localName)
@@ -1508,22 +1508,22 @@ PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const S
 
 bool Element::hasAttribute(const String& name) const
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return false;
 
     // This call to String::lower() seems to be required but
     // there may be a way to remove it.
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    return attrs->getAttributeItem(localName, false);
+    return attributeData->getAttributeItem(localName, false);
 }
 
 bool Element::hasAttributeNS(const String& namespaceURI, const String& localName) const
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return false;
-    return attrs->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
+    return attributeData->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
 }
 
 CSSStyleDeclaration *Element::style()
@@ -1558,7 +1558,7 @@ void Element::focus(bool restorePreviousSelection)
         // If a focus event handler changes the focus to a different node it
         // does not make sense to continue and update appearence.
         protect = this;
-        if (shadowRoot() && page->focusController()->transferFocusToElementInShadowRoot(this, restorePreviousSelection))
+        if (hasShadowRoot() && page->focusController()->transferFocusToElementInShadowRoot(this, restorePreviousSelection))
             return;
         if (!page->focusController()->setFocusedNode(this, doc->frame()))
             return;
@@ -1710,15 +1710,12 @@ void Element::cancelFocusAppearanceUpdate()
 
 void Element::normalizeAttributes()
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
-        return;
-
-    if (attrs->isEmpty())
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData || attributeData->isEmpty())
         return;
 
     Vector<RefPtr<Attribute> > attributeVector;
-    attrs->copyAttributesToVector(attributeVector);
+    attributeData->copyAttributesToVector(attributeVector);
     size_t numAttrs = attributeVector.size();
     for (size_t i = 0; i < numAttrs; ++i) {
         if (Attr* attr = attributeVector[i]->attr())
@@ -1751,30 +1748,6 @@ unsigned Element::childElementCount() const
     return count;
 }
 
-#if ENABLE(STYLE_SCOPED)
-bool Element::hasScopedHTMLStyleChild() const
-{
-    return hasRareData() && rareData()->hasScopedHTMLStyleChild();
-}
-
-size_t Element::numberOfScopedHTMLStyleChildren() const
-{
-    return hasRareData() ? rareData()->numberOfScopedHTMLStyleChildren() : 0;
-}
-
-void Element::registerScopedHTMLStyleChild()
-{
-    ensureRareData()->registerScopedHTMLStyleChild();
-}
-
-void Element::unregisterScopedHTMLStyleChild()
-{
-    ASSERT(hasRareData());
-    if (hasRareData())
-        rareData()->unregisterScopedHTMLStyleChild();
-}
-#endif
-
 bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
 {
     if (selector.isEmpty()) {
@@ -1879,13 +1852,13 @@ void Element::setUnsignedIntegralAttribute(const QualifiedName& attributeName, u
 }
 
 #if ENABLE(SVG)
-bool Element::childShouldCreateRenderer(Node* child) const
+bool Element::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // Only create renderers for SVG elements whose parents are SVG elements, or for proper <svg xmlns="svgNS"> subdocuments.
-    if (child->isSVGElement())
-        return child->hasTagName(SVGNames::svgTag) || isSVGElement();
+    if (childContext.node()->isSVGElement())
+        return childContext.node()->hasTagName(SVGNames::svgTag) || isSVGElement();
 
-    return Node::childShouldCreateRenderer(child);
+    return Node::childShouldCreateRenderer(childContext);
 }
 #endif
     
@@ -1971,6 +1944,33 @@ PassRefPtr<WebKitAnimationList> Element::webkitGetAnimations() const
     return animController->animationsForRenderer(renderer());
 }
 
+const AtomicString& Element::webkitRegionOverflow() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+
+    if (document()->cssRegionsEnabled() && renderer() && renderer()->isRenderRegion()) {
+        RenderRegion* region = toRenderRegion(renderer());
+        switch (region->regionState()) {
+        case RenderRegion::RegionFit: {
+            DEFINE_STATIC_LOCAL(AtomicString, fitState, ("fit"));
+            return fitState;
+        }
+        case RenderRegion::RegionEmpty: {
+            DEFINE_STATIC_LOCAL(AtomicString, emptyState, ("empty"));
+            return emptyState;
+        }
+        case RenderRegion::RegionOverflow: {
+            DEFINE_STATIC_LOCAL(AtomicString, overflowState, ("overflow"));
+            return overflowState;
+        }
+        default:
+            break;
+        }
+    }
+    DEFINE_STATIC_LOCAL(AtomicString, undefinedState, ("undefined"));
+    return undefinedState;
+}
+
 #ifndef NDEBUG
 bool Element::fastAttributeLookupAllowed(const QualifiedName& name) const
 {
@@ -2004,7 +2004,7 @@ void Element::willModifyAttribute(const QualifiedName& name, const AtomicString&
 
 #if ENABLE(INSPECTOR)
     if (!isSynchronizingStyleAttribute())
-        InspectorInstrumentation::willModifyDOMAttr(document(), this);
+        InspectorInstrumentation::willModifyDOMAttr(document(), this, oldValue, newValue);
 #endif
 }
 
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 9381e2f58..c9a1139a9 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -42,6 +42,7 @@ class DOMTokenList;
 class ElementRareData;
 class IntSize;
 class ShadowRoot;
+class ShadowRootList;
 class WebKitAnimationList;
 
 enum SpellcheckAttributeState {
@@ -147,6 +148,8 @@ public:
     const AtomicString& getIdAttribute() const;
     void setIdAttribute(const AtomicString&);
 
+    const AtomicString& getNameAttribute() const;
+
     // Call this to get the value of the id attribute for style resolution purposes.
     // The value will already be lowercased if the document is in compatibility mode,
     // so this function is not suitable for non-style uses.
@@ -236,14 +239,10 @@ public:
     // Only called by the parser immediately after element construction.
     void parserSetAttributeMap(PassOwnPtr<NamedNodeMap>, FragmentScriptingPermission);
 
-    NamedNodeMap* attributeMap() const { return m_attributeMap.get(); }
-    NamedNodeMap* ensureAttributeMap() const;
-
     ElementAttributeData* attributeData() const { return m_attributeMap ? m_attributeMap->attributeData() : 0; }
-    ElementAttributeData* ensureAttributeData() const { return ensureUpdatedAttributes()->attributeData(); }
-
-    // FIXME: This method should be removed once AttributeData is moved to Element.
-    ElementAttributeData* ensureAttributeDataWithoutUpdate() const { return ensureAttributeMap()->attributeData(); }
+    ElementAttributeData* ensureAttributeData() const;
+    ElementAttributeData* updatedAttributeData() const;
+    ElementAttributeData* ensureUpdatedAttributeData() const;
 
     void setAttributesFromElement(const Element&);
 
@@ -254,7 +253,11 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     void recalcStyle(StyleChange = NoChange);
 
-    ShadowRoot* shadowRoot() const;
+    bool hasShadowRoot() const;
+    ShadowRootList* shadowRootList() const;
+
+    // FIXME: These API will be moved to ShadowRootList.
+    // https://bugs.webkit.org/show_bug.cgi?id=78313
     void setShadowRoot(PassRefPtr<ShadowRoot>, ExceptionCode&);
     ShadowRoot* ensureShadowRoot();
     void removeShadowRoot();
@@ -323,13 +326,6 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
-#if ENABLE(STYLE_SCOPED)
-    void registerScopedHTMLStyleChild();
-    void unregisterScopedHTMLStyleChild();
-    bool hasScopedHTMLStyleChild() const;
-    size_t numberOfScopedHTMLStyleChildren() const;
-#endif
-
     bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
 
     DOMTokenList* classList();
@@ -376,7 +372,7 @@ public:
     virtual void dispatchFormControlChangeEvent() { }
 
 #if ENABLE(SVG)
-    virtual bool childShouldCreateRenderer(Node*) const; 
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 #endif
     
 #if ENABLE(FULLSCREEN_API)
@@ -396,7 +392,10 @@ public:
     
     PassRefPtr<RenderStyle> styleForRenderer();
 
-    PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
+    const AtomicString& webkitRegionOverflow() const;
+
+    bool hasID() const;
+    bool hasClass() const;
 
 protected:
     Element(const QualifiedName& tagName, Document* document, ConstructionType type)
@@ -418,11 +417,6 @@ protected:
     virtual bool shouldRegisterAsNamedItem() const { return false; }
     virtual bool shouldRegisterAsExtraNamedItem() const { return false; }
 
-    // The implementation of Element::attributeChanged() calls the following two functions.
-    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
-    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
-    void updateAfterAttributeChanged(Attribute*);
-    
     void idAttributeChanged(Attribute*);
 
     HTMLCollection* ensureCachedHTMLCollection(CollectionType);
@@ -539,7 +533,9 @@ inline Element* Element::nextElementSibling() const
 inline NamedNodeMap* Element::ensureUpdatedAttributes() const
 {
     updateInvalidAttributes();
-    return ensureAttributeMap();
+    if (!m_attributeMap)
+        createAttributeMap();
+    return m_attributeMap.get();
 }
 
 inline NamedNodeMap* Element::updatedAttributes() const
@@ -548,10 +544,29 @@ inline NamedNodeMap* Element::updatedAttributes() const
     return m_attributeMap.get();
 }
 
+inline ElementAttributeData* Element::ensureAttributeData() const
+{
+    if (!m_attributeMap)
+        createAttributeMap();
+    return m_attributeMap->attributeData();
+}
+
+inline ElementAttributeData* Element::updatedAttributeData() const
+{
+    updateInvalidAttributes();
+    return attributeData();
+}
+
+inline ElementAttributeData* Element::ensureUpdatedAttributeData() const
+{
+    updateInvalidAttributes();
+    return ensureAttributeData();
+}
+
 inline void Element::setAttributesFromElement(const Element& other)
 {
-    if (NamedNodeMap* attributeMap = other.updatedAttributes())
-        ensureUpdatedAttributes()->setAttributes(*attributeMap);
+    if (ElementAttributeData* attributeData = other.updatedAttributeData())
+        ensureUpdatedAttributeData()->setAttributes(*attributeData, this);
 }
 
 inline void Element::updateName(const AtomicString& oldName, const AtomicString& newName)
@@ -628,7 +643,12 @@ inline bool Element::isIdAttributeName(const QualifiedName& attributeName) const
 
 inline const AtomicString& Element::getIdAttribute() const
 {
-    return fastGetAttribute(document()->idAttributeName());
+    return hasID() ? fastGetAttribute(document()->idAttributeName()) : nullAtom;
+}
+
+inline const AtomicString& Element::getNameAttribute() const
+{
+    return hasName() ? fastGetAttribute(HTMLNames::nameAttr) : nullAtom;
 }
 
 inline void Element::setIdAttribute(const AtomicString& value)
@@ -660,13 +680,6 @@ inline void Element::removeAttribute(unsigned index)
     m_attributeMap->removeAttribute(index);
 }
 
-inline NamedNodeMap* Element::ensureAttributeMap() const
-{
-    if (!m_attributeMap)
-        createAttributeMap();
-    return m_attributeMap.get();
-}
-
 inline void Element::updateInvalidAttributes() const
 {
     if (!isStyleAttributeValid())
@@ -687,6 +700,27 @@ inline Element* firstElementChild(const ContainerNode* container)
     return static_cast<Element*>(child);
 }
 
+inline bool Element::hasID() const
+{
+    return attributeData() && attributeData()->hasID();
+}
+
+inline bool Element::hasClass() const
+{
+    return attributeData() && attributeData()->hasClass();
+}
+
+// Put here to make them inline.
+inline bool Node::hasID() const
+{
+    return isElementNode() && toElement(this)->hasID();
+}
+
+inline bool Node::hasClass() const
+{
+    return isElementNode() && toElement(this)->hasClass();
+}
+
 } // namespace
 
 #endif
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index 20d4c8e11..c66b14592 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -22,44 +22,45 @@ module core {
 
     interface [
         JSGenerateToNativeObject,
-        JSInlineGetOwnPropertySlot
+        JSInlineGetOwnPropertySlot,
+        V8CustomToJSObject
     ] Element : Node {
 
         // DOM Level 1 Core
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString tagName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString tagName;
 
-        [ConvertNullStringTo=Null] DOMString getAttribute(in [Optional=CallWithDefaultValue] DOMString name);
-        [ObjCLegacyUnnamedParameters] void setAttribute(in [Optional=CallWithDefaultValue] DOMString name,
-                                         in [Optional=CallWithDefaultValue] DOMString value)
+        [TreatReturnedNullStringAs=Null] DOMString getAttribute(in [Optional=DefaultIsUndefined] DOMString name);
+        [ObjCLegacyUnnamedParameters] void setAttribute(in [Optional=DefaultIsUndefined] DOMString name,
+                                         in [Optional=DefaultIsUndefined] DOMString value)
             raises(DOMException);
-        void removeAttribute(in [Optional=CallWithDefaultValue] DOMString name);
-        Attr getAttributeNode(in [Optional=CallWithDefaultValue] DOMString name);
-        Attr setAttributeNode(in [Optional=CallWithDefaultValue] Attr newAttr)
+        void removeAttribute(in [Optional=DefaultIsUndefined] DOMString name);
+        Attr getAttributeNode(in [Optional=DefaultIsUndefined] DOMString name);
+        Attr setAttributeNode(in [Optional=DefaultIsUndefined] Attr newAttr)
             raises(DOMException);
-        Attr removeAttributeNode(in [Optional=CallWithDefaultValue] Attr oldAttr)
+        Attr removeAttributeNode(in [Optional=DefaultIsUndefined] Attr oldAttr)
             raises(DOMException);
-        NodeList getElementsByTagName(in [Optional=CallWithDefaultValue] DOMString name);
+        NodeList getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString name);
 
         // DOM Level 2 Core
 
-        [ObjCLegacyUnnamedParameters] DOMString getAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                in [Optional=CallWithDefaultValue] DOMString localName);
-        [ObjCLegacyUnnamedParameters] void setAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                           in [Optional=CallWithDefaultValue] DOMString qualifiedName, 
-                                           in [Optional=CallWithDefaultValue] DOMString value)
+        [ObjCLegacyUnnamedParameters] DOMString getAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                in [Optional=DefaultIsUndefined] DOMString localName);
+        [ObjCLegacyUnnamedParameters] void setAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                           in [Optional=DefaultIsUndefined] DOMString qualifiedName, 
+                                           in [Optional=DefaultIsUndefined] DOMString value)
             raises(DOMException);
         [ObjCLegacyUnnamedParameters] void removeAttributeNS(in [TreatNullAs=NullString] DOMString namespaceURI,
                                               in DOMString localName);
-        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                       in [Optional=CallWithDefaultValue] DOMString localName);
-        [ObjCLegacyUnnamedParameters] Attr getAttributeNodeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                               in [Optional=CallWithDefaultValue] DOMString localName);
-        Attr setAttributeNodeNS(in [Optional=CallWithDefaultValue] Attr newAttr)
+        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                       in [Optional=DefaultIsUndefined] DOMString localName);
+        [ObjCLegacyUnnamedParameters] Attr getAttributeNodeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                               in [Optional=DefaultIsUndefined] DOMString localName);
+        Attr setAttributeNodeNS(in [Optional=DefaultIsUndefined] Attr newAttr)
             raises(DOMException);
         boolean hasAttribute(in DOMString name);
-        [ObjCLegacyUnnamedParameters] boolean hasAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                              in [Optional=CallWithDefaultValue] DOMString localName);
+        [ObjCLegacyUnnamedParameters] boolean hasAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                              in [Optional=DefaultIsUndefined] DOMString localName);
 
         readonly attribute CSSStyleDeclaration style;
 
@@ -86,15 +87,15 @@ module core {
         // WebKit extensions
 
         void scrollIntoViewIfNeeded(in [Optional] boolean centerIfNeeded);
-        void scrollByLines(in [Optional=CallWithDefaultValue] long lines);
-        void scrollByPages(in [Optional=CallWithDefaultValue] long pages);
+        void scrollByLines(in [Optional=DefaultIsUndefined] long lines);
+        void scrollByPages(in [Optional=DefaultIsUndefined] long pages);
 
 #if defined(ENABLE_ANIMATION_API) && ENABLE_ANIMATION_API
         WebKitAnimationList webkitGetAnimations();
 #endif
 
         // HTML 5
-        NodeList getElementsByClassName(in [Optional=CallWithDefaultValue] DOMString name);
+        NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString name);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute DOMStringMap dataset;
@@ -107,7 +108,7 @@ module core {
             raises(DOMException);
 
         // WebKit extension, pending specification.
-        boolean webkitMatchesSelector(in [Optional=CallWithDefaultValue] DOMString selectors)
+        boolean webkitMatchesSelector(in [Optional=DefaultIsUndefined] DOMString selectors)
             raises(DOMException);
 
         // ElementTraversal API
@@ -130,9 +131,12 @@ module core {
 
 #if defined(ENABLE_FULLSCREEN_API) && ENABLE_FULLSCREEN_API
         const unsigned short ALLOW_KEYBOARD_INPUT = 1;
-        [V8EnabledAtRuntime] void webkitRequestFullScreen(in [Optional=CallWithDefaultValue] unsigned short flags);
+        [V8EnabledAtRuntime] void webkitRequestFullScreen(in [Optional=DefaultIsUndefined] unsigned short flags);
 #endif
 
+        // CSS Regions API
+        readonly attribute DOMString webkitRegionOverflow;
+
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // Event handler DOM attributes
         attribute [NotEnumerable] EventListener onabort;
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index cea62f3cf..71457f4b1 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -26,38 +26,159 @@
 #include "config.h"
 #include "ElementAttributeData.h"
 
+#include "Attr.h"
 #include "StyledElement.h"
 
 namespace WebCore {
 
+ElementAttributeData::~ElementAttributeData()
+{
+    detachAttributesFromElement();
+}
+
 void ElementAttributeData::setClass(const String& className, bool shouldFoldCase)
 {
     m_classNames.set(className, shouldFoldCase);
 }
 
-StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(Element* element)
+StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(StyledElement* element)
 {
     if (!m_inlineStyleDecl) {
         ASSERT(element->isStyledElement());
-        m_inlineStyleDecl = StylePropertySet::createInline(static_cast<StyledElement*>(element));
+        m_inlineStyleDecl = StylePropertySet::create();
         m_inlineStyleDecl->setStrictParsing(element->isHTMLElement() && !element->document()->inQuirksMode());
     }
     return m_inlineStyleDecl.get();
 }
 
-void ElementAttributeData::destroyInlineStyleDecl()
+void ElementAttributeData::destroyInlineStyleDecl(StyledElement* element)
 {
     if (!m_inlineStyleDecl)
         return;
-    m_inlineStyleDecl->clearParentElement();
+    m_inlineStyleDecl->clearParentElement(element);
     m_inlineStyleDecl = 0;
 }
 
-StylePropertySet* ElementAttributeData::ensureAttributeStyle(StyledElement* element)
+void ElementAttributeData::addAttribute(PassRefPtr<Attribute> prpAttribute, Element* element)
+{
+    RefPtr<Attribute> attribute = prpAttribute;
+
+    if (element)
+        element->willModifyAttribute(attribute->name(), nullAtom, attribute->value());
+
+    m_attributes.append(attribute);
+    if (Attr* attr = attribute->attr())
+        attr->m_element = element;
+
+    if (element)
+        element->didModifyAttribute(attribute.get());
+}
+
+void ElementAttributeData::removeAttribute(size_t index, Element* element)
+{
+    ASSERT(index < length());
+
+    RefPtr<Attribute> attribute = m_attributes[index];
+
+    if (element)
+        element->willRemoveAttribute(attribute->name(), attribute->value());
+
+    if (Attr* attr = attribute->attr())
+        attr->m_element = 0;
+    m_attributes.remove(index);
+
+    if (element)
+        element->didRemoveAttribute(attribute.get());
+}
+
+void ElementAttributeData::detachAttributesFromElement()
+{
+    size_t size = m_attributes.size();
+    for (size_t i = 0; i < size; i++) {
+        if (Attr* attr = m_attributes[i]->attr())
+            attr->m_element = 0;
+    }
+}
+
+void ElementAttributeData::copyAttributesToVector(Vector<RefPtr<Attribute> >& copy)
+{
+    copy = m_attributes;
+}
+
+size_t ElementAttributeData::getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    unsigned len = length();
+
+    // Continue to checking case-insensitively and/or full namespaced names if necessary:
+    for (unsigned i = 0; i < len; ++i) {
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
+                return i;
+        } else {
+            // FIXME: Would be faster to do this comparison without calling toString, which
+            // generates a temporary string by concatenation. But this branch is only reached
+            // if the attribute name has a prefix, which is rare in HTML.
+            if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
+                return i;
+        }
+    }
+    return notFound;
+}
+
+void ElementAttributeData::setAttributes(const ElementAttributeData& other, Element* element)
+{
+    ASSERT(element);
+
+    // If assigning the map changes the id attribute, we need to call
+    // updateId.
+    Attribute* oldId = getAttributeItem(element->document()->idAttributeName());
+    Attribute* newId = other.getAttributeItem(element->document()->idAttributeName());
+
+    if (oldId || newId)
+        element->updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
+
+    Attribute* oldName = getAttributeItem(HTMLNames::nameAttr);
+    Attribute* newName = other.getAttributeItem(HTMLNames::nameAttr);
+
+    if (oldName || newName)
+        element->updateName(oldName ? oldName->value() : nullAtom, newName ? newName->value() : nullAtom);
+
+    clearAttributes();
+    unsigned newLength = other.length();
+    m_attributes.resize(newLength);
+
+    // FIXME: These loops can probably be combined.
+    for (unsigned i = 0; i < newLength; i++)
+        m_attributes[i] = other.m_attributes[i]->clone();
+    for (unsigned i = 0; i < newLength; i++)
+        element->attributeChanged(m_attributes[i].get());
+}
+
+void ElementAttributeData::clearAttributes()
 {
-    if (!m_attributeStyle)
-        m_attributeStyle = StylePropertySet::createAttributeStyle(element);
-    return m_attributeStyle.get();
+    clearClass();
+    detachAttributesFromElement();
+    m_attributes.clear();
+}
+
+void ElementAttributeData::replaceAttribute(size_t index, PassRefPtr<Attribute> prpAttribute, Element* element)
+{
+    ASSERT(element);
+    ASSERT(index < length());
+
+    RefPtr<Attribute> attribute = prpAttribute;
+    Attribute* old = m_attributes[index].get();
+
+    element->willModifyAttribute(attribute->name(), old->value(), attribute->value());
+
+    if (Attr* attr = old->attr())
+        attr->m_element = 0;
+    m_attributes[index] = attribute;
+    if (Attr* attr = attribute->attr())
+        attr->m_element = element;
+
+    element->didModifyAttribute(attribute.get());
 }
 
 }
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index 408065981..be145617c 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -26,8 +26,10 @@
 #ifndef ElementAttributeData_h
 #define ElementAttributeData_h
 
+#include "Attribute.h"
 #include "SpaceSplitString.h"
 #include "StylePropertySet.h"
+#include <wtf/NotFound.h>
 
 namespace WebCore {
 
@@ -35,6 +37,8 @@ class Element;
 
 class ElementAttributeData {
 public:
+    ~ElementAttributeData();
+
     void clearClass() { m_classNames.clear(); }
     void setClass(const String& className, bool shouldFoldCase);
     const SpaceSplitString& classNames() const { return m_classNames; }
@@ -43,25 +47,109 @@ public:
     void setIdForStyleResolution(const AtomicString& newId) { m_idForStyleResolution = newId; }
 
     StylePropertySet* inlineStyleDecl() { return m_inlineStyleDecl.get(); }
-    StylePropertySet* ensureInlineStyleDecl(Element*);
-    void destroyInlineStyleDecl();
+    StylePropertySet* ensureInlineStyleDecl(StyledElement*);
+    void destroyInlineStyleDecl(StyledElement* element);
 
     StylePropertySet* attributeStyle() const { return m_attributeStyle.get(); }
-    StylePropertySet* ensureAttributeStyle(StyledElement*);
+    void setAttributeStyle(PassRefPtr<StylePropertySet> style) { m_attributeStyle = style; }
+
+    size_t length() const { return m_attributes.size(); }
+    bool isEmpty() const { return m_attributes.isEmpty(); }
+
+    // Internal interface.
+    Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
+    Attribute* getAttributeItem(const QualifiedName&) const;
+    size_t getAttributeItemIndex(const QualifiedName&) const;
+
+    // These functions do no error checking.
+    void addAttribute(PassRefPtr<Attribute>, Element*);
+    void removeAttribute(const QualifiedName&, Element*);
+    void removeAttribute(size_t index, Element*);
+
+    bool hasID() const { return !m_idForStyleResolution.isNull(); }
+    bool hasClass() const { return !m_classNames.isNull(); }
 
 private:
+    friend class Element;
     friend class NamedNodeMap;
 
     ElementAttributeData()
     {
     }
 
+    void detachAttributesFromElement();
+    void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
+    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
+    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
+    size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
+    void setAttributes(const ElementAttributeData& other, Element*);
+    void clearAttributes();
+    void replaceAttribute(size_t index, PassRefPtr<Attribute>, Element*);
+
     RefPtr<StylePropertySet> m_inlineStyleDecl;
     RefPtr<StylePropertySet> m_attributeStyle;
     SpaceSplitString m_classNames;
     AtomicString m_idForStyleResolution;
+    Vector<RefPtr<Attribute>, 4> m_attributes;
 };
 
+inline void ElementAttributeData::removeAttribute(const QualifiedName& name, Element* element)
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index == notFound)
+        return;
+
+    removeAttribute(index, element);
+}
+
+inline Attribute* ElementAttributeData::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
+    if (index != notFound)
+        return m_attributes[index].get();
+    return 0;
+}
+
+inline Attribute* ElementAttributeData::getAttributeItem(const QualifiedName& name) const
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index != notFound)
+        return m_attributes[index].get();
+    return 0;
+}
+
+// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
+// can tune the behavior (hasAttribute is case sensitive whereas getAttribute is not).
+inline size_t ElementAttributeData::getAttributeItemIndex(const QualifiedName& name) const
+{
+    size_t len = length();
+    for (unsigned i = 0; i < len; ++i) {
+        if (m_attributes[i]->name().matches(name))
+            return i;
+    }
+    return notFound;
+}
+
+inline size_t ElementAttributeData::getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    unsigned len = length();
+    bool doSlowCheck = shouldIgnoreAttributeCase;
+
+    // Optimize for the case where the attribute exists and its name exactly matches.
+    for (unsigned i = 0; i < len; ++i) {
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (name == attrName.localName())
+                return i;
+        } else
+            doSlowCheck = true;
+    }
+
+    if (doSlowCheck)
+        return getAttributeItemIndexSlowCase(name, shouldIgnoreAttributeCase);
+    return notFound;
+}
+
 }
 
 #endif // ElementAttributeData_h
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index ca32115e6..ff45783bd 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -27,12 +27,11 @@
 #include "Element.h"
 #include "HTMLCollection.h"
 #include "NodeRareData.h"
+#include "ShadowRootList.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-class ShadowRoot;
-
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
@@ -40,13 +39,6 @@ public:
 
     void resetComputedStyle();
 
-#if ENABLE(STYLE_SCOPED)
-    void registerScopedHTMLStyleChild();
-    void unregisterScopedHTMLStyleChild();
-    bool hasScopedHTMLStyleChild() const;
-    size_t numberOfScopedHTMLStyleChildren() const;
-#endif
-
     using NodeRareData::needsFocusAppearanceUpdateSoonAfterAttach;
     using NodeRareData::setNeedsFocusAppearanceUpdateSoonAfterAttach;
 
@@ -72,13 +64,9 @@ public:
 
     LayoutSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    ShadowRoot* m_shadowRoot;
+    ShadowRootList m_shadowRootList;
     AtomicString m_shadowPseudoId;
 
-#if ENABLE(STYLE_SCOPED)
-    size_t m_numberOfScopedHTMLStyleChildren;
-#endif
-
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
 
@@ -95,11 +83,8 @@ inline IntSize defaultMinimumSizeForResizing()
 }
 
 inline ElementRareData::ElementRareData()
-    : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
-    , m_shadowRoot(0)
-#if ENABLE(STYLE_SCOPED)
-    , m_numberOfScopedHTMLStyleChildren(0)
-#endif
+    : NodeRareData()
+    , m_minimumSizeForResizing(defaultMinimumSizeForResizing())
     , m_styleAffectedByEmpty(false)
 #if ENABLE(FULLSCREEN_API)
     , m_containsFullScreenElement(false)
@@ -109,7 +94,7 @@ inline ElementRareData::ElementRareData()
 
 inline ElementRareData::~ElementRareData()
 {
-    ASSERT(!m_shadowRoot);
+    ASSERT(!m_shadowRootList.hasShadowRoot());
 }
 
 inline void ElementRareData::resetComputedStyle()
@@ -117,29 +102,5 @@ inline void ElementRareData::resetComputedStyle()
     m_computedStyle.clear();
 }
 
-#if ENABLE(STYLE_SCOPED)
-inline void ElementRareData::registerScopedHTMLStyleChild()
-{
-    ++m_numberOfScopedHTMLStyleChildren;
-}
-
-inline void ElementRareData::unregisterScopedHTMLStyleChild()
-{
-    ASSERT(m_numberOfScopedHTMLStyleChildren > 0);
-    if (m_numberOfScopedHTMLStyleChildren > 0)
-        --m_numberOfScopedHTMLStyleChildren;
-}
-
-inline bool ElementRareData::hasScopedHTMLStyleChild() const
-{
-    return m_numberOfScopedHTMLStyleChildren;
-}
-
-inline size_t ElementRareData::numberOfScopedHTMLStyleChildren() const
-{
-    return m_numberOfScopedHTMLStyleChildren;
-}
-#endif
-
 }
 #endif // ElementRareData_h
diff --git a/Source/WebCore/dom/Entity.idl b/Source/WebCore/dom/Entity.idl
index 8dacbe90a..b9ec406b9 100644
--- a/Source/WebCore/dom/Entity.idl
+++ b/Source/WebCore/dom/Entity.idl
@@ -20,9 +20,9 @@
 module core {
 
     interface Entity : Node {
-        readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString notationName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString publicId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString systemId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString notationName;
     };
 
 }
diff --git a/Source/WebCore/dom/Event.idl b/Source/WebCore/dom/Event.idl
index 94d45427e..2abd5a950 100644
--- a/Source/WebCore/dom/Event.idl
+++ b/Source/WebCore/dom/Event.idl
@@ -22,7 +22,7 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         ConstructorTemplate=Event,
         JSNoStaticTables,
         ObjCPolymorphic
@@ -63,9 +63,9 @@ module events {
 
         void               stopPropagation();
         void               preventDefault();
-        [ObjCLegacyUnnamedParameters] void initEvent(in [Optional=CallWithDefaultValue] DOMString eventTypeArg, 
-                                      in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                                      in [Optional=CallWithDefaultValue] boolean cancelableArg);
+        [ObjCLegacyUnnamedParameters] void initEvent(in [Optional=DefaultIsUndefined] DOMString eventTypeArg, 
+                                      in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                                      in [Optional=DefaultIsUndefined] boolean cancelableArg);
 
         // DOM Level 3 Additions.
         readonly attribute boolean defaultPrevented;
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index 7573832ba..3ee5285bc 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -127,7 +127,7 @@ static inline bool isShadowRootOrSVGShadowRoot(const Node* node)
 
 static inline bool isShadowHost(Node* node)
 {
-    return node->isElementNode() && toElement(node)->shadowRoot();
+    return node->isElementNode() && toElement(node)->hasShadowRoot();
 }
 
 PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Node> relatedTarget, const Vector<Node*> relatedTargetAncestors)
diff --git a/Source/WebCore/dom/EventSender.h b/Source/WebCore/dom/EventSender.h
new file mode 100644
index 000000000..646034c32
--- /dev/null
+++ b/Source/WebCore/dom/EventSender.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EventSender_h
+#define EventSender_h
+
+#include "Timer.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+template<typename T> class EventSender {
+    WTF_MAKE_NONCOPYABLE(EventSender); WTF_MAKE_FAST_ALLOCATED;
+public:
+    explicit EventSender(const AtomicString& eventType);
+
+    const AtomicString& eventType() const { return m_eventType; }
+    void dispatchEventSoon(T*);
+    void cancelEvent(T*);
+    void dispatchPendingEvents();
+
+#ifndef NDEBUG
+    bool hasPendingEvents(T* sender) const
+    {
+        return m_dispatchSoonList.find(sender) != notFound || m_dispatchingList.find(sender) != notFound;
+    }
+#endif
+
+private:
+    void timerFired(Timer<EventSender<T> >*) { dispatchPendingEvents(); }
+
+    AtomicString m_eventType;
+    Timer<EventSender<T> > m_timer;
+    Vector<T*> m_dispatchSoonList;
+    Vector<T*> m_dispatchingList;
+};
+
+template<typename T> EventSender<T>::EventSender(const AtomicString& eventType)
+    : m_eventType(eventType)
+    , m_timer(this, &EventSender::timerFired)
+{
+}
+
+template<typename T> void EventSender<T>::dispatchEventSoon(T* sender)
+{
+    m_dispatchSoonList.append(sender);
+    if (!m_timer.isActive())
+        m_timer.startOneShot(0);
+}
+
+template<typename T> void EventSender<T>::cancelEvent(T* sender)
+{
+    // Remove instances of this sender from both lists.
+    // Use loops because we allow multiple instances to get into the lists.
+    size_t size = m_dispatchSoonList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchSoonList[i] == sender)
+            m_dispatchSoonList[i] = 0;
+    }
+    size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchingList[i] == sender)
+            m_dispatchingList[i] = 0;
+    }
+}
+
+template<typename T> void EventSender<T>::dispatchPendingEvents()
+{
+    // Need to avoid re-entering this function; if new dispatches are
+    // scheduled before the parent finishes processing the list, they
+    // will set a timer and eventually be processed.
+    if (!m_dispatchingList.isEmpty())
+        return;
+
+    m_timer.stop();
+
+    m_dispatchSoonList.checkConsistency();
+
+    m_dispatchingList.swap(m_dispatchSoonList);
+    size_t size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (T* sender = m_dispatchingList[i]) {
+            m_dispatchingList[i] = 0;
+            sender->dispatchPendingEvent(this);
+        }
+    }
+    m_dispatchingList.clear();
+}
+
+} // namespace WebCore
+
+#endif // EventSender_h
diff --git a/Source/WebCore/dom/HashChangeEvent.idl b/Source/WebCore/dom/HashChangeEvent.idl
index b2b48877b..6c80a957f 100644
--- a/Source/WebCore/dom/HashChangeEvent.idl
+++ b/Source/WebCore/dom/HashChangeEvent.idl
@@ -23,11 +23,11 @@ module events {
     interface [
         ConstructorTemplate=Event
     ] HashChangeEvent : Event {
-        void initHashChangeEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                 in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                 in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                 in [Optional=CallWithDefaultValue] DOMString oldURL, 
-                                 in [Optional=CallWithDefaultValue] DOMString newURL); 
+        void initHashChangeEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                 in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                 in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                 in [Optional=DefaultIsUndefined] DOMString oldURL, 
+                                 in [Optional=DefaultIsUndefined] DOMString newURL); 
         readonly attribute [InitializedByEventConstructor] DOMString oldURL;
         readonly attribute [InitializedByEventConstructor] DOMString newURL;
     };
diff --git a/Source/WebCore/dom/KeyboardEvent.idl b/Source/WebCore/dom/KeyboardEvent.idl
index e71361f67..2c2b7ba11 100644
--- a/Source/WebCore/dom/KeyboardEvent.idl
+++ b/Source/WebCore/dom/KeyboardEvent.idl
@@ -40,37 +40,37 @@ module events {
         readonly attribute boolean          altGraphKey;
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        boolean getModifierState(in [Optional=CallWithDefaultValue] DOMString keyIdentifierArg);
+        boolean getModifierState(in [Optional=DefaultIsUndefined] DOMString keyIdentifierArg);
 #endif
 
         // FIXME: this does not match the version in the DOM spec.
-        void initKeyboardEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                               in [Optional=CallWithDefaultValue] boolean canBubble, 
-                               in [Optional=CallWithDefaultValue] boolean cancelable, 
-                               in [Optional=CallWithDefaultValue] DOMWindow view, 
-                               in [Optional=CallWithDefaultValue] DOMString keyIdentifier,
-                               in [Optional=CallWithDefaultValue] unsigned long keyLocation,
-                               in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                               in [Optional=CallWithDefaultValue] boolean altKey,
-                               in [Optional=CallWithDefaultValue] boolean shiftKey,
-                               in [Optional=CallWithDefaultValue] boolean metaKey,
-                               in [Optional=CallWithDefaultValue] boolean altGraphKey);
+        void initKeyboardEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                               in [Optional=DefaultIsUndefined] boolean canBubble, 
+                               in [Optional=DefaultIsUndefined] boolean cancelable, 
+                               in [Optional=DefaultIsUndefined] DOMWindow view, 
+                               in [Optional=DefaultIsUndefined] DOMString keyIdentifier,
+                               in [Optional=DefaultIsUndefined] unsigned long keyLocation,
+                               in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                               in [Optional=DefaultIsUndefined] boolean altKey,
+                               in [Optional=DefaultIsUndefined] boolean shiftKey,
+                               in [Optional=DefaultIsUndefined] boolean metaKey,
+                               in [Optional=DefaultIsUndefined] boolean altGraphKey);
 
         // WebKit Extensions
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute long             keyCode;
         readonly attribute long             charCode;
         
-        void initKeyboardEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                               in [Optional=CallWithDefaultValue] boolean canBubble, 
-                               in [Optional=CallWithDefaultValue] boolean cancelable, 
-                               in [Optional=CallWithDefaultValue] DOMWindow view, 
-                               in [Optional=CallWithDefaultValue] DOMString keyIdentifier,
-                               in [Optional=CallWithDefaultValue] unsigned long keyLocation,
-                               in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                               in [Optional=CallWithDefaultValue] boolean altKey,
-                               in [Optional=CallWithDefaultValue] boolean shiftKey,
-                               in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initKeyboardEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                               in [Optional=DefaultIsUndefined] boolean canBubble, 
+                               in [Optional=DefaultIsUndefined] boolean cancelable, 
+                               in [Optional=DefaultIsUndefined] DOMWindow view, 
+                               in [Optional=DefaultIsUndefined] DOMString keyIdentifier,
+                               in [Optional=DefaultIsUndefined] unsigned long keyLocation,
+                               in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                               in [Optional=DefaultIsUndefined] boolean altKey,
+                               in [Optional=DefaultIsUndefined] boolean shiftKey,
+                               in [Optional=DefaultIsUndefined] boolean metaKey);
 #endif
 
     };
diff --git a/Source/WebCore/dom/MessageEvent.idl b/Source/WebCore/dom/MessageEvent.idl
index 123235929..c8356ed60 100644
--- a/Source/WebCore/dom/MessageEvent.idl
+++ b/Source/WebCore/dom/MessageEvent.idl
@@ -38,23 +38,23 @@ module events {
         readonly attribute [InitializedByEventConstructor, CachedAttribute, CustomGetter] DOMObject data;
         readonly attribute [InitializedByEventConstructor, CustomGetter] Array ports;
 
-        [Custom] void initMessageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                                       in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                                       in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                                       in [Optional=CallWithDefaultValue] DOMObject dataArg, 
-                                       in [Optional=CallWithDefaultValue] DOMString originArg, 
-                                       in [Optional=CallWithDefaultValue] DOMString lastEventIdArg, 
-                                       in [Optional=CallWithDefaultValue] DOMWindow sourceArg, 
-                                       in [Optional=CallWithDefaultValue] Array messagePorts);
+        [Custom] void initMessageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                                       in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                                       in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                                       in [Optional=DefaultIsUndefined] DOMObject dataArg, 
+                                       in [Optional=DefaultIsUndefined] DOMString originArg, 
+                                       in [Optional=DefaultIsUndefined] DOMString lastEventIdArg, 
+                                       in [Optional=DefaultIsUndefined] DOMWindow sourceArg, 
+                                       in [Optional=DefaultIsUndefined] Array messagePorts);
 
-        [Custom] void webkitInitMessageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg,
-                                             in [Optional=CallWithDefaultValue] boolean canBubbleArg,
-                                             in [Optional=CallWithDefaultValue] boolean cancelableArg,
-                                             in [Optional=CallWithDefaultValue] DOMObject dataArg,
-                                             in [Optional=CallWithDefaultValue] DOMString originArg,
-                                             in [Optional=CallWithDefaultValue] DOMString lastEventIdArg,
-                                             in [Optional=CallWithDefaultValue] DOMWindow sourceArg,
-                                             in [Optional=CallWithDefaultValue] Array transferables);
+        [Custom] void webkitInitMessageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg,
+                                             in [Optional=DefaultIsUndefined] boolean canBubbleArg,
+                                             in [Optional=DefaultIsUndefined] boolean cancelableArg,
+                                             in [Optional=DefaultIsUndefined] DOMObject dataArg,
+                                             in [Optional=DefaultIsUndefined] DOMString originArg,
+                                             in [Optional=DefaultIsUndefined] DOMString lastEventIdArg,
+                                             in [Optional=DefaultIsUndefined] DOMWindow sourceArg,
+                                             in [Optional=DefaultIsUndefined] Array transferables);
 #else
         // Code generator for ObjC bindings does not support custom bindings, thus there is no good way to
         // return a variant value. As workaround, expose the data attribute as SerializedScriptValue.
@@ -63,14 +63,14 @@ module events {
         // There's no good way to expose an array via the ObjC bindings, so for now just expose a single port.
         readonly attribute MessagePort messagePort;
 
-        void initMessageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                              in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                              in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                              in [Optional=CallWithDefaultValue] SerializedScriptValue dataArg, 
-                              in [Optional=CallWithDefaultValue] DOMString originArg, 
-                              in [Optional=CallWithDefaultValue] DOMString lastEventIdArg, 
-                              in [Optional=CallWithDefaultValue] DOMWindow sourceArg, 
-                              in [Optional=CallWithDefaultValue] MessagePort messagePort);
+        void initMessageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                              in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                              in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                              in [Optional=DefaultIsUndefined] SerializedScriptValue dataArg, 
+                              in [Optional=DefaultIsUndefined] DOMString originArg, 
+                              in [Optional=DefaultIsUndefined] DOMString lastEventIdArg, 
+                              in [Optional=DefaultIsUndefined] DOMWindow sourceArg, 
+                              in [Optional=DefaultIsUndefined] MessagePort messagePort);
 #endif
 
     };
diff --git a/Source/WebCore/dom/MouseEvent.idl b/Source/WebCore/dom/MouseEvent.idl
index 3ece01c50..48eff1e3e 100644
--- a/Source/WebCore/dom/MouseEvent.idl
+++ b/Source/WebCore/dom/MouseEvent.idl
@@ -34,21 +34,21 @@ module events {
         readonly attribute unsigned short   button;
         readonly attribute EventTarget      relatedTarget;
         
-        [ObjCLegacyUnnamedParameters] void initMouseEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                           in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                           in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                           in [Optional=CallWithDefaultValue] DOMWindow view, 
-                                           in [Optional=CallWithDefaultValue] long detail, 
-                                           in [Optional=CallWithDefaultValue] long screenX, 
-                                           in [Optional=CallWithDefaultValue] long screenY, 
-                                           in [Optional=CallWithDefaultValue] long clientX, 
-                                           in [Optional=CallWithDefaultValue] long clientY, 
-                                           in [Optional=CallWithDefaultValue] boolean ctrlKey, 
-                                           in [Optional=CallWithDefaultValue] boolean altKey, 
-                                           in [Optional=CallWithDefaultValue] boolean shiftKey, 
-                                           in [Optional=CallWithDefaultValue] boolean metaKey, 
-                                           in [Optional=CallWithDefaultValue] unsigned short button, 
-                                           in [Optional=CallWithDefaultValue] EventTarget relatedTarget);
+        [ObjCLegacyUnnamedParameters] void initMouseEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                           in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                           in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                           in [Optional=DefaultIsUndefined] DOMWindow view, 
+                                           in [Optional=DefaultIsUndefined] long detail, 
+                                           in [Optional=DefaultIsUndefined] long screenX, 
+                                           in [Optional=DefaultIsUndefined] long screenY, 
+                                           in [Optional=DefaultIsUndefined] long clientX, 
+                                           in [Optional=DefaultIsUndefined] long clientY, 
+                                           in [Optional=DefaultIsUndefined] boolean ctrlKey, 
+                                           in [Optional=DefaultIsUndefined] boolean altKey, 
+                                           in [Optional=DefaultIsUndefined] boolean shiftKey, 
+                                           in [Optional=DefaultIsUndefined] boolean metaKey, 
+                                           in [Optional=DefaultIsUndefined] unsigned short button, 
+                                           in [Optional=DefaultIsUndefined] EventTarget relatedTarget);
 
         // extensions
         readonly attribute long             offsetX;
diff --git a/Source/WebCore/dom/MutationEvent.idl b/Source/WebCore/dom/MutationEvent.idl
index 5aee2e560..2765dc9c2 100644
--- a/Source/WebCore/dom/MutationEvent.idl
+++ b/Source/WebCore/dom/MutationEvent.idl
@@ -33,14 +33,14 @@ module events {
         readonly attribute DOMString      attrName;
         readonly attribute unsigned short attrChange;
 
-        [ObjCLegacyUnnamedParameters] void initMutationEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                              in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                              in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                              in [Optional=CallWithDefaultValue] Node relatedNode, 
-                                              in [Optional=CallWithDefaultValue] DOMString prevValue, 
-                                              in [Optional=CallWithDefaultValue] DOMString newValue, 
-                                              in [Optional=CallWithDefaultValue] DOMString attrName, 
-                                              in [Optional=CallWithDefaultValue] unsigned short attrChange);
+        [ObjCLegacyUnnamedParameters] void initMutationEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                              in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                              in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                              in [Optional=DefaultIsUndefined] Node relatedNode, 
+                                              in [Optional=DefaultIsUndefined] DOMString prevValue, 
+                                              in [Optional=DefaultIsUndefined] DOMString newValue, 
+                                              in [Optional=DefaultIsUndefined] DOMString attrName, 
+                                              in [Optional=DefaultIsUndefined] unsigned short attrChange);
 
     };
 
diff --git a/Source/WebCore/dom/MutationRecord.idl b/Source/WebCore/dom/MutationRecord.idl
index c19b41f21..a7883c50f 100644
--- a/Source/WebCore/dom/MutationRecord.idl
+++ b/Source/WebCore/dom/MutationRecord.idl
@@ -41,8 +41,8 @@ module core {
         readonly attribute Node nextSibling;
 
         readonly attribute DOMString attributeName;
-        readonly attribute [ConvertNullStringTo=Null] DOMString attributeNamespace;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString attributeNamespace;
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString oldValue;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString oldValue;
     };
 }
diff --git a/Source/WebCore/dom/NameNodeList.cpp b/Source/WebCore/dom/NameNodeList.cpp
index df63a8cfe..47268fe72 100644
--- a/Source/WebCore/dom/NameNodeList.cpp
+++ b/Source/WebCore/dom/NameNodeList.cpp
@@ -44,7 +44,7 @@ NameNodeList::~NameNodeList()
 
 bool NameNodeList::nodeMatches(Element* testNode) const
 {
-    return testNode->fastGetAttribute(nameAttr) == m_nodeName;
+    return testNode->getNameAttribute() == m_nodeName;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
index 0a32a66ca..47145970e 100644
--- a/Source/WebCore/dom/NamedNodeMap.cpp
+++ b/Source/WebCore/dom/NamedNodeMap.cpp
@@ -40,15 +40,6 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
 }
 
-inline void NamedNodeMap::detachAttributesFromElement()
-{
-    size_t size = m_attributes.size();
-    for (size_t i = 0; i < size; i++) {
-        if (Attr* attr = m_attributes[i]->attr())
-            attr->m_element = 0;
-    }
-}
-
 void NamedNodeMap::ref()
 {
     ASSERT(m_element);
@@ -61,14 +52,9 @@ void NamedNodeMap::deref()
     m_element->deref();
 }
 
-NamedNodeMap::~NamedNodeMap()
-{
-    detachAttributesFromElement();
-}
-
 PassRefPtr<Node> NamedNodeMap::getNamedItem(const String& name) const
 {
-    Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
+    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a)
         return 0;
     
@@ -82,7 +68,7 @@ PassRefPtr<Node> NamedNodeMap::getNamedItemNS(const String& namespaceURI, const
 
 PassRefPtr<Node> NamedNodeMap::removeNamedItem(const String& name, ExceptionCode& ec)
 {
-    Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
+    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a) {
         ec = NOT_FOUND_ERR;
         return 0;
@@ -135,9 +121,9 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* node, ExceptionCode& ec)
     RefPtr<Attr> oldAttr;
     if (oldAttribute) {
         oldAttr = oldAttribute->createAttrIfNeeded(m_element);
-        replaceAttribute(index, attribute);
+        m_attributeData.replaceAttribute(index, attribute, m_element);
     } else
-        addAttribute(attribute);
+        m_attributeData.addAttribute(attribute, m_element);
 
     return oldAttr.release();
 }
@@ -157,7 +143,7 @@ PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, Except
         return 0;
     }
 
-    RefPtr<Attr> attr = m_attributes[index]->createAttrIfNeeded(m_element);
+    RefPtr<Attr> attr = m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
 
     removeAttribute(index);
 
@@ -169,40 +155,7 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
     if (index >= length())
         return 0;
 
-    return m_attributes[index]->createAttrIfNeeded(m_element);
-}
-
-void NamedNodeMap::copyAttributesToVector(Vector<RefPtr<Attribute> >& copy)
-{
-    copy = m_attributes;
-}
-
-size_t NamedNodeMap::getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
-{
-    unsigned len = length();
-
-    // Continue to checking case-insensitively and/or full namespaced names if necessary:
-    for (unsigned i = 0; i < len; ++i) {
-        const QualifiedName& attrName = m_attributes[i]->name();
-        if (!attrName.hasPrefix()) {
-            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
-                return i;
-        } else {
-            // FIXME: Would be faster to do this comparison without calling toString, which
-            // generates a temporary string by concatenation. But this branch is only reached
-            // if the attribute name has a prefix, which is rare in HTML.
-            if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
-                return i;
-        }
-    }
-    return notFound;
-}
-
-void NamedNodeMap::clearAttributes()
-{
-    attributeData()->clearClass();
-    detachAttributesFromElement();
-    m_attributes.clear();
+    return m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
 }
 
 void NamedNodeMap::detachFromElement()
@@ -212,90 +165,7 @@ void NamedNodeMap::detachFromElement()
     // of that, we can simply clear all the attributes to avoid accessing stale
     // pointers to do things like create Attr objects.
     m_element = 0;
-    clearAttributes();
-}
-
-void NamedNodeMap::setAttributes(const NamedNodeMap& other)
-{
-    // clone all attributes in the other map, but attach to our element
-    if (!m_element)
-        return;
-
-    // If assigning the map changes the id attribute, we need to call
-    // updateId.
-    Attribute* oldId = getAttributeItem(m_element->document()->idAttributeName());
-    Attribute* newId = other.getAttributeItem(m_element->document()->idAttributeName());
-
-    if (oldId || newId)
-        m_element->updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
-
-    Attribute* oldName = getAttributeItem(HTMLNames::nameAttr);
-    Attribute* newName = other.getAttributeItem(HTMLNames::nameAttr);
-
-    if (oldName || newName)
-        m_element->updateName(oldName ? oldName->value() : nullAtom, newName ? newName->value() : nullAtom);
-
-    clearAttributes();
-    unsigned newLength = other.length();
-    m_attributes.resize(newLength);
-
-    // FIXME: These loops can probably be combined.
-    for (unsigned i = 0; i < newLength; i++)
-        m_attributes[i] = other.m_attributes[i]->clone();
-    for (unsigned i = 0; i < newLength; i++)
-        m_element->attributeChanged(m_attributes[i].get());
-}
-
-void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
-{
-    RefPtr<Attribute> attribute = prpAttribute;
-
-    if (m_element)
-        m_element->willModifyAttribute(attribute->name(), nullAtom, attribute->value());
-
-    m_attributes.append(attribute);
-    if (Attr* attr = attribute->attr())
-        attr->m_element = m_element;
-
-    if (m_element)
-        m_element->didModifyAttribute(attribute.get());
-}
-
-void NamedNodeMap::removeAttribute(size_t index)
-{
-    ASSERT(index < length());
-
-    RefPtr<Attribute> attribute = m_attributes[index];
-
-    if (m_element)
-        m_element->willRemoveAttribute(attribute->name(), attribute->value());
-
-    if (Attr* attr = attribute->attr())
-        attr->m_element = 0;
-    m_attributes.remove(index);
-
-    if (m_element)
-        m_element->didRemoveAttribute(attribute.get());
-}
-
-void NamedNodeMap::replaceAttribute(size_t index, PassRefPtr<Attribute> prpAttribute)
-{
-    ASSERT(index < length());
-
-    RefPtr<Attribute> attribute = prpAttribute;
-    Attribute* old = m_attributes[index].get();
-
-    if (m_element)
-        m_element->willModifyAttribute(attribute->name(), old->value(), attribute->value());
-
-    if (Attr* attr = old->attr())
-        attr->m_element = 0;
-    m_attributes[index] = attribute;
-    if (Attr* attr = attribute->attr())
-        attr->m_element = m_element;
-
-    if (m_element)
-        m_element->didModifyAttribute(attribute.get());
+    m_attributeData.clearAttributes();
 }
 
 bool NamedNodeMap::mapsEquivalent(const NamedNodeMap* otherMap) const
diff --git a/Source/WebCore/dom/NamedNodeMap.h b/Source/WebCore/dom/NamedNodeMap.h
index 6bdde0fb3..3201fcd08 100644
--- a/Source/WebCore/dom/NamedNodeMap.h
+++ b/Source/WebCore/dom/NamedNodeMap.h
@@ -25,10 +25,8 @@
 #ifndef NamedNodeMap_h
 #define NamedNodeMap_h
 
-#include "Attribute.h"
 #include "ElementAttributeData.h"
 #include "SpaceSplitString.h"
-#include <wtf/NotFound.h>
 
 namespace WebCore {
 
@@ -44,8 +42,6 @@ public:
         return adoptPtr(new NamedNodeMap(element));
     }
 
-    ~NamedNodeMap();
-
     void ref();
     void deref();
 
@@ -63,19 +59,17 @@ public:
     PassRefPtr<Node> setNamedItemNS(Node*, ExceptionCode&);
 
     PassRefPtr<Node> item(unsigned index) const;
-    size_t length() const { return m_attributes.size(); }
-    bool isEmpty() const { return !length(); }
+    size_t length() const { return m_attributeData.length(); }
+    bool isEmpty() const { return m_attributeData.isEmpty(); }
 
     // Internal interface.
 
-    Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
-    Attribute* getAttributeItem(const QualifiedName&) const;
-    size_t getAttributeItemIndex(const QualifiedName&) const;
-
-    void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
+    Attribute* attributeItem(unsigned index) const { return m_attributeData.attributeItem(index); }
+    Attribute* getAttributeItem(const QualifiedName& name) const { return m_attributeData.getAttributeItem(name); }
+    size_t getAttributeItemIndex(const QualifiedName& name) const { return m_attributeData.getAttributeItemIndex(name); }
 
-    void shrinkToLength() { m_attributes.shrinkCapacity(length()); }
-    void reserveInitialCapacity(unsigned capacity) { m_attributes.reserveInitialCapacity(capacity); }
+    void shrinkToLength() { m_attributeData.m_attributes.shrinkCapacity(length()); }
+    void reserveInitialCapacity(unsigned capacity) { m_attributeData.m_attributes.reserveInitialCapacity(capacity); }
 
     // Used during parsing: only inserts if not already there. No error checking!
     void insertAttribute(PassRefPtr<Attribute> newAttribute, bool allowDuplicates)
@@ -88,9 +82,9 @@ public:
     bool mapsEquivalent(const NamedNodeMap* otherMap) const;
 
     // These functions do no error checking.
-    void addAttribute(PassRefPtr<Attribute>);
-    void removeAttribute(const QualifiedName&);
-    void removeAttribute(size_t index);
+    void addAttribute(PassRefPtr<Attribute> attribute) { m_attributeData.addAttribute(attribute, m_element); }
+    void removeAttribute(const QualifiedName& name) { m_attributeData.removeAttribute(name, m_element); }
+    void removeAttribute(size_t index) { m_attributeData.removeAttribute(index, m_element); }
 
     Element* element() const { return m_element; }
 
@@ -103,14 +97,8 @@ private:
     {
     }
 
-    void detachAttributesFromElement();
     void detachFromElement();
-    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
-    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
-    size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
-    void setAttributes(const NamedNodeMap&);
-    void clearAttributes();
-    void replaceAttribute(size_t index, PassRefPtr<Attribute>);
+    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const { return m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase); }
 
     // FIXME: NamedNodeMap is being broken up into two classes, one containing data
     //        for elements with attributes, and one for exposure to the DOM.
@@ -118,66 +106,8 @@ private:
     ElementAttributeData m_attributeData;
 
     Element* m_element;
-    Vector<RefPtr<Attribute>, 4> m_attributes;
 };
 
-inline Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
-{
-    size_t index = getAttributeItemIndex(name);
-    if (index != notFound)
-        return m_attributes[index].get();
-    return 0;
-}
-
-inline size_t NamedNodeMap::getAttributeItemIndex(const QualifiedName& name) const
-{
-    size_t len = length();
-    for (unsigned i = 0; i < len; ++i) {
-        if (m_attributes[i]->name().matches(name))
-            return i;
-    }
-    return notFound;
-}
-
-inline Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
-{
-    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
-    if (index != notFound)
-        return m_attributes[index].get();
-    return 0;
-}
-
-// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
-// can tune the behavior (hasAttribute is case sensitive whereas getAttribute is not).
-inline size_t NamedNodeMap::getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const
-{
-    unsigned len = length();
-    bool doSlowCheck = shouldIgnoreAttributeCase;
-
-    // Optimize for the case where the attribute exists and its name exactly matches.
-    for (unsigned i = 0; i < len; ++i) {
-        const QualifiedName& attrName = m_attributes[i]->name();
-        if (!attrName.hasPrefix()) {
-            if (name == attrName.localName())
-                return i;
-        } else
-            doSlowCheck = true;
-    }
-
-    if (doSlowCheck)
-        return getAttributeItemIndexSlowCase(name, shouldIgnoreAttributeCase);
-    return notFound;
-}
-
-inline void NamedNodeMap::removeAttribute(const QualifiedName& name)
-{
-    size_t index = getAttributeItemIndex(name);
-    if (index == notFound)
-        return;
-
-    removeAttribute(index);
-}
-
 } // namespace WebCore
 
 #endif // NamedNodeMap_h
diff --git a/Source/WebCore/dom/NamedNodeMap.idl b/Source/WebCore/dom/NamedNodeMap.idl
index 3c07a1146..88820c017 100644
--- a/Source/WebCore/dom/NamedNodeMap.idl
+++ b/Source/WebCore/dom/NamedNodeMap.idl
@@ -24,34 +24,35 @@ module core {
         JSGenerateIsReachable=ImplElementRoot,
         JSCustomMarkFunction,
         IndexedGetter,
-        NamedGetter
+        NamedGetter,
+        V8CustomToJSObject
     ] NamedNodeMap {
 
-        Node getNamedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        Node getNamedItem(in [Optional=DefaultIsUndefined] DOMString name);
 
-        Node setNamedItem(in [Optional=CallWithDefaultValue] Node node)
+        Node setNamedItem(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
 
-        Node removeNamedItem(in [Optional=CallWithDefaultValue] DOMString name)
+        Node removeNamedItem(in [Optional=DefaultIsUndefined] DOMString name)
             raises(DOMException);
 
-        Node item(in [Optional=CallWithDefaultValue] unsigned long index);
+        Node item(in [Optional=DefaultIsUndefined] unsigned long index);
         
         readonly attribute unsigned long length;
 
 
         // Introduced in DOM Level 2:
 
-        [ObjCLegacyUnnamedParameters] Node getNamedItemNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI, 
-                                           in [Optional=CallWithDefaultValue] DOMString localName)
+        [ObjCLegacyUnnamedParameters] Node getNamedItemNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI, 
+                                           in [Optional=DefaultIsUndefined] DOMString localName)
             // FIXME: the implementation does take an exceptioncode parameter.
             /*raises(DOMException)*/;
 
-        Node setNamedItemNS(in [Optional=CallWithDefaultValue] Node node)
+        Node setNamedItemNS(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] Node removeNamedItemNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI, 
-                                              in [Optional=CallWithDefaultValue] DOMString localName)
+        [ObjCLegacyUnnamedParameters] Node removeNamedItemNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI, 
+                                              in [Optional=DefaultIsUndefined] DOMString localName)
             raises(DOMException);
 
     };
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 39b8fa895..2e9c61a7e 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -63,7 +63,7 @@
 #include "HTMLElement.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
-#include "InspectorInstrumentation.h"
+#include "InspectorCounters.h"
 #include "KeyboardEvent.h"
 #include "LabelsNodeList.h"
 #include "Logging.h"
@@ -86,6 +86,7 @@
 #include "ScopedEventQueue.h"
 #include "SelectorQuery.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "StaticNodeList.h"
 #include "StorageEvent.h"
 #include "TagNodeList.h"
@@ -227,7 +228,10 @@ void Node::dumpStatistics()
                 break;
             }
             case DOCUMENT_FRAGMENT_NODE: {
-                ++fragmentNodes;
+                if (node->isShadowRoot())
+                    ++shadowRootNodes;
+                else
+                    ++fragmentNodes;
                 break;
             }
             case NOTATION_NODE: {
@@ -238,10 +242,6 @@ void Node::dumpStatistics()
                 ++xpathNSNodes;
                 break;
             }
-            case SHADOW_ROOT_NODE: {
-                ++shadowRootNodes;
-                break;
-            }
         }
     }
 
@@ -352,8 +352,7 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
     if ((s1 && s2) && (s1->flowThread() != s2->flowThread()))
         ch = Detach;
 
-    // When either the region thread or the region index has changed,
-    // we need to prepare a separate render region object.
+    // When the region thread has changed, we need to prepare a separate render region object.
     if ((s1 && s2) && (s1->regionThread() != s2->regionThread()))
         ch = Detach;
 
@@ -406,6 +405,8 @@ Node::~Node()
 
     if (doc)
         doc->guardDeref();
+
+    InspectorCounters::decrementCounter(InspectorCounters::NodeCounter);
 }
 
 void Node::setDocument(Document* document)
@@ -632,7 +633,7 @@ void Node::normalize()
             continue;
         }
 
-        RefPtr<Text> text = static_cast<Text*>(node.get());
+        RefPtr<Text> text = toText(node.get());
 
         // Remove empty text nodes.
         if (!text->length()) {
@@ -647,7 +648,7 @@ void Node::normalize()
         while (Node* nextSibling = node->nextSibling()) {
             if (nextSibling->nodeType() != TEXT_NODE)
                 break;
-            RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
+            RefPtr<Text> nextText = toText(nextSibling);
 
             // Remove empty text nodes.
             if (!nextText->length()) {
@@ -694,13 +695,13 @@ const AtomicString& Node::virtualNamespaceURI() const
 
 bool Node::isContentEditable()
 {
-    document()->updateLayoutIgnorePendingStylesheets();
+    document()->updateStyleIfNeeded();
     return rendererIsEditable(Editable);
 }
 
 bool Node::isContentRichlyEditable()
 {
-    document()->updateLayoutIgnorePendingStylesheets();
+    document()->updateStyleIfNeeded();
     return rendererIsEditable(RichlyEditable);
 }
 
@@ -808,9 +809,9 @@ bool Node::hasNonEmptyBoundingBox() const
     return false;
 }
 
-inline static ShadowRoot* shadowRoot(Node* node)
+inline static ShadowRoot* oldestShadowRootFor(const Node* node)
 {
-    return node->isElementNode() ? toElement(node)->shadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->oldestShadowRoot() : 0;
 }
 
 inline void Node::setStyleChange(StyleChangeType changeType)
@@ -1339,7 +1340,7 @@ void Node::detach()
     setFlag(InDetachFlag);
 
     if (renderer())
-        renderer()->destroy();
+        renderer()->destroyAndCleanupAnonymousWrappers();
     setRenderer(0);
 
     Document* doc = document();
@@ -1759,11 +1760,13 @@ bool Node::isEqualNode(Node* other) const
         NamedNodeMap* attributes = toElement(this)->updatedAttributes();
         NamedNodeMap* otherAttributes = toElement(other)->updatedAttributes();
 
-        if (attributes && !attributes->mapsEquivalent(otherAttributes))
-            return false;
-
-        if (otherAttributes && !otherAttributes->mapsEquivalent(attributes))
-            return false;
+        if (attributes) {
+            if (!attributes->mapsEquivalent(otherAttributes))
+                return false;
+        } else if (otherAttributes) {
+            if (!otherAttributes->mapsEquivalent(attributes))
+                return false;
+        }
     }
     
     Node* child = firstChild();
@@ -1844,7 +1847,6 @@ bool Node::isDefaultNamespace(const AtomicString& namespaceURIMaybeEmpty) const
         case NOTATION_NODE:
         case DOCUMENT_TYPE_NODE:
         case DOCUMENT_FRAGMENT_NODE:
-        case SHADOW_ROOT_NODE:
             return false;
         case ATTRIBUTE_NODE: {
             const Attr* attr = static_cast<const Attr*>(this);
@@ -1878,7 +1880,6 @@ String Node::lookupPrefix(const AtomicString &namespaceURI) const
         case NOTATION_NODE:
         case DOCUMENT_FRAGMENT_NODE:
         case DOCUMENT_TYPE_NODE:
-        case SHADOW_ROOT_NODE:
             return String();
         case ATTRIBUTE_NODE: {
             const Attr *attr = static_cast<const Attr *>(this);
@@ -1937,7 +1938,6 @@ String Node::lookupNamespaceURI(const String &prefix) const
         case NOTATION_NODE:
         case DOCUMENT_TYPE_NODE:
         case DOCUMENT_FRAGMENT_NODE:
-        case SHADOW_ROOT_NODE:
             return String();
         case ATTRIBUTE_NODE: {
             const Attr *attr = static_cast<const Attr *>(this);
@@ -2005,7 +2005,6 @@ static void appendTextContent(const Node* node, bool convertBRsToNewlines, bool&
     case Node::ENTITY_NODE:
     case Node::ENTITY_REFERENCE_NODE:
     case Node::DOCUMENT_FRAGMENT_NODE:
-    case Node::SHADOW_ROOT_NODE:
         isNullString = false;
         for (Node* child = node->firstChild(); child; child = child->nextSibling()) {
             if (child->nodeType() == Node::COMMENT_NODE || child->nodeType() == Node::PROCESSING_INSTRUCTION_NODE)
@@ -2043,8 +2042,7 @@ void Node::setTextContent(const String& text, ExceptionCode& ec)
         case ATTRIBUTE_NODE:
         case ENTITY_NODE:
         case ENTITY_REFERENCE_NODE:
-        case DOCUMENT_FRAGMENT_NODE:
-        case SHADOW_ROOT_NODE: {
+        case DOCUMENT_FRAGMENT_NODE: {
             ContainerNode* container = toContainerNode(this);
 #if ENABLE(MUTATION_OBSERVERS)
             ChildListMutationScope mutation(this);
@@ -2271,13 +2269,11 @@ static void traverseTreeAndMark(const String& baseIndent, const Node* rootNode,
             indent += "\t";
         fprintf(stderr, "%s", indent.utf8().data());
         node->showNode();
-
-        ContainerNode* rootNode = shadowRoot(const_cast<Node*>(node));
-
-        if (rootNode) {
-            indent += "\t";
-            traverseTreeAndMark(indent, rootNode, markedNode1, markedLabel1, markedNode2, markedLabel2);
-        }
+        if (node->isShadowRoot()) {
+            if (ShadowRoot* youngerShadowRoot = toShadowRoot(node)->youngerShadowRoot())
+                traverseTreeAndMark(indent + "\t", youngerShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
+        } else if (ShadowRoot* oldestShadowRoot = oldestShadowRootFor(node))
+            traverseTreeAndMark(indent + "\t", oldestShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
     }
 }
 
@@ -2307,7 +2303,7 @@ void Node::formatForDebugger(char* buffer, unsigned length) const
     strncpy(buffer, result.utf8().data(), length - 1);
 }
 
-static ContainerNode* parentOrHostOrFrameOwner(Node* node)
+static ContainerNode* parentOrHostOrFrameOwner(const Node* node)
 {
     ContainerNode* parent = node->parentOrHostNode();
     if (!parent && node->document() && node->document()->frame())
@@ -2315,16 +2311,21 @@ static ContainerNode* parentOrHostOrFrameOwner(Node* node)
     return parent;
 }
 
-static void showSubTreeAcrossFrame(Node* node, const Node* markedNode, const String& indent)
+static void showSubTreeAcrossFrame(const Node* node, const Node* markedNode, const String& indent)
 {
     if (node == markedNode)
         fputs("*", stderr);
     fputs(indent.utf8().data(), stderr);
     node->showNode();
-    if (node->isFrameOwnerElement())
-        showSubTreeAcrossFrame(static_cast<HTMLFrameOwnerElement*>(node)->contentDocument(), markedNode, indent + "\t");
-    if (ShadowRoot* shadow = shadowRoot(node))
-        showSubTreeAcrossFrame(shadow, markedNode, indent + "\t");
+     if (node->isShadowRoot()) {
+         if (ShadowRoot* youngerShadowRoot = toShadowRoot(node)->youngerShadowRoot())
+             showSubTreeAcrossFrame(youngerShadowRoot, markedNode, indent + "\t");
+     } else {
+         if (node->isFrameOwnerElement())
+             showSubTreeAcrossFrame(static_cast<const HTMLFrameOwnerElement*>(node)->contentDocument(), markedNode, indent + "\t");
+         if (ShadowRoot* oldestShadowRoot = oldestShadowRootFor(node))
+             showSubTreeAcrossFrame(oldestShadowRoot, markedNode, indent + "\t");
+     }
     for (Node* child = node->firstChild(); child; child = child->nextSibling())
         showSubTreeAcrossFrame(child, markedNode, indent + "\t");
 }
@@ -2483,6 +2484,11 @@ static inline HashSet<SVGElementInstance*> instancesForSVGElement(Node* node)
 }
 #endif
 
+static inline bool isTouchEventType(const AtomicString& eventType)
+{
+    return eventType == eventNames().touchstartEvent || eventType == eventNames().touchmoveEvent || eventType == eventNames().touchendEvent || eventType == eventNames().touchcancelEvent;
+}
+
 static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
     if (!targetNode->EventTarget::addEventListener(eventType, listener, useCapture))
@@ -2492,6 +2498,8 @@ static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eve
         document->addListenerTypeIfNeeded(eventType);
         if (eventType == eventNames().mousewheelEvent)
             document->didAddWheelEventHandler();
+        else if (isTouchEventType(eventType))
+            document->didAddTouchEventHandler();
     }
         
     return true;
@@ -2541,6 +2549,8 @@ static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString&
     if (Document* document = targetNode->document()) {
         if (eventType == eventNames().mousewheelEvent)
             document->didRemoveWheelEventHandler();
+        else if (isTouchEventType(eventType))
+            document->didRemoveTouchEventHandler();
     }
     
     return true;
@@ -2721,6 +2731,39 @@ void Node::notifyMutationObserversNodeWillDetach()
 }
 #endif // ENABLE(MUTATION_OBSERVERS)
 
+#if ENABLE(STYLE_SCOPED)
+bool Node::hasScopedHTMLStyleChild() const
+{
+    return hasRareData() && rareData()->hasScopedHTMLStyleChild();
+}
+
+size_t Node::numberOfScopedHTMLStyleChildren() const
+{
+    return hasRareData() ? rareData()->numberOfScopedHTMLStyleChildren() : 0;
+}
+
+void Node::registerScopedHTMLStyleChild()
+{
+    ensureRareData()->registerScopedHTMLStyleChild();
+}
+
+void Node::unregisterScopedHTMLStyleChild()
+{
+    ASSERT(hasRareData());
+    if (hasRareData())
+        rareData()->unregisterScopedHTMLStyleChild();
+}
+#else
+bool Node::hasScopedHTMLStyleChild() const
+{
+    return 0;
+}
+
+size_t Node::numberOfScopedHTMLStyleChildren() const
+{
+    return 0;
+}
+#endif
 
 void Node::handleLocalEvents(Event* event)
 {
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 311bd4117..9ca126498 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -90,7 +90,7 @@ class HTMLPropertiesCollection;
 
 typedef int ExceptionCode;
 
-const int nodeStyleChangeShift = 25;
+const int nodeStyleChangeShift = 23;
 
 // SyntheticStyleChange means that we need to go through the entire style change logic even though
 // no style property has actually changed. It is used to restructure the tree when, for instance,
@@ -122,7 +122,6 @@ public:
         DOCUMENT_FRAGMENT_NODE = 11,
         NOTATION_NODE = 12,
         XPATH_NAMESPACE_NODE = 13,
-        SHADOW_ROOT_NODE = 14
     };
     enum DocumentPosition {
         DOCUMENT_POSITION_EQUIVALENT = 0x00,
@@ -224,6 +223,9 @@ public:
     bool isDocumentNode() const;
     bool isShadowRoot() const { return getFlag(IsShadowRootOrSVGShadowRootFlag) && !isSVGElement(); }
     virtual bool isContentElement() const { return false; }
+#if ENABLE(SHADOW_DOM)
+    virtual bool isShadowElement() const { return false; }
+#endif
 
     Node* shadowAncestorNode() const;
     // Returns 0, a ShadowRoot, or a legacy shadow root.
@@ -297,9 +299,11 @@ public:
     virtual bool sheetLoaded() { return true; }
     virtual void startLoadingDynamicSheet() { ASSERT_NOT_REACHED(); }
 
+    bool attributeStyleDirty() const { return getFlag(AttributeStyleDirtyFlag); }
     bool hasName() const { return getFlag(HasNameFlag); }
-    bool hasID() const { return getFlag(HasIDFlag); }
-    bool hasClass() const { return getFlag(HasClassFlag); }
+    bool hasID() const;
+    bool hasClass() const;
+    
     bool active() const { return getFlag(IsActiveFlag); }
     bool inActiveChain() const { return getFlag(InActiveChainFlag); }
     bool inDetach() const { return getFlag(InDetachFlag); }
@@ -312,9 +316,10 @@ public:
     bool childNeedsStyleRecalc() const { return getFlag(ChildNeedsStyleRecalcFlag); }
     bool isLink() const { return getFlag(IsLinkFlag); }
 
+    void setAttributeStyleDirty() { setFlag(AttributeStyleDirtyFlag); }
+    void clearAttributeStyleDirty() { clearFlag(AttributeStyleDirtyFlag); }
+
     void setHasName(bool f) { setFlag(f, HasNameFlag); }
-    void setHasID(bool f) { setFlag(f, HasIDFlag); }
-    void setHasClass(bool f) { setFlag(f, HasClassFlag); }
     void setChildNeedsStyleRecalc() { setFlag(ChildNeedsStyleRecalcFlag); }
     void clearChildNeedsStyleRecalc() { clearFlag(ChildNeedsStyleRecalcFlag); }
     void setInDocument() { setFlag(InDocumentFlag); }
@@ -492,7 +497,7 @@ public:
     virtual void willRemove();
     void createRendererIfNeeded();
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual bool childShouldCreateRenderer(Node*) const { return true; }
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const { return true; }
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     ContainerNode* parentNodeForRenderingAndStyle();
     
@@ -632,6 +637,13 @@ public:
     void notifyMutationObserversNodeWillDetach();
 #endif // ENABLE(MUTATION_OBSERVERS)
 
+#if ENABLE(STYLE_SCOPED)
+    void registerScopedHTMLStyleChild();
+    void unregisterScopedHTMLStyleChild();
+#endif
+    bool hasScopedHTMLStyleChild() const;
+    size_t numberOfScopedHTMLStyleChildren() const;
+
 private:
     enum NodeFlags {
         IsTextFlag = 1,
@@ -641,37 +653,37 @@ private:
         IsStyledElementFlag = 1 << 4,
         IsHTMLFlag = 1 << 5,
         IsSVGFlag = 1 << 6,
-        HasIDFlag = 1 << 7,
-        HasClassFlag = 1 << 8,
-        IsAttachedFlag = 1 << 9,
-        ChildNeedsStyleRecalcFlag = 1 << 10,
-        InDocumentFlag = 1 << 11,
-        IsLinkFlag = 1 << 12,
-        IsActiveFlag = 1 << 13,
-        IsHoveredFlag = 1 << 14,
-        InActiveChainFlag = 1 << 15,
-        InDetachFlag = 1 << 16,
-        HasRareDataFlag = 1 << 17,
-        IsShadowRootOrSVGShadowRootFlag = 1 << 18,
+        IsAttachedFlag = 1 << 7,
+        ChildNeedsStyleRecalcFlag = 1 << 8,
+        InDocumentFlag = 1 << 9,
+        IsLinkFlag = 1 << 10,
+        IsActiveFlag = 1 << 11,
+        IsHoveredFlag = 1 << 12,
+        InActiveChainFlag = 1 << 13,
+        InDetachFlag = 1 << 14,
+        HasRareDataFlag = 1 << 15,
+        IsShadowRootOrSVGShadowRootFlag = 1 << 16,
 
         // These bits are used by derived classes, pulled up here so they can
         // be stored in the same memory word as the Node bits above.
-        IsParsingChildrenFinishedFlag = 1 << 19, // Element
-        IsStyleAttributeValidFlag = 1 << 20, // StyledElement
-        IsSynchronizingStyleAttributeFlag = 1 << 21, // StyledElement
+        IsParsingChildrenFinishedFlag = 1 << 17, // Element
+        IsStyleAttributeValidFlag = 1 << 18, // StyledElement
+        IsSynchronizingStyleAttributeFlag = 1 << 19, // StyledElement
 #if ENABLE(SVG)
-        AreSVGAttributesValidFlag = 1 << 22, // Element
-        IsSynchronizingSVGAttributesFlag = 1 << 23, // SVGElement
-        HasSVGRareDataFlag = 1 << 24, // SVGElement
+        AreSVGAttributesValidFlag = 1 << 20, // Element
+        IsSynchronizingSVGAttributesFlag = 1 << 21, // SVGElement
+        HasSVGRareDataFlag = 1 << 22, // SVGElement
 #endif
 
         StyleChangeMask = 1 << nodeStyleChangeShift | 1 << (nodeStyleChangeShift + 1),
 
-        SelfOrAncestorHasDirAutoFlag = 1 << 27,
-        HasCustomWillOrDidRecalcStyleFlag = 1 << 28,
-        HasCustomStyleForRendererFlag = 1 << 29,
+        SelfOrAncestorHasDirAutoFlag = 1 << 25,
+        HasCustomWillOrDidRecalcStyleFlag = 1 << 26,
+        HasCustomStyleForRendererFlag = 1 << 27,
+
+        HasNameFlag = 1 << 28,
 
-        HasNameFlag = 1 << 30,
+        AttributeStyleDirtyFlag = 1 << 31,
 
 #if ENABLE(SVG)
         DefaultNodeFlags = IsParsingChildrenFinishedFlag | IsStyleAttributeValidFlag | AreSVGAttributesValidFlag
@@ -680,7 +692,7 @@ private:
 #endif
     };
 
-    // 1 bit remaining
+    // 3 bits remaining
 
     bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
     void setFlag(bool f, NodeFlags mask) const { m_nodeFlags = (m_nodeFlags & ~mask) | (-(int32_t)f & mask); } 
diff --git a/Source/WebCore/dom/Node.idl b/Source/WebCore/dom/Node.idl
index b67be68b4..e27a215ca 100644
--- a/Source/WebCore/dom/Node.idl
+++ b/Source/WebCore/dom/Node.idl
@@ -26,7 +26,7 @@ module core {
         JSCustomPushEventHandlerScope,
         JSCustomIsReachable,
         JSCustomFinalize,
-        JSCustomToJS,
+        CustomToJSObject,
         EventTarget,
         JSGenerateToNativeObject,
         JSInlineGetOwnPropertySlot,
@@ -51,10 +51,10 @@ module core {
         const unsigned short      DOCUMENT_FRAGMENT_NODE         = 11;
         const unsigned short      NOTATION_NODE                  = 12;
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString        nodeName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        nodeName;
 
                  // FIXME: the spec says this can also raise on retrieval.
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        nodeValue
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        nodeValue
                      setter raises(DOMException);
 
         readonly attribute unsigned short   nodeType;
@@ -67,46 +67,46 @@ module core {
         readonly attribute NamedNodeMap     attributes;
         readonly attribute Document         ownerDocument;
 
-        [ObjCLegacyUnnamedParameters, Custom] Node insertBefore(in [Return] Node newChild,
-                                                 in Node refChild)
+        [ObjCLegacyUnnamedParameters, Custom] Node insertBefore(in [CustomReturn] Node newChild,
+                                                                in Node refChild)
             raises(DOMException);
         [ObjCLegacyUnnamedParameters, Custom] Node replaceChild(in Node newChild,
-                                                 in [Return] Node oldChild)
-            raises(DOMExceptionJSC);
-        [Custom] Node               removeChild(in [Return] Node oldChild)
+                                                                in [CustomReturn] Node oldChild)
             raises(DOMException);
-        [Custom] Node               appendChild(in [Return] Node newChild)
+        [Custom] Node               removeChild(in [CustomReturn] Node oldChild)
+            raises(DOMException);
+        [Custom] Node               appendChild(in [CustomReturn] Node newChild)
             raises(DOMException);
 
         boolean            hasChildNodes();
-        Node               cloneNode(in [Optional=CallWithDefaultValue] boolean deep);
+        Node               cloneNode(in [Optional=DefaultIsUndefined] boolean deep);
         void               normalize();
 
         // Introduced in DOM Level 2:
 
-        [ObjCLegacyUnnamedParameters] boolean isSupported(in [Optional=CallWithDefaultValue] DOMString feature, 
-                                           in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString version);
+        [ObjCLegacyUnnamedParameters] boolean isSupported(in [Optional=DefaultIsUndefined] DOMString feature, 
+                                           in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString version);
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString        namespaceURI;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        prefix
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        namespaceURI;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        prefix
                      setter raises(DOMException);
-        readonly attribute [ConvertNullStringTo=Null] DOMString        localName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        localName;
 
         boolean            hasAttributes();
 
         // Introduced in DOM Level 3:
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString       baseURI;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString       baseURI;
 
                  // FIXME: the spec says this can also raise on retrieval.
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString       textContent
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString       textContent
                      setter raises(DOMException);
 
-        boolean            isSameNode(in [Optional=CallWithDefaultValue] Node other);
-        boolean            isEqualNode(in [Optional=CallWithDefaultValue] Node other);
-        [ConvertNullStringTo=Null] DOMString          lookupPrefix(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI);
-        boolean            isDefaultNamespace(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI);
-        [ConvertNullStringTo=Null] DOMString          lookupNamespaceURI(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString prefix);
+        boolean            isSameNode(in [Optional=DefaultIsUndefined] Node other);
+        boolean            isEqualNode(in [Optional=DefaultIsUndefined] Node other);
+        [TreatReturnedNullStringAs=Null] DOMString          lookupPrefix(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI);
+        boolean            isDefaultNamespace(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI);
+        [TreatReturnedNullStringAs=Null] DOMString          lookupNamespaceURI(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString prefix);
 
         // DocumentPosition
         const unsigned short      DOCUMENT_POSITION_DISCONNECTED = 0x01;
@@ -116,10 +116,10 @@ module core {
         const unsigned short      DOCUMENT_POSITION_CONTAINED_BY = 0x10;
         const unsigned short      DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC = 0x20;
 
-        unsigned short     compareDocumentPosition(in [Optional=CallWithDefaultValue] Node other);
+        unsigned short     compareDocumentPosition(in [Optional=DefaultIsUndefined] Node other);
 
         // Introduced in DOM4
-        boolean contains(in [Optional=CallWithDefaultValue] Node other);
+        boolean contains(in [Optional=DefaultIsUndefined] Node other);
 
 #if 0
         DOMObject          getFeature(in DOMString feature, 
diff --git a/Source/WebCore/dom/NodeFilter.idl b/Source/WebCore/dom/NodeFilter.idl
index 8edef0e03..5caa5ff03 100644
--- a/Source/WebCore/dom/NodeFilter.idl
+++ b/Source/WebCore/dom/NodeFilter.idl
@@ -47,7 +47,7 @@ module traversal {
         const unsigned long       SHOW_DOCUMENT_FRAGMENT         = 0x00000400;
         const unsigned long       SHOW_NOTATION                  = 0x00000800;
 
-        [CallWith=ScriptState] short acceptNode(in [Optional=CallWithDefaultValue] Node n);
+        [CallWith=ScriptState] short acceptNode(in [Optional=DefaultIsUndefined] Node n);
 
     };
 
diff --git a/Source/WebCore/dom/NodeList.idl b/Source/WebCore/dom/NodeList.idl
index ebe813f83..71544d16b 100644
--- a/Source/WebCore/dom/NodeList.idl
+++ b/Source/WebCore/dom/NodeList.idl
@@ -26,7 +26,7 @@ module core {
         NamedGetter
     ] NodeList {
 
-        Node item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
+        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
 
         readonly attribute unsigned long length;
 
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index 77b920d1b..0864b2626 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -100,6 +100,9 @@ public:
         , m_tabIndexWasSetExplicitly(false)
         , m_isFocused(false)
         , m_needsFocusAppearanceUpdateSoonAfterAttach(false)
+#if ENABLE(STYLE_SCOPED)
+        , m_numberOfScopedHTMLStyleChildren(0)
+#endif
     {
     }
 
@@ -226,6 +229,30 @@ public:
     }
 #endif
 
+#if ENABLE(STYLE_SCOPED)
+    void registerScopedHTMLStyleChild()
+    {
+        ++m_numberOfScopedHTMLStyleChildren;
+    }
+
+    void unregisterScopedHTMLStyleChild()
+    {
+        ASSERT(m_numberOfScopedHTMLStyleChildren > 0);
+        if (m_numberOfScopedHTMLStyleChildren > 0)
+            --m_numberOfScopedHTMLStyleChildren;
+    }
+
+    bool hasScopedHTMLStyleChild() const
+    {
+        return m_numberOfScopedHTMLStyleChildren;
+    }
+
+    size_t numberOfScopedHTMLStyleChildren() const
+    {
+        return m_numberOfScopedHTMLStyleChildren;
+    }
+#endif
+
     bool isFocused() const { return m_isFocused; }
     void setFocused(bool focused) { m_isFocused = focused; }
 
@@ -257,6 +284,10 @@ private:
     mutable RefPtr<DOMSettableTokenList> m_itemType;
     mutable OwnPtr<HTMLPropertiesCollection> m_properties;
 #endif
+
+#if ENABLE(STYLE_SCOPED)
+    size_t m_numberOfScopedHTMLStyleChildren;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index 4a9709a0d..cdcb102d8 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -27,14 +27,15 @@
 #include "NodeRenderingContext.h"
 
 #include "ContainerNode.h"
-#include "ContentInclusionSelector.h"
 #include "HTMLContentElement.h"
+#include "HTMLContentSelector.h"
 #include "Node.h"
 #include "RenderFlowThread.h"
 #include "RenderFullScreen.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
@@ -43,12 +44,11 @@
 namespace WebCore {
 
 NodeRenderingContext::NodeRenderingContext(Node* node)
-    : m_location(LocationNotInTree)
-    , m_phase(AttachStraight)
+    : m_phase(AttachingNotInTree)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRoot(0)
-    , m_includer(0)
+    , m_visualParentShadowRootList(0)
+    , m_insertionPoint(0)
     , m_style(0)
     , m_parentFlowRenderer(0)
 {
@@ -57,49 +57,46 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
         return;
 
     if (parent->isShadowRoot()) {
-        m_location = LocationShadowChild;
+        m_phase = AttachingShadowChild;
         m_parentNodeForRenderingAndStyle = parent->shadowHost();
         return;
     }
 
-    m_location = LocationLightChild;
-
     if (parent->isElementNode()) {
-        m_visualParentShadowRoot = toElement(parent)->shadowRoot();
-
-        if (m_visualParentShadowRoot) {
-            if ((m_includer = m_visualParentShadowRoot->includerFor(m_node))
-                && m_visualParentShadowRoot->isInclusionSelectorActive()) {
-                m_phase = AttachContentForwarded;
-                m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_includer).parentNodeForRenderingAndStyle();
+        if (toElement(parent)->hasShadowRoot()) {
+            m_visualParentShadowRootList = toElement(parent)->shadowRootList();
+            if ((m_insertionPoint = m_visualParentShadowRootList->insertionPointFor(m_node))
+                && m_visualParentShadowRootList->isSelectorActive()) {
+                m_phase = AttachingDistributed;
+                m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_insertionPoint).parentNodeForRenderingAndStyle();
                 return;
             }
 
-            m_phase = AttachContentLight;
+            m_phase = AttachingNotDistributed;
             m_parentNodeForRenderingAndStyle = parent;
             return;
         }
 
-        if (parent->isContentElement()) {
-            HTMLContentElement* shadowContentElement = toHTMLContentElement(parent);
-            if (!shadowContentElement->hasInclusion()) {
-                m_phase = AttachContentFallback;
-                m_parentNodeForRenderingAndStyle = NodeRenderingContext(parent).parentNodeForRenderingAndStyle();
-                return;
-            }
+        if (isInsertionPoint(parent)) {
+            if (toInsertionPoint(parent)->hasSelection())
+                m_phase = AttachingNotFallbacked;
+            else
+                m_phase = AttachingFallbacked;
+            m_parentNodeForRenderingAndStyle = NodeRenderingContext(parent).parentNodeForRenderingAndStyle();
+            return;
         }
     }
 
+    m_phase = AttachingStraight;
     m_parentNodeForRenderingAndStyle = parent;
 }
 
 NodeRenderingContext::NodeRenderingContext(Node* node, RenderStyle* style)
-    : m_location(LocationUndetermined)
-    , m_phase(AttachStraight)
+    : m_phase(Calculating)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRoot(0)
-    , m_includer(0)
+    , m_visualParentShadowRootList(0)
+    , m_insertionPoint(0)
     , m_style(style)
     , m_parentFlowRenderer(0)
 {
@@ -120,72 +117,80 @@ PassRefPtr<RenderStyle> NodeRenderingContext::releaseStyle()
     return m_style.release();
 }
 
-static RenderObject* nextRendererOf(HTMLContentElement* parent, Node* current)
+static RenderObject* nextRendererOf(InsertionPoint* parent, Node* current)
 {
-    ShadowInclusion* currentInclusion = parent->inclusions()->find(current);
-    if (!currentInclusion)
+    HTMLContentSelection* currentSelection = parent->selections()->find(current);
+    if (!currentSelection)
         return 0;
 
-    for (ShadowInclusion* inclusion = currentInclusion->next(); inclusion; inclusion = inclusion->next()) {
-        if (RenderObject* renderer = inclusion->content()->renderer())
+    for (HTMLContentSelection* selection = currentSelection->next(); selection; selection = selection->next()) {
+        if (RenderObject* renderer = selection->node()->renderer())
             return renderer;
     }
 
     return 0;
 }
 
-static RenderObject* previousRendererOf(HTMLContentElement* parent, Node* current)
+static RenderObject* previousRendererOf(InsertionPoint* parent, Node* current)
 {
     RenderObject* lastRenderer = 0;
 
-    for (ShadowInclusion* inclusion = parent->inclusions()->first(); inclusion; inclusion = inclusion->next()) {
-        if (inclusion->content() == current)
+    for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
+        if (selection->node() == current)
             break;
-        if (RenderObject* renderer = inclusion->content()->renderer())
+        if (RenderObject* renderer = selection->node()->renderer())
             lastRenderer = renderer;
     }
 
     return lastRenderer;
 }
 
-static RenderObject* firstRendererOf(HTMLContentElement* parent)
+static RenderObject* firstRendererOf(InsertionPoint* parent)
 {
-    for (ShadowInclusion* inclusion = parent->inclusions()->first(); inclusion; inclusion = inclusion->next()) {
-        if (RenderObject* renderer = inclusion->content()->renderer())
-            return renderer;
+    if (parent->hasSelection()) {
+        for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
+            if (RenderObject* renderer = selection->node()->renderer())
+                return renderer;
+        }
+
+        return 0;
     }
 
-    return 0;
+    return NodeRenderingContext(parent).nextRenderer();
 }
 
-static RenderObject* lastRendererOf(HTMLContentElement* parent)
+static RenderObject* lastRendererOf(InsertionPoint* parent)
 {
-    for (ShadowInclusion* inclusion = parent->inclusions()->last(); inclusion; inclusion = inclusion->previous()) {
-        if (RenderObject* renderer = inclusion->content()->renderer())
-            return renderer;
+    if (parent->hasSelection()) {
+        for (HTMLContentSelection* selection = parent->selections()->last(); selection; selection = selection->previous()) {
+            if (RenderObject* renderer = selection->node()->renderer())
+                return renderer;
+        }
+
+        return 0;
     }
 
-    return 0;
+    return NodeRenderingContext(parent).previousRenderer();
 }
 
 RenderObject* NodeRenderingContext::nextRenderer() const
 {
-    ASSERT(m_node->renderer() || m_location != LocationUndetermined);
+    ASSERT(m_node->renderer() || m_phase != Calculating);
     if (RenderObject* renderer = m_node->renderer())
         return renderer->nextSibling();
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->nextRendererForNode(m_node);
 
-    if (m_phase == AttachContentForwarded) {
-        if (RenderObject* found = nextRendererOf(m_includer, m_node))
+    if (m_phase == AttachingDistributed) {
+        if (RenderObject* found = nextRendererOf(m_insertionPoint, m_node))
             return found;
-        return NodeRenderingContext(m_includer).nextRenderer();
+        return NodeRenderingContext(m_insertionPoint).nextRenderer();
     }
 
-    // Avoid an O(n^2) problem with this function by not checking for
+    // Avoid an O(N^2) problem with this function by not checking for
     // nextRenderer() when the parent element hasn't attached yet.
-    if (m_node->parentOrHostNode() && !m_node->parentOrHostNode()->attached() && m_phase != AttachContentFallback)
+    if (m_node->parentOrHostNode() && !m_node->parentOrHostNode()->attached())
         return 0;
 
     for (Node* node = m_node->nextSibling(); node; node = node->nextSibling()) {
@@ -195,31 +200,30 @@ RenderObject* NodeRenderingContext::nextRenderer() const
                 continue;
             return node->renderer();
         }
-        if (node->isContentElement()) {
-            if (RenderObject* first = firstRendererOf(toHTMLContentElement(node)))
+
+        if (isInsertionPoint(node)) {
+            if (RenderObject* first = firstRendererOf(toInsertionPoint(node)))
                 return first;
         }
     }
 
-    if (m_phase == AttachContentFallback)
-        return NodeRenderingContext(m_node->parentNode()).nextRenderer();
-
     return 0;
 }
 
 RenderObject* NodeRenderingContext::previousRenderer() const
 {
-    ASSERT(m_node->renderer() || m_location != LocationUndetermined);
+    ASSERT(m_node->renderer() || m_phase != Calculating);
+
     if (RenderObject* renderer = m_node->renderer())
         return renderer->previousSibling();
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->previousRendererForNode(m_node);
 
-    if (m_phase == AttachContentForwarded) {
-        if (RenderObject* found = previousRendererOf(m_includer, m_node))
+    if (m_phase == AttachingDistributed) {
+        if (RenderObject* found = previousRendererOf(m_insertionPoint, m_node))
             return found;
-        return NodeRenderingContext(m_includer).previousRenderer();
+        return NodeRenderingContext(m_insertionPoint).previousRenderer();
     }
 
     // FIXME: We should have the same O(N^2) avoidance as nextRenderer does
@@ -231,68 +235,57 @@ RenderObject* NodeRenderingContext::previousRenderer() const
                 continue;
             return node->renderer();
         }
-        if (node->isContentElement()) {
-            if (RenderObject* last = lastRendererOf(toHTMLContentElement(node)))
+        if (isInsertionPoint(node)) {
+            if (RenderObject* last = lastRendererOf(toInsertionPoint(node)))
                 return last;
         }
     }
 
-    if (m_phase == AttachContentFallback)
-        return NodeRenderingContext(m_node->parentNode()).previousRenderer();
-
     return 0;
 }
 
 RenderObject* NodeRenderingContext::parentRenderer() const
 {
     if (RenderObject* renderer = m_node->renderer()) {
-        ASSERT(m_location == LocationUndetermined);
+        ASSERT(m_phase == Calculating);
         return renderer->parent();
     }
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer;
 
-    ASSERT(m_location != LocationUndetermined);
+    ASSERT(m_phase != Calculating);
     return m_parentNodeForRenderingAndStyle ? m_parentNodeForRenderingAndStyle->renderer() : 0;
 }
 
 void NodeRenderingContext::hostChildrenChanged()
 {
-    if (m_phase == AttachContentLight)
-        m_visualParentShadowRoot->hostChildrenChanged();
+    if (m_phase == AttachingNotDistributed)
+        m_visualParentShadowRootList->hostChildrenChanged();
 }
 
 bool NodeRenderingContext::shouldCreateRenderer() const
 {
-    ASSERT(m_location != LocationUndetermined);
+    ASSERT(m_phase != Calculating);
     ASSERT(parentNodeForRenderingAndStyle());
 
-    if (m_location == LocationNotInTree || m_phase == AttachContentLight)
+    if (m_phase == AttachingNotInTree || m_phase == AttachingNotDistributed || m_phase == AttachingNotFallbacked)
         return false;
-
     RenderObject* parentRenderer = this->parentRenderer();
     if (!parentRenderer)
         return false;
-
-    if (m_location == LocationLightChild && m_phase == AttachStraight) {
-        // FIXME: Ignoring canHaveChildren() in a case of shadow children might be wrong.
-        // See https://bugs.webkit.org/show_bug.cgi?id=52423
-        if (!parentRenderer->canHaveChildren())
-            return false;
-
-        if (m_visualParentShadowRoot)
-            return false;
-    }
-
-    if (!m_parentNodeForRenderingAndStyle->childShouldCreateRenderer(m_node))
+    if (!parentRenderer->canHaveChildren())
+        return false;
+    if (!m_parentNodeForRenderingAndStyle->childShouldCreateRenderer(*this))
         return false;
-
     return true;
 }
 
 void NodeRenderingContext::moveToFlowThreadIfNeeded()
 {
+    if (!m_node->document()->cssRegionsEnabled())
+        return;
+
     if (!m_node->isElementNode() || !m_style || m_style->flowThread().isEmpty())
         return;
 
diff --git a/Source/WebCore/dom/NodeRenderingContext.h b/Source/WebCore/dom/NodeRenderingContext.h
index 610420d37..ca20d525c 100644
--- a/Source/WebCore/dom/NodeRenderingContext.h
+++ b/Source/WebCore/dom/NodeRenderingContext.h
@@ -34,12 +34,12 @@ namespace WebCore {
 
 class ContainerNode;
 class Document;
+class InsertionPoint;
 class Node;
 class RenderFlowThread;
 class RenderObject;
 class RenderStyle;
-class HTMLContentElement;
-class ShadowRoot;
+class ShadowRootList;
 
 class NodeRenderingContext {
 public:
@@ -52,7 +52,7 @@ public:
     RenderObject* parentRenderer() const;
     RenderObject* nextRenderer() const;
     RenderObject* previousRenderer() const;
-    HTMLContentElement* includer() const;
+    InsertionPoint* insertionPoint() const;
 
     RenderStyle* style() const;
     void setStyle(PassRefPtr<RenderStyle>);
@@ -62,32 +62,28 @@ public:
 
     void hostChildrenChanged();
 
+    bool isOnEncapsulationBoundary() const;
     bool hasFlowThreadParent() const { return m_parentFlowRenderer; }
     RenderFlowThread* parentFlowRenderer() const { return m_parentFlowRenderer; }
     void moveToFlowThreadIfNeeded();
 
 private:
-
-    enum TreeLocation {
-        LocationUndetermined,
-        LocationNotInTree,
-        LocationLightChild,
-        LocationShadowChild,
-    };
-
-    enum AttachPhase {
-        AttachStraight,
-        AttachContentLight,
-        AttachContentForwarded,
-        AttachContentFallback,
+    enum AttachingPhase {
+        Calculating,
+        AttachingStraight,
+        AttachingNotInTree,
+        AttachingDistributed,
+        AttachingNotDistributed,
+        AttachingFallbacked,
+        AttachingNotFallbacked,
+        AttachingShadowChild,
     };
 
-    TreeLocation m_location;
-    AttachPhase m_phase;
+    AttachingPhase m_phase;
     Node* m_node;
     ContainerNode* m_parentNodeForRenderingAndStyle;
-    ShadowRoot* m_visualParentShadowRoot;
-    HTMLContentElement* m_includer;
+    ShadowRootList* m_visualParentShadowRootList;
+    InsertionPoint* m_insertionPoint;
     RefPtr<RenderStyle> m_style;
     RenderFlowThread* m_parentFlowRenderer;
     AtomicString m_flowThread;
@@ -100,7 +96,7 @@ inline Node* NodeRenderingContext::node() const
 
 inline ContainerNode* NodeRenderingContext::parentNodeForRenderingAndStyle() const
 {
-    ASSERT(m_location != LocationUndetermined);
+    ASSERT(m_phase != Calculating);
     return m_parentNodeForRenderingAndStyle;
 }
 
@@ -109,9 +105,16 @@ inline RenderStyle* NodeRenderingContext::style() const
     return m_style.get();
 }
 
-inline HTMLContentElement* NodeRenderingContext::includer() const
+inline InsertionPoint* NodeRenderingContext::insertionPoint() const
+{
+    return m_insertionPoint;
+}
+
+inline bool NodeRenderingContext::isOnEncapsulationBoundary() const
 {
-    return m_includer;
+    return (m_phase == AttachingDistributed
+            || m_phase == AttachingShadowChild
+            || m_phase == AttachingFallbacked);
 }
 
 class NodeRendererFactory {
diff --git a/Source/WebCore/dom/Notation.idl b/Source/WebCore/dom/Notation.idl
index 96351d253..2917cb26f 100644
--- a/Source/WebCore/dom/Notation.idl
+++ b/Source/WebCore/dom/Notation.idl
@@ -20,8 +20,8 @@
 module core {
 
     interface Notation : Node {
-        readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString publicId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString systemId;
     };
 
 }
diff --git a/Source/WebCore/dom/OverflowEvent.idl b/Source/WebCore/dom/OverflowEvent.idl
index a1ecc4179..10b9504f4 100644
--- a/Source/WebCore/dom/OverflowEvent.idl
+++ b/Source/WebCore/dom/OverflowEvent.idl
@@ -37,9 +37,9 @@ module events {
         readonly attribute [InitializedByEventConstructor] boolean verticalOverflow;
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        void initOverflowEvent(in [Optional=CallWithDefaultValue] unsigned short orient,
-                               in [Optional=CallWithDefaultValue] boolean horizontalOverflow,
-                               in [Optional=CallWithDefaultValue] boolean verticalOverflow);
+        void initOverflowEvent(in [Optional=DefaultIsUndefined] unsigned short orient,
+                               in [Optional=DefaultIsUndefined] boolean horizontalOverflow,
+                               in [Optional=DefaultIsUndefined] boolean verticalOverflow);
 #endif
     };
 
diff --git a/Source/WebCore/dom/PopStateEvent.cpp b/Source/WebCore/dom/PopStateEvent.cpp
index 8d0cb7292..d1e0c758a 100644
--- a/Source/WebCore/dom/PopStateEvent.cpp
+++ b/Source/WebCore/dom/PopStateEvent.cpp
@@ -28,6 +28,8 @@
 #include "PopStateEvent.h"
 
 #include "EventNames.h"
+#include "History.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -38,6 +40,7 @@ PopStateEventInit::PopStateEventInit()
 PopStateEvent::PopStateEvent()
     : Event(eventNames().popstateEvent, false, true)
     , m_serializedState(0)
+    , m_history(0)
 {
 }
 
@@ -45,19 +48,14 @@ PopStateEvent::PopStateEvent(const AtomicString& type, const PopStateEventInit&
     : Event(type, initializer)
     , m_state(initializer.state)
     , m_serializedState(0)
+    , m_history(0)
 {
 }
 
-PopStateEvent::PopStateEvent(const ScriptValue& state)
-    : Event(eventNames().popstateEvent, false, true)
-    , m_state(state)
-    , m_serializedState(0)
-{
-}
-
-PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> serializedState)
+PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> serializedState, PassRefPtr<History> history)
     : Event(eventNames().popstateEvent, false, true)
     , m_serializedState(serializedState)
+    , m_history(history)
 {
 }
 
@@ -70,14 +68,9 @@ PassRefPtr<PopStateEvent> PopStateEvent::create()
     return adoptRef(new PopStateEvent);
 }
 
-PassRefPtr<PopStateEvent> PopStateEvent::create(const ScriptValue& state)
-{
-    return adoptRef(new PopStateEvent(state));
-}
-
-PassRefPtr<PopStateEvent> PopStateEvent::create(PassRefPtr<SerializedScriptValue> serializedState)
+PassRefPtr<PopStateEvent> PopStateEvent::create(PassRefPtr<SerializedScriptValue> serializedState, PassRefPtr<History> history)
 {
-    return adoptRef(new PopStateEvent(serializedState));
+    return adoptRef(new PopStateEvent(serializedState, history));
 }
 
 PassRefPtr<PopStateEvent> PopStateEvent::create(const AtomicString& type, const PopStateEventInit& initializer)
diff --git a/Source/WebCore/dom/PopStateEvent.h b/Source/WebCore/dom/PopStateEvent.h
index 5125fc1ca..8de0ae6d1 100644
--- a/Source/WebCore/dom/PopStateEvent.h
+++ b/Source/WebCore/dom/PopStateEvent.h
@@ -29,7 +29,6 @@
 
 #include "Event.h"
 #include "ScriptValue.h"
-#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -39,27 +38,30 @@ struct PopStateEventInit : public EventInit {
     ScriptValue state;
 };
 
+class History;
+class SerializedScriptValue;
+
 class PopStateEvent : public Event {
 public:
     virtual ~PopStateEvent();
     static PassRefPtr<PopStateEvent> create();
-    static PassRefPtr<PopStateEvent> create(const ScriptValue&);
-    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue>);
+    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue>, PassRefPtr<History>);
     static PassRefPtr<PopStateEvent> create(const AtomicString&, const PopStateEventInit&);
 
     SerializedScriptValue* serializedState() const { return m_serializedState.get(); }
     ScriptValue state() const { return m_state; }
+    History* history() const { return m_history.get(); }
 
     virtual const AtomicString& interfaceName() const;
 
 private:
     PopStateEvent();
     PopStateEvent(const AtomicString&, const PopStateEventInit&);
-    explicit PopStateEvent(const ScriptValue&);
-    explicit PopStateEvent(PassRefPtr<SerializedScriptValue>);
+    explicit PopStateEvent(PassRefPtr<SerializedScriptValue>, PassRefPtr<History>);
 
     ScriptValue m_state;
     RefPtr<SerializedScriptValue> m_serializedState;
+    RefPtr<History> m_history;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/PopStateEvent.idl b/Source/WebCore/dom/PopStateEvent.idl
index 6326a9d7a..c9343ca80 100644
--- a/Source/WebCore/dom/PopStateEvent.idl
+++ b/Source/WebCore/dom/PopStateEvent.idl
@@ -30,7 +30,7 @@ module events {
     interface [
         ConstructorTemplate=Event
     ] PopStateEvent : Event {
-        readonly attribute [InitializedByEventConstructor, CustomGetter] DOMObject state;
+        readonly attribute [InitializedByEventConstructor, CachedAttribute, CustomGetter] DOMObject state;
     };
 #endif
 
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index fed04947a..74b16ab60 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -153,7 +153,7 @@ Text* Position::containerText() const
 {
     switch (anchorType()) {
     case PositionIsOffsetInAnchor:
-        return m_anchorNode && m_anchorNode->isTextNode() ? static_cast<Text*>(m_anchorNode.get()) : 0;
+        return m_anchorNode && m_anchorNode->isTextNode() ? toText(m_anchorNode.get()) : 0;
     case PositionIsBeforeAnchor:
     case PositionIsAfterAnchor:
         return 0;
@@ -283,7 +283,7 @@ PassRefPtr<CSSComputedStyleDeclaration> Position::computedStyle() const
     Element* elem = element();
     if (!elem)
         return 0;
-    return WebCore::computedStyle(elem);
+    return CSSComputedStyleDeclaration::create(elem);
 }
 
 Position Position::previous(PositionMoveType moveType) const
@@ -1018,7 +1018,7 @@ Position Position::leadingWhitespacePosition(EAffinity affinity, bool considerNo
 
     Position prev = previousCharacterPosition(affinity);
     if (prev != *this && prev.deprecatedNode()->inSameContainingBlockFlowElement(deprecatedNode()) && prev.deprecatedNode()->isTextNode()) {
-        String string = static_cast<Text *>(prev.deprecatedNode())->data();
+        String string = toText(prev.deprecatedNode())->data();
         UChar c = string[prev.deprecatedEditingOffset()];
         if (considerNonCollapsibleWhitespace ? (isSpaceOrNewline(c) || c == noBreakSpace) : isCollapsibleWhitespace(c))
             if (isEditablePosition(prev))
diff --git a/Source/WebCore/dom/ProcessingInstruction.idl b/Source/WebCore/dom/ProcessingInstruction.idl
index 9c673fdcb..02499a2f1 100644
--- a/Source/WebCore/dom/ProcessingInstruction.idl
+++ b/Source/WebCore/dom/ProcessingInstruction.idl
@@ -24,8 +24,8 @@ module core {
 
         // DOM Level 1
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString target;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString data
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString target;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString data
                      setter raises(DOMException);
 
         // interface LinkStyle from DOM Level 2 Style Sheets
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index 9b569b3e0..0c00cfda9 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -677,7 +677,6 @@ static inline unsigned lengthOfContentsInNode(Node* node)
     case Node::DOCUMENT_FRAGMENT_NODE:
     case Node::NOTATION_NODE:
     case Node::XPATH_NAMESPACE_NODE:
-    case Node::SHADOW_ROOT_NODE:
         return node->childNodeCount();
     }
     ASSERT_NOT_REACHED();
@@ -840,7 +839,6 @@ PassRefPtr<Node> Range::processContentsBetweenOffsets(ActionType action, PassRef
     case Node::DOCUMENT_FRAGMENT_NODE:
     case Node::NOTATION_NODE:
     case Node::XPATH_NAMESPACE_NODE:
-    case Node::SHADOW_ROOT_NODE:
         // FIXME: Should we assert that some nodes never appear here?
         if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
             if (fragment)
@@ -997,7 +995,7 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
 
     Node::NodeType newNodeType = newNode->nodeType();
     int numNewChildren;
-    if (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) {
+    if (newNodeType == Node::DOCUMENT_FRAGMENT_NODE && !newNode->isShadowRoot()) {
         // check each child node, not the DocumentFragment itself
         numNewChildren = 0;
         for (Node* c = newNode->firstChild(); c; c = c->nextSibling()) {
@@ -1028,16 +1026,19 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
     case Node::ENTITY_NODE:
     case Node::NOTATION_NODE:
     case Node::DOCUMENT_NODE:
-    case Node::SHADOW_ROOT_NODE:
         ec = RangeException::INVALID_NODE_TYPE_ERR;
         return;
     default:
+        if (newNode->isShadowRoot()) {
+            ec = RangeException::INVALID_NODE_TYPE_ERR;
+            return;
+        }
         break;
     }
 
     bool collapsed = m_start == m_end;
     if (startIsText) {
-        RefPtr<Text> newText = static_cast<Text*>(m_start.container())->splitText(m_start.offset(), ec);
+        RefPtr<Text> newText = toText(m_start.container())->splitText(m_start.offset(), ec);
         if (ec)
             return;
         m_start.container()->parentNode()->insertBefore(newNode.release(), newText.get(), ec);
@@ -1217,8 +1218,7 @@ Node* Range::checkNodeWOffset(Node* n, int offset, ExceptionCode& ec) const
         case Node::DOCUMENT_NODE:
         case Node::ELEMENT_NODE:
         case Node::ENTITY_REFERENCE_NODE:
-        case Node::XPATH_NAMESPACE_NODE:
-        case Node::SHADOW_ROOT_NODE: {
+        case Node::XPATH_NAMESPACE_NODE: {
             if (!offset)
                 return 0;
             Node* childBefore = n->childNode(offset - 1);
@@ -1243,7 +1243,6 @@ void Range::checkNodeBA(Node* n, ExceptionCode& ec) const
         case Node::DOCUMENT_NODE:
         case Node::ENTITY_NODE:
         case Node::NOTATION_NODE:
-        case Node::SHADOW_ROOT_NODE:
             ec = RangeException::INVALID_NODE_TYPE_ERR;
             return;
         case Node::CDATA_SECTION_NODE:
@@ -1265,7 +1264,6 @@ void Range::checkNodeBA(Node* n, ExceptionCode& ec) const
         case Node::ATTRIBUTE_NODE:
         case Node::DOCUMENT_NODE:
         case Node::DOCUMENT_FRAGMENT_NODE:
-        case Node::SHADOW_ROOT_NODE:
             break;
         case Node::CDATA_SECTION_NODE:
         case Node::COMMENT_NODE:
@@ -1397,7 +1395,6 @@ void Range::selectNode(Node* refNode, ExceptionCode& ec)
             case Node::PROCESSING_INSTRUCTION_NODE:
             case Node::TEXT_NODE:
             case Node::XPATH_NAMESPACE_NODE:
-            case Node::SHADOW_ROOT_NODE:
                 break;
             case Node::DOCUMENT_TYPE_NODE:
             case Node::ENTITY_NODE:
@@ -1422,7 +1419,6 @@ void Range::selectNode(Node* refNode, ExceptionCode& ec)
         case Node::DOCUMENT_NODE:
         case Node::ENTITY_NODE:
         case Node::NOTATION_NODE:
-        case Node::SHADOW_ROOT_NODE:
             ec = RangeException::INVALID_NODE_TYPE_ERR;
             return;
     }
@@ -1463,7 +1459,6 @@ void Range::selectNodeContents(Node* refNode, ExceptionCode& ec)
             case Node::PROCESSING_INSTRUCTION_NODE:
             case Node::TEXT_NODE:
             case Node::XPATH_NAMESPACE_NODE:
-            case Node::SHADOW_ROOT_NODE:
                 break;
             case Node::DOCUMENT_TYPE_NODE:
             case Node::ENTITY_NODE:
@@ -1512,7 +1507,6 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
         case Node::PROCESSING_INSTRUCTION_NODE:
         case Node::TEXT_NODE:
         case Node::XPATH_NAMESPACE_NODE:
-        case Node::SHADOW_ROOT_NODE:
             break;
     }
 
@@ -1678,7 +1672,7 @@ IntRect Range::boundingBox()
     const size_t n = rects.size();
     for (size_t i = 0; i < n; ++i)
         result.unite(rects[i]);
-    return result;
+    return pixelSnappedIntRect(result);
 }
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight, RangeInFixedPosition* inFixed)
@@ -2040,7 +2034,7 @@ void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
                 }
             }
         } else if (node->isTextNode()) {
-            if (RenderObject* renderer = static_cast<Text*>(node)->renderer()) {
+            if (RenderObject* renderer = toText(node)->renderer()) {
                 RenderText* renderText = toRenderText(renderer);
                 int startOffset = (node == startContainer) ? m_start.offset() : 0;
                 int endOffset = (node == endContainer) ? m_end.offset() : INT_MAX;
diff --git a/Source/WebCore/dom/Range.idl b/Source/WebCore/dom/Range.idl
index eb7168fa6..67f4aee07 100644
--- a/Source/WebCore/dom/Range.idl
+++ b/Source/WebCore/dom/Range.idl
@@ -36,25 +36,25 @@ module ranges {
         readonly attribute Node commonAncestorContainer
             getter raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void setStart(in [Optional=CallWithDefaultValue] Node refNode, 
-                                     in [Optional=CallWithDefaultValue] long offset)
+        [ObjCLegacyUnnamedParameters] void setStart(in [Optional=DefaultIsUndefined] Node refNode, 
+                                     in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
-        [ObjCLegacyUnnamedParameters] void setEnd(in [Optional=CallWithDefaultValue] Node refNode, 
-                                   in [Optional=CallWithDefaultValue] long offset)
+        [ObjCLegacyUnnamedParameters] void setEnd(in [Optional=DefaultIsUndefined] Node refNode, 
+                                   in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
-        void setStartBefore(in [Optional=CallWithDefaultValue] Node refNode)
+        void setStartBefore(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void setStartAfter(in [Optional=CallWithDefaultValue] Node refNode)
+        void setStartAfter(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void setEndBefore(in [Optional=CallWithDefaultValue] Node refNode)
+        void setEndBefore(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void setEndAfter(in [Optional=CallWithDefaultValue] Node refNode)
+        void setEndAfter(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void collapse(in [Optional=CallWithDefaultValue] boolean toStart)
+        void collapse(in [Optional=DefaultIsUndefined] boolean toStart)
             raises(DOMException);
-        void selectNode(in [Optional=CallWithDefaultValue] Node refNode)
+        void selectNode(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void selectNodeContents(in [Optional=CallWithDefaultValue] Node refNode)
+        void selectNodeContents(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
 
         // CompareHow
@@ -63,8 +63,8 @@ module ranges {
         const unsigned short END_TO_END     = 2;
         const unsigned short END_TO_START   = 3;
 
-        [ObjCLegacyUnnamedParameters] short compareBoundaryPoints(in [Optional=CallWithDefaultValue] CompareHow how,
-                                                   in [Optional=CallWithDefaultValue] Range sourceRange)
+        [ObjCLegacyUnnamedParameters] short compareBoundaryPoints(in [Optional=DefaultIsUndefined] CompareHow how,
+                                                   in [Optional=DefaultIsUndefined] Range sourceRange)
             raises(DOMException);
 
         void deleteContents()
@@ -73,9 +73,9 @@ module ranges {
             raises(DOMException);
         DocumentFragment cloneContents()
             raises(DOMException);
-        void insertNode(in [Optional=CallWithDefaultValue] Node newNode)
+        void insertNode(in [Optional=DefaultIsUndefined] Node newNode)
             raises(DOMException, RangeException);
-        void surroundContents(in [Optional=CallWithDefaultValue] Node newParent)
+        void surroundContents(in [Optional=DefaultIsUndefined] Node newParent)
             raises(DOMException, RangeException);
         Range cloneRange()
             raises(DOMException);
@@ -94,15 +94,15 @@ module ranges {
 
         // extensions
 
-        DocumentFragment createContextualFragment(in [Optional=CallWithDefaultValue] DOMString html)
+        DocumentFragment createContextualFragment(in [Optional=DefaultIsUndefined] DOMString html)
             raises(DOMException);
 
         // WebKit extensions
 
-        boolean intersectsNode(in [Optional=CallWithDefaultValue] Node refNode)
+        boolean intersectsNode(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
 
-        short compareNode(in [Optional=CallWithDefaultValue] Node refNode)
+        short compareNode(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
 
         // CompareResults
@@ -111,15 +111,15 @@ module ranges {
         const unsigned short NODE_BEFORE_AND_AFTER = 2;
         const unsigned short NODE_INSIDE           = 3;
 
-        short comparePoint(in [Optional=CallWithDefaultValue] Node refNode, 
-                           in [Optional=CallWithDefaultValue] long offset)
+        short comparePoint(in [Optional=DefaultIsUndefined] Node refNode, 
+                           in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
 
-        boolean isPointInRange(in [Optional=CallWithDefaultValue] Node refNode, 
-                               in [Optional=CallWithDefaultValue] long offset)
+        boolean isPointInRange(in [Optional=DefaultIsUndefined] Node refNode, 
+                               in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
 
-        void expand(in [Optional=CallWithDefaultValue] DOMString unit)
+        void expand(in [Optional=DefaultIsUndefined] DOMString unit)
             raises(RangeException, DOMException);
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
diff --git a/Source/WebCore/dom/RequestAnimationFrameCallback.idl b/Source/WebCore/dom/RequestAnimationFrameCallback.idl
index b850c4776..4da682083 100644
--- a/Source/WebCore/dom/RequestAnimationFrameCallback.idl
+++ b/Source/WebCore/dom/RequestAnimationFrameCallback.idl
@@ -30,7 +30,7 @@
 
 module core {
     interface [
-        Callback=FunctionOnly,
+        Callback,
         Conditional=REQUEST_ANIMATION_FRAME,
     ] RequestAnimationFrameCallback{
 #if defined(V8_BINDING) && V8_BINDING
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 71c1fce42..895e8337d 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -355,7 +355,7 @@ String ScriptElement::scriptContent() const
         if (!n->isTextNode())
             continue;
 
-        Text* t = static_cast<Text*>(n);
+        Text* t = toText(n);
         if (foundMultipleTextNodes)
             content.append(t->data());
         else if (firstTextNode) {
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 5670fe8ef..9a5682d7f 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -93,6 +93,7 @@ ScriptExecutionContext::ScriptExecutionContext()
     : m_iteratingActiveDOMObjects(false)
     , m_inDestructor(false)
     , m_inDispatchErrorEvent(false)
+    , m_activeDOMObjectsAreSuspended(false)
 #if ENABLE(SQL_DATABASE)
     , m_hasOpenDatabases(false)
 #endif
@@ -102,7 +103,6 @@ ScriptExecutionContext::ScriptExecutionContext()
 ScriptExecutionContext::~ScriptExecutionContext()
 {
     m_inDestructor = true;
-
     for (HashSet<ContextDestructionObserver*>::iterator iter = m_destructionObservers.begin(); iter != m_destructionObservers.end(); iter = m_destructionObservers.begin()) {
         ContextDestructionObserver* observer = *iter;
         m_destructionObservers.remove(observer);
@@ -211,11 +211,12 @@ bool ScriptExecutionContext::canSuspendActiveDOMObjects()
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         if (!iter->first->canSuspend()) {
             m_iteratingActiveDOMObjects = false;
             return false;
         }
-    }    
+    }
     m_iteratingActiveDOMObjects = false;
     return true;
 }
@@ -227,18 +228,23 @@ void ScriptExecutionContext::suspendActiveDOMObjects(ActiveDOMObject::ReasonForS
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         iter->first->suspend(why);
     }
     m_iteratingActiveDOMObjects = false;
+    m_activeDOMObjectsAreSuspended = true;
+    m_reasonForSuspendingActiveDOMObjects = why;
 }
 
 void ScriptExecutionContext::resumeActiveDOMObjects()
 {
+    m_activeDOMObjectsAreSuspended = false;
     // No protection against m_activeDOMObjects changing during iteration: resume() shouldn't execute arbitrary JS.
     m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         iter->first->resume();
     }
     m_iteratingActiveDOMObjects = false;
@@ -251,6 +257,7 @@ void ScriptExecutionContext::stopActiveDOMObjects()
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         iter->first->stop();
     }
     m_iteratingActiveDOMObjects = false;
@@ -259,6 +266,14 @@ void ScriptExecutionContext::stopActiveDOMObjects()
     closeMessagePorts();
 }
 
+void ScriptExecutionContext::suspendActiveDOMObjectIfNeeded(ActiveDOMObject* object)
+{
+    ASSERT(m_activeDOMObjects.contains(object));
+    // Ensure all ActiveDOMObjects are suspended also newly created ones.
+    if (m_activeDOMObjectsAreSuspended)
+        object->suspend(m_reasonForSuspendingActiveDOMObjects);
+}
+
 void ScriptExecutionContext::didCreateActiveDOMObject(ActiveDOMObject* object, void* upcastPointer)
 {
     ASSERT(object);
diff --git a/Source/WebCore/dom/ScriptExecutionContext.h b/Source/WebCore/dom/ScriptExecutionContext.h
index 6cbdd0265..15ceb42ee 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.h
+++ b/Source/WebCore/dom/ScriptExecutionContext.h
@@ -98,6 +98,9 @@ public:
     void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL = String(), unsigned lineNumber = 0, PassRefPtr<ScriptCallStack> = 0);
     void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptCallStack>);
 
+#if ENABLE(BLOB)
+    PublicURLManager& publicURLManager();
+#endif
     // Active objects are not garbage collected even if inaccessible, e.g. because their activity may result in callbacks being invoked.
     bool canSuspendActiveDOMObjects();
     // Active objects can be asked to suspend even if canSuspendActiveDOMObjects() returns 'false' -
@@ -106,12 +109,15 @@ public:
     virtual void resumeActiveDOMObjects();
     virtual void stopActiveDOMObjects();
 
-#if ENABLE(BLOB)
-    PublicURLManager& publicURLManager();
-#endif
+    bool activeDOMObjectsAreSuspended() const { return m_activeDOMObjectsAreSuspended; }
+
+    // Called from the constructor and destructors of ActiveDOMObject.
     void didCreateActiveDOMObject(ActiveDOMObject*, void* upcastPointer);
     void willDestroyActiveDOMObject(ActiveDOMObject*);
 
+    // Called after the construction of an ActiveDOMObject to synchronize suspend state.
+    void suspendActiveDOMObjectIfNeeded(ActiveDOMObject*);
+
     typedef const HashMap<ActiveDOMObject*, void*> ActiveDOMObjectsMap;
     ActiveDOMObjectsMap& activeDOMObjects() const { return m_activeDOMObjects; }
 
@@ -215,6 +221,9 @@ private:
     OwnPtr<PublicURLManager> m_publicURLManager;
 #endif
 
+    bool m_activeDOMObjectsAreSuspended;
+    ActiveDOMObject::ReasonForSuspension m_reasonForSuspendingActiveDOMObjects;
+
 #if ENABLE(SQL_DATABASE)
     RefPtr<DatabaseThread> m_databaseThread;
     bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
diff --git a/Source/WebCore/dom/ScriptedAnimationController.cpp b/Source/WebCore/dom/ScriptedAnimationController.cpp
index 8875f5568..099bc5cbd 100644
--- a/Source/WebCore/dom/ScriptedAnimationController.cpp
+++ b/Source/WebCore/dom/ScriptedAnimationController.cpp
@@ -85,7 +85,7 @@ ScriptedAnimationController::CallbackId ScriptedAnimationController::registerCal
     callback->m_element = animationElement;
     m_callbacks.append(callback);
 
-    InspectorInstrumentation::didRegisterAnimationFrameCallback(m_document, id);
+    InspectorInstrumentation::didRequestAnimationFrame(m_document, id);
 
     if (!m_suspendCount)
         scheduleAnimation();
@@ -97,7 +97,7 @@ void ScriptedAnimationController::cancelCallback(CallbackId id)
     for (size_t i = 0; i < m_callbacks.size(); ++i) {
         if (m_callbacks[i]->m_id == id) {
             m_callbacks[i]->m_firedOrCancelled = true;
-            InspectorInstrumentation::didCancelAnimationFrameCallback(m_document, id);
+            InspectorInstrumentation::didCancelAnimationFrame(m_document, id);
             m_callbacks.remove(i);
             return;
         }
@@ -141,9 +141,9 @@ void ScriptedAnimationController::serviceScriptedAnimations(DOMTimeStamp time)
             RequestAnimationFrameCallback* callback = callbacks[i].get();
             if (!callback->m_firedOrCancelled && (!callback->m_element || callback->m_element->renderer())) {
                 callback->m_firedOrCancelled = true;
-                InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireAnimationFrameEvent(m_document, callback->m_id);
+                InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireAnimationFrame(m_document, callback->m_id);
                 callback->handleEvent(time);
-                InspectorInstrumentation::didFireAnimationFrameEvent(cookie);
+                InspectorInstrumentation::didFireAnimationFrame(cookie);
                 firedCallback = true;
                 callbacks.remove(i);
                 break;
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 290be3f6d..6cf50acb9 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -27,22 +27,28 @@
 #include "config.h"
 #include "ShadowRoot.h"
 
-#include "ContentInclusionSelector.h"
 #include "Document.h"
 #include "Element.h"
 #include "HTMLContentElement.h"
+#include "HTMLContentSelector.h"
 #include "HTMLNames.h"
+#include "InsertionPoint.h"
 #include "NodeRareData.h"
+#include "ShadowRootList.h"
 #include "SVGNames.h"
-#include "Text.h"
+
+#if ENABLE(SHADOW_DOM)
+#include "RuntimeEnabledFeatures.h"
+#endif
 
 namespace WebCore {
 
 ShadowRoot::ShadowRoot(Document* document)
     : DocumentFragment(document, CreateShadowRoot)
     , TreeScope(this)
+    , m_prev(0)
+    , m_next(0)
     , m_applyAuthorSheets(false)
-    , m_needsRecalculateContent(false)
 {
     ASSERT(document);
     
@@ -55,6 +61,9 @@ ShadowRoot::ShadowRoot(Document* document)
 
 ShadowRoot::~ShadowRoot()
 {
+    ASSERT(!m_prev);
+    ASSERT(!m_next);
+
     // We must call clearRareData() here since a ShadowRoot class inherits TreeScope
     // as well as Node. See a comment on TreeScope.h for the reason.
     if (hasRareData())
@@ -92,7 +101,13 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ExceptionCode& ec)
 
 PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPurpose purpose, ExceptionCode& ec)
 {
-    if (!element || element->shadowRoot()) {
+#if ENABLE(SHADOW_DOM)
+    bool isMultipleShadowSubtreesEnabled = RuntimeEnabledFeatures::multipleShadowSubtreesEnabled();
+#else
+    bool isMultipleShadowSubtreesEnabled = false;
+#endif
+
+    if (!element || (!isMultipleShadowSubtreesEnabled && element->hasShadowRoot())) {
         ec = HIERARCHY_REQUEST_ERR;
         return 0;
     }
@@ -104,14 +119,15 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPu
         return 0;
     }
 
-    ASSERT(purpose != CreatingUserAgentShadowRoot || !element->shadowRoot());
-    RefPtr<ShadowRoot> shadowRoot = create(element->document());
+    ASSERT(purpose != CreatingUserAgentShadowRoot || !element->hasShadowRoot());
+    RefPtr<ShadowRoot> shadowRoot = adoptRef(new ShadowRoot(element->document()));
 
     ec = 0;
     element->setShadowRoot(shadowRoot, ec);
     if (ec)
         return 0;
-
+    ASSERT(element == shadowRoot->host());
+    ASSERT(element->hasShadowRoot());
     return shadowRoot.release();
 }
 
@@ -120,11 +136,6 @@ String ShadowRoot::nodeName() const
     return "#shadow-root";
 }
 
-Node::NodeType ShadowRoot::nodeType() const
-{
-    return SHADOW_ROOT_NODE;
-}
-
 PassRefPtr<Node> ShadowRoot::cloneNode(bool)
 {
     // ShadowRoot should not be arbitrarily cloned.
@@ -146,53 +157,11 @@ bool ShadowRoot::childTypeAllowed(NodeType type) const
     }
 }
 
-void ShadowRoot::recalcShadowTreeStyle(StyleChange change)
-{
-    if (needsReattachHostChildrenAndShadow())
-        reattachHostChildrenAndShadow();
-    else {
-        for (Node* n = firstChild(); n; n = n->nextSibling()) {
-            if (n->isElementNode())
-                static_cast<Element*>(n)->recalcStyle(change);
-            else if (n->isTextNode())
-                static_cast<Text*>(n)->recalcTextStyle(change);
-        }
-    }
-
-    clearNeedsReattachHostChildrenAndShadow();
-    clearNeedsStyleRecalc();
-    clearChildNeedsStyleRecalc();
-}
-
-void ShadowRoot::setNeedsReattachHostChildrenAndShadow()
-{
-    m_needsRecalculateContent = true;
-    if (shadowHost())
-        shadowHost()->setNeedsStyleRecalc();
-}
-
-HTMLContentElement* ShadowRoot::includerFor(Node* node) const
-{
-    if (!m_inclusions)
-        return 0;
-    ShadowInclusion* found = m_inclusions->findFor(node);
-    if (!found)
-        return 0;
-    return found->includer();
-}
-
-void ShadowRoot::hostChildrenChanged()
+ShadowRootList* ShadowRoot::list() const
 {
-    if (!hasContentElement())
-        return;
-
-    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
-    setNeedsReattachHostChildrenAndShadow();
-}
-
-bool ShadowRoot::isInclusionSelectorActive() const
-{
-    return m_inclusions && m_inclusions->hasCandidates();
+    if (host())
+        return host()->shadowRootList();
+    return 0;
 }
 
 bool ShadowRoot::hasContentElement() const
@@ -217,46 +186,15 @@ void ShadowRoot::setApplyAuthorSheets(bool value)
 
 void ShadowRoot::attach()
 {
-    // Children of m_inclusions is populated lazily in
-    // ensureInclusions(), and here we just ensure that
+    // Children of m_selector is populated lazily in
+    // ensureSelector(), and here we just ensure that
     // it is in clean state.
-    ASSERT(!m_inclusions || !m_inclusions->hasCandidates());
+    // FIXME: This assertion breaks if multiple shadow roots are being attached.
+    // ShadowRootList should have responsibility of side effect of selector in attaching/detaching.
+    ASSERT(!host()->shadowRootList()->selector() || !host()->shadowRootList()->selector()->hasCandidates());
     DocumentFragment::attach();
-    if (m_inclusions)
-        m_inclusions->didSelect();
-}
-
-void ShadowRoot::reattachHostChildrenAndShadow()
-{
-    Node* hostNode = host();
-    if (!hostNode)
-        return;
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (child->attached())
-            child->detach();
-    }
-
-    reattach();
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (!child->attached())
-            child->attach();
-    }
-}
-
-ContentInclusionSelector* ShadowRoot::inclusions() const
-{
-    return m_inclusions.get();
+    if (HTMLContentSelector* selector = host()->shadowRootList()->selector())
+        selector->didSelect();
 }
 
-ContentInclusionSelector* ShadowRoot::ensureInclusions()
-{
-    if (!m_inclusions)
-        m_inclusions = adoptPtr(new ContentInclusionSelector());
-    m_inclusions->willSelectOver(this);
-    return m_inclusions.get();
-}
-
-
 }
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index 401ee5e9d..312116749 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -30,16 +30,19 @@
 #include "DocumentFragment.h"
 #include "ExceptionCode.h"
 #include "TreeScope.h"
+#include <wtf/DoublyLinkedList.h>
 
 namespace WebCore {
 
-class ContentInclusionSelector;
 class Document;
 class HTMLContentElement;
+class HTMLContentSelector;
+class InsertionPoint;
+class ShadowRootList;
 
-class ShadowRoot : public DocumentFragment, public TreeScope {
+class ShadowRoot : public DocumentFragment, public TreeScope, public DoublyLinkedListNode<ShadowRoot> {
+    friend class WTF::DoublyLinkedListNode<ShadowRoot>;
 public:
-    static PassRefPtr<ShadowRoot> create(Document*);
     static PassRefPtr<ShadowRoot> create(Element*, ExceptionCode&);
 
     // FIXME: We will support multiple shadow subtrees, however current implementation does not work well
@@ -58,56 +61,44 @@ public:
     void clearNeedsReattachHostChildrenAndShadow();
     bool needsReattachHostChildrenAndShadow();
 
-    HTMLContentElement* includerFor(Node*) const;
+    InsertionPoint* insertionPointFor(Node*) const;
     void hostChildrenChanged();
-    bool isInclusionSelectorActive() const;
 
     virtual void attach();
-    void reattachHostChildrenAndShadow();
 
     virtual bool applyAuthorSheets() const;
     void setApplyAuthorSheets(bool);
 
     Element* host() const { return shadowHost(); }
+    ShadowRootList* list() const;
 
-    ContentInclusionSelector* inclusions() const;
-    ContentInclusionSelector* ensureInclusions();
+    ShadowRoot* youngerShadowRoot() const { return prev(); }
+    ShadowRoot* olderShadowRoot() const { return next(); }
+
+    bool hasContentElement() const;
 
 private:
     ShadowRoot(Document*);
     virtual ~ShadowRoot();
 
     virtual String nodeName() const;
-    virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType) const;
 
-    bool hasContentElement() const;
-
+    ShadowRoot* m_prev;
+    ShadowRoot* m_next;
     bool m_applyAuthorSheets : 1;
-    bool m_needsRecalculateContent : 1;
-    OwnPtr<ContentInclusionSelector> m_inclusions;
 };
 
-inline PassRefPtr<ShadowRoot> ShadowRoot::create(Document* document)
-{
-    return adoptRef(new ShadowRoot(document));
-}
-
-inline void ShadowRoot::clearNeedsReattachHostChildrenAndShadow()
-{
-    m_needsRecalculateContent = false;
-}
-
-inline bool ShadowRoot::needsReattachHostChildrenAndShadow()
+inline const ShadowRoot* toShadowRoot(const Node* node)
 {
-    return m_needsRecalculateContent || hasContentElement();
+    ASSERT(!node || node->isShadowRoot());
+    return static_cast<const ShadowRoot*>(node);
 }
 
 inline ShadowRoot* toShadowRoot(Node* node)
 {
-    ASSERT(!node || node->nodeType() == Node::SHADOW_ROOT_NODE);
-    return static_cast<ShadowRoot*>(node);
+    return const_cast<ShadowRoot*>(toShadowRoot(static_cast<const Node*>(node)));
 }
 
 } // namespace
diff --git a/Source/WebCore/dom/ShadowRoot.idl b/Source/WebCore/dom/ShadowRoot.idl
index 011d6795f..ffa3b03b4 100644
--- a/Source/WebCore/dom/ShadowRoot.idl
+++ b/Source/WebCore/dom/ShadowRoot.idl
@@ -33,11 +33,11 @@ module core {
         ConstructorRaisesException
     ] ShadowRoot : DocumentFragment {
         readonly attribute Element host;
-        Element getElementById(in [Optional=CallWithDefaultValue] DOMString elementId);
-        NodeList getElementsByClassName(in [Optional=CallWithDefaultValue] DOMString className);
-        NodeList getElementsByTagName(in [Optional=CallWithDefaultValue] DOMString tagName);
-        NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                        in [Optional=CallWithDefaultValue] DOMString localName);
+        Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
+        NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString className);
+        NodeList getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString tagName);
+        NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                        in [Optional=DefaultIsUndefined] DOMString localName);
     };
 
 }
diff --git a/Source/WebCore/dom/ShadowRootList.cpp b/Source/WebCore/dom/ShadowRootList.cpp
new file mode 100644
index 000000000..3adee6370
--- /dev/null
+++ b/Source/WebCore/dom/ShadowRootList.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ShadowRootList.h"
+
+#include "Document.h"
+#include "Element.h"
+#include "HTMLContentSelector.h"
+#include "RuntimeEnabledFeatures.h"
+#include "ShadowRoot.h"
+#include "Text.h"
+
+namespace WebCore {
+
+ShadowRootList::ShadowRootList()
+    : m_needsRecalculateContent(false)
+{
+}
+
+ShadowRootList::~ShadowRootList()
+{
+    ASSERT(!hasShadowRoot());
+}
+
+void ShadowRootList::pushShadowRoot(ShadowRoot* shadowRoot)
+{
+#if ENABLE(SHADOW_DOM)
+    if (!RuntimeEnabledFeatures::multipleShadowSubtreesEnabled())
+        ASSERT(!hasShadowRoot());
+#else
+    ASSERT(!hasShadowRoot());
+#endif
+
+    m_shadowRoots.push(shadowRoot);
+}
+
+ShadowRoot* ShadowRootList::popShadowRoot()
+{
+    if (!hasShadowRoot())
+        return 0;
+
+    return m_shadowRoots.removeHead();
+}
+
+void ShadowRootList::insertedIntoDocument()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->insertedIntoDocument();
+}
+
+void ShadowRootList::removedFromDocument()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->removedFromDocument();
+}
+
+void ShadowRootList::insertedIntoTree(bool deep)
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->insertedIntoTree(deep);
+}
+
+void ShadowRootList::removedFromTree(bool deep)
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->removedFromTree(deep);
+}
+
+void ShadowRootList::willRemove()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->willRemove();
+}
+
+void ShadowRootList::attach()
+{
+    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
+    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
+    ASSERT(m_shadowRoots.size() <= 1);
+
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (!root->attached())
+            root->attach();
+    }
+}
+
+void ShadowRootList::detach()
+{
+    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
+    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
+    ASSERT(m_shadowRoots.size() <= 1);
+
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (root->attached())
+            root->detach();
+    }
+}
+
+InsertionPoint* ShadowRootList::insertionPointFor(Node* node) const
+{
+    if (!m_selector)
+        return 0;
+    HTMLContentSelection* found = m_selector->findFor(node);
+    if (!found)
+        return 0;
+    return found->insertionPoint();
+}
+
+bool ShadowRootList::isSelectorActive() const
+{
+    return m_selector && m_selector->hasCandidates();
+}
+
+void ShadowRootList::reattach()
+{
+    detach();
+    attach();
+}
+
+bool ShadowRootList::childNeedsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    if (!youngestShadowRoot())
+        return false;
+
+    return youngestShadowRoot()->childNeedsStyleRecalc();
+}
+
+bool ShadowRootList::needsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    if (!youngestShadowRoot())
+        return false;
+
+    return youngestShadowRoot()->needsStyleRecalc();
+}
+
+void ShadowRootList::recalcShadowTreeStyle(Node::StyleChange change)
+{
+    ShadowRoot* youngest = youngestShadowRoot();
+    if (!youngest)
+        return;
+
+    if (needsReattachHostChildrenAndShadow())
+        reattachHostChildrenAndShadow();
+    else {
+        for (Node* n = youngest->firstChild(); n; n = n->nextSibling()) {
+            if (n->isElementNode())
+                static_cast<Element*>(n)->recalcStyle(change);
+            else if (n->isTextNode())
+                toText(n)->recalcTextStyle(change);
+        }
+    }
+
+    clearNeedsReattachHostChildrenAndShadow();
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        root->clearNeedsStyleRecalc();
+        root->clearChildNeedsStyleRecalc();
+    }
+}
+
+bool ShadowRootList::needsReattachHostChildrenAndShadow()
+{
+    return m_needsRecalculateContent || (youngestShadowRoot() && youngestShadowRoot()->hasContentElement());
+}
+
+void ShadowRootList::hostChildrenChanged()
+{
+    ASSERT(youngestShadowRoot());
+
+    if (!youngestShadowRoot()->hasContentElement())
+        return;
+
+    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
+    setNeedsReattachHostChildrenAndShadow();
+}
+
+void ShadowRootList::setNeedsReattachHostChildrenAndShadow()
+{
+    m_needsRecalculateContent = true;
+
+    host()->setNeedsStyleRecalc();
+}
+
+void ShadowRootList::reattachHostChildrenAndShadow()
+{
+    ASSERT(youngestShadowRoot());
+
+    Node* hostNode = youngestShadowRoot()->host();
+    if (!hostNode)
+        return;
+
+    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
+        if (child->attached())
+            child->detach();
+    }
+
+    reattach();
+
+    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
+        if (!child->attached())
+            child->attach();
+    }
+}
+
+HTMLContentSelector* ShadowRootList::ensureSelector()
+{
+    if (!m_selector)
+        m_selector = adoptPtr(new HTMLContentSelector());
+    m_selector->willSelectOver(host());
+    return m_selector.get();
+}
+
+} // namespace
diff --git a/Source/WebCore/dom/ShadowRootList.h b/Source/WebCore/dom/ShadowRootList.h
new file mode 100644
index 000000000..db3170a6d
--- /dev/null
+++ b/Source/WebCore/dom/ShadowRootList.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ShadowRootList_h
+#define ShadowRootList_h
+
+#include "ShadowRoot.h"
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class Node;
+class Element;
+class HTMLContentSelector;
+class InsertionPoint;
+
+class ShadowRootList {
+public:
+    ShadowRootList();
+    ~ShadowRootList();
+
+    bool hasShadowRoot() const;
+    ShadowRoot* youngestShadowRoot() const;
+    ShadowRoot* oldestShadowRoot() const;
+
+    void pushShadowRoot(ShadowRoot*);
+    ShadowRoot* popShadowRoot();
+
+    void insertedIntoDocument();
+    void removedFromDocument();
+    void insertedIntoTree(bool deep);
+    void removedFromTree(bool deep);
+    void willRemove();
+
+    void attach();
+    void detach();
+    void reattach();
+
+    bool childNeedsStyleRecalc();
+    bool needsStyleRecalc();
+    void recalcShadowTreeStyle(Node::StyleChange);
+    void setNeedsReattachHostChildrenAndShadow();
+    void clearNeedsReattachHostChildrenAndShadow();
+    bool needsReattachHostChildrenAndShadow();
+    void reattachHostChildrenAndShadow();
+    void hostChildrenChanged();
+
+    InsertionPoint* insertionPointFor(Node*) const;
+
+    HTMLContentSelector* selector() const;
+    HTMLContentSelector* ensureSelector();
+
+    bool isSelectorActive() const;
+
+private:
+    Element* host() const;
+
+    DoublyLinkedList<ShadowRoot> m_shadowRoots;
+    OwnPtr<HTMLContentSelector> m_selector;
+    bool m_needsRecalculateContent : 1;
+    WTF_MAKE_NONCOPYABLE(ShadowRootList);
+};
+
+inline bool ShadowRootList::hasShadowRoot() const
+{
+    return !m_shadowRoots.isEmpty();
+}
+
+inline ShadowRoot* ShadowRootList::youngestShadowRoot() const
+{
+    return m_shadowRoots.head();
+}
+
+inline ShadowRoot* ShadowRootList::oldestShadowRoot() const
+{
+    return m_shadowRoots.tail();
+}
+
+inline HTMLContentSelector* ShadowRootList::selector() const
+{
+    return m_selector.get();
+}
+
+inline void ShadowRootList::clearNeedsReattachHostChildrenAndShadow()
+{
+    m_needsRecalculateContent = false;
+}
+
+inline Element* ShadowRootList::host() const
+{
+    ASSERT(hasShadowRoot());
+    return youngestShadowRoot()->host();
+}
+
+} // namespace
+
+#endif
diff --git a/Source/WebCore/dom/StaticHashSetNodeList.cpp b/Source/WebCore/dom/StaticHashSetNodeList.cpp
index 6c8c2db97..3d6b5c38f 100644
--- a/Source/WebCore/dom/StaticHashSetNodeList.cpp
+++ b/Source/WebCore/dom/StaticHashSetNodeList.cpp
@@ -69,7 +69,7 @@ Node* StaticHashSetNodeList::itemWithName(const AtomicString& elementId) const
     ListHashSet<RefPtr<Node> >::const_iterator end = m_nodes.end();
     for ( ; it != end ; ++it) {
         Node* node = (*it).get();
-        if (node->hasID() && static_cast<Element*>(node)->getIdAttribute() == elementId)
+        if (static_cast<Element*>(node)->getIdAttribute() == elementId)
             return node;
     }
 
diff --git a/Source/WebCore/dom/StaticNodeList.cpp b/Source/WebCore/dom/StaticNodeList.cpp
index 0a19a0582..fe1d1cbe4 100644
--- a/Source/WebCore/dom/StaticNodeList.cpp
+++ b/Source/WebCore/dom/StaticNodeList.cpp
@@ -50,8 +50,7 @@ Node* StaticNodeList::itemWithName(const AtomicString& elementId) const
     size_t length = m_nodes.size();
     for (size_t i = 0; i < length; ++i) {
         Node* node = m_nodes[i].get();
-        // FIXME: This should probably be using getIdAttribute instead of idForStyleResolution.
-        if (node->hasID() && static_cast<Element*>(node)->getIdAttribute() == elementId)
+        if (static_cast<Element*>(node)->getIdAttribute() == elementId)
             return node;
     }
 
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 526052647..99e7f3523 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -66,6 +66,11 @@ void StyledElement::attributeChanged(Attribute* attr)
     if (!(attr->name() == styleAttr && isSynchronizingStyleAttribute()))
         parseAttribute(attr);
 
+    if (isPresentationAttribute(attr)) {
+        setAttributeStyleDirty();
+        setNeedsStyleRecalc(InlineStyleChange);
+    }
+
     Element::attributeChanged(attr);
 }
 
@@ -79,7 +84,6 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
             break;
     }
     bool hasClass = i < length;
-    setHasClass(hasClass);
     if (hasClass) {
         const bool shouldFoldCase = document()->inQuirksMode();
         ensureAttributeData()->setClass(newClassString, shouldFoldCase);
@@ -88,7 +92,6 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
     } else if (attributeData())
         attributeData()->clearClass();
     setNeedsStyleRecalc();
-    dispatchSubtreeModifiedEvent();
 }
 
 void StyledElement::parseAttribute(Attribute* attr)
@@ -99,198 +102,81 @@ void StyledElement::parseAttribute(Attribute* attr)
         if (attr->isNull())
             destroyInlineStyleDecl();
         else if (document()->contentSecurityPolicy()->allowInlineStyle())
-            ensureInlineStyleDecl()->parseDeclaration(attr->value());
+            ensureInlineStyleDecl()->parseDeclaration(attr->value(), document()->elementSheet());
         setIsStyleAttributeValid();
         setNeedsStyleRecalc();
+        InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
     }
 }
 
-void StyledElement::removeCSSProperties(int id1, int id2, int id3, int id4, int id5, int id6, int id7, int id8)
+void StyledElement::inlineStyleChanged()
 {
-    StylePropertySet* style = attributeStyle();
-    if (!style)
-        return;
-
-    ASSERT(id1 != CSSPropertyInvalid);
-    style->removeProperty(id1);
-
-    if (id2 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id2);
-    if (id3 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id3);
-    if (id4 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id4);
-    if (id5 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id5);
-    if (id6 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id6);
-    if (id7 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id7);
-    if (id8 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id8);
+    setNeedsStyleRecalc(InlineStyleChange);
+    setIsStyleAttributeValid(false);
+    InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
 }
-
-void StyledElement::addCSSProperty(int id, const String &value)
+    
+bool StyledElement::setInlineStyleProperty(int propertyID, int identifier, bool important)
 {
-    if (!ensureAttributeStyle()->setProperty(id, value))
-        removeCSSProperty(id);
+    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier), important);
+    inlineStyleChanged();
+    return true;
 }
 
-void StyledElement::addCSSProperty(int propertyID, int identifier)
+bool StyledElement::setInlineStyleProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes unit, bool important)
 {
-    ensureAttributeStyle()->setProperty(CSSProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier)));
-    setNeedsStyleRecalc();
+    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit), important);
+    inlineStyleChanged();
+    return true;
 }
 
-void StyledElement::addCSSImageProperty(int id, const String& url)
+bool StyledElement::setInlineStyleProperty(int propertyID, const String& value, bool important)
 {
-    ensureAttributeStyle()->setProperty(CSSProperty(id, CSSImageValue::create(url)));
-    setNeedsStyleRecalc();
+    bool changes = ensureInlineStyleDecl()->setProperty(propertyID, value, important, document()->elementSheet());
+    if (changes)
+        inlineStyleChanged();
+    return changes;
 }
 
-void StyledElement::addCSSLength(int id, const String &value)
+bool StyledElement::removeInlineStyleProperty(int propertyID)
 {
-    // FIXME: This function should not spin up the CSS parser, but should instead just figure out the correct
-    // length unit and make the appropriate parsed value.
-
-    // strip attribute garbage..
-    StringImpl* v = value.impl();
-    if (v) {
-        unsigned int l = 0;
-        
-        while (l < v->length() && (*v)[l] <= ' ')
-            l++;
-        
-        for (; l < v->length(); l++) {
-            UChar cc = (*v)[l];
-            if (cc > '9')
-                break;
-            if (cc < '0') {
-                if (cc == '%' || cc == '*')
-                    l++;
-                if (cc != '.')
-                    break;
-            }
-        }
-
-        if (l != v->length()) {
-            addCSSProperty(id, v->substring(0, l));
-            return;
-        }
-    }
-
-    addCSSProperty(id, value);
+    bool changes = ensureInlineStyleDecl()->removeProperty(propertyID);
+    if (changes)
+        inlineStyleChanged();
+    return changes;
 }
 
-static String parseColorStringWithCrazyLegacyRules(const String& colorString)
+void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
-    // Per spec, only look at the first 128 digits of the string.
-    const size_t maxColorLength = 128;
-    // We'll pad the buffer with two extra 0s later, so reserve two more than the max.
-    Vector<char, maxColorLength+2> digitBuffer;
-    
-    size_t i = 0;
-    // Skip a leading #.
-    if (colorString[0] == '#')
-        i = 1;
-    
-    // Grab the first 128 characters, replacing non-hex characters with 0.
-    // Non-BMP characters are replaced with "00" due to them appearing as two "characters" in the String.
-    for (; i < colorString.length() && digitBuffer.size() < maxColorLength; i++) {
-        if (!isASCIIHexDigit(colorString[i]))
-            digitBuffer.append('0');
-        else
-            digitBuffer.append(colorString[i]);
-    }
-
-    if (!digitBuffer.size())
-        return "#000000";
-
-    // Pad the buffer out to at least the next multiple of three in size.
-    digitBuffer.append('0');
-    digitBuffer.append('0');
-
-    if (digitBuffer.size() < 6)
-        return String::format("#0%c0%c0%c", digitBuffer[0], digitBuffer[1], digitBuffer[2]);
-    
-    // Split the digits into three components, then search the last 8 digits of each component.
-    ASSERT(digitBuffer.size() >= 6);
-    size_t componentLength = digitBuffer.size() / 3;
-    size_t componentSearchWindowLength = min<size_t>(componentLength, 8);
-    size_t redIndex = componentLength - componentSearchWindowLength;
-    size_t greenIndex = componentLength * 2 - componentSearchWindowLength;
-    size_t blueIndex = componentLength * 3 - componentSearchWindowLength;
-    // Skip digits until one of them is non-zero, or we've only got two digits left in the component.
-    while (digitBuffer[redIndex] == '0' && digitBuffer[greenIndex] == '0' && digitBuffer[blueIndex] == '0' && (componentLength - redIndex) > 2) {
-        redIndex++;
-        greenIndex++;
-        blueIndex++;
-    }
-    ASSERT(redIndex + 1 < componentLength);
-    ASSERT(greenIndex >= componentLength);
-    ASSERT(greenIndex + 1 < componentLength * 2);
-    ASSERT(blueIndex >= componentLength * 2);
-    ASSERT(blueIndex + 1 < digitBuffer.size());
-    return String::format("#%c%c%c%c%c%c", digitBuffer[redIndex], digitBuffer[redIndex + 1], digitBuffer[greenIndex], digitBuffer[greenIndex + 1], digitBuffer[blueIndex], digitBuffer[blueIndex + 1]);   
+    if (StylePropertySet* inlineStyle = inlineStyleDecl())
+        inlineStyle->addSubresourceStyleURLs(urls, document()->elementSheet());
 }
 
-// Color parsing that matches HTML's "rules for parsing a legacy color value"
-void StyledElement::addCSSColor(int id, const String& attributeValue)
+void StyledElement::updateAttributeStyle()
 {
-    // An empty string doesn't apply a color. (One containing only whitespace does, which is why this check occurs before stripping.)
-    if (attributeValue.isEmpty()) {
-        removeCSSProperty(id);
-        return;
-    }
-
-    String colorString = attributeValue.stripWhiteSpace();
-
-    // "transparent" doesn't apply a color either.
-    if (equalIgnoringCase(colorString, "transparent")) {
-        removeCSSProperty(id);
-        return;
+    RefPtr<StylePropertySet> style = StylePropertySet::create();
+    for (unsigned i = 0; i < attributeCount(); ++i) {
+        Attribute* attribute = attributeItem(i);
+        collectStyleForAttribute(attribute, style.get());
     }
+    clearAttributeStyleDirty();
 
-    // If the string is a named CSS color or a 3/6-digit hex color, use that.
-    Color parsedColor(colorString);
-    if (parsedColor.isValid()) {
-        addCSSProperty(id, colorString);
-        return;
+    if (style->isEmpty())
+        attributeData()->setAttributeStyle(0);
+    else {
+        style->shrinkToFit();
+        attributeData()->setAttributeStyle(style.release());
     }
-
-    addCSSProperty(id, parseColorStringWithCrazyLegacyRules(colorString));
 }
 
-void StyledElement::copyNonAttributeProperties(const Element* sourceElement)
+void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, int identifier)
 {
-    ASSERT(sourceElement);
-    ASSERT(sourceElement->isStyledElement());
-
-    const StyledElement* source = static_cast<const StyledElement*>(sourceElement);
-    if (!source->inlineStyleDecl())
-        return;
-
-    StylePropertySet* inlineStyle = ensureInlineStyleDecl();
-    inlineStyle->copyPropertiesFrom(*source->inlineStyleDecl());
-    inlineStyle->setStrictParsing(source->inlineStyleDecl()->useStrictParsing());
-
-    setIsStyleAttributeValid(source->isStyleAttributeValid());
-    setIsSynchronizingStyleAttribute(source->isSynchronizingStyleAttribute());
-    
-    Element::copyNonAttributeProperties(sourceElement);
+    style->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier));
 }
 
-void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
+void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, double value, CSSPrimitiveValue::UnitTypes unit)
 {
-    if (StylePropertySet* inlineStyle = inlineStyleDecl())
-        inlineStyle->addSubresourceStyleURLs(urls);
+    style->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit));
 }
 
 }
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index 2a6d392cf..2773e41c3 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -36,23 +36,21 @@ class StyledElement : public Element {
 public:
     virtual ~StyledElement();
 
-    void addCSSLength(int id, const String& value);
-    void addCSSProperty(int id, const String& value);
-    void addCSSProperty(int id, int value);
-    void addCSSImageProperty(int propertyID, const String& url);
-    void addCSSColor(int id, const String& color);
-    void removeCSSProperties(int id1, int id2 = CSSPropertyInvalid, int id3 = CSSPropertyInvalid, int id4 = CSSPropertyInvalid, int id5 = CSSPropertyInvalid, int id6 = CSSPropertyInvalid, int id7 = CSSPropertyInvalid, int id8 = CSSPropertyInvalid);
-    void removeCSSProperty(int id) { removeCSSProperties(id); }
-
     virtual StylePropertySet* additionalAttributeStyle() { return 0; }
     void invalidateStyleAttribute();
 
     StylePropertySet* inlineStyleDecl() const { return attributeData() ? attributeData()->inlineStyleDecl() : 0; }
-    StylePropertySet* ensureInlineStyleDecl() { return ensureAttributeDataWithoutUpdate()->ensureInlineStyleDecl(this); }
-    virtual CSSStyleDeclaration* style() OVERRIDE { return ensureInlineStyleDecl()->ensureCSSStyleDeclaration(); }
-
-    StylePropertySet* attributeStyle() const { return attributeData() ? attributeData()->attributeStyle() : 0; }
-    StylePropertySet* ensureAttributeStyle() { return ensureAttributeDataWithoutUpdate()->ensureAttributeStyle(this); }
+    StylePropertySet* ensureInlineStyleDecl() { return ensureAttributeData()->ensureInlineStyleDecl(this); }
+    
+    // Unlike StylePropertySet setters, these implement invalidation.
+    bool setInlineStyleProperty(int propertyID, int identifier, bool important = false);
+    bool setInlineStyleProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes, bool important = false);
+    bool setInlineStyleProperty(int propertyID, const String& value, bool important = false);
+    bool removeInlineStyleProperty(int propertyID);
+    
+    virtual CSSStyleDeclaration* style() OVERRIDE { return ensureInlineStyleDecl()->ensureInlineCSSStyleDeclaration(this); }
+
+    StylePropertySet* attributeStyle();
 
     const SpaceSplitString& classNames() const;
 
@@ -66,6 +64,13 @@ protected:
     virtual void parseAttribute(Attribute*);
     virtual void copyNonAttributeProperties(const Element*);
 
+    virtual bool isPresentationAttribute(Attribute*) const { return false; }
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) { }
+
+    void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, int identifier);
+    void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, double value, CSSPrimitiveValue::UnitTypes);
+    void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, const String& value);
+
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
     // classAttributeChanged() exists to share code between
@@ -75,11 +80,14 @@ protected:
 
 private:
     virtual void updateStyleAttribute() const;
+    void inlineStyleChanged();
+
+    void updateAttributeStyle();
 
     void destroyInlineStyleDecl()
     {
         if (attributeData())
-            attributeData()->destroyInlineStyleDecl();
+            attributeData()->destroyInlineStyleDecl(this);
     }
 };
 
@@ -95,6 +103,18 @@ inline void StyledElement::invalidateStyleAttribute()
     clearIsStyleAttributeValid();
 }
 
+inline StylePropertySet* StyledElement::attributeStyle()
+{
+    if (attributeStyleDirty())
+        updateAttributeStyle();
+    return attributeData() ? attributeData()->attributeStyle() : 0;
+}
+
+inline void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, const String& value)
+{
+    style->setProperty(propertyID, value, false, document()->elementSheet());
+}
+
 } //namespace
 
 #endif
diff --git a/Source/WebCore/dom/Text.h b/Source/WebCore/dom/Text.h
index 7629b7dab..deb18a5ea 100644
--- a/Source/WebCore/dom/Text.h
+++ b/Source/WebCore/dom/Text.h
@@ -70,6 +70,12 @@ private:
 #endif
 };
 
+inline Text* toText(Node* node)
+{
+    ASSERT(!node || node->isTextNode());
+    return static_cast<Text*>(node);
+}
+
 } // namespace WebCore
 
 #endif // Text_h
diff --git a/Source/WebCore/dom/Text.idl b/Source/WebCore/dom/Text.idl
index d781677f5..4736e22fe 100644
--- a/Source/WebCore/dom/Text.idl
+++ b/Source/WebCore/dom/Text.idl
@@ -23,12 +23,12 @@ module core {
 
         // DOM Level 1
 
-        Text splitText(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset)
+        Text splitText(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset)
             raises (DOMException);
 
         // Introduced in DOM Level 3:
         readonly attribute DOMString       wholeText;
-        Text               replaceWholeText(in [Optional=CallWithDefaultValue] DOMString content)
+        Text               replaceWholeText(in [Optional=DefaultIsUndefined] DOMString content)
                                             raises(DOMException);
     };
 
diff --git a/Source/WebCore/dom/TextEvent.idl b/Source/WebCore/dom/TextEvent.idl
index 2421b65ad..36f507c06 100644
--- a/Source/WebCore/dom/TextEvent.idl
+++ b/Source/WebCore/dom/TextEvent.idl
@@ -30,11 +30,11 @@ module events {
 
         readonly attribute DOMString data;
 
-        void initTextEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                           in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                           in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                           in [Optional=CallWithDefaultValue] DOMWindow viewArg, 
-                           in [Optional=CallWithDefaultValue] DOMString dataArg);
+        void initTextEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                           in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                           in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                           in [Optional=DefaultIsUndefined] DOMWindow viewArg, 
+                           in [Optional=DefaultIsUndefined] DOMString dataArg);
 
     };
 
diff --git a/Source/WebCore/dom/TouchEvent.idl b/Source/WebCore/dom/TouchEvent.idl
index 39edfc87e..4b79757f5 100644
--- a/Source/WebCore/dom/TouchEvent.idl
+++ b/Source/WebCore/dom/TouchEvent.idl
@@ -36,18 +36,18 @@ module events {
         readonly attribute boolean altKey;
         readonly attribute boolean metaKey;
 
-        void initTouchEvent(in [Optional=CallWithDefaultValue] TouchList touches,
-                            in [Optional=CallWithDefaultValue] TouchList targetTouches,
-                            in [Optional=CallWithDefaultValue] TouchList changedTouches,
-                            in [Optional=CallWithDefaultValue] DOMString type,
-                            in [Optional=CallWithDefaultValue] DOMWindow view,
-                            in [Optional=CallWithDefaultValue] long screenX, 
-                            in [Optional=CallWithDefaultValue] long screenY, 
-                            in [Optional=CallWithDefaultValue] long clientX, 
-                            in [Optional=CallWithDefaultValue] long clientY,
-                            in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                            in [Optional=CallWithDefaultValue] boolean altKey,
-                            in [Optional=CallWithDefaultValue] boolean shiftKey,
-                            in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initTouchEvent(in [Optional=DefaultIsUndefined] TouchList touches,
+                            in [Optional=DefaultIsUndefined] TouchList targetTouches,
+                            in [Optional=DefaultIsUndefined] TouchList changedTouches,
+                            in [Optional=DefaultIsUndefined] DOMString type,
+                            in [Optional=DefaultIsUndefined] DOMWindow view,
+                            in [Optional=DefaultIsUndefined] long screenX, 
+                            in [Optional=DefaultIsUndefined] long screenY, 
+                            in [Optional=DefaultIsUndefined] long clientX, 
+                            in [Optional=DefaultIsUndefined] long clientY,
+                            in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                            in [Optional=DefaultIsUndefined] boolean altKey,
+                            in [Optional=DefaultIsUndefined] boolean shiftKey,
+                            in [Optional=DefaultIsUndefined] boolean metaKey);
     };
 }
diff --git a/Source/WebCore/dom/TreeScopeAdopter.cpp b/Source/WebCore/dom/TreeScopeAdopter.cpp
index 727df2f12..e76209cc8 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.cpp
+++ b/Source/WebCore/dom/TreeScopeAdopter.cpp
@@ -28,12 +28,13 @@
 #include "Document.h"
 #include "NodeRareData.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 
 namespace WebCore {
 
 static inline ShadowRoot* shadowRootFor(Node* node)
 {
-    return node->isElementNode() ? toElement(node)->shadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
 }
 
 void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
@@ -96,10 +97,8 @@ inline void TreeScopeAdopter::moveNodeToNewDocument(Node* node, Document* oldDoc
     ASSERT(!node->inDocument() || oldDocument != newDocument);
 
     newDocument->guardRef();
-    if (oldDocument) {
+    if (oldDocument)
         oldDocument->moveNodeIteratorsToNewDocument(node, newDocument);
-        oldDocument->guardDeref();
-    }
 
     node->setDocument(newDocument);
 
@@ -110,6 +109,9 @@ inline void TreeScopeAdopter::moveNodeToNewDocument(Node* node, Document* oldDoc
 
     node->didMoveToNewDocument(oldDocument);
     ASSERT(didMoveToNewDocumentWasCalled);
+    
+    if (oldDocument)
+        oldDocument->guardDeref();
 }
 
 }
diff --git a/Source/WebCore/dom/UIEvent.idl b/Source/WebCore/dom/UIEvent.idl
index 83dcdc95a..39a2caf83 100644
--- a/Source/WebCore/dom/UIEvent.idl
+++ b/Source/WebCore/dom/UIEvent.idl
@@ -24,11 +24,11 @@ module events {
         readonly attribute DOMWindow            view;
         readonly attribute long                 detail;
         
-        [ObjCLegacyUnnamedParameters] void initUIEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                        in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                        in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                        in [Optional=CallWithDefaultValue] DOMWindow view, 
-                                        in [Optional=CallWithDefaultValue] long detail);
+        [ObjCLegacyUnnamedParameters] void initUIEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                        in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                        in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                        in [Optional=DefaultIsUndefined] DOMWindow view, 
+                                        in [Optional=DefaultIsUndefined] long detail);
 
         // extensions
         readonly attribute long                 keyCode;
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index 636804b97..b5dc48c10 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -212,10 +212,14 @@ static float numericPrefix(const String& keyString, const String& valueString, D
     // and we should check if the valueString prefix was a number.
 
     bool didReadNumber;
-    float value = valueString.toFloat(ok, &didReadNumber);
+    float value;
+    if (valueString.is8Bit())
+        value = WTF::charactersToFloatIgnoringJunk(valueString.characters8(), valueString.length(), ok, &didReadNumber);
+    else
+        value = WTF::charactersToFloatIgnoringJunk(valueString.characters16(), valueString.length(), ok, &didReadNumber);
     if (!*ok) {
         if (!didReadNumber) {
-            ASSERT(!value);
+            ASSERT(isnan(value) || !value);
             reportViewportWarning(document, UnrecognizedViewportArgumentValueError, valueString, keyString);
             return value;
         }
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index e00263698..bced96576 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -30,9 +30,12 @@
 #include "config.h"
 #include "WebKitNamedFlow.h"
 
+#include "RenderFlowThread.h"
+
 namespace WebCore {
 
-WebKitNamedFlow::WebKitNamedFlow()
+WebKitNamedFlow::WebKitNamedFlow(RenderFlowThread* parentFlowThread)
+: m_parentFlowThread(parentFlowThread)
 {
 }
 
@@ -40,4 +43,10 @@ WebKitNamedFlow::~WebKitNamedFlow()
 {
 }
 
+bool WebKitNamedFlow::overflow() const
+{
+    m_parentFlowThread->document()->updateLayoutIgnorePendingStylesheets();
+    return m_parentFlowThread->overflow();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/WebKitNamedFlow.h b/Source/WebCore/dom/WebKitNamedFlow.h
index 276796121..e815f03f4 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.h
+++ b/Source/WebCore/dom/WebKitNamedFlow.h
@@ -35,17 +35,22 @@
 
 namespace WebCore {
 
+class RenderFlowThread;
+
 class WebKitNamedFlow : public RefCounted<WebKitNamedFlow> {
 public:
-    static PassRefPtr<WebKitNamedFlow> create()
+    static PassRefPtr<WebKitNamedFlow> create(RenderFlowThread* parentFlowThread)
     {
-        return adoptRef(new WebKitNamedFlow);
+        return adoptRef(new WebKitNamedFlow(parentFlowThread));
     }
 
     ~WebKitNamedFlow();
 
+    bool overflow() const;
 private:
-    WebKitNamedFlow();
+    WebKitNamedFlow(RenderFlowThread*);
+
+    RenderFlowThread* m_parentFlowThread;
 };
 
 }
diff --git a/Source/WebCore/dom/WebKitNamedFlow.idl b/Source/WebCore/dom/WebKitNamedFlow.idl
index 06d85529e..2a065dd17 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.idl
+++ b/Source/WebCore/dom/WebKitNamedFlow.idl
@@ -29,7 +29,8 @@
 
 module core {
     interface [
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] WebKitNamedFlow {
+        readonly attribute boolean overflow;
     };
 }
diff --git a/Source/WebCore/dom/WheelEvent.idl b/Source/WebCore/dom/WheelEvent.idl
index e0fd563ba..0282525fb 100644
--- a/Source/WebCore/dom/WheelEvent.idl
+++ b/Source/WebCore/dom/WheelEvent.idl
@@ -46,31 +46,31 @@ module events {
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        void initWheelEvent(in [Optional=CallWithDefaultValue] long wheelDeltaX,
-                            in [Optional=CallWithDefaultValue] long wheelDeltaY, 
-                            in [Optional=CallWithDefaultValue] DOMWindow view, 
-                            in [Optional=CallWithDefaultValue] long screenX,
-                            in [Optional=CallWithDefaultValue] long screenY,
-                            in [Optional=CallWithDefaultValue] long clientX,
-                            in [Optional=CallWithDefaultValue] long clientY,
-                            in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                            in [Optional=CallWithDefaultValue] boolean altKey,
-                            in [Optional=CallWithDefaultValue] boolean shiftKey,
-                            in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initWheelEvent(in [Optional=DefaultIsUndefined] long wheelDeltaX,
+                            in [Optional=DefaultIsUndefined] long wheelDeltaY, 
+                            in [Optional=DefaultIsUndefined] DOMWindow view, 
+                            in [Optional=DefaultIsUndefined] long screenX,
+                            in [Optional=DefaultIsUndefined] long screenY,
+                            in [Optional=DefaultIsUndefined] long clientX,
+                            in [Optional=DefaultIsUndefined] long clientY,
+                            in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                            in [Optional=DefaultIsUndefined] boolean altKey,
+                            in [Optional=DefaultIsUndefined] boolean shiftKey,
+                            in [Optional=DefaultIsUndefined] boolean metaKey);
 #endif /* !defined(LANGUAGE_JAVASCRIPT) */
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        void initWebKitWheelEvent(in [Optional=CallWithDefaultValue] long wheelDeltaX,
-                                  in [Optional=CallWithDefaultValue] long wheelDeltaY, 
-                                  in [Optional=CallWithDefaultValue] DOMWindow view, 
-                                  in [Optional=CallWithDefaultValue] long screenX,
-                                  in [Optional=CallWithDefaultValue] long screenY,
-                                  in [Optional=CallWithDefaultValue] long clientX,
-                                  in [Optional=CallWithDefaultValue] long clientY,
-                                  in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                                  in [Optional=CallWithDefaultValue] boolean altKey,
-                                  in [Optional=CallWithDefaultValue] boolean shiftKey,
-                                  in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initWebKitWheelEvent(in [Optional=DefaultIsUndefined] long wheelDeltaX,
+                                  in [Optional=DefaultIsUndefined] long wheelDeltaY, 
+                                  in [Optional=DefaultIsUndefined] DOMWindow view, 
+                                  in [Optional=DefaultIsUndefined] long screenX,
+                                  in [Optional=DefaultIsUndefined] long screenY,
+                                  in [Optional=DefaultIsUndefined] long clientX,
+                                  in [Optional=DefaultIsUndefined] long clientY,
+                                  in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                                  in [Optional=DefaultIsUndefined] boolean altKey,
+                                  in [Optional=DefaultIsUndefined] boolean shiftKey,
+                                  in [Optional=DefaultIsUndefined] boolean metaKey);
 #endif /* defined(LANGUAGE_JAVASCRIPT) */
     };
 }
diff --git a/Source/WebCore/editing/ApplyBlockElementCommand.cpp b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
index 45fcf27e1..b32641be7 100644
--- a/Source/WebCore/editing/ApplyBlockElementCommand.cpp
+++ b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
@@ -80,10 +80,10 @@ void ApplyBlockElementCommand::doApply()
     VisiblePosition endOfSelection = selection.visibleEnd();
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
-    Element* startScope = 0;
-    int startIndex = indexForVisiblePosition(startOfSelection, &startScope);
-    Element* endScope = 0;
-    int endIndex = indexForVisiblePosition(endOfSelection, &endScope);
+    RefPtr<Element> startScope;
+    int startIndex = indexForVisiblePosition(startOfSelection, startScope);
+    RefPtr<Element> endScope;
+    int endIndex = indexForVisiblePosition(endOfSelection, endScope);
 
     formatSelection(startOfSelection, endOfSelection);
 
@@ -93,8 +93,8 @@ void ApplyBlockElementCommand::doApply()
     ASSERT(startIndex >= 0);
     ASSERT(startIndex <= endIndex);
     if (startScope == endScope && startIndex >= 0 && startIndex <= endIndex) {
-        VisiblePosition start(visiblePositionForIndex(startIndex, startScope));
-        VisiblePosition end(visiblePositionForIndex(endIndex, endScope));
+        VisiblePosition start(visiblePositionForIndex(startIndex, startScope.get()));
+        VisiblePosition end(visiblePositionForIndex(endIndex, endScope.get()));
         if (start.isNotNull() && end.isNotNull())
             setEndingSelection(VisibleSelection(start, end, endingSelection().isDirectional()));
     }
@@ -162,7 +162,7 @@ static bool isNewLineAtPosition(const Position& position)
         return false;
 
     ExceptionCode ec = 0;
-    String textAtPosition = static_cast<Text*>(textNode)->substringData(offset, 1, ec);
+    String textAtPosition = toText(textNode)->substringData(offset, 1, ec);
     if (ec)
         return false;
 
@@ -257,18 +257,18 @@ VisiblePosition ApplyBlockElementCommand::endOfNextParagrahSplittingTextNodesIfN
 
     if (text == start.containerNode() && text->previousSibling() && text->previousSibling()->isTextNode()) {
         ASSERT(start.offsetInContainerNode() < position.offsetInContainerNode());
-        start = Position(static_cast<Text*>(text->previousSibling()), start.offsetInContainerNode());
+        start = Position(toText(text->previousSibling()), start.offsetInContainerNode());
     }
     if (text == end.containerNode() && text->previousSibling() && text->previousSibling()->isTextNode()) {
         ASSERT(end.offsetInContainerNode() < position.offsetInContainerNode());
-        end = Position(static_cast<Text*>(text->previousSibling()), end.offsetInContainerNode());
+        end = Position(toText(text->previousSibling()), end.offsetInContainerNode());
     }
     if (text == m_endOfLastParagraph.containerNode()) {
         if (m_endOfLastParagraph.offsetInContainerNode() < position.offsetInContainerNode()) {
             // We can only fix endOfLastParagraph if the previous node was still text and hasn't been modified by script.
             if (text->previousSibling()->isTextNode()
-                && static_cast<unsigned>(m_endOfLastParagraph.offsetInContainerNode()) <= static_cast<Text*>(text->previousSibling())->length())
-                m_endOfLastParagraph = Position(static_cast<Text*>(text->previousSibling()), m_endOfLastParagraph.offsetInContainerNode());
+                && static_cast<unsigned>(m_endOfLastParagraph.offsetInContainerNode()) <= toText(text->previousSibling())->length())
+                m_endOfLastParagraph = Position(toText(text->previousSibling()), m_endOfLastParagraph.offsetInContainerNode());
         } else
             m_endOfLastParagraph = Position(text.get(), m_endOfLastParagraph.offsetInContainerNode() - 1);
     }
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 1adde10cf..25444bb7d 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -387,7 +387,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(EditingStyle* style)
         float desiredFontSize = max(MinimumFontSize, startingFontSizes.get(node) + style->fontSizeDelta());
         RefPtr<CSSValue> value = inlineStyleDecl->getPropertyCSSValue(CSSPropertyFontSize);
         if (value) {
-            inlineStyleDecl->removeProperty(CSSPropertyFontSize);
+            element->removeInlineStyleProperty(CSSPropertyFontSize);
             currentFontSize = computedFontSize(node);
         }
         if (currentFontSize != desiredFontSize) {
@@ -444,7 +444,7 @@ HTMLElement* ApplyStyleCommand::splitAncestorsWithUnicodeBidi(Node* node, bool b
     Node* nextHighestAncestorWithUnicodeBidi = 0;
     int highestAncestorUnicodeBidi = 0;
     for (Node* n = node->parentNode(); n != block; n = n->parentNode()) {
-        int unicodeBidi = getIdentifierValue(computedStyle(n).get(), CSSPropertyUnicodeBidi);
+        int unicodeBidi = getIdentifierValue(CSSComputedStyleDeclaration::create(n).get(), CSSPropertyUnicodeBidi);
         if (unicodeBidi && unicodeBidi != CSSValueNormal) {
             highestAncestorUnicodeBidi = unicodeBidi;
             nextHighestAncestorWithUnicodeBidi = highestAncestorWithUnicodeBidi;
@@ -496,7 +496,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
             continue;
 
         StyledElement* element = static_cast<StyledElement*>(n);
-        int unicodeBidi = getIdentifierValue(computedStyle(element).get(), CSSPropertyUnicodeBidi);
+        int unicodeBidi = getIdentifierValue(CSSComputedStyleDeclaration::create(element).get(), CSSPropertyUnicodeBidi);
         if (!unicodeBidi || unicodeBidi == CSSValueNormal)
             continue;
 
@@ -522,7 +522,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
 static Node* highestEmbeddingAncestor(Node* startNode, Node* enclosingNode)
 {
     for (Node* n = startNode; n && n != enclosingNode; n = n->parentNode()) {
-        if (n->isHTMLElement() && getIdentifierValue(computedStyle(n).get(), CSSPropertyUnicodeBidi) == CSSValueEmbed)
+        if (n->isHTMLElement() && getIdentifierValue(CSSComputedStyleDeclaration::create(n).get(), CSSPropertyUnicodeBidi) == CSSValueEmbed)
             return n;
     }
 
@@ -1123,14 +1123,14 @@ void ApplyStyleCommand::splitTextAtEnd(const Position& start, const Position& en
     ASSERT(end.containerNode()->isTextNode());
 
     bool shouldUpdateStart = start.anchorType() == Position::PositionIsOffsetInAnchor && start.containerNode() == end.containerNode();
-    Text* text = static_cast<Text *>(end.deprecatedNode());
+    Text* text = toText(end.deprecatedNode());
     splitTextNode(text, end.offsetInContainerNode());
 
     Node* prevNode = text->previousSibling();
     if (!prevNode || !prevNode->isTextNode())
         return;
 
-    Position newStart = shouldUpdateStart ? Position(static_cast<Text*>(prevNode), start.offsetInContainerNode()) : start;
+    Position newStart = shouldUpdateStart ? Position(toText(prevNode), start.offsetInContainerNode()) : start;
     updateStartEnd(newStart, lastPositionInNode(prevNode));
 }
 
@@ -1162,7 +1162,7 @@ void ApplyStyleCommand::splitTextElementAtEnd(const Position& start, const Posit
     if (!firstTextNode || !firstTextNode->isTextNode())
         return;
 
-    Position newStart = shouldUpdateStart ? Position(static_cast<Text*>(firstTextNode), start.offsetInContainerNode()) : start;
+    Position newStart = shouldUpdateStart ? Position(toText(firstTextNode), start.offsetInContainerNode()) : start;
     updateStartEnd(newStart, positionAfterNode(firstTextNode));
 }
 
@@ -1410,7 +1410,7 @@ float ApplyStyleCommand::computedFontSize(Node* node)
     if (!node)
         return 0;
 
-    RefPtr<CSSComputedStyleDeclaration> style = computedStyle(node);
+    RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(node);
     if (!style)
         return 0;
 
@@ -1433,8 +1433,8 @@ void ApplyStyleCommand::joinChildTextNodes(Node* node, const Position& start, co
     while (child) {
         Node* next = child->nextSibling();
         if (child->isTextNode() && next && next->isTextNode()) {
-            Text* childText = static_cast<Text *>(child);
-            Text* nextText = static_cast<Text *>(next);
+            Text* childText = toText(child);
+            Text* nextText = toText(next);
             if (start.anchorType() == Position::PositionIsOffsetInAnchor && next == start.containerNode())
                 newStart = Position(childText, childText->length() + start.offsetInContainerNode());
             if (end.anchorType() == Position::PositionIsOffsetInAnchor && next == end.containerNode())
diff --git a/Source/WebCore/editing/BreakBlockquoteCommand.cpp b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
index 76e9159ac..d3639398a 100644
--- a/Source/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -107,7 +107,7 @@ void BreakBlockquoteCommand::doApply()
         
     // Split at pos if in the middle of a text node.
     if (startNode->isTextNode()) {
-        Text* textNode = static_cast<Text*>(startNode);
+        Text* textNode = toText(startNode);
         if ((unsigned)pos.deprecatedEditingOffset() >= textNode->length()) {
             startNode = startNode->traverseNextNode();
             ASSERT(startNode);
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index 2a629c3a0..f57657137 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -356,7 +356,7 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
     } else if (caretMinOffset(refChild) >= offset)
         insertNodeBefore(insertChild, refChild);
     else if (refChild->isTextNode() && caretMaxOffset(refChild) > offset) {
-        splitTextNode(static_cast<Text *>(refChild), offset);
+        splitTextNode(toText(refChild), offset);
 
         // Mutation events (bug 22634) from the text node insertion may have removed the refChild
         if (!refChild->inDocument())
@@ -532,7 +532,7 @@ Position CompositeEditCommand::positionOutsideTabSpan(const Position& pos)
     if (pos.offsetInContainerNode() >= caretMaxOffset(pos.containerNode()))
         return positionInParentAfterNode(tabSpan);
 
-    splitTextNodeContainingElement(static_cast<Text *>(pos.containerNode()), pos.offsetInContainerNode());
+    splitTextNodeContainingElement(toText(pos.containerNode()), pos.offsetInContainerNode());
     return positionInParentBeforeNode(tabSpan);
 }
 
@@ -590,7 +590,7 @@ bool CompositeEditCommand::canRebalance(const Position& position) const
     if (position.anchorType() != Position::PositionIsOffsetInAnchor || !node || !node->isTextNode())
         return false;
 
-    Text* textNode = static_cast<Text*>(node);
+    Text* textNode = toText(node);
     if (textNode->length() == 0)
         return false;
 
@@ -610,14 +610,14 @@ void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
 
     // If the rebalance is for the single offset, and neither text[offset] nor text[offset - 1] are some form of whitespace, do nothing.
     int offset = position.deprecatedEditingOffset();
-    String text = static_cast<Text*>(node)->data();
+    String text = toText(node)->data();
     if (!isWhitespace(text[offset])) {
         offset--;
         if (offset < 0 || !isWhitespace(text[offset]))
             return;
     }
 
-    rebalanceWhitespaceOnTextSubstring(static_cast<Text*>(node), position.offsetInContainerNode(), position.offsetInContainerNode());
+    rebalanceWhitespaceOnTextSubstring(toText(node), position.offsetInContainerNode(), position.offsetInContainerNode());
 }
 
 void CompositeEditCommand::rebalanceWhitespaceOnTextSubstring(PassRefPtr<Text> prpTextNode, int startOffset, int endOffset)
@@ -659,7 +659,7 @@ void CompositeEditCommand::prepareWhitespaceAtPositionForSplit(Position& positio
     Node* node = position.deprecatedNode();
     if (!node || !node->isTextNode())
         return;
-    Text* textNode = static_cast<Text*>(node);    
+    Text* textNode = toText(node);    
     
     if (textNode->length() == 0)
         return;
@@ -677,9 +677,9 @@ void CompositeEditCommand::prepareWhitespaceAtPositionForSplit(Position& positio
     Position previous(previousVisiblePos.deepEquivalent());
     
     if (isCollapsibleWhitespace(previousVisiblePos.characterAfter()) && previous.deprecatedNode()->isTextNode() && !previous.deprecatedNode()->hasTagName(brTag))
-        replaceTextInNodePreservingMarkers(static_cast<Text*>(previous.deprecatedNode()), previous.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
+        replaceTextInNodePreservingMarkers(toText(previous.deprecatedNode()), previous.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     if (isCollapsibleWhitespace(visiblePos.characterAfter()) && position.deprecatedNode()->isTextNode() && !position.deprecatedNode()->hasTagName(brTag))
-        replaceTextInNodePreservingMarkers(static_cast<Text*>(position.deprecatedNode()), position.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
+        replaceTextInNodePreservingMarkers(toText(position.deprecatedNode()), position.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
 }
 
 void CompositeEditCommand::rebalanceWhitespace()
@@ -698,6 +698,8 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
     if (!textNode || start >= end)
         return;
 
+    document()->updateLayout();
+
     RenderText* textRenderer = toRenderText(textNode->renderer());
     if (!textRenderer)
         return;
@@ -780,18 +782,20 @@ void CompositeEditCommand::deleteInsignificantText(const Position& start, const
     if (comparePositions(start, end) >= 0)
         return;
 
-    Node* next;
-    for (Node* node = start.deprecatedNode(); node; node = next) {
-        next = node->traverseNextNode();
-        if (node->isTextNode()) {
-            Text* textNode = static_cast<Text*>(node);
-            int startOffset = node == start.deprecatedNode() ? start.deprecatedEditingOffset() : 0;
-            int endOffset = node == end.deprecatedNode() ? end.deprecatedEditingOffset() : static_cast<int>(textNode->length());
-            deleteInsignificantText(textNode, startOffset, endOffset);
-        }
+    Vector<RefPtr<Text> > nodes;
+    for (Node* node = start.deprecatedNode(); node; node = node->traverseNextNode()) {
+        if (node->isTextNode())
+            nodes.append(toText(node));
         if (node == end.deprecatedNode())
             break;
     }
+
+    for (size_t i = 0; i < nodes.size(); ++i) {
+        Text* textNode = nodes[i].get();
+        int startOffset = textNode == start.deprecatedNode() ? start.deprecatedEditingOffset() : 0;
+        int endOffset = textNode == end.deprecatedNode() ? end.deprecatedEditingOffset() : static_cast<int>(textNode->length());
+        deleteInsignificantText(textNode, startOffset, endOffset);
+    }
 }
 
 void CompositeEditCommand::deleteInsignificantTextDownstream(const Position& pos)
@@ -857,7 +861,7 @@ void CompositeEditCommand::removePlaceholderAt(const Position& p)
         return;
     }
     
-    deleteTextFromNode(static_cast<Text*>(p.anchorNode()), p.offsetInContainerNode(), 1);
+    deleteTextFromNode(toText(p.anchorNode()), p.offsetInContainerNode(), 1);
 }
 
 PassRefPtr<Node> CompositeEditCommand::insertNewDefaultParagraphElementAt(const Position& position)
@@ -1033,7 +1037,7 @@ void CompositeEditCommand::cleanupAfterDeletion(VisiblePosition destination)
         else if (lineBreakExistsAtPosition(position)) {
             // There is a preserved '\n' at caretAfterDelete.
             // We can safely assume this is a text node.
-            Text* textNode = static_cast<Text*>(node);
+            Text* textNode = toText(node);
             if (textNode->length() == 1)
                 removeNodeAndPruneAncestors(node);
             else
@@ -1326,7 +1330,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
         removeNodeAndPruneAncestors(caretPos.deprecatedNode());
     else if (caretPos.deprecatedNode()->isTextNode()) {
         ASSERT(caretPos.deprecatedEditingOffset() == 0);
-        Text* textNode = static_cast<Text*>(caretPos.deprecatedNode());
+        Text* textNode = toText(caretPos.deprecatedNode());
         ContainerNode* parentNode = textNode->parentNode();
         // The preserved newline must be the first thing in the node, since otherwise the previous
         // paragraph would be quoted, and we verified that it wasn't above.
diff --git a/Source/WebCore/editing/DeleteButtonController.cpp b/Source/WebCore/editing/DeleteButtonController.cpp
index 2a3005ea6..e8b05eca5 100644
--- a/Source/WebCore/editing/DeleteButtonController.cpp
+++ b/Source/WebCore/editing/DeleteButtonController.cpp
@@ -205,17 +205,16 @@ void DeleteButtonController::createDeletionUI()
     RefPtr<HTMLDivElement> container = HTMLDivElement::create(m_target->document());
     container->setIdAttribute(containerElementIdentifier);
 
-    StylePropertySet* style = container->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserModify, CSSValueReadOnly);
-    style->setProperty(CSSPropertyVisibility, CSSValueHidden);
-    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyCursor, CSSValueDefault);
-    style->setProperty(CSSPropertyTop, "0");
-    style->setProperty(CSSPropertyRight, "0");
-    style->setProperty(CSSPropertyBottom, "0");
-    style->setProperty(CSSPropertyLeft, "0");
+    container->setInlineStyleProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
+    container->setInlineStyleProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
+    container->setInlineStyleProperty(CSSPropertyWebkitUserModify, CSSValueReadOnly);
+    container->setInlineStyleProperty(CSSPropertyVisibility, CSSValueHidden);
+    container->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
+    container->setInlineStyleProperty(CSSPropertyCursor, CSSValueDefault);
+    container->setInlineStyleProperty(CSSPropertyTop, "0");
+    container->setInlineStyleProperty(CSSPropertyRight, "0");
+    container->setInlineStyleProperty(CSSPropertyBottom, "0");
+    container->setInlineStyleProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = HTMLDivElement::create(m_target->document());
     outline->setIdAttribute(outlineElementIdentifier);
@@ -223,16 +222,15 @@ void DeleteButtonController::createDeletionUI()
     const int borderWidth = 4;
     const int borderRadius = 6;
 
-    style = outline->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyZIndex, String::number(-1000000));
-    style->setProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderBox()->borderTop()) + "px");
-    style->setProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderBox()->borderRight()) + "px");
-    style->setProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderBox()->borderBottom()) + "px");
-    style->setProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderBox()->borderLeft()) + "px");
-    style->setProperty(CSSPropertyBorder, String::number(borderWidth) + "px solid rgba(0, 0, 0, 0.6)");
-    style->setProperty(CSSPropertyWebkitBorderRadius, String::number(borderRadius) + "px");
-    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
+    outline->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
+    outline->setInlineStyleProperty(CSSPropertyZIndex, String::number(-1000000));
+    outline->setInlineStyleProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderBox()->borderTop()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderBox()->borderRight()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderBox()->borderBottom()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderBox()->borderLeft()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyBorder, String::number(borderWidth) + "px solid rgba(0, 0, 0, 0.6)");
+    outline->setInlineStyleProperty(CSSPropertyWebkitBorderRadius, String::number(borderRadius) + "px");
+    outline->setInlineStyleProperty(CSSPropertyVisibility, CSSValueVisible);
 
     ExceptionCode ec = 0;
     container->appendChild(outline.get(), ec);
@@ -247,14 +245,13 @@ void DeleteButtonController::createDeletionUI()
     const int buttonHeight = 30;
     const int buttonBottomShadowOffset = 2;
 
-    style = button->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyZIndex, String::number(1000000));
-    style->setProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderBox()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
-    style->setProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderBox()->borderLeft() - (borderWidth / 2)) + "px");
-    style->setProperty(CSSPropertyWidth, String::number(buttonWidth) + "px");
-    style->setProperty(CSSPropertyHeight, String::number(buttonHeight) + "px");
-    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
+    button->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
+    button->setInlineStyleProperty(CSSPropertyZIndex, String::number(1000000));
+    button->setInlineStyleProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderBox()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
+    button->setInlineStyleProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderBox()->borderLeft() - (borderWidth / 2)) + "px");
+    button->setInlineStyleProperty(CSSPropertyWidth, String::number(buttonWidth) + "px");
+    button->setInlineStyleProperty(CSSPropertyHeight, String::number(buttonHeight) + "px");
+    button->setInlineStyleProperty(CSSPropertyVisibility, CSSValueVisible);
 
     float deviceScaleFactor = WebCore::deviceScaleFactor(m_frame);
     RefPtr<Image> buttonImage;
@@ -310,12 +307,12 @@ void DeleteButtonController::show(HTMLElement* element)
     }
 
     if (m_target->renderer()->style()->position() == StaticPosition) {
-        m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueRelative);
+        m_target->setInlineStyleProperty(CSSPropertyPosition, CSSValueRelative);
         m_wasStaticPositioned = true;
     }
 
     if (m_target->renderer()->style()->hasAutoZIndex()) {
-        m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyZIndex, "0");
+        m_target->setInlineStyleProperty(CSSPropertyZIndex, "0");
         m_wasAutoZIndex = true;
     }
 }
@@ -331,9 +328,9 @@ void DeleteButtonController::hide()
 
     if (m_target) {
         if (m_wasStaticPositioned)
-            m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueStatic);
+            m_target->setInlineStyleProperty(CSSPropertyPosition, CSSValueStatic);
         if (m_wasAutoZIndex)
-            m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyZIndex, CSSValueAuto);
+            m_target->setInlineStyleProperty(CSSPropertyZIndex, CSSValueAuto);
     }
 
     m_wasStaticPositioned = false;
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 839b73420..9a94509ce 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -423,7 +423,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
     }
 
     if (startOffset >= caretMaxOffset(startNode) && startNode->isTextNode()) {
-        Text *text = static_cast<Text *>(startNode);
+        Text* text = toText(startNode);
         if (text->length() > (unsigned)caretMaxOffset(startNode))
             deleteTextFromNode(text, caretMaxOffset(startNode), text->length() - caretMaxOffset(startNode));
     }
@@ -441,7 +441,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
         if (m_downstreamEnd.deprecatedEditingOffset() - startOffset > 0) {
             if (startNode->isTextNode()) {
                 // in a text node that needs to be trimmed
-                Text* text = static_cast<Text*>(startNode);
+                Text* text = toText(startNode);
                 deleteTextFromNode(text, startOffset, m_downstreamEnd.deprecatedEditingOffset() - startOffset);
             } else {
                 removeChildrenInRange(startNode, startOffset, m_downstreamEnd.deprecatedEditingOffset());
@@ -461,14 +461,14 @@ void DeleteSelectionCommand::handleGeneralDelete()
         if (startOffset > 0) {
             if (startNode->isTextNode()) {
                 // in a text node that needs to be trimmed
-                Text *text = static_cast<Text *>(node.get());
+                Text* text = toText(node.get());
                 deleteTextFromNode(text, startOffset, text->length() - startOffset);
                 node = node->traverseNextNode();
             } else {
                 node = startNode->childNode(startOffset);
             }
         } else if (startNode == m_upstreamEnd.deprecatedNode() && startNode->isTextNode()) {
-            Text* text = static_cast<Text*>(m_upstreamEnd.deprecatedNode());
+            Text* text = toText(m_upstreamEnd.deprecatedNode());
             deleteTextFromNode(text, 0, m_upstreamEnd.deprecatedEditingOffset());
         }
         
@@ -501,7 +501,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
             } else {
                 if (m_downstreamEnd.deprecatedNode()->isTextNode()) {
                     // in a text node that needs to be trimmed
-                    Text* text = static_cast<Text*>(m_downstreamEnd.deprecatedNode());
+                    Text* text = toText(m_downstreamEnd.deprecatedNode());
                     if (m_downstreamEnd.deprecatedEditingOffset() > 0) {
                         deleteTextFromNode(text, 0, m_downstreamEnd.deprecatedEditingOffset());
                     }
@@ -533,12 +533,12 @@ void DeleteSelectionCommand::fixupWhitespace()
     document()->updateLayoutIgnorePendingStylesheets();
     // FIXME: isRenderedCharacter should be removed, and we should use VisiblePosition::characterAfter and VisiblePosition::characterBefore
     if (m_leadingWhitespace.isNotNull() && !m_leadingWhitespace.isRenderedCharacter() && m_leadingWhitespace.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(m_leadingWhitespace.deprecatedNode());
+        Text* textNode = toText(m_leadingWhitespace.deprecatedNode());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
         replaceTextInNodePreservingMarkers(textNode, m_leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     if (m_trailingWhitespace.isNotNull() && !m_trailingWhitespace.isRenderedCharacter() && m_trailingWhitespace.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(m_trailingWhitespace.deprecatedNode());
+        Text* textNode = toText(m_trailingWhitespace.deprecatedNode());
         ASSERT(!textNode->renderer() ||textNode->renderer()->style()->collapseWhiteSpace());
         replaceTextInNodePreservingMarkers(textNode, m_trailingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index 98224f243..57291c1f5 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -378,7 +378,7 @@ void EditingStyle::init(Node* node, PropertiesToInclude propertiesToInclude)
     else if (isTabSpanNode(node))
         node = node->parentNode();
 
-    RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = computedStyle(node);
+    RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = CSSComputedStyleDeclaration::create(node);
     m_mutableStyle = propertiesToInclude == AllProperties && computedStyleAtPosition ? computedStyleAtPosition->copy() : editingStyleFromComputedStyle(computedStyleAtPosition);
 
     if (propertiesToInclude == EditingPropertiesInEffect) {
@@ -558,8 +558,8 @@ void EditingStyle::removeStyleAddedByNode(Node* node)
 {
     if (!node || !node->parentNode())
         return;
-    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(computedStyle(node->parentNode()), AllEditingProperties);
-    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(computedStyle(node), AllEditingProperties);
+    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node->parentNode()), AllEditingProperties);
+    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node), AllEditingProperties);
     nodeStyle->removeEquivalentProperties(parentStyle->ensureCSSStyleDeclaration());
     m_mutableStyle->removeEquivalentProperties(nodeStyle->ensureCSSStyleDeclaration());
 }
@@ -569,8 +569,8 @@ void EditingStyle::removeStyleConflictingWithStyleOfNode(Node* node)
     if (!node || !node->parentNode() || !m_mutableStyle)
         return;
 
-    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(computedStyle(node->parentNode()), AllEditingProperties);
-    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(computedStyle(node), AllEditingProperties);
+    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node->parentNode()), AllEditingProperties);
+    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node), AllEditingProperties);
     nodeStyle->removeEquivalentProperties(parentStyle->ensureCSSStyleDeclaration());
 
     unsigned propertyCount = nodeStyle->propertyCount();
@@ -641,7 +641,7 @@ TriState EditingStyle::triStateOfStyle(const VisibleSelection& selection) const
 
     TriState state = FalseTriState;
     for (Node* node = selection.start().deprecatedNode(); node; node = node->traverseNextNode()) {
-        RefPtr<CSSComputedStyleDeclaration> nodeStyle = computedStyle(node);
+        RefPtr<CSSComputedStyleDeclaration> nodeStyle = CSSComputedStyleDeclaration::create(node);
         if (nodeStyle) {
             TriState nodeState = triStateOfStyle(nodeStyle.get(), node->isTextNode() ? EditingStyle::DoNotIgnoreTextOnlyProperties : EditingStyle::IgnoreTextOnlyProperties);
             if (node == selection.start().deprecatedNode())
@@ -813,7 +813,7 @@ bool EditingStyle::extractConflictingImplicitStyleOfAttributes(HTMLElement* elem
 
 bool EditingStyle::styleIsPresentInComputedStyleOfNode(Node* node) const
 {
-    return !m_mutableStyle || getPropertiesNotIn(m_mutableStyle.get(), computedStyle(node).get())->isEmpty();
+    return !m_mutableStyle || getPropertiesNotIn(m_mutableStyle.get(), CSSComputedStyleDeclaration::create(node).get())->isEmpty();
 }
 
 bool EditingStyle::elementIsStyledSpanOrHTMLEquivalent(const HTMLElement* element)
@@ -1061,7 +1061,7 @@ void EditingStyle::mergeStyleFromRulesForSerialization(StyledElement* element)
     // The property value, if it's a percentage, may not reflect the actual computed value.  
     // For example: style="height: 1%; overflow: visible;" in quirksmode
     // FIXME: There are others like this, see <rdar://problem/5195123> Slashdot copy/paste fidelity problem
-    RefPtr<CSSComputedStyleDeclaration> computedStyleForElement = computedStyle(element);
+    RefPtr<CSSComputedStyleDeclaration> computedStyleForElement = CSSComputedStyleDeclaration::create(element);
     RefPtr<StylePropertySet> fromComputedStyle = StylePropertySet::create();
     {
         unsigned propertyCount = m_mutableStyle->propertyCount();
@@ -1182,6 +1182,91 @@ PassRefPtr<EditingStyle> EditingStyle::styleAtSelectionStart(const VisibleSelect
     return style;
 }
 
+WritingDirection EditingStyle::textDirectionForSelection(const VisibleSelection& selection, EditingStyle* typingStyle, bool& hasNestedOrMultipleEmbeddings)
+{
+    hasNestedOrMultipleEmbeddings = true;
+
+    if (selection.isNone())
+        return NaturalWritingDirection;
+
+    Position position = selection.start().downstream();
+
+    Node* node = position.deprecatedNode();
+    if (!node)
+        return NaturalWritingDirection;
+
+    Position end;
+    if (selection.isRange()) {
+        end = selection.end().upstream();
+
+        Node* pastLast = Range::create(end.document(), position.parentAnchoredEquivalent(), end.parentAnchoredEquivalent())->pastLastNode();
+        for (Node* n = node; n && n != pastLast; n = n->traverseNextNode()) {
+            if (!n->isStyledElement())
+                continue;
+
+            RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(n);
+            RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
+            if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
+                continue;
+
+            int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
+            if (unicodeBidiValue == CSSValueEmbed || unicodeBidiValue == CSSValueBidiOverride)
+                return NaturalWritingDirection;
+        }
+    }
+
+    if (selection.isCaret()) {
+        WritingDirection direction;
+        if (typingStyle && typingStyle->textDirection(direction)) {
+            hasNestedOrMultipleEmbeddings = false;
+            return direction;
+        }
+        node = selection.visibleStart().deepEquivalent().deprecatedNode();
+    }
+
+    // The selection is either a caret with no typing attributes or a range in which no embedding is added, so just use the start position
+    // to decide.
+    Node* block = enclosingBlock(node);
+    WritingDirection foundDirection = NaturalWritingDirection;
+
+    for (; node != block; node = node->parentNode()) {
+        if (!node->isStyledElement())
+            continue;
+
+        RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(node);
+        RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
+        if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
+            continue;
+
+        int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
+        if (unicodeBidiValue == CSSValueNormal)
+            continue;
+
+        if (unicodeBidiValue == CSSValueBidiOverride)
+            return NaturalWritingDirection;
+
+        ASSERT(unicodeBidiValue == CSSValueEmbed);
+        RefPtr<CSSValue> direction = style->getPropertyCSSValue(CSSPropertyDirection);
+        if (!direction || !direction->isPrimitiveValue())
+            continue;
+
+        int directionValue = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent();
+        if (directionValue != CSSValueLtr && directionValue != CSSValueRtl)
+            continue;
+
+        if (foundDirection != NaturalWritingDirection)
+            return NaturalWritingDirection;
+
+        // In the range case, make sure that the embedding element persists until the end of the range.
+        if (selection.isRange() && !end.deprecatedNode()->isDescendantOf(node))
+            return NaturalWritingDirection;
+        
+        foundDirection = directionValue == CSSValueLtr ? LeftToRightWritingDirection : RightToLeftWritingDirection;
+    }
+    hasNestedOrMultipleEmbeddings = false;
+    return foundDirection;
+}
+
 static void reconcileTextDecorationProperties(StylePropertySet* style)
 {    
     RefPtr<CSSValue> textDecorationsInEffect = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
@@ -1487,7 +1572,7 @@ bool hasTransparentBackgroundColor(StylePropertySet* style)
 PassRefPtr<CSSValue> backgroundColorInEffect(Node* node)
 {
     for (Node* ancestor = node; ancestor; ancestor = ancestor->parentNode()) {
-        RefPtr<CSSComputedStyleDeclaration> ancestorStyle = computedStyle(ancestor);
+        RefPtr<CSSComputedStyleDeclaration> ancestorStyle = CSSComputedStyleDeclaration::create(ancestor);
         if (!hasTransparentBackgroundColor(ancestorStyle.get()))
             return ancestorStyle->getPropertyCSSValue(CSSPropertyBackgroundColor);
     }
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index 6b60920c6..71dc652f0 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -145,6 +145,7 @@ public:
     bool shouldUseFixedDefaultFontSize() const { return m_shouldUseFixedDefaultFontSize; }
 
     static PassRefPtr<EditingStyle> styleAtSelectionStart(const VisibleSelection&, bool shouldUseBackgroundColorInEffect = false);
+    static WritingDirection textDirectionForSelection(const VisibleSelection&, EditingStyle* typingStyle, bool& hasNestedOrMultipleEmbeddings);
 private:
     EditingStyle();
     EditingStyle(Node*, PropertiesToInclude);
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 97b153365..1ce24e538 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -418,7 +418,7 @@ void Editor::replaceSelectionWithFragment(PassRefPtr<DocumentFragment> fragment,
         return;
 
     RefPtr<Range> rangeToCheck = Range::create(m_frame->document(), firstPositionInNode(nodeToCheck), lastPositionInNode(nodeToCheck));
-    m_spellChecker->requestCheckingFor(SpellCheckRequest::create(resolveTextCheckingTypeMask(TextCheckingTypeSpelling | TextCheckingTypeGrammar), rangeToCheck, rangeToCheck));
+    m_spellChecker->requestCheckingFor(SpellCheckRequest::create(resolveTextCheckingTypeMask(TextCheckingTypeSpelling | TextCheckingTypeGrammar), TextCheckingProcessBatch, rangeToCheck, rangeToCheck));
 }
 
 void Editor::replaceSelectionWithText(const String& text, bool selectReplacement, bool smartReplace)
@@ -499,92 +499,6 @@ void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
         client()->respondToChangedContents();
 }
 
-WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbeddings) const
-{
-    hasNestedOrMultipleEmbeddings = true;
-
-    if (m_frame->selection()->isNone())
-        return NaturalWritingDirection;
-
-    Position position = m_frame->selection()->selection().start().downstream();
-
-    Node* node = position.deprecatedNode();
-    if (!node)
-        return NaturalWritingDirection;
-
-    Position end;
-    if (m_frame->selection()->isRange()) {
-        end = m_frame->selection()->selection().end().upstream();
-
-        Node* pastLast = Range::create(m_frame->document(), position.parentAnchoredEquivalent(), end.parentAnchoredEquivalent())->pastLastNode();
-        for (Node* n = node; n && n != pastLast; n = n->traverseNextNode()) {
-            if (!n->isStyledElement())
-                continue;
-
-            RefPtr<CSSComputedStyleDeclaration> style = computedStyle(n);
-            RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-            if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
-                continue;
-
-            int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
-            if (unicodeBidiValue == CSSValueEmbed || unicodeBidiValue == CSSValueBidiOverride)
-                return NaturalWritingDirection;
-        }
-    }
-
-    if (m_frame->selection()->isCaret()) {
-        RefPtr<EditingStyle> typingStyle = m_frame->selection()->typingStyle();
-        WritingDirection direction;
-        if (typingStyle && typingStyle->textDirection(direction)) {
-            hasNestedOrMultipleEmbeddings = false;
-            return direction;
-        }
-        node = m_frame->selection()->selection().visibleStart().deepEquivalent().deprecatedNode();
-    }
-
-    // The selection is either a caret with no typing attributes or a range in which no embedding is added, so just use the start position
-    // to decide.
-    Node* block = enclosingBlock(node);
-    WritingDirection foundDirection = NaturalWritingDirection;
-
-    for (; node != block; node = node->parentNode()) {
-        if (!node->isStyledElement())
-            continue;
-
-        RefPtr<CSSComputedStyleDeclaration> style = computedStyle(node);
-        RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-        if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
-            continue;
-
-        int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
-        if (unicodeBidiValue == CSSValueNormal)
-            continue;
-
-        if (unicodeBidiValue == CSSValueBidiOverride)
-            return NaturalWritingDirection;
-
-        ASSERT(unicodeBidiValue == CSSValueEmbed);
-        RefPtr<CSSValue> direction = style->getPropertyCSSValue(CSSPropertyDirection);
-        if (!direction || !direction->isPrimitiveValue())
-            continue;
-
-        int directionValue = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent();
-        if (directionValue != CSSValueLtr && directionValue != CSSValueRtl)
-            continue;
-
-        if (foundDirection != NaturalWritingDirection)
-            return NaturalWritingDirection;
-
-        // In the range case, make sure that the embedding element persists until the end of the range.
-        if (m_frame->selection()->isRange() && !end.deprecatedNode()->isDescendantOf(node))
-            return NaturalWritingDirection;
-
-        foundDirection = directionValue == CSSValueLtr ? LeftToRightWritingDirection : RightToLeftWritingDirection;
-    }
-    hasNestedOrMultipleEmbeddings = false;
-    return foundDirection;
-}
-
 bool Editor::hasBidiSelection() const
 {
     if (m_frame->selection()->isNone())
@@ -764,7 +678,7 @@ Node* Editor::findEventTargetFromSelection() const
     return findEventTargetFrom(m_frame->selection()->selection());
 }
 
-void Editor::applyStyle(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyStyle(StylePropertySet* style, EditAction editingAction)
 {
     switch (m_frame->selection()->selectionType()) {
     case VisibleSelection::NoSelection:
@@ -780,12 +694,12 @@ void Editor::applyStyle(CSSStyleDeclaration* style, EditAction editingAction)
     }
 }
     
-bool Editor::shouldApplyStyle(CSSStyleDeclaration* style, Range* range)
+bool Editor::shouldApplyStyle(StylePropertySet* style, Range* range)
 {   
     return client()->shouldApplyStyle(style, range);
 }
     
-void Editor::applyParagraphStyle(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyParagraphStyle(StylePropertySet* style, EditAction editingAction)
 {
     switch (m_frame->selection()->selectionType()) {
     case VisibleSelection::NoSelection:
@@ -799,18 +713,18 @@ void Editor::applyParagraphStyle(CSSStyleDeclaration* style, EditAction editingA
     }
 }
 
-void Editor::applyStyleToSelection(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyStyleToSelection(StylePropertySet* style, EditAction editingAction)
 {
-    if (!style || !style->length() || !canEditRichly())
+    if (!style || style->isEmpty() || !canEditRichly())
         return;
 
     if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
         applyStyle(style, editingAction);
 }
 
-void Editor::applyParagraphStyleToSelection(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyParagraphStyleToSelection(StylePropertySet* style, EditAction editingAction)
 {
-    if (!style || !style->length() || !canEditRichly())
+    if (!style || style->isEmpty() || !canEditRichly())
         return;
     
     if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
@@ -1348,7 +1262,7 @@ void Editor::setBaseWritingDirection(WritingDirection direction)
 
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyDirection, direction == LeftToRightWritingDirection ? "ltr" : direction == RightToLeftWritingDirection ? "rtl" : "inherit", false);
-    applyParagraphStyleToSelection(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    applyParagraphStyleToSelection(style.get(), EditActionSetWritingDirection);
 }
 
 void Editor::selectComposition()
@@ -1502,7 +1416,7 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         unsigned extentOffset = extent.deprecatedEditingOffset();
 
         if (baseNode && baseNode == extentNode && baseNode->isTextNode() && baseOffset + text.length() == extentOffset) {
-            m_compositionNode = static_cast<Text*>(baseNode);
+            m_compositionNode = toText(baseNode);
             m_compositionStart = baseOffset;
             m_compositionEnd = extentOffset;
             m_customCompositionUnderlines = underlines;
@@ -2021,7 +1935,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingTypeMask textC
     bool asynchronous = m_frame && m_frame->settings() && m_frame->settings()->asynchronousSpellCheckingEnabled() && !shouldShowCorrectionPanel;
 
     // In asynchronous mode, we intentionally check paragraph-wide sentence.
-    RefPtr<SpellCheckRequest> request = SpellCheckRequest::create(resolveTextCheckingTypeMask(textCheckingOptions), asynchronous ? paragraphRange : rangeToCheck, paragraphRange);
+    RefPtr<SpellCheckRequest> request = SpellCheckRequest::create(resolveTextCheckingTypeMask(textCheckingOptions), TextCheckingProcessIncremental, asynchronous ? paragraphRange : rangeToCheck, paragraphRange);
 
     if (asynchronous) {
         m_spellChecker->requestCheckingFor(request);
@@ -2665,9 +2579,9 @@ bool Editor::shouldChangeSelection(const VisibleSelection& oldSelection, const V
     return client() && client()->shouldChangeSelectedRange(oldSelection.toNormalizedRange().get(), newSelection.toNormalizedRange().get(), affinity, stillSelecting);
 }
 
-void Editor::computeAndSetTypingStyle(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::computeAndSetTypingStyle(StylePropertySet* style, EditAction editingAction)
 {
-    if (!style || !style->length()) {
+    if (!style || style->isEmpty()) {
         m_frame->selection()->clearTypingStyle();
         return;
     }
@@ -2676,7 +2590,7 @@ void Editor::computeAndSetTypingStyle(CSSStyleDeclaration* style, EditAction edi
     RefPtr<EditingStyle> typingStyle;
     if (m_frame->selection()->typingStyle()) {
         typingStyle = m_frame->selection()->typingStyle()->copy();
-        typingStyle->overrideWithStyle(style->makeMutable().get());
+        typingStyle->overrideWithStyle(style);
     } else
         typingStyle = EditingStyle::create(style);
 
@@ -2745,10 +2659,13 @@ void Editor::applyEditingStyleToElement(Element* element) const
     ASSERT(element->isStyledElement());
     if (!element->isStyledElement())
         return;
-    StylePropertySet* style = static_cast<StyledElement*>(element)->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWordWrap, "break-word", false);
-    style->setProperty(CSSPropertyWebkitNbspMode, "space", false);
-    style->setProperty(CSSPropertyWebkitLineBreak, "after-white-space", false);
+
+    // Mutate using the CSSOM wrapper so we get the same event behavior as a script.
+    CSSStyleDeclaration* style = static_cast<StyledElement*>(element)->style();
+    ExceptionCode ec;
+    style->setPropertyInternal(CSSPropertyWordWrap, "break-word", false, ec);
+    style->setPropertyInternal(CSSPropertyWebkitNbspMode, "space", false, ec);
+    style->setPropertyInternal(CSSPropertyWebkitLineBreak, "after-white-space", false, ec);
 }
 
 // Searches from the beginning of the document if nothing is selected.
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index 5a7815892..e398bbf3e 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -46,7 +46,6 @@ typedef int NSWritingDirection;
 
 namespace WebCore {
 
-class CSSStyleDeclaration;
 class Clipboard;
 class CompositeEditCommand;
 class DeleteButtonController;
@@ -63,6 +62,7 @@ class SimpleFontData;
 class SpellChecker;
 class SpellCheckRequest;
 class SpellingCorrectionController;
+class StylePropertySet;
 class Text;
 class TextCheckerClient;
 class TextEvent;
@@ -130,7 +130,7 @@ public:
     bool shouldInsertText(const String&, Range*, EditorInsertAction) const;
     bool shouldShowDeleteInterface(HTMLElement*) const;
     bool shouldDeleteRange(Range*) const;
-    bool shouldApplyStyle(CSSStyleDeclaration*, Range*);
+    bool shouldApplyStyle(StylePropertySet*, Range*);
     
     void respondToChangedSelection(const VisibleSelection& oldSelection);
     void respondToChangedContents(const VisibleSelection& endingSelection);
@@ -138,7 +138,6 @@ public:
     bool selectionStartHasStyle(int propertyID, const String& value) const;
     TriState selectionHasStyle(int propertyID, const String& value) const;
     String selectionStartCSSPropertyValue(int propertyID);
-    WritingDirection textDirectionForSelection(bool&) const;
     
     TriState selectionUnorderedListState() const;
     TriState selectionOrderedListState() const;
@@ -162,10 +161,10 @@ public:
     Node* removedAnchor() const { return m_removedAnchor.get(); }
     void setRemovedAnchor(PassRefPtr<Node> n) { m_removedAnchor = n; }
 
-    void applyStyle(CSSStyleDeclaration*, EditAction = EditActionUnspecified);
-    void applyParagraphStyle(CSSStyleDeclaration*, EditAction = EditActionUnspecified);
-    void applyStyleToSelection(CSSStyleDeclaration*, EditAction);
-    void applyParagraphStyleToSelection(CSSStyleDeclaration*, EditAction);
+    void applyStyle(StylePropertySet*, EditAction = EditActionUnspecified);
+    void applyParagraphStyle(StylePropertySet*, EditAction = EditActionUnspecified);
+    void applyStyleToSelection(StylePropertySet*, EditAction);
+    void applyParagraphStyleToSelection(StylePropertySet*, EditAction);
 
     void appliedEditing(PassRefPtr<CompositeEditCommand>);
     void unappliedEditing(PassRefPtr<EditCommandComposition>);
@@ -346,7 +345,7 @@ public:
     const VisibleSelection& mark() const; // Mark, to be used as emacs uses it.
     void setMark(const VisibleSelection&);
 
-    void computeAndSetTypingStyle(CSSStyleDeclaration* , EditAction = EditActionUnspecified);
+    void computeAndSetTypingStyle(StylePropertySet* , EditAction = EditActionUnspecified);
     void applyEditingStyleToBodyElement() const;
     void applyEditingStyleToElement(Element*) const;
 
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index a2ad63372..a4137425d 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -103,11 +103,11 @@ static bool applyCommandToFrame(Frame* frame, EditorCommandSource source, EditAc
     // FIXME: We don't call shouldApplyStyle when the source is DOM; is there a good reason for that?
     switch (source) {
     case CommandFromMenuOrKeyBinding:
-        frame->editor()->applyStyleToSelection(style->ensureCSSStyleDeclaration(), action);
+        frame->editor()->applyStyleToSelection(style, action);
         return true;
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
-        frame->editor()->applyStyle(style->ensureCSSStyleDeclaration());
+        frame->editor()->applyStyle(style);
         return true;
     }
     ASSERT_NOT_REACHED();
@@ -179,11 +179,11 @@ static bool executeApplyParagraphStyle(Frame* frame, EditorCommandSource source,
     // FIXME: We don't call shouldApplyStyle when the source is DOM; is there a good reason for that?
     switch (source) {
     case CommandFromMenuOrKeyBinding:
-        frame->editor()->applyParagraphStyleToSelection(style->ensureCSSStyleDeclaration(), action);
+        frame->editor()->applyParagraphStyleToSelection(style.get(), action);
         return true;
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
-        frame->editor()->applyParagraphStyle(style->ensureCSSStyleDeclaration());
+        frame->editor()->applyParagraphStyle(style.get());
         return true;
     }
     ASSERT_NOT_REACHED();
@@ -241,7 +241,9 @@ static String valueStyle(Frame* frame, int propertyID)
 static TriState stateTextWritingDirection(Frame* frame, WritingDirection direction)
 {
     bool hasNestedOrMultipleEmbeddings;
-    WritingDirection selectionDirection = frame->editor()->textDirectionForSelection(hasNestedOrMultipleEmbeddings);
+    WritingDirection selectionDirection = EditingStyle::textDirectionForSelection(frame->selection()->selection(),
+        frame->selection()->typingStyle(), hasNestedOrMultipleEmbeddings);
+    // FXIME: We should be returning MixedTriState when selectionDirection == direction && hasNestedOrMultipleEmbeddings
     return (selectionDirection == direction && !hasNestedOrMultipleEmbeddings) ? TrueTriState : FalseTriState;
 }
 
@@ -583,7 +585,7 @@ static bool executeMakeTextWritingDirectionLeftToRight(Frame* frame, Event*, Edi
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
     style->setProperty(CSSPropertyDirection, CSSValueLtr);
-    frame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    frame->editor()->applyStyle(style.get(), EditActionSetWritingDirection);
     return true;
 }
 
@@ -591,7 +593,7 @@ static bool executeMakeTextWritingDirectionNatural(Frame* frame, Event*, EditorC
 {
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyUnicodeBidi, CSSValueNormal);
-    frame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    frame->editor()->applyStyle(style.get(), EditActionSetWritingDirection);
     return true;
 }
 
@@ -600,7 +602,7 @@ static bool executeMakeTextWritingDirectionRightToLeft(Frame* frame, Event*, Edi
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
     style->setProperty(CSSPropertyDirection, CSSValueRtl);
-    frame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    frame->editor()->applyStyle(style.get(), EditActionSetWritingDirection);
     return true;
 }
 
diff --git a/Source/WebCore/editing/FrameSelection.cpp b/Source/WebCore/editing/FrameSelection.cpp
index fc7286eba..de2d65d7e 100644
--- a/Source/WebCore/editing/FrameSelection.cpp
+++ b/Source/WebCore/editing/FrameSelection.cpp
@@ -425,10 +425,17 @@ static void updatePositionAfterAdoptingTextReplacement(Position& position, Chara
         position.moveToOffset(positionOffset - oldLength + newLength);
 }
 
+static inline bool nodeIsDetachedFromDocument(Node* node)
+{
+    ASSERT(node);
+    Node* highest = highestAncestor(node);
+    return highest->nodeType() == Node::DOCUMENT_FRAGMENT_NODE && !highest->isShadowRoot();
+}
+
 void FrameSelection::textWillBeReplaced(CharacterData* node, unsigned offset, unsigned oldLength, unsigned newLength)
 {
     // The fragment check is a performance optimization. See http://trac.webkit.org/changeset/30062.
-    if (isNone() || !node || highestAncestor(node)->nodeType() == Node::DOCUMENT_FRAGMENT_NODE)
+    if (isNone() || !node || nodeIsDetachedFromDocument(node))
         return;
 
     Position base = m_selection.base();
diff --git a/Source/WebCore/editing/InsertLineBreakCommand.cpp b/Source/WebCore/editing/InsertLineBreakCommand.cpp
index c8e8b83c3..f64763235 100644
--- a/Source/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/Source/WebCore/editing/InsertLineBreakCommand.cpp
@@ -137,7 +137,7 @@ void InsertLineBreakCommand::doApply()
         setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM, endingSelection().isDirectional()));
     } else if (pos.deprecatedNode()->isTextNode()) {
         // Split a text node
-        Text* textNode = static_cast<Text*>(pos.deprecatedNode());
+        Text* textNode = toText(pos.deprecatedNode());
         splitTextNode(textNode, pos.deprecatedEditingOffset());
         insertNodeBefore(nodeToInsert, textNode);
         Position endingPosition = firstPositionInNode(textNode);
diff --git a/Source/WebCore/editing/InsertListCommand.cpp b/Source/WebCore/editing/InsertListCommand.cpp
index dbc22ba7d..e4e357826 100644
--- a/Source/WebCore/editing/InsertListCommand.cpp
+++ b/Source/WebCore/editing/InsertListCommand.cpp
@@ -152,11 +152,11 @@ void InsertListCommand::doApply()
                 // FIXME: This is an inefficient way to keep selection alive because indexForVisiblePosition walks from
                 // the beginning of the document to the endOfSelection everytime this code is executed.
                 // But not using index is hard because there are so many ways we can lose selection inside doApplyForSingleParagraph.
-                Element* scope = 0;
-                int indexForEndOfSelection = indexForVisiblePosition(endOfSelection, &scope);
+                RefPtr<Element> scope;
+                int indexForEndOfSelection = indexForVisiblePosition(endOfSelection, scope);
                 doApplyForSingleParagraph(forceCreateList, listTag, currentSelection.get());
                 if (endOfSelection.isNull() || endOfSelection.isOrphan() || startOfLastParagraph.isNull() || startOfLastParagraph.isOrphan()) {
-                    endOfSelection = visiblePositionForIndex(indexForEndOfSelection, scope);
+                    endOfSelection = visiblePositionForIndex(indexForEndOfSelection, scope.get());
                     // If endOfSelection is null, then some contents have been deleted from the document.
                     // This should never happen and if it did, exit early immediately because we've lost the loop invariant.
                     ASSERT(endOfSelection.isNotNull());
diff --git a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 4aec419a1..46f3c8a5d 100644
--- a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -322,14 +322,14 @@ void InsertParagraphSeparatorCommand::doApply()
     // FIXME: leadingWhitespacePosition is returning the position before preserved newlines for positions
     // after the preserved newline, causing the newline to be turned into a nbsp.
     if (leadingWhitespace.isNotNull() && leadingWhitespace.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(leadingWhitespace.deprecatedNode());
+        Text* textNode = toText(leadingWhitespace.deprecatedNode());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
         replaceTextInNodePreservingMarkers(textNode, leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     
     // Split at pos if in the middle of a text node.
     if (insertionPosition.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(insertionPosition.deprecatedNode());
+        Text* textNode = toText(insertionPosition.deprecatedNode());
         bool atEnd = (unsigned)insertionPosition.deprecatedEditingOffset() >= textNode->length();
         if (insertionPosition.deprecatedEditingOffset() > 0 && !atEnd) {
             splitTextNode(textNode, insertionPosition.deprecatedEditingOffset());
@@ -389,7 +389,7 @@ void InsertParagraphSeparatorCommand::doApply()
             ASSERT(!insertionPosition.deprecatedNode()->renderer() || insertionPosition.deprecatedNode()->renderer()->style()->collapseWhiteSpace());
             deleteInsignificantTextDownstream(insertionPosition);
             if (insertionPosition.deprecatedNode()->isTextNode())
-                insertTextIntoNode(static_cast<Text*>(insertionPosition.deprecatedNode()), 0, nonBreakingSpaceString());
+                insertTextIntoNode(toText(insertionPosition.deprecatedNode()), 0, nonBreakingSpaceString());
         }
     }
 
diff --git a/Source/WebCore/editing/InsertTextCommand.cpp b/Source/WebCore/editing/InsertTextCommand.cpp
index b2c0af06e..39fa2a897 100644
--- a/Source/WebCore/editing/InsertTextCommand.cpp
+++ b/Source/WebCore/editing/InsertTextCommand.cpp
@@ -209,7 +209,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
 
     // keep tabs coalesced in tab span
     if (isTabSpanTextNode(node)) {
-        RefPtr<Text> textNode = static_cast<Text*>(node);
+        RefPtr<Text> textNode = toText(node);
         insertTextIntoNode(textNode, offset, "\t");
         return Position(textNode.release(), offset + 1);
     }
@@ -221,7 +221,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
     if (!node->isTextNode()) {
         insertNodeAt(spanNode.get(), insertPos);
     } else {
-        RefPtr<Text> textNode = static_cast<Text*>(node);
+        RefPtr<Text> textNode = toText(node);
         if (offset >= textNode->length())
             insertNodeAfter(spanNode, textNode.release());
         else {
diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
index 306a84655..476904ebc 100644
--- a/Source/WebCore/editing/MarkupAccumulator.cpp
+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
@@ -419,7 +419,7 @@ void MarkupAccumulator::appendStartMarkup(StringBuilder& result, const Node* nod
 
     switch (node->nodeType()) {
     case Node::TEXT_NODE:
-        appendText(result, static_cast<Text*>(const_cast<Node*>(node)));
+        appendText(result, toText(const_cast<Node*>(node)));
         break;
     case Node::COMMENT_NODE:
         appendComment(result, static_cast<const Comment*>(node)->data());
@@ -444,7 +444,6 @@ void MarkupAccumulator::appendStartMarkup(StringBuilder& result, const Node* nod
     case Node::ENTITY_REFERENCE_NODE:
     case Node::NOTATION_NODE:
     case Node::XPATH_NAMESPACE_NODE:
-    case Node::SHADOW_ROOT_NODE:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
index cbbba5225..ca5baba4b 100644
--- a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
+++ b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RemoveCSSPropertyCommand.h"
 
+#include "CSSStyleDeclaration.h"
 #include "StylePropertySet.h"
 #include <wtf/Assertions.h>
 
@@ -45,13 +46,17 @@ void RemoveCSSPropertyCommand::doApply()
     StylePropertySet* style = m_element->inlineStyleDecl();
     m_oldValue = style->getPropertyValue(m_property);
     m_important = style->propertyIsImportant(m_property);
-    style->removeProperty(m_property);
+
+    // Mutate using the CSSOM wrapper so we get the same event behavior as a script.
+    ExceptionCode ec;
+    // Setting to null string removes the property. We don't have internal version of removeProperty.
+    m_element->style()->setPropertyInternal(m_property, String(), false, ec);
 }
 
 void RemoveCSSPropertyCommand::doUnapply()
 {
-    StylePropertySet* style = m_element->inlineStyleDecl();
-    style->setProperty(m_property, m_oldValue, m_important);
+    ExceptionCode ec;
+    m_element->style()->setPropertyInternal(m_property, m_oldValue, m_important, ec);
 }
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index 8ce9446a9..95fdaf060 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -30,8 +30,8 @@
 #include "ApplyStyleCommand.h"
 #include "BeforeTextInsertedEvent.h"
 #include "BreakBlockquoteCommand.h"
-#include "CSSComputedStyleDeclaration.h"
 #include "CSSPropertyNames.h"
+#include "CSSStyleDeclaration.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "DocumentFragment.h"
@@ -293,6 +293,9 @@ void ReplacementFragment::removeUnrenderedNodes(Node* holder)
 
 void ReplacementFragment::removeInterchangeNodes(Node* container)
 {
+    m_hasInterchangeNewlineAtStart = false;
+    m_hasInterchangeNewlineAtEnd = false;
+
     // Interchange newlines at the "start" of the incoming fragment must be
     // either the first node in the fragment or the first leaf in the fragment.
     Node* node = container->firstChild();
@@ -531,10 +534,13 @@ void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(Insert
             // FIXME: Hyatt is concerned that selectively using display:inline will give inconsistent
             // results. We already know one issue because td elements ignore their display property
             // in quirks mode (which Mail.app is always in). We should look for an alternative.
+            
+            // Mutate using the CSSOM wrapper so we get the same event behavior as a script.
+            ExceptionCode ec;
             if (isBlock(element))
-                element->ensureInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueInline);
+                element->style()->setPropertyInternal(CSSPropertyDisplay, "inline", false, ec);
             if (element->renderer() && element->renderer()->style()->isFloating())
-                element->ensureInlineStyleDecl()->setProperty(CSSPropertyFloat, CSSValueNone);
+                element->style()->setPropertyInternal(CSSPropertyFloat, "none", false, ec);
         }
     }
 }
@@ -597,7 +603,7 @@ void ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds(InsertedNodes& ins
     document()->updateLayoutIgnorePendingStylesheets();
 
     Node* lastLeafInserted = insertedNodes.lastLeafInserted();
-    if (lastLeafInserted && lastLeafInserted->isTextNode() && !nodeHasVisibleRenderText(static_cast<Text*>(lastLeafInserted))
+    if (lastLeafInserted && lastLeafInserted->isTextNode() && !nodeHasVisibleRenderText(toText(lastLeafInserted))
         && !enclosingNodeWithTag(firstPositionInOrBeforeNode(lastLeafInserted), selectTag)
         && !enclosingNodeWithTag(firstPositionInOrBeforeNode(lastLeafInserted), scriptTag)) {
         insertedNodes.willRemoveNode(lastLeafInserted);
@@ -608,7 +614,7 @@ void ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds(InsertedNodes& ins
     // it is a top level node in the fragment and the user can't insert into those elements.
     Node* firstNodeInserted = insertedNodes.firstNodeInserted();
     lastLeafInserted = insertedNodes.lastLeafInserted();
-    if (firstNodeInserted && firstNodeInserted->isTextNode() && !nodeHasVisibleRenderText(static_cast<Text*>(firstNodeInserted))) {
+    if (firstNodeInserted && firstNodeInserted->isTextNode() && !nodeHasVisibleRenderText(toText(firstNodeInserted))) {
         insertedNodes.willRemoveNode(firstNodeInserted);
         removeNode(firstNodeInserted);
     }
@@ -1189,7 +1195,7 @@ void ReplaceSelectionCommand::addSpacesForSmartReplace()
     if (needsTrailingSpace && endNode) {
         bool collapseWhiteSpace = !endNode->renderer() || endNode->renderer()->style()->collapseWhiteSpace();
         if (endNode->isTextNode()) {
-            Text* text = static_cast<Text*>(endNode);
+            Text* text = toText(endNode);
             // FIXME: we shouldn't always be inserting the space at the end
             insertTextIntoNode(text, text->length(), collapseWhiteSpace ? nonBreakingSpaceString() : " ");
             if (m_endOfInsertedContent.containerNode() == text)
@@ -1213,7 +1219,7 @@ void ReplaceSelectionCommand::addSpacesForSmartReplace()
     if (needsLeadingSpace && startNode) {
         bool collapseWhiteSpace = !startNode->renderer() || startNode->renderer()->style()->collapseWhiteSpace();
         if (startNode->isTextNode()) {
-            insertTextIntoNode(static_cast<Text*>(startNode), startOffset, collapseWhiteSpace ? nonBreakingSpaceString() : " ");
+            insertTextIntoNode(toText(startNode), startOffset, collapseWhiteSpace ? nonBreakingSpaceString() : " ");
             if (m_endOfInsertedContent.containerNode() == startNode && m_endOfInsertedContent.offsetInContainerNode())
                 m_endOfInsertedContent.moveToOffset(m_endOfInsertedContent.offsetInContainerNode() + 1);
         } else {
@@ -1279,7 +1285,7 @@ Node* ReplaceSelectionCommand::insertAsListItems(PassRefPtr<Node> prpListElement
     if (isMiddle) {
         int textNodeOffset = insertPos.offsetInContainerNode();
         if (insertPos.deprecatedNode()->isTextNode() && textNodeOffset > 0)
-            splitTextNode(static_cast<Text*>(insertPos.deprecatedNode()), textNodeOffset);
+            splitTextNode(toText(insertPos.deprecatedNode()), textNodeOffset);
         splitTreeToNode(insertPos.deprecatedNode(), lastNode, true);
     }
 
@@ -1333,7 +1339,7 @@ bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& f
         return false;
 
     Node* nodeAfterInsertionPos = endingSelection().end().downstream().anchorNode();
-    Text* textNode = static_cast<Text*>(fragment.firstChild());
+    Text* textNode = toText(fragment.firstChild());
     // Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
 
     Position start = endingSelection().start();
diff --git a/Source/WebCore/editing/SpellChecker.cpp b/Source/WebCore/editing/SpellChecker.cpp
index 683644c6d..e1243b14d 100644
--- a/Source/WebCore/editing/SpellChecker.cpp
+++ b/Source/WebCore/editing/SpellChecker.cpp
@@ -47,12 +47,13 @@ namespace WebCore {
 
 static const int unrequestedSequence = -1;
 
-SpellCheckRequest::SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String& text, TextCheckingTypeMask mask)
+SpellCheckRequest::SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String& text, TextCheckingTypeMask mask, TextCheckingProcessType processType)
     : m_sequence(sequence)
-    , m_checkingRange(checkingRange)
-    , m_paragraphRange(paragraphRange)
     , m_text(text)
     , m_mask(mask)
+    , m_processType(processType)
+    , m_checkingRange(checkingRange)
+    , m_paragraphRange(paragraphRange)
     , m_rootEditableElement(m_checkingRange->startContainer()->rootEditableElement())
 {
 }
@@ -62,7 +63,7 @@ SpellCheckRequest::~SpellCheckRequest()
 }
 
 // static
-PassRefPtr<SpellCheckRequest> SpellCheckRequest::create(TextCheckingTypeMask textCheckingOptions, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange)
+PassRefPtr<SpellCheckRequest> SpellCheckRequest::create(TextCheckingTypeMask textCheckingOptions, TextCheckingProcessType processType, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange)
 {
     ASSERT(checkingRange);
     ASSERT(paragraphRange);
@@ -71,7 +72,7 @@ PassRefPtr<SpellCheckRequest> SpellCheckRequest::create(TextCheckingTypeMask tex
     if (!text.length())
         return PassRefPtr<SpellCheckRequest>();
 
-    return adoptRef(new SpellCheckRequest(unrequestedSequence, checkingRange, paragraphRange, text, textCheckingOptions));
+    return adoptRef(new SpellCheckRequest(unrequestedSequence, checkingRange, paragraphRange, text, textCheckingOptions, processType));
 }
 
 
@@ -145,7 +146,7 @@ void SpellChecker::invokeRequest(PassRefPtr<SpellCheckRequest> request)
     ASSERT(!m_processingRequest);
 
     m_processingRequest = request;
-    client()->requestCheckingOfString(this, m_processingRequest->sequence(), m_processingRequest->mask(), m_processingRequest->text());
+    client()->requestCheckingOfString(this, m_processingRequest->textCheckingRequest());
 }
 
 void SpellChecker::enqueueRequest(PassRefPtr<SpellCheckRequest> request)
diff --git a/Source/WebCore/editing/SpellChecker.h b/Source/WebCore/editing/SpellChecker.h
index 20306da1a..07f51e431 100644
--- a/Source/WebCore/editing/SpellChecker.h
+++ b/Source/WebCore/editing/SpellChecker.h
@@ -46,10 +46,12 @@ struct TextCheckingResult;
 
 class SpellCheckRequest : public RefCounted<SpellCheckRequest> {
 public:
-    SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String&, TextCheckingTypeMask);
+    SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String&, TextCheckingTypeMask, TextCheckingProcessType);
     ~SpellCheckRequest();
 
-    static PassRefPtr<SpellCheckRequest> create(TextCheckingTypeMask, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange);
+    static PassRefPtr<SpellCheckRequest> create(TextCheckingTypeMask, TextCheckingProcessType, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange);
+
+    TextCheckingRequest textCheckingRequest() const;
 
     void setSequence(int sequence) { m_sequence = sequence; }
     int sequence() const { return m_sequence; }
@@ -57,14 +59,15 @@ public:
     PassRefPtr<Range> paragraphRange() const { return m_paragraphRange; }
     const String& text() const { return m_text; }
     TextCheckingTypeMask mask() const { return m_mask; }
+    TextCheckingProcessType processType() const { return m_processType; }
     PassRefPtr<Element> rootEditableElement() const { return m_rootEditableElement; }
 private:
-
     int m_sequence;
-    RefPtr<Range> m_checkingRange;
-    RefPtr<Range> m_paragraphRange;
     String m_text;
     TextCheckingTypeMask m_mask;
+    TextCheckingProcessType m_processType;
+    RefPtr<Range> m_checkingRange;
+    RefPtr<Range> m_paragraphRange;
     RefPtr<Element> m_rootEditableElement;
 };
 
@@ -109,6 +112,11 @@ private:
     RequestQueue m_requestQueue;
 };
 
+inline TextCheckingRequest SpellCheckRequest::textCheckingRequest() const
+{
+    return TextCheckingRequest(m_sequence, m_text, m_mask, m_processType);
+}
+
 } // namespace WebCore
 
 #endif // SpellChecker_h
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index c1c79f28a..aaeca4f9a 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -487,25 +487,20 @@ bool TextIterator::handleTextNode()
         return true;
     }
 
-    if (!renderer->firstTextBox() && str.length() > 0) {
-        if (!m_handledFirstLetter && renderer->isTextFragment()) {
-            handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
-            if (m_firstLetterText) {
-                handleTextBox();
-                return false;
-            }
-        }
+    if (renderer->firstTextBox())
+        m_textBox = renderer->firstTextBox();
+
+    bool shouldHandleFirstLetter = !m_handledFirstLetter && renderer->isTextFragment() && !m_offset;
+    if (shouldHandleFirstLetter)
+        handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
+
+    if (!renderer->firstTextBox() && str.length() > 0 && !shouldHandleFirstLetter) {
         if (renderer->style()->visibility() != VISIBLE && !m_ignoresStyleVisibility)
             return false;
         m_lastTextNodeEndedWithCollapsedSpace = true; // entire block is collapsed space
         return true;
     }
 
-    
-    m_textBox = renderer->firstTextBox();
-    if (!m_handledFirstLetter && renderer->isTextFragment() && !m_offset)
-        handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
-
     if (m_firstLetterText)
         renderer = m_firstLetterText;
 
@@ -562,6 +557,7 @@ void TextIterator::handleTextBox()
                 nextTextBox = m_sortedTextBoxes[m_sortedTextBoxesPosition + 1];
         } else 
             nextTextBox = m_textBox->nextTextBox();
+        ASSERT(!nextTextBox || nextTextBox->renderer() == renderer);
 
         if (runStart < runEnd) {
             // Handle either a single newline character (which becomes a space),
@@ -630,6 +626,7 @@ void TextIterator::handleTextNodeFirstLetter(RenderTextFragment* renderer)
             m_handledFirstLetter = true;
             m_remainingTextBox = m_textBox;
             m_textBox = firstLetter->firstTextBox();
+            m_sortedTextBoxes.clear();
             m_firstLetterText = firstLetter;
         }
     }
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index 28cc029d0..07046100e 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -1033,7 +1033,7 @@ bool lineBreakExistsAtPosition(const Position& position)
     if (!position.anchorNode()->isTextNode() || !position.anchorNode()->renderer()->style()->preserveNewline())
         return false;
     
-    Text* textNode = static_cast<Text*>(position.anchorNode());
+    Text* textNode = toText(position.anchorNode());
     unsigned offset = position.offsetInContainerNode();
     return offset < textNode->length() && textNode->data()[offset] == '\n';
 }
@@ -1072,31 +1072,24 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection& original
 // opertion is unreliable. TextIterator's TextIteratorEmitsCharactersBetweenAllVisiblePositions mode needs to be fixed, 
 // or these functions need to be changed to iterate using actual VisiblePositions.
 // FIXME: Deploy these functions everywhere that TextIterators are used to convert between VisiblePositions and indices.
-int indexForVisiblePosition(const VisiblePosition& visiblePosition, Element **scope)
+int indexForVisiblePosition(const VisiblePosition& visiblePosition, RefPtr<Element>& scope)
 {
     if (visiblePosition.isNull())
         return 0;
-        
+
     Position p(visiblePosition.deepEquivalent());
     Document* document = p.anchorNode()->document();
-    
-    Element* root;
     Node* shadowRoot = p.anchorNode()->shadowTreeRootNode();
-    
+
     if (shadowRoot) {
         // Use the shadow root for form elements, since TextIterators will not enter shadow content.
         ASSERT(shadowRoot->isElementNode());
-        root = static_cast<Element*>(shadowRoot);
+        scope = static_cast<Element*>(shadowRoot);
     } else
-        root = document->documentElement();
-    
-    if (scope) {
-        ASSERT(!*scope);
-        *scope = root;
-    }
-    
-    RefPtr<Range> range = Range::create(document, firstPositionInNode(root), p.parentAnchoredEquivalent());
-    
+        scope = document->documentElement();
+
+    RefPtr<Range> range = Range::create(document, firstPositionInNode(scope.get()), p.parentAnchoredEquivalent());
+
     return TextIterator::rangeLength(range.get(), true);
 }
 
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index 0f2d1bdc0..abb49e312 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -180,7 +180,7 @@ bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
     
 int comparePositions(const VisiblePosition&, const VisiblePosition&);
 
-int indexForVisiblePosition(const VisiblePosition&, Element **scope);
+int indexForVisiblePosition(const VisiblePosition&, RefPtr<Element>& scope);
 VisiblePosition visiblePositionForIndex(int index, Element *scope);
 
 // -------------------------------------------------------------------------
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 423924fa4..2f5833674 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -37,6 +37,8 @@
 #import "FrameView.h"
 #import "HTMLNames.h"
 #import "Pasteboard.h"
+#import "PasteboardStrategy.h"
+#import "PlatformStrategies.h"
 #import "RenderBlock.h"
 #import "RuntimeApplicationChecks.h"
 #import "Sound.h"
@@ -49,7 +51,7 @@ using namespace HTMLNames;
 PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy, Frame* frame)
 {
     return ClipboardMac::create(Clipboard::CopyAndPaste,
-        policy == ClipboardWritable ? [NSPasteboard pasteboardWithUniqueName] : [NSPasteboard generalPasteboard], policy, frame);
+        policy == ClipboardWritable ? platformStrategies()->pasteboardStrategy()->uniqueName() : String(NSGeneralPboard), policy, frame);
 }
 
 void Editor::showFontPanel()
@@ -289,11 +291,8 @@ void Editor::takeFindStringFromSelection()
 
 void Editor::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes)
 {
-    RetainPtr<NSMutableArray> types(AdoptNS, [[NSMutableArray alloc] init]);    
-    for (size_t i = 0; i < pasteboardTypes.size(); ++i)
-        [types.get() addObject:pasteboardTypes[i]];
     Pasteboard pasteboard(pasteboardName);
-    pasteboard.writeSelectionForTypes(types.get(), selectedRange().get(), true, m_frame);
+    pasteboard.writeSelectionForTypes(pasteboardTypes, selectedRange().get(), true, m_frame);
 }
     
 void Editor::readSelectionFromPasteboard(const String& pasteboardName)
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index c9a0e78dd..c0c0bf4db 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -30,7 +30,6 @@
 #include "markup.h"
 
 #include "CDATASection.h"
-#include "CSSComputedStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index ece6f233f..db8925946 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -361,7 +361,7 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c, LineEndpoi
         }
     }
 
-    return startNode->isTextNode() ? Position(static_cast<Text*>(startNode), toInlineTextBox(startBox)->start())
+    return startNode->isTextNode() ? Position(toText(startNode), toInlineTextBox(startBox)->start())
         : positionBeforeNode(startNode);
 }
 
@@ -441,7 +441,7 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c, LineEndpoint
         int endOffset = endTextBox->start();
         if (!endTextBox->isLineBreak())
             endOffset += endTextBox->len();
-        pos = Position(static_cast<Text*>(endNode), endOffset);
+        pos = Position(toText(endNode), endOffset);
     } else
         pos = positionAfterNode(endNode);
     
@@ -545,7 +545,7 @@ static inline IntPoint absoluteLineDirectionPointToLocalPointInBlock(RootInlineB
     RenderBlock* containingBlock = root->block();
     FloatPoint absoluteBlockPoint = containingBlock->localToAbsolute(FloatPoint());
     if (containingBlock->hasOverflowClip())
-        absoluteBlockPoint -= containingBlock->layer()->scrolledContentOffset();
+        absoluteBlockPoint -= containingBlock->scrolledContentOffset();
 
     if (root->block()->isHorizontalWritingMode())
         return IntPoint(lineDirectionPoint - absoluteBlockPoint.x(), root->blockDirectionPointInLine());
@@ -834,7 +834,7 @@ VisiblePosition startOfParagraph(const VisiblePosition& c, EditingBoundaryCrossi
                     i = max(0, o);
                 while (--i >= 0) {
                     if (chars[i] == '\n')
-                        return VisiblePosition(Position(static_cast<Text*>(n), i + 1), DOWNSTREAM);
+                        return VisiblePosition(Position(toText(n), i + 1), DOWNSTREAM);
                 }
             }
             node = n;
@@ -910,7 +910,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c, EditingBoundaryCrossing
                 int o = n == startNode ? offset : 0;
                 for (int i = o; i < length; ++i) {
                     if (chars[i] == '\n')
-                        return VisiblePosition(Position(static_cast<Text*>(n), i), DOWNSTREAM);
+                        return VisiblePosition(Position(toText(n), i), DOWNSTREAM);
                 }
             }
             node = n;
diff --git a/Source/WebCore/fileapi/Blob.idl b/Source/WebCore/fileapi/Blob.idl
index 1400dc1b3..29c5141d2 100644
--- a/Source/WebCore/fileapi/Blob.idl
+++ b/Source/WebCore/fileapi/Blob.idl
@@ -32,7 +32,7 @@ module html {
 
     interface [
         JSGenerateIsReachable=Impl,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] Blob {
         readonly attribute unsigned long long size;
diff --git a/Source/WebCore/fileapi/DOMFileSystem.cpp b/Source/WebCore/fileapi/DOMFileSystem.cpp
index ac386903b..9799e1207 100644
--- a/Source/WebCore/fileapi/DOMFileSystem.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystem.cpp
@@ -56,8 +56,9 @@ namespace WebCore {
 PassRefPtr<DOMFileSystem> DOMFileSystem::create(ScriptExecutionContext* context, const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
 {
     RefPtr<DOMFileSystem> fileSystem(adoptRef(new DOMFileSystem(context, name, asyncFileSystem)));
+    fileSystem->suspendIfNeeded();
     InspectorInstrumentation::didOpenFileSystem(fileSystem.get());
-    return fileSystem;
+    return fileSystem.release();
 }
 
 DOMFileSystem::DOMFileSystem(ScriptExecutionContext* context, const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
diff --git a/Source/WebCore/fileapi/DOMWindowFileSystem.cpp b/Source/WebCore/fileapi/DOMWindowFileSystem.cpp
new file mode 100644
index 000000000..570c39db2
--- /dev/null
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMWindowFileSystem.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include "DOMFileSystem.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "EntryCallback.h"
+#include "ErrorCallback.h"
+#include "FileError.h"
+#include "FileSystemCallback.h"
+#include "FileSystemCallbacks.h"
+#include "LocalFileSystem.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+DOMWindowFileSystem::DOMWindowFileSystem()
+{
+}
+
+DOMWindowFileSystem::~DOMWindowFileSystem()
+{
+}
+
+void DOMWindowFileSystem::webkitRequestFileSystem(DOMWindow* window, int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    if (!window->isCurrentlyDisplayedInFrame())
+        return;
+
+    Document* document = window->document();
+    if (!document)
+        return;
+
+    if (!AsyncFileSystem::isAvailable() || !document->securityOrigin()->canAccessFileSystem()) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
+    if (!AsyncFileSystem::isValidType(fileSystemType)) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
+}
+
+void DOMWindowFileSystem::webkitResolveLocalFileSystemURL(DOMWindow* window, const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    if (!window->isCurrentlyDisplayedInFrame())
+        return;
+
+    Document* document = window->document();
+    if (!document)
+        return;
+
+    SecurityOrigin* securityOrigin = document->securityOrigin();
+    KURL completedURL = document->completeURL(url);
+    if (!AsyncFileSystem::isAvailable() || !securityOrigin->canAccessFileSystem() || !securityOrigin->canRequest(completedURL)) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::ENCODING_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().readFileSystem(document, type, ResolveURICallbacks::create(successCallback, errorCallback, document, filePath));
+}
+
+COMPILE_ASSERT(static_cast<int>(DOMWindowFileSystem::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
+COMPILE_ASSERT(static_cast<int>(DOMWindowFileSystem::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/Source/WebCore/fileapi/DOMWindowFileSystem.h b/Source/WebCore/fileapi/DOMWindowFileSystem.h
new file mode 100644
index 000000000..2783553a1
--- /dev/null
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef DOMWindowFileSystem_h
+#define DOMWindowFileSystem_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class DOMWindow;
+class EntryCallback;
+class ErrorCallback;
+class FileSystemCallback;
+
+class DOMWindowFileSystem {
+public:
+
+    static void webkitRequestFileSystem(DOMWindow*, int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
+    static void webkitResolveLocalFileSystemURL(DOMWindow*, const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+
+    // They are placed here and in all capital letters so they can be checked against the constants in the
+    // IDL at compile time.
+    enum FileSystemType {
+        TEMPORARY,
+        PERSISTENT,
+    };
+
+private:
+    DOMWindowFileSystem();
+    ~DOMWindowFileSystem();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // DOMWindowFileSystem_h
diff --git a/Source/WebCore/css/FontFamilyValue.h b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
index b2fbaa29b..79947cbd7 100644
--- a/Source/WebCore/css/FontFamilyValue.h
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
@@ -1,6 +1,5 @@
 /*
- * (C) 1999-2003 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -18,33 +17,19 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef FontFamilyValue_h
-#define FontFamilyValue_h
+module window {
 
-#include "CSSPrimitiveValue.h"
-#include "PlatformString.h"
+    interface [
+        Conditional=FILE_SYSTEM,
+        Supplemental=DOMWindow
+    ] DOMWindowFileSystem {
+        const unsigned short TEMPORARY = 0;
+        const unsigned short PERSISTENT = 1;
 
-namespace WebCore {
+        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size,
+                in [Callback] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url,
+                in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+    };
 
-class FontFamilyValue : public CSSPrimitiveValue {
-public:
-    static PassRefPtr<FontFamilyValue> create(const String& familyName)
-    {
-        return adoptRef(new FontFamilyValue(familyName));
-    }
-
-    void appendSpaceSeparated(const UChar* characters, unsigned length);
-
-    const String& familyName() const { return m_familyName; }
-
-    String customCssText() const;
-
-private:
-    FontFamilyValue(const String& familyName);
-
-    String m_familyName;
-};
-
-} // namespace
-
-#endif
+}
diff --git a/Source/WebCore/fileapi/DirectoryEntry.idl b/Source/WebCore/fileapi/DirectoryEntry.idl
index 7d9246502..c6c9ae9bb 100644
--- a/Source/WebCore/fileapi/DirectoryEntry.idl
+++ b/Source/WebCore/fileapi/DirectoryEntry.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] DirectoryEntry : Entry {
         DirectoryReader createReader();
diff --git a/Source/WebCore/fileapi/DirectoryEntrySync.idl b/Source/WebCore/fileapi/DirectoryEntrySync.idl
index e4ca8d7ea..66c288fbb 100644
--- a/Source/WebCore/fileapi/DirectoryEntrySync.idl
+++ b/Source/WebCore/fileapi/DirectoryEntrySync.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] DirectoryEntrySync : EntrySync {
         DirectoryReaderSync createReader() raises (FileException);
diff --git a/Source/WebCore/fileapi/Entry.idl b/Source/WebCore/fileapi/Entry.idl
index 4be6c8b75..c6cdba5bd 100644
--- a/Source/WebCore/fileapi/Entry.idl
+++ b/Source/WebCore/fileapi/Entry.idl
@@ -31,7 +31,7 @@
 module storage {
     interface [
         Conditional=FILE_SYSTEM,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] Entry {
         readonly attribute boolean isFile;
diff --git a/Source/WebCore/fileapi/EntrySync.idl b/Source/WebCore/fileapi/EntrySync.idl
index 2db476d33..cd4bae7de 100644
--- a/Source/WebCore/fileapi/EntrySync.idl
+++ b/Source/WebCore/fileapi/EntrySync.idl
@@ -31,7 +31,7 @@
 module storage {
     interface [
         Conditional=FILE_SYSTEM,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] EntrySync {
         readonly attribute boolean isFile;
diff --git a/Source/WebCore/fileapi/File.idl b/Source/WebCore/fileapi/File.idl
index 4a6bbd3cb..4c3bafc27 100644
--- a/Source/WebCore/fileapi/File.idl
+++ b/Source/WebCore/fileapi/File.idl
@@ -27,7 +27,7 @@ module html {
 
     interface [
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] File : Blob {
         readonly attribute DOMString name;
diff --git a/Source/WebCore/fileapi/FileEntry.idl b/Source/WebCore/fileapi/FileEntry.idl
index d176cdeb8..63b004050 100644
--- a/Source/WebCore/fileapi/FileEntry.idl
+++ b/Source/WebCore/fileapi/FileEntry.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] FileEntry : Entry {
         void createWriter(in [Callback] FileWriterCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
diff --git a/Source/WebCore/fileapi/FileEntrySync.idl b/Source/WebCore/fileapi/FileEntrySync.idl
index 0d79250da..8ac40baa2 100644
--- a/Source/WebCore/fileapi/FileEntrySync.idl
+++ b/Source/WebCore/fileapi/FileEntrySync.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] FileEntrySync : EntrySync {
         File file() raises (FileException);
diff --git a/Source/WebCore/fileapi/FileReader.cpp b/Source/WebCore/fileapi/FileReader.cpp
index 29c598470..07c4b6746 100644
--- a/Source/WebCore/fileapi/FileReader.cpp
+++ b/Source/WebCore/fileapi/FileReader.cpp
@@ -48,6 +48,13 @@ namespace WebCore {
 
 static const double progressNotificationIntervalMS = 50;
 
+PassRefPtr<FileReader> FileReader::create(ScriptExecutionContext* context)
+{
+    RefPtr<FileReader> fileReader(adoptRef(new FileReader(context)));
+    fileReader->suspendIfNeeded();
+    return fileReader.release();
+}
+
 FileReader::FileReader(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(EMPTY)
diff --git a/Source/WebCore/fileapi/FileReader.h b/Source/WebCore/fileapi/FileReader.h
index 804dd291b..ecdd4856c 100644
--- a/Source/WebCore/fileapi/FileReader.h
+++ b/Source/WebCore/fileapi/FileReader.h
@@ -51,10 +51,7 @@ typedef int ExceptionCode;
 
 class FileReader : public RefCounted<FileReader>, public ActiveDOMObject, public EventTarget, public FileReaderLoaderClient {
 public:
-    static PassRefPtr<FileReader> create(ScriptExecutionContext* context)
-    {
-        return adoptRef(new FileReader(context));
-    }
+    static PassRefPtr<FileReader> create(ScriptExecutionContext*);
 
     virtual ~FileReader();
 
diff --git a/Source/WebCore/fileapi/FileReaderLoader.cpp b/Source/WebCore/fileapi/FileReaderLoader.cpp
index 5fb6061c0..e55149a31 100644
--- a/Source/WebCore/fileapi/FileReaderLoader.cpp
+++ b/Source/WebCore/fileapi/FileReaderLoader.cpp
@@ -68,7 +68,8 @@ FileReaderLoader::FileReaderLoader(ReadType readType, FileReaderLoaderClient* cl
 FileReaderLoader::~FileReaderLoader()
 {
     terminate();
-    ThreadableBlobRegistry::unregisterBlobURL(m_urlForReading);
+    if (!m_urlForReading.isEmpty())
+        ThreadableBlobRegistry::unregisterBlobURL(m_urlForReading);
 }
 
 void FileReaderLoader::start(ScriptExecutionContext* scriptExecutionContext, Blob* blob)
diff --git a/Source/WebCore/fileapi/FileReaderSync.cpp b/Source/WebCore/fileapi/FileReaderSync.cpp
index 1fe5c7f73..79e5200ea 100644
--- a/Source/WebCore/fileapi/FileReaderSync.cpp
+++ b/Source/WebCore/fileapi/FileReaderSync.cpp
@@ -49,8 +49,10 @@ FileReaderSync::FileReaderSync()
 
 PassRefPtr<ArrayBuffer> FileReaderSync::readAsArrayBuffer(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return 0;
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsArrayBuffer, 0);
     startLoading(scriptExecutionContext, loader, blob, ec);
@@ -60,8 +62,10 @@ PassRefPtr<ArrayBuffer> FileReaderSync::readAsArrayBuffer(ScriptExecutionContext
 
 String FileReaderSync::readAsBinaryString(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return String();
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsBinaryString, 0);
     startLoading(scriptExecutionContext, loader, blob, ec);
@@ -70,8 +74,10 @@ String FileReaderSync::readAsBinaryString(ScriptExecutionContext* scriptExecutio
 
 String FileReaderSync::readAsText(ScriptExecutionContext* scriptExecutionContext, Blob* blob, const String& encoding, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return String();
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsText, 0);
     loader.setEncoding(encoding);
@@ -81,8 +87,10 @@ String FileReaderSync::readAsText(ScriptExecutionContext* scriptExecutionContext
 
 String FileReaderSync::readAsDataURL(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return String();
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsDataURL, 0);
     loader.setDataType(blob->type());
diff --git a/Source/WebCore/fileapi/FileReaderSync.idl b/Source/WebCore/fileapi/FileReaderSync.idl
index 77250da29..920f36840 100644
--- a/Source/WebCore/fileapi/FileReaderSync.idl
+++ b/Source/WebCore/fileapi/FileReaderSync.idl
@@ -36,11 +36,11 @@ module html {
     ] FileReaderSync {
         [CallWith=ScriptExecutionContext] ArrayBuffer readAsArrayBuffer(in Blob blob)
             raises(FileException);
-        [CallWith=ScriptExecutionContext, ConvertScriptString] DOMString readAsBinaryString(in Blob blob)
+        [CallWith=ScriptExecutionContext] DOMString readAsBinaryString(in Blob blob)
             raises(FileException);
-        [CallWith=ScriptExecutionContext, ConvertScriptString] DOMString readAsText(in Blob blob, in [Optional] DOMString encoding)
+        [CallWith=ScriptExecutionContext] DOMString readAsText(in Blob blob, in [Optional] DOMString encoding)
             raises(FileException);
-        [CallWith=ScriptExecutionContext, ConvertScriptString] DOMString readAsDataURL(in Blob blob)
+        [CallWith=ScriptExecutionContext] DOMString readAsDataURL(in Blob blob)
             raises(FileException);
     };
 }
diff --git a/Source/WebCore/fileapi/FileThread.cpp b/Source/WebCore/fileapi/FileThread.cpp
index 4d55630e4..82bc686f6 100644
--- a/Source/WebCore/fileapi/FileThread.cpp
+++ b/Source/WebCore/fileapi/FileThread.cpp
@@ -83,13 +83,13 @@ void FileThread::unscheduleTasks(const void* instance)
     m_queue.removeIf(predicate);
 }
 
-void* FileThread::fileThreadStart(void* arg)
+void FileThread::fileThreadStart(void* arg)
 {
     FileThread* fileThread = static_cast<FileThread*>(arg);
-    return fileThread->runLoop();
+    fileThread->runLoop();
 }
 
-void* FileThread::runLoop()
+void FileThread::runLoop()
 {
     {
         // Wait for FileThread::start() to complete to have m_threadID
@@ -110,8 +110,6 @@ void* FileThread::runLoop()
 
     // Clear the self refptr, possibly resulting in deletion
     m_selfRef = 0;
-
-    return 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/fileapi/FileThread.h b/Source/WebCore/fileapi/FileThread.h
index 9c1d267b3..6c3255b57 100644
--- a/Source/WebCore/fileapi/FileThread.h
+++ b/Source/WebCore/fileapi/FileThread.h
@@ -72,8 +72,8 @@ public:
 private:
     FileThread();
 
-    static void* fileThreadStart(void*);
-    void* runLoop();
+    static void fileThreadStart(void*);
+    void runLoop();
 
     ThreadIdentifier m_threadID;
     RefPtr<FileThread> m_selfRef;
diff --git a/Source/WebCore/fileapi/FileWriter.cpp b/Source/WebCore/fileapi/FileWriter.cpp
index 2b25cfaf9..7cd9b8348 100644
--- a/Source/WebCore/fileapi/FileWriter.cpp
+++ b/Source/WebCore/fileapi/FileWriter.cpp
@@ -45,6 +45,13 @@ namespace WebCore {
 
 static const int kMaxRecursionDepth = 3;
 
+PassRefPtr<FileWriter> FileWriter::create(ScriptExecutionContext* context)
+{
+    RefPtr<FileWriter> fileWriter(adoptRef(new FileWriter(context)));
+    fileWriter->suspendIfNeeded();
+    return fileWriter.release();
+}
+
 FileWriter::FileWriter(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_readyState(INIT)
diff --git a/Source/WebCore/fileapi/FileWriter.h b/Source/WebCore/fileapi/FileWriter.h
index 2b597a188..946135072 100644
--- a/Source/WebCore/fileapi/FileWriter.h
+++ b/Source/WebCore/fileapi/FileWriter.h
@@ -48,10 +48,7 @@ class ScriptExecutionContext;
 
 class FileWriter : public FileWriterBase, public ActiveDOMObject, public EventTarget, public AsyncFileWriterClient {
 public:
-    static PassRefPtr<FileWriter> create(ScriptExecutionContext* context)
-    {
-        return adoptRef(new FileWriter(context));
-    }
+    static PassRefPtr<FileWriter> create(ScriptExecutionContext*);
 
     enum ReadyState {
         INIT = 0,
diff --git a/Source/WebCore/history/BackForwardController.cpp b/Source/WebCore/history/BackForwardController.cpp
index d89c9a550..1e8819aae 100644
--- a/Source/WebCore/history/BackForwardController.cpp
+++ b/Source/WebCore/history/BackForwardController.cpp
@@ -116,7 +116,13 @@ void BackForwardController::markPagesForFullStyleRecalc()
     for (int i = first; i <= last; i++) {
         if (!i)
             continue;
-        itemAtIndex(i)->markForFullStyleRecalc();
+
+        // FIXME: itemAtIndex should never return null here, but due to the way the
+        // back/forward list is implemented in WebKit2 it sometimes can, when the
+        // session has been updated in the UI process but the session update message
+        // hasn't yet reached the web process.
+        if (HistoryItem* historyItem = itemAtIndex(i))
+            historyItem->markForFullStyleRecalc();
     }
 }
 
diff --git a/Source/WebCore/history/CachedFrame.cpp b/Source/WebCore/history/CachedFrame.cpp
index 60fab043f..9b0d2fe82 100644
--- a/Source/WebCore/history/CachedFrame.cpp
+++ b/Source/WebCore/history/CachedFrame.cpp
@@ -168,7 +168,6 @@ CachedFrame::CachedFrame(Frame* frame)
     // but after we've fired the pagehide event, in case that creates more objects.
     // Suspending must also happen after we've recursed over child frames, in case
     // those create more objects.
-    // FIXME: It's still possible to have objects created after suspending in some cases, see http://webkit.org/b/53733 for more details.
     m_document->documentWillSuspendForPageCache();
     m_document->suspendScriptedAnimationControllerCallbacks();
     m_document->suspendActiveDOMObjects(ActiveDOMObject::DocumentWillBecomeInactive);
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index 2a083619c..a0d5de4d9 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -199,11 +199,11 @@ static void logCanCachePageDecision(Page* page)
         cannotCache = true;
     }
 #if ENABLE(DEVICE_ORIENTATION)
-    if (page->deviceMotionController() && page->deviceMotionController()->isActive()) {
+    if (DeviceMotionController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceMotion");
         cannotCache = true;
     }
-    if (page->deviceOrientationController() && page->deviceOrientationController()->isActive()) {
+    if (DeviceOrientationController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceOrientation");
         cannotCache = true;
     }
@@ -251,29 +251,33 @@ bool PageCache::canCachePageContainingThisFrame(Frame* frame)
             return false;
     }
     
-    return frame->loader()->documentLoader()
-        && frame->loader()->documentLoader()->mainDocumentError().isNull()
+    FrameLoader* frameLoader = frame->loader();
+    DocumentLoader* documentLoader = frameLoader->documentLoader();
+    Document* document = frame->document();
+    
+    return documentLoader
+        && documentLoader->mainDocumentError().isNull()
         // Do not cache error pages (these can be recognized as pages with substitute data or unreachable URLs).
-        && !(frame->loader()->documentLoader()->substituteData().isValid() && !frame->loader()->documentLoader()->substituteData().failingURL().isEmpty())
-        && (!frame->loader()->subframeLoader()->containsPlugins() || frame->page()->settings()->pageCacheSupportsPlugins())
-        && !frame->document()->url().protocolIs("https")
+        && !(documentLoader->substituteData().isValid() && !documentLoader->substituteData().failingURL().isEmpty())
+        && (!frameLoader->subframeLoader()->containsPlugins() || frame->page()->settings()->pageCacheSupportsPlugins())
+        && (!document->url().protocolIs("https") || (!documentLoader->response().cacheControlContainsNoCache() && !documentLoader->response().cacheControlContainsNoStore()))
         && (!frame->domWindow() || !frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
 #if ENABLE(SQL_DATABASE)
-        && !frame->document()->hasOpenDatabases()
+        && !document->hasOpenDatabases()
 #endif
 #if ENABLE(SHARED_WORKERS)
-        && !SharedWorkerRepository::hasSharedWorkers(frame->document())
+        && !SharedWorkerRepository::hasSharedWorkers(document)
 #endif
-        && !frame->document()->usingGeolocation()
-        && frame->loader()->history()->currentItem()
-        && !frame->loader()->quickRedirectComing()
-        && !frame->loader()->documentLoader()->isLoadingInAPISense()
-        && !frame->loader()->documentLoader()->isStopping()
-        && frame->document()->canSuspendActiveDOMObjects()
+        && !document->usingGeolocation()
+        && frameLoader->history()->currentItem()
+        && !frameLoader->quickRedirectComing()
+        && !documentLoader->isLoadingInAPISense()
+        && !documentLoader->isStopping()
+        && document->canSuspendActiveDOMObjects()
         // FIXME: We should investigating caching frames that have an associated
         // application cache. <rdar://problem/5917899> tracks that work.
-        && frame->loader()->documentLoader()->applicationCacheHost()->canCacheInPageCache()
-        && frame->loader()->client()->canCachePage();
+        && documentLoader->applicationCacheHost()->canCacheInPageCache()
+        && frameLoader->client()->canCachePage();
 }
     
 bool PageCache::canCache(Page* page)
@@ -296,8 +300,8 @@ bool PageCache::canCache(Page* page)
         && page->backForward()->isActive()
         && page->settings()->usesPageCache()
 #if ENABLE(DEVICE_ORIENTATION)
-        && !(page->deviceMotionController() && page->deviceMotionController()->isActive())
-        && !(page->deviceOrientationController() && page->deviceOrientationController()->isActive())
+        && !DeviceMotionController::isActiveAt(page)
+        && !DeviceOrientationController::isActiveAt(page)
 #endif
         && loadType != FrameLoadTypeReload
         && loadType != FrameLoadTypeReloadFromOrigin
diff --git a/Source/WebCore/html/BaseButtonInputType.cpp b/Source/WebCore/html/BaseButtonInputType.cpp
index 11546eddd..9a1616fce 100644
--- a/Source/WebCore/html/BaseButtonInputType.cpp
+++ b/Source/WebCore/html/BaseButtonInputType.cpp
@@ -100,7 +100,7 @@ bool BaseButtonInputType::storesValueSeparateFromAttribute()
     return false;
 }
 
-void BaseButtonInputType::setValue(const String& sanitizedValue, bool, bool)
+void BaseButtonInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
 {
     element()->setAttribute(valueAttr, sanitizedValue);
 }
diff --git a/Source/WebCore/html/BaseButtonInputType.h b/Source/WebCore/html/BaseButtonInputType.h
index dabc27cac..1b7543c05 100644
--- a/Source/WebCore/html/BaseButtonInputType.h
+++ b/Source/WebCore/html/BaseButtonInputType.h
@@ -48,7 +48,7 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
-    virtual void setValue(const String&, bool, bool) OVERRIDE;
+    virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/BaseCheckableInputType.cpp b/Source/WebCore/html/BaseCheckableInputType.cpp
index 70f539d80..ff28dae36 100644
--- a/Source/WebCore/html/BaseCheckableInputType.cpp
+++ b/Source/WebCore/html/BaseCheckableInputType.cpp
@@ -104,7 +104,7 @@ bool BaseCheckableInputType::storesValueSeparateFromAttribute()
     return false;
 }
 
-void BaseCheckableInputType::setValue(const String& sanitizedValue, bool, bool)
+void BaseCheckableInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
 {
     element()->setAttribute(valueAttr, sanitizedValue);
 }
diff --git a/Source/WebCore/html/BaseCheckableInputType.h b/Source/WebCore/html/BaseCheckableInputType.h
index 2c2c4ad3c..4211ad521 100644
--- a/Source/WebCore/html/BaseCheckableInputType.h
+++ b/Source/WebCore/html/BaseCheckableInputType.h
@@ -50,7 +50,7 @@ private:
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual String fallbackValue() const OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
-    virtual void setValue(const String&, bool, bool) OVERRIDE;
+    virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
     virtual bool isCheckable() OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/BaseDateAndTimeInputType.cpp b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
index 46366729f..2904f2e85 100644
--- a/Source/WebCore/html/BaseDateAndTimeInputType.cpp
+++ b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
@@ -65,9 +65,9 @@ double BaseDateAndTimeInputType::valueAsNumber() const
     return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
 }
 
-void BaseDateAndTimeInputType::setValueAsNumber(double newValue, bool sendChangeEvent, ExceptionCode&) const
+void BaseDateAndTimeInputType::setValueAsNumber(double newValue, TextFieldEventBehavior eventBehavior, ExceptionCode&) const
 {
-    element()->setValue(serialize(newValue), sendChangeEvent);
+    element()->setValue(serialize(newValue), eventBehavior);
 }
 
 bool BaseDateAndTimeInputType::typeMismatchFor(const String& value) const
diff --git a/Source/WebCore/html/BaseDateAndTimeInputType.h b/Source/WebCore/html/BaseDateAndTimeInputType.h
index 46c0c9d8d..e34535060 100644
--- a/Source/WebCore/html/BaseDateAndTimeInputType.h
+++ b/Source/WebCore/html/BaseDateAndTimeInputType.h
@@ -52,7 +52,7 @@ private:
     virtual double valueAsDate() const OVERRIDE;
     virtual void setValueAsDate(double, ExceptionCode&) const OVERRIDE;
     virtual double valueAsNumber() const OVERRIDE;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const OVERRIDE;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
     virtual bool typeMismatchFor(const String&) const OVERRIDE;
     virtual bool typeMismatch() const OVERRIDE;
     virtual bool rangeUnderflow(const String&) const OVERRIDE;
diff --git a/Source/WebCore/html/CheckboxInputType.cpp b/Source/WebCore/html/CheckboxInputType.cpp
index 4e9663443..02967bbf4 100644
--- a/Source/WebCore/html/CheckboxInputType.cpp
+++ b/Source/WebCore/html/CheckboxInputType.cpp
@@ -80,7 +80,7 @@ PassOwnPtr<ClickHandlingState> CheckboxInputType::willDispatchClick()
     if (state->indeterminate)
         element()->setIndeterminate(false);
 
-    element()->setChecked(!state->checked, true);
+    element()->setChecked(!state->checked, DispatchChangeEvent);
 
     return state.release();
 }
diff --git a/Source/WebCore/html/ColorInputType.cpp b/Source/WebCore/html/ColorInputType.cpp
index 071cc3416..83647ea6a 100644
--- a/Source/WebCore/html/ColorInputType.cpp
+++ b/Source/WebCore/html/ColorInputType.cpp
@@ -106,6 +106,8 @@ Color ColorInputType::valueAsColor() const
 
 void ColorInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
+
     Document* document = element()->document();
     RefPtr<HTMLDivElement> wrapperElement = HTMLDivElement::create(document);
     wrapperElement->setShadowPseudoId("-webkit-color-swatch-wrapper");
@@ -114,15 +116,15 @@ void ColorInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     wrapperElement->appendChild(colorSwatch.release(), ec);
     ASSERT(!ec);
-    element()->ensureShadowRoot()->appendChild(wrapperElement.release(), ec);
+    element()->shadowRootList()->oldestShadowRoot()->appendChild(wrapperElement.release(), ec);
     ASSERT(!ec);
     
     updateColorSwatch();
 }
 
-void ColorInputType::setValue(const String& value, bool valueChanged, bool sendChangeEvent)
+void ColorInputType::setValue(const String& value, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    InputType::setValue(value, valueChanged, sendChangeEvent);
+    InputType::setValue(value, valueChanged, eventBehavior);
 
     if (!valueChanged)
         return;
@@ -178,12 +180,12 @@ void ColorInputType::updateColorSwatch()
     if (!colorSwatch)
         return;
 
-    colorSwatch->ensureInlineStyleDecl()->setProperty(CSSPropertyBackgroundColor, element()->value(), false);
+    colorSwatch->setInlineStyleProperty(CSSPropertyBackgroundColor, element()->value(), false);
 }
 
 HTMLElement* ColorInputType::shadowColorSwatch() const
 {
-    ShadowRoot* shadow = element()->shadowRoot();
+    ShadowRoot* shadow = element()->shadowRootList()->oldestShadowRoot();
     return shadow ? toHTMLElement(shadow->firstChild()->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/ColorInputType.h b/Source/WebCore/html/ColorInputType.h
index 3e064bd44..f92b91ced 100644
--- a/Source/WebCore/html/ColorInputType.h
+++ b/Source/WebCore/html/ColorInputType.h
@@ -55,7 +55,7 @@ private:
     virtual String fallbackValue() const OVERRIDE;
     virtual String sanitizeValue(const String&) const OVERRIDE;
     virtual void createShadowSubtree() OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual void handleDOMActivateEvent(Event*) OVERRIDE;
     virtual void detach() OVERRIDE;
 
diff --git a/Source/WebCore/html/DOMFormData.idl b/Source/WebCore/html/DOMFormData.idl
index 73ac211e1..4bab556be 100644
--- a/Source/WebCore/html/DOMFormData.idl
+++ b/Source/WebCore/html/DOMFormData.idl
@@ -33,13 +33,14 @@ module html {
     interface [
         CustomConstructor,
         JSGenerateToNativeObject,
-        JSGenerateToJS
+        JSGenerateToJSObject,
+        InterfaceName=FormData
     ] DOMFormData {
         // void append(DOMString name, DOMString value);
         // void append(DOMString name, Blob value, optional DOMString filename);
-        [Custom] void append(in [Optional=CallWithDefaultValue] DOMString name, 
-                             in [Optional=CallWithDefaultValue] DOMString value,
-                             in [Optional=CallWithDefaultValue] DOMString filename);
+        [Custom] void append(in [Optional=DefaultIsUndefined] DOMString name, 
+                             in [Optional=DefaultIsUndefined] DOMString value,
+                             in [Optional=DefaultIsUndefined] DOMString filename);
     };
 
 }
diff --git a/Source/WebCore/html/DOMSettableTokenList.idl b/Source/WebCore/html/DOMSettableTokenList.idl
index f0646e5a0..93bf67f69 100644
--- a/Source/WebCore/html/DOMSettableTokenList.idl
+++ b/Source/WebCore/html/DOMSettableTokenList.idl
@@ -26,7 +26,7 @@ module core {
 
     interface [
         IndexedGetter,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] DOMSettableTokenList : DOMTokenList {
         attribute DOMString value;
     };
diff --git a/Source/WebCore/html/DOMTokenList.idl b/Source/WebCore/html/DOMTokenList.idl
index 88169acb9..55b636f7d 100644
--- a/Source/WebCore/html/DOMTokenList.idl
+++ b/Source/WebCore/html/DOMTokenList.idl
@@ -26,10 +26,11 @@ module core {
 
     interface [
         JSGenerateIsReachable=ImplElementRoot,
-        IndexedGetter
+        IndexedGetter,
+        V8CustomToJSObject
     ] DOMTokenList {
         readonly attribute unsigned long length;
-        [ConvertNullStringTo=Null] DOMString item(in unsigned long index);
+        [TreatReturnedNullStringAs=Null] DOMString item(in unsigned long index);
         boolean contains(in DOMString token) raises(DOMException);
         void add(in DOMString token) raises(DOMException);
         void remove(in DOMString token) raises(DOMException);
diff --git a/Source/WebCore/html/DOMURL.cpp b/Source/WebCore/html/DOMURL.cpp
index 086bf778c..36a401a22 100644
--- a/Source/WebCore/html/DOMURL.cpp
+++ b/Source/WebCore/html/DOMURL.cpp
@@ -34,6 +34,7 @@
 #include "Blob.h"
 #include "BlobURL.h"
 #include "KURL.h"
+#include "MemoryCache.h"
 #include "PublicURLManager.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
@@ -89,6 +90,8 @@ void DOMURL::revokeObjectURL(ScriptExecutionContext* scriptExecutionContext, con
         return;
 
     KURL url(KURL(), urlString);
+    if (CachedResource* resource = memoryCache()->resourceForURL(url))
+        memoryCache()->remove(resource);
 
     HashSet<String>& blobURLs = scriptExecutionContext->publicURLManager().blobURLs();
     if (blobURLs.contains(url.string())) {
diff --git a/Source/WebCore/html/DOMURL.idl b/Source/WebCore/html/DOMURL.idl
index 4f9722df3..e929ca86f 100644
--- a/Source/WebCore/html/DOMURL.idl
+++ b/Source/WebCore/html/DOMURL.idl
@@ -29,13 +29,13 @@ module html {
         Conditional=BLOB,
         Constructor,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] DOMURL {
 #if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        static [CallWith=ScriptExecutionContext,ConvertNullStringTo=Undefined] DOMString createObjectURL(in MediaStream stream);
+        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in MediaStream stream);
 #endif
-        static [CallWith=ScriptExecutionContext,ConvertNullStringTo=Undefined] DOMString createObjectURL(in Blob blob);
+        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in Blob blob);
         static [CallWith=ScriptExecutionContext] void revokeObjectURL(in DOMString url);
     };
 }
diff --git a/Source/WebCore/html/DOMWindowHTML.idl b/Source/WebCore/html/DOMWindowHTML.idl
new file mode 100644
index 000000000..889c3a00e
--- /dev/null
+++ b/Source/WebCore/html/DOMWindowHTML.idl
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    // FIXME: Most of this could/should be generated from make_names.pl/HTMLNames.in
+    // to reduce the chance that we forget a constructor when adding a new element.
+    interface [
+        Supplemental=DOMWindow
+    ] DOMWindowHTML {
+
+        attribute HTMLDocumentConstructor HTMLDocument;
+        attribute HTMLElementConstructor HTMLElement;
+        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
+        attribute HTMLAppletElementConstructor HTMLAppletElement;
+        attribute HTMLAreaElementConstructor HTMLAreaElement;
+        attribute HTMLBRElementConstructor HTMLBRElement;
+        attribute HTMLBaseElementConstructor HTMLBaseElement;
+        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
+        attribute HTMLBodyElementConstructor HTMLBodyElement;
+        attribute HTMLButtonElementConstructor HTMLButtonElement;
+        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
+        attribute HTMLDListElementConstructor HTMLDListElement;
+        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
+        attribute HTMLDivElementConstructor HTMLDivElement;
+        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
+        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
+        attribute HTMLFontElementConstructor HTMLFontElement;
+        attribute HTMLFormElementConstructor HTMLFormElement;
+        attribute HTMLFrameElementConstructor HTMLFrameElement;
+        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
+        attribute HTMLHRElementConstructor HTMLHRElement;
+        attribute HTMLHeadElementConstructor HTMLHeadElement;
+        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
+        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
+        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
+        attribute HTMLImageElementConstructor HTMLImageElement;
+        attribute HTMLInputElementConstructor HTMLInputElement;
+        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
+        attribute HTMLLIElementConstructor HTMLLIElement;
+        attribute HTMLLabelElementConstructor HTMLLabelElement;
+        attribute HTMLLegendElementConstructor HTMLLegendElement;
+        attribute HTMLLinkElementConstructor HTMLLinkElement;
+        attribute HTMLMapElementConstructor HTMLMapElement;
+        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
+        attribute HTMLMenuElementConstructor HTMLMenuElement;
+        attribute HTMLMetaElementConstructor HTMLMetaElement;
+#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
+        attribute HTMLMeterElementConstructor HTMLMeterElement;
+#endif
+        attribute HTMLModElementConstructor HTMLModElement;
+        attribute HTMLOListElementConstructor HTMLOListElement;
+        attribute HTMLObjectElementConstructor HTMLObjectElement;
+        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
+        attribute HTMLOptionElementConstructor HTMLOptionElement;
+        attribute HTMLOutputElementConstructor HTMLOutputElement;
+        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
+        attribute HTMLParamElementConstructor HTMLParamElement;
+        attribute HTMLPreElementConstructor HTMLPreElement;
+#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
+        attribute HTMLProgressElementConstructor HTMLProgressElement;
+#endif
+        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
+        attribute HTMLScriptElementConstructor HTMLScriptElement;
+        attribute HTMLSelectElementConstructor HTMLSelectElement;
+        attribute HTMLSpanElementConstructor HTMLSpanElement;
+        attribute HTMLStyleElementConstructor HTMLStyleElement;
+        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
+        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
+        attribute HTMLTableColElementConstructor HTMLTableColElement;
+        attribute HTMLTableElementConstructor HTMLTableElement;
+        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
+        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
+        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
+        attribute HTMLTitleElementConstructor HTMLTitleElement;
+        attribute HTMLUListElementConstructor HTMLUListElement;
+
+        attribute HTMLCollectionConstructor HTMLCollection;
+        attribute HTMLAllCollectionConstructor HTMLAllCollection;
+        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
+        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
+
+        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
+        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
+
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
+
+        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
+    };
+
+}
diff --git a/Source/WebCore/html/FileInputType.cpp b/Source/WebCore/html/FileInputType.cpp
index ea9a2ee68..5759f6741 100644
--- a/Source/WebCore/html/FileInputType.cpp
+++ b/Source/WebCore/html/FileInputType.cpp
@@ -36,6 +36,7 @@
 #include "RenderFileUploadControl.h"
 #include "ScriptController.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
@@ -217,7 +218,7 @@ bool FileInputType::storesValueSeparateFromAttribute()
     return true;
 }
 
-void FileInputType::setValue(const String&, bool, bool)
+void FileInputType::setValue(const String&, bool, TextFieldEventBehavior)
 {
     m_fileList->clear();
     m_icon.clear();
@@ -265,13 +266,15 @@ bool FileInputType::isFileUpload() const
 
 void FileInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
     ExceptionCode ec = 0;
-    element()->ensureShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
+    element()->shadowRootList()->oldestShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
 }
 
 void FileInputType::multipleAttributeChanged()
 {
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->ensureShadowRoot()->firstChild());
+    ASSERT(element()->hasShadowRoot());
+    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->shadowRootList()->oldestShadowRoot()->firstChild());
     if (button)
         button->setValue(element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
 }
diff --git a/Source/WebCore/html/FileInputType.h b/Source/WebCore/html/FileInputType.h
index b5a5d196d..53575a420 100644
--- a/Source/WebCore/html/FileInputType.h
+++ b/Source/WebCore/html/FileInputType.h
@@ -59,7 +59,7 @@ private:
     virtual bool canSetValue(const String&) OVERRIDE;
     virtual bool getTypeSpecificValue(String&) OVERRIDE; // Checked first, before internal storage or the value attribute.
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual void receiveDroppedFiles(const Vector<String>&) OVERRIDE;
     virtual Icon* icon() const OVERRIDE;
     virtual bool isFileUpload() const OVERRIDE;
diff --git a/Source/WebCore/html/HTMLAllCollection.idl b/Source/WebCore/html/HTMLAllCollection.idl
index 3068e40fd..5ceae016c 100644
--- a/Source/WebCore/html/HTMLAllCollection.idl
+++ b/Source/WebCore/html/HTMLAllCollection.idl
@@ -33,7 +33,7 @@ module html {
         JSGenerateIsReachable
     ] HTMLAllCollection {
         readonly attribute unsigned long length;
-        [Custom] Node item(in [Optional=CallWithDefaultValue] unsigned long index);
+        [Custom] Node item(in [Optional=DefaultIsUndefined] unsigned long index);
         [Custom] Node namedItem(in DOMString name);
 
         // FIXME: This should return an HTMLAllCollection.
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index 8b932b4fa..cf86b283f 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -293,7 +293,7 @@ void HTMLAnchorElement::setRel(const String& value)
 
 const AtomicString& HTMLAnchorElement::name() const
 {
-    return getAttribute(nameAttr);
+    return getNameAttribute();
 }
 
 short HTMLAnchorElement::tabIndex() const
@@ -489,7 +489,7 @@ void HTMLAnchorElement::sendPings(const KURL& destinationURL)
     if (!hasAttribute(pingAttr) || !document()->settings()->hyperlinkAuditingEnabled())
         return;
 
-    SpaceSplitString pingURLs(getAttribute(pingAttr), true);
+    SpaceSplitString pingURLs(getAttribute(pingAttr), false);
     for (unsigned i = 0; i < pingURLs.size(); i++)
         PingLoader::sendPing(document()->frame(), document()->completeURL(pingURLs[i]), destinationURL);
 }
diff --git a/Source/WebCore/html/HTMLAnchorElement.idl b/Source/WebCore/html/HTMLAnchorElement.idl
index 3c40b73b6..7bd174c63 100644
--- a/Source/WebCore/html/HTMLAnchorElement.idl
+++ b/Source/WebCore/html/HTMLAnchorElement.idl
@@ -35,6 +35,10 @@ module html {
         attribute [Reflect] DOMString type;
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString hash;
         readonly attribute DOMString host;
         readonly attribute DOMString hostname;
diff --git a/Source/WebCore/html/HTMLAppletElement.cpp b/Source/WebCore/html/HTMLAppletElement.cpp
index df55cd901..af63d2677 100644
--- a/Source/WebCore/html/HTMLAppletElement.cpp
+++ b/Source/WebCore/html/HTMLAppletElement.cpp
@@ -78,7 +78,7 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
         if (!codeBase.isNull())
             args.set("codeBase", codeBase);
 
-        const AtomicString& name = document()->isHTMLDocument() ? getAttribute(nameAttr) : getIdAttribute();
+        const AtomicString& name = document()->isHTMLDocument() ? getNameAttribute() : getIdAttribute();
         if (!name.isNull())
             args.set("name", name);
         const AtomicString& archive = getAttribute(archiveAttr);
diff --git a/Source/WebCore/html/HTMLAppletElement.idl b/Source/WebCore/html/HTMLAppletElement.idl
index 6a683d7fc..8f16a400f 100644
--- a/Source/WebCore/html/HTMLAppletElement.idl
+++ b/Source/WebCore/html/HTMLAppletElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         CustomNamedSetter,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomCall
     ] HTMLAppletElement : HTMLElement {
         attribute [Reflect] DOMString align;
diff --git a/Source/WebCore/html/HTMLAreaElement.idl b/Source/WebCore/html/HTMLAreaElement.idl
index a14a4701f..dfb9c9b5d 100644
--- a/Source/WebCore/html/HTMLAreaElement.idl
+++ b/Source/WebCore/html/HTMLAreaElement.idl
@@ -29,6 +29,9 @@ module html {
         attribute [Reflect] DOMString shape;
         attribute [Reflect] DOMString target;
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
         // IE Extensions
         readonly attribute DOMString hash;
         readonly attribute DOMString host;
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index 60d96d53d..151df7f38 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -304,6 +304,7 @@ text
 title
 top
 topmargin
+translate
 truespeed
 type
 usemap
diff --git a/Source/WebCore/html/HTMLAudioElement.cpp b/Source/WebCore/html/HTMLAudioElement.cpp
index e3dcf47f1..98decc152 100644
--- a/Source/WebCore/html/HTMLAudioElement.cpp
+++ b/Source/WebCore/html/HTMLAudioElement.cpp
@@ -43,7 +43,9 @@ HTMLAudioElement::HTMLAudioElement(const QualifiedName& tagName, Document* docum
 
 PassRefPtr<HTMLAudioElement> HTMLAudioElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
-    return adoptRef(new HTMLAudioElement(tagName, document, createdByParser));
+    RefPtr<HTMLAudioElement> audioElement(adoptRef(new HTMLAudioElement(tagName, document, createdByParser)));
+    audioElement->suspendIfNeeded();
+    return audioElement.release();
 }
 
 PassRefPtr<HTMLAudioElement> HTMLAudioElement::createForJSConstructor(Document* document, const String& src)
@@ -54,6 +56,7 @@ PassRefPtr<HTMLAudioElement> HTMLAudioElement::createForJSConstructor(Document*
         audio->setSrc(src);
         audio->scheduleLoad(HTMLMediaElement::MediaResource);
     }
+    audio->suspendIfNeeded();
     return audio.release();
 }
 
diff --git a/Source/WebCore/html/HTMLAudioElement.idl b/Source/WebCore/html/HTMLAudioElement.idl
index 109164627..1adf01c46 100644
--- a/Source/WebCore/html/HTMLAudioElement.idl
+++ b/Source/WebCore/html/HTMLAudioElement.idl
@@ -27,7 +27,7 @@ module html {
     interface [
         ActiveDOMObject,
         Conditional=VIDEO,
-        NamedConstructor=Audio(in [Optional=CallWithNullValue] DOMString src)
+        NamedConstructor=Audio(in [Optional=DefaultIsNullString] DOMString src)
     ] HTMLAudioElement : HTMLMediaElement {
     };
 }
diff --git a/Source/WebCore/html/HTMLBRElement.cpp b/Source/WebCore/html/HTMLBRElement.cpp
index 5efe6379a..33f0c533c 100644
--- a/Source/WebCore/html/HTMLBRElement.cpp
+++ b/Source/WebCore/html/HTMLBRElement.cpp
@@ -48,21 +48,26 @@ PassRefPtr<HTMLBRElement> HTMLBRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLBRElement(tagName, document));
 }
 
-void HTMLBRElement::parseAttribute(Attribute* attr)
+bool HTMLBRElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == clearAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLBRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == clearAttr) {
-        // If the string is empty, then don't add the clear property. 
+        // If the string is empty, then don't add the clear property.
         // <br clear> and <br clear=""> are just treated like <br> by Gecko, Mac IE, etc. -dwh
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyClear);
-        else if (!attr->value().isEmpty()) {
+        if (!attr->isEmpty()) {
             if (equalIgnoringCase(attr->value(), "all"))
-                addCSSProperty(CSSPropertyClear, "both");
+                addPropertyToAttributeStyle(style, CSSPropertyClear, "both");
             else
-                addCSSProperty(CSSPropertyClear, attr->value());
+                addPropertyToAttributeStyle(style, CSSPropertyClear, attr->value());
         }
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 RenderObject* HTMLBRElement::createRenderer(RenderArena* arena, RenderStyle* style)
diff --git a/Source/WebCore/html/HTMLBRElement.h b/Source/WebCore/html/HTMLBRElement.h
index 10a6432c7..16c1beae7 100644
--- a/Source/WebCore/html/HTMLBRElement.h
+++ b/Source/WebCore/html/HTMLBRElement.h
@@ -38,8 +38,9 @@ public:
 private:
     HTMLBRElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
-    
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 };
 
diff --git a/Source/WebCore/html/HTMLBodyElement.cpp b/Source/WebCore/html/HTMLBodyElement.cpp
index a769a2c21..34d2924fa 100644
--- a/Source/WebCore/html/HTMLBodyElement.cpp
+++ b/Source/WebCore/html/HTMLBodyElement.cpp
@@ -25,6 +25,7 @@
 #include "HTMLBodyElement.h"
 
 #include "Attribute.h"
+#include "CSSImageValue.h"
 #include "CSSParser.h"
 #include "CSSValueKeywords.h"
 #include "EventNames.h"
@@ -60,46 +61,39 @@ HTMLBodyElement::~HTMLBodyElement()
 {
 }
 
-void HTMLBodyElement::parseAttribute(Attribute* attr)
+bool HTMLBodyElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == backgroundAttr || attr->name() == marginwidthAttr || attr->name() == leftmarginAttr || attr->name() == marginheightAttr || attr->name() == topmarginAttr || attr->name() == bgcolorAttr || attr->name() == textAttr || attr->name() == bgpropertiesAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLBodyElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == backgroundAttr) {
         String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (!url.isEmpty())
-            addCSSImageProperty(CSSPropertyBackgroundImage, document()->completeURL(url).string());
-        else
-            removeCSSProperty(CSSPropertyBackgroundImage);
+            style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
     } else if (attr->name() == marginwidthAttr || attr->name() == leftmarginAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginRight, CSSPropertyMarginLeft);
-        else {
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
     } else if (attr->name() == marginheightAttr || attr->name() == topmarginAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginBottom, CSSPropertyMarginTop);
-        else {
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
     } else if (attr->name() == bgcolorAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyBackgroundColor);
-        else
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     } else if (attr->name() == textAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyColor);
-        else
-            addCSSColor(CSSPropertyColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyColor, attr->value());
     } else if (attr->name() == bgpropertiesAttr) {
         if (equalIgnoringCase(attr->value(), "fixed"))
-            addCSSProperty(CSSPropertyBackgroundAttachment, CSSValueFixed);
-        else
-            removeCSSProperty(CSSPropertyBackgroundAttachment);
-    } else if (attr->name() == vlinkAttr ||
-               attr->name() == alinkAttr ||
-               attr->name() == linkAttr) {
+           addPropertyToAttributeStyle(style, CSSPropertyBackgroundAttachment, CSSValueFixed);
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLBodyElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == vlinkAttr || attr->name() == alinkAttr || attr->name() == linkAttr) {
         if (attr->isNull()) {
             if (attr->name() == linkAttr)
                 document()->resetLinkColor();
@@ -118,9 +112,8 @@ void HTMLBodyElement::parseAttribute(Attribute* attr)
                     document()->setActiveLinkColor(color);
             }
         }
-        
-        if (attached())
-            document()->recalcStyle(Force);
+
+        setNeedsStyleRecalc();
     } else if (attr->name() == onloadAttr)
         document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onbeforeunloadAttr)
diff --git a/Source/WebCore/html/HTMLBodyElement.h b/Source/WebCore/html/HTMLBodyElement.h
index 8004b10da..41ba4485c 100644
--- a/Source/WebCore/html/HTMLBodyElement.h
+++ b/Source/WebCore/html/HTMLBodyElement.h
@@ -71,6 +71,8 @@ private:
     HTMLBodyElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
     
diff --git a/Source/WebCore/html/HTMLButtonElement.cpp b/Source/WebCore/html/HTMLButtonElement.cpp
index 1468248b9..a79641a31 100644
--- a/Source/WebCore/html/HTMLButtonElement.cpp
+++ b/Source/WebCore/html/HTMLButtonElement.cpp
@@ -79,6 +79,17 @@ const AtomicString& HTMLButtonElement::formControlType() const
     return emptyAtom;
 }
 
+bool HTMLButtonElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr) {
+        // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
+        // See http://bugs.webkit.org/show_bug.cgi?id=12071
+        return false;
+    }
+
+    return HTMLFormControlElement::isPresentationAttribute(attr);
+}
+
 void HTMLButtonElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == typeAttr) {
@@ -89,9 +100,6 @@ void HTMLButtonElement::parseAttribute(Attribute* attr)
         else
             m_type = SUBMIT;
         setNeedsWillValidateCheck();
-    } else if (attr->name() == alignAttr) {
-        // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
-        // See http://bugs.webkit.org/show_bug.cgi?id=12071
     } else
         HTMLFormControlElement::parseAttribute(attr);
 }
diff --git a/Source/WebCore/html/HTMLButtonElement.h b/Source/WebCore/html/HTMLButtonElement.h
index 9699bef0e..00518ea4c 100644
--- a/Source/WebCore/html/HTMLButtonElement.h
+++ b/Source/WebCore/html/HTMLButtonElement.h
@@ -44,6 +44,7 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
     virtual bool appendFormData(FormDataList&, bool);
 
diff --git a/Source/WebCore/html/HTMLButtonElement.idl b/Source/WebCore/html/HTMLButtonElement.idl
index b8b8621f9..b9eafb0d5 100644
--- a/Source/WebCore/html/HTMLButtonElement.idl
+++ b/Source/WebCore/html/HTMLButtonElement.idl
@@ -30,6 +30,9 @@ module html {
         attribute [Reflect] DOMString formTarget;
         readonly attribute ValidityState validity;
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
         attribute [Reflect] boolean disabled;
         attribute [Reflect] boolean autofocus;
         attribute [Reflect] DOMString name;
@@ -41,7 +44,9 @@ module html {
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void click();
+#endif
 
         readonly attribute NodeList labels;
     };
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 9cf78d403..7ed6e3d11 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -45,6 +45,7 @@
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
+#include "RenderLayer.h"
 #include "Settings.h"
 #include <math.h>
 #include <stdio.h>
@@ -79,7 +80,12 @@ HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* doc
     , m_size(DefaultWidth, DefaultHeight)
     , m_rendererIsCanvas(false)
     , m_ignoreReset(false)
+#if ENABLE(HIGH_DPI_CANVAS)
+      // FIXME: Make this the default once https://bugs.webkit.org/show_bug.cgi?id=73645 has been fixed.
     , m_deviceScaleFactor(document->frame() ? document->frame()->page()->deviceScaleFactor() : 1)
+#else
+    , m_deviceScaleFactor(1)
+#endif
     , m_originClean(true)
     , m_hasCreatedImageBuffer(false)
 {
@@ -264,6 +270,25 @@ void HTMLCanvasElement::reset()
         (*it)->canvasResized(this);
 }
 
+bool HTMLCanvasElement::paintsIntoCanvasBuffer() const
+{
+    ASSERT(m_context);
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+    if (m_context->is2d())
+        return true;
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (!m_context->isAccelerated())
+        return true;
+
+    if (renderBox() && renderBox()->hasLayer() && renderBox()->layer()->hasAcceleratedCompositing())
+        return false;
+#endif
+    return true;
+}
+
+
 void HTMLCanvasElement::paint(GraphicsContext* context, const LayoutRect& r, bool useLowQualityScale)
 {
     // Clear the dirty rect
@@ -273,7 +298,7 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const LayoutRect& r, boo
         return;
     
     if (m_context) {
-        if (!m_context->paintsIntoCanvasBuffer() && !document()->printing())
+        if (!paintsIntoCanvasBuffer() && !document()->printing())
             return;
         m_context->paintRenderingResultsToCanvas();
     }
@@ -282,9 +307,9 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const LayoutRect& r, boo
         ImageBuffer* imageBuffer = buffer();
         if (imageBuffer) {
             if (m_presentedImage)
-                context->drawImage(m_presentedImage.get(), ColorSpaceDeviceRGB, r, CompositeSourceOver, useLowQualityScale);
+                context->drawImage(m_presentedImage.get(), ColorSpaceDeviceRGB, pixelSnappedIntRect(r), CompositeSourceOver, useLowQualityScale);
             else
-                context->drawImageBuffer(imageBuffer, ColorSpaceDeviceRGB, r, CompositeSourceOver, useLowQualityScale);
+                context->drawImageBuffer(imageBuffer, ColorSpaceDeviceRGB, pixelSnappedIntRect(r), CompositeSourceOver, useLowQualityScale);
         }
     }
 
diff --git a/Source/WebCore/html/HTMLCanvasElement.h b/Source/WebCore/html/HTMLCanvasElement.h
index 967444d0c..e2c4888e5 100644
--- a/Source/WebCore/html/HTMLCanvasElement.h
+++ b/Source/WebCore/html/HTMLCanvasElement.h
@@ -148,6 +148,8 @@ private:
 
     bool shouldDefer() const;
 
+    bool paintsIntoCanvasBuffer() const;
+
     HashSet<CanvasObserver*> m_observers;
 
     IntSize m_size;
diff --git a/Source/WebCore/html/HTMLCanvasElement.idl b/Source/WebCore/html/HTMLCanvasElement.idl
index 35a806c65..2be96a556 100644
--- a/Source/WebCore/html/HTMLCanvasElement.idl
+++ b/Source/WebCore/html/HTMLCanvasElement.idl
@@ -33,13 +33,13 @@ module html {
         attribute long width;
         attribute long height;
 
-        [Custom] DOMString toDataURL(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString type)
+        [Custom] DOMString toDataURL(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString type)
             raises(DOMException);
 
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // The custom binding is needed to handle context creation attributes.
-        [Custom] DOMObject getContext(in [Optional=CallWithDefaultValue] DOMString contextId);
+        [Custom] DOMObject getContext(in [Optional=DefaultIsUndefined] DOMString contextId);
 #endif
 #endif
 
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index e6f2eac0a..7d06308fc 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -254,7 +254,7 @@ bool HTMLCollection::checkForNameMatch(Element* element, bool checkName, const A
     if (m_type == DocAll && !nameShouldBeVisibleInDocumentAll(e))
         return false;
 
-    return e->getAttribute(nameAttr) == name && e->getIdAttribute() != name;
+    return e->getNameAttribute() == name && e->getIdAttribute() != name;
 }
 
 Node* HTMLCollection::namedItem(const AtomicString& name) const
@@ -294,7 +294,7 @@ void HTMLCollection::updateNameCache() const
             continue;
         HTMLElement* e = toHTMLElement(element);
         const AtomicString& idAttrVal = e->getIdAttribute();
-        const AtomicString& nameAttrVal = e->getAttribute(nameAttr);
+        const AtomicString& nameAttrVal = e->getNameAttribute();
         if (!idAttrVal.isEmpty())
             append(m_cache.idCache, idAttrVal, e);
         if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (m_type != DocAll || nameShouldBeVisibleInDocumentAll(e)))
diff --git a/Source/WebCore/html/HTMLCollection.idl b/Source/WebCore/html/HTMLCollection.idl
index a4d172d1a..778377626 100644
--- a/Source/WebCore/html/HTMLCollection.idl
+++ b/Source/WebCore/html/HTMLCollection.idl
@@ -23,16 +23,16 @@ module html {
     interface [
         IndexedGetter,
         NamedGetter,
-        JSCustomToJS,
+        CustomToJSObject,
         JSGenerateIsReachable,
         ObjCPolymorphic
     ] HTMLCollection {
         readonly attribute unsigned long length;
-        Node item(in [Optional=CallWithDefaultValue] unsigned long index);
-        [Custom] Node namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        Node item(in [Optional=DefaultIsUndefined] unsigned long index);
+        [Custom] Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        NodeList tags(in [Optional=CallWithDefaultValue] DOMString name);
+        NodeList tags(in [Optional=DefaultIsUndefined] DOMString name);
 #endif
     };
 
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index 015cf61ce..d49daa4c6 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -28,8 +28,10 @@
 #include "HTMLSummaryElement.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "RenderDetails.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -108,7 +110,7 @@ RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle
 
 void HTMLDetailsElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
 
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(DetailsSummaryElement::create(document()), ASSERT_NO_EXCEPTION, true);
@@ -122,7 +124,7 @@ Element* HTMLDetailsElement::findMainSummary() const
             return toElement(child);
     }
 
-    return static_cast<DetailsSummaryElement*>(shadowRoot()->firstChild())->fallbackSummary();
+    return static_cast<DetailsSummaryElement*>(shadowRootList()->oldestShadowRoot()->firstChild())->fallbackSummary();
 }
 
 void HTMLDetailsElement::parseAttribute(Attribute* attr)
@@ -136,15 +138,18 @@ void HTMLDetailsElement::parseAttribute(Attribute* attr)
         HTMLElement::parseAttribute(attr);
 }
 
-bool HTMLDetailsElement::childShouldCreateRenderer(Node* child) const
+bool HTMLDetailsElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
+    if (!childContext.isOnEncapsulationBoundary())
+        return false;
+
     if (m_isOpen)
-        return true;
+        return HTMLElement::childShouldCreateRenderer(childContext);
 
-    if (!child->hasTagName(summaryTag))
+    if (!childContext.node()->hasTagName(summaryTag))
         return false;
 
-    return child == findMainSummary();
+    return childContext.node() == findMainSummary() && HTMLElement::childShouldCreateRenderer(childContext);
 }
 
 void HTMLDetailsElement::toggleOpen()
diff --git a/Source/WebCore/html/HTMLDetailsElement.h b/Source/WebCore/html/HTMLDetailsElement.h
index a86a365c6..94e88334d 100644
--- a/Source/WebCore/html/HTMLDetailsElement.h
+++ b/Source/WebCore/html/HTMLDetailsElement.h
@@ -36,9 +36,8 @@ private:
     HTMLDetailsElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    bool childShouldCreateRenderer(Node*) const;
 
     void createShadowSubtree();
 
diff --git a/Source/WebCore/html/HTMLDivElement.cpp b/Source/WebCore/html/HTMLDivElement.cpp
index da2785c1f..bd15ae239 100644
--- a/Source/WebCore/html/HTMLDivElement.cpp
+++ b/Source/WebCore/html/HTMLDivElement.cpp
@@ -48,21 +48,26 @@ PassRefPtr<HTMLDivElement> HTMLDivElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLDivElement(tagName, document));
 }
 
-void HTMLDivElement::parseAttribute(Attribute* attr)
+bool HTMLDivElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLDivElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
         if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
-           addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitCenter);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
         else if (equalIgnoringCase(attr->value(), "left"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitLeft);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
         else if (equalIgnoringCase(attr->value(), "right"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitRight);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addCSSProperty(CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLDivElement.h b/Source/WebCore/html/HTMLDivElement.h
index cd90d8728..f8f4f7101 100644
--- a/Source/WebCore/html/HTMLDivElement.h
+++ b/Source/WebCore/html/HTMLDivElement.h
@@ -36,7 +36,8 @@ protected:
     HTMLDivElement(const QualifiedName&, Document*);
 
 private:
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLDocument.idl b/Source/WebCore/html/HTMLDocument.idl
index dd020e2c5..19420ee3d 100644
--- a/Source/WebCore/html/HTMLDocument.idl
+++ b/Source/WebCore/html/HTMLDocument.idl
@@ -21,12 +21,13 @@
 module html {
 
     interface [
-        CustomNamedGetter
+        CustomNamedGetter,
+        V8CustomToJSObject
     ] HTMLDocument : Document {
         [JSCustom, V8Custom] void open();
         void close();
-        [Custom] void write(in [Optional=CallWithDefaultValue] DOMString text);
-        [Custom] void writeln(in [Optional=CallWithDefaultValue] DOMString text);
+        [Custom] void write(in [Optional=DefaultIsUndefined] DOMString text);
+        [Custom] void writeln(in [Optional=DefaultIsUndefined] DOMString text);
 
         readonly attribute HTMLCollection embeds;
         readonly attribute HTMLCollection plugins;
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index a018fe23b..4e8da5c7d 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -29,6 +29,7 @@
 #include "CSSParser.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "CSSValuePool.h"
 #include "ChildListMutationScope.h"
 #include "DocumentFragment.h"
 #include "Event.h"
@@ -140,51 +141,85 @@ static unsigned parseBorderWidthAttribute(Attribute* attr)
     return borderWidth;
 }
 
-void HTMLElement::applyBorderAttribute(Attribute* attr)
+void HTMLElement::applyBorderAttributeToStyle(Attribute* attr, StylePropertySet* style)
 {
-    addCSSLength(CSSPropertyBorderWidth, String::number(parseBorderWidthAttribute(attr)));
-    addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-    addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-    addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-    addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
+    addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, parseBorderWidthAttribute(attr), CSSPrimitiveValue::CSS_PX);
+    addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
 }
 
-void HTMLElement::mapLanguageAttributeToLocale(Attribute* attribute)
+void HTMLElement::mapLanguageAttributeToLocale(Attribute* attribute, StylePropertySet* style)
 {
     ASSERT(attribute && (attribute->name() == langAttr || attribute->name().matches(XMLNames::langAttr)));
-    const AtomicString& value = attribute->value();
-    if (value.isNull())
-        removeCSSProperty(CSSPropertyWebkitLocale);
-    else if (!value.isEmpty()) {
+    if (!attribute->isEmpty()) {
         // Have to quote so the locale id is treated as a string instead of as a CSS keyword.
-        addCSSProperty(CSSPropertyWebkitLocale, quoteCSSString(value));
+        addPropertyToAttributeStyle(style, CSSPropertyWebkitLocale, quoteCSSString(attribute->value()));
     } else {
         // The empty string means the language is explicitly unknown.
-        addCSSProperty(CSSPropertyWebkitLocale, CSSValueAuto);
+        addPropertyToAttributeStyle(style, CSSPropertyWebkitLocale, CSSValueAuto);
     }
-    setNeedsStyleRecalc();
 }
 
-void HTMLElement::parseAttribute(Attribute* attr)
+bool HTMLElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (isIdAttributeName(attr->name()) || attr->name() == classAttr || attr->name() == styleAttr)
-        return StyledElement::parseAttribute(attr);
+    if (attr->name() == alignAttr || attr->name() == contenteditableAttr || attr->name() == hiddenAttr || attr->name() == langAttr || attr->name().matches(XMLNames::langAttr) || attr->name() == draggableAttr || attr->name() == dirAttr)
+        return true;
+    return StyledElement::isPresentationAttribute(attr);
+}
 
+void HTMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
     if (attr->name() == alignAttr) {
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
-        else if (equalIgnoringCase(attr->value(), "middle"))
-            addCSSProperty(CSSPropertyTextAlign, "center");
+        if (equalIgnoringCase(attr->value(), "middle"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, "center");
         else
-            addCSSProperty(CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else if (attr->name() == contenteditableAttr) {
-        setContentEditable(attr);
+        if (attr->isEmpty() || equalIgnoringCase(attr->value(), "true")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadWrite);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitNbspMode, CSSValueSpace);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
+        } else if (equalIgnoringCase(attr->value(), "plaintext-only")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadWritePlaintextOnly);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitNbspMode, CSSValueSpace);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
+        } else if (equalIgnoringCase(attr->value(), "false"))
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadOnly);
     } else if (attr->name() == hiddenAttr) {
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyDisplay);
-        else
-            addCSSProperty(CSSPropertyDisplay, CSSValueNone);
-    } else if (attr->name() == tabindexAttr) {
+        addPropertyToAttributeStyle(style, CSSPropertyDisplay, CSSValueNone);
+    } else if (attr->name() == draggableAttr) {
+        if (equalIgnoringCase(attr->value(), "true")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserDrag, CSSValueElement);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserSelect, CSSValueNone);
+        } else if (equalIgnoringCase(attr->value(), "false"))
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserDrag, CSSValueNone);
+    } else if (attr->name() == dirAttr) {
+        if (equalIgnoringCase(attr->value(), "auto"))
+            addPropertyToAttributeStyle(style, CSSPropertyUnicodeBidi, unicodeBidiAttributeForDirAuto(this));
+        else {
+            addPropertyToAttributeStyle(style, CSSPropertyDirection, attr->value());
+            if (!hasTagName(bdiTag) && !hasTagName(bdoTag) && !hasTagName(outputTag))
+                addPropertyToAttributeStyle(style, CSSPropertyUnicodeBidi, CSSValueEmbed);
+        }
+    } else if (attr->name().matches(XMLNames::langAttr)) {
+        mapLanguageAttributeToLocale(attr, style);
+    } else if (attr->name() == langAttr) {
+        // xml:lang has a higher priority than lang.
+        if (!fastHasAttribute(XMLNames::langAttr))
+            mapLanguageAttributeToLocale(attr, style);
+    } else
+        StyledElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLElement::parseAttribute(Attribute* attr)
+{
+    if (isIdAttributeName(attr->name()) || attr->name() == classAttr || attr->name() == styleAttr)
+        return StyledElement::parseAttribute(attr);
+
+    if (attr->name() == dirAttr)
+        dirAttributeChanged(attr);
+    else if (attr->name() == tabindexAttr) {
         int tabindex = 0;
         if (attr->isEmpty())
             clearTabIndexExplicitly();
@@ -192,40 +227,6 @@ void HTMLElement::parseAttribute(Attribute* attr)
             // Clamp tabindex to the range of 'short' to match Firefox's behavior.
             setTabIndexExplicitly(max(static_cast<int>(std::numeric_limits<short>::min()), min(tabindex, static_cast<int>(std::numeric_limits<short>::max()))));
         }
-    } else if (attr->name().matches(XMLNames::langAttr)) {
-        mapLanguageAttributeToLocale(attr);
-    } else if (attr->name() == langAttr) {
-        // xml:lang has a higher priority than lang.
-        if (!fastHasAttribute(XMLNames::langAttr))
-            mapLanguageAttributeToLocale(attr);
-    } else if (attr->name() == dirAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyDirection, CSSPropertyUnicodeBidi);
-        else {
-            bool dirIsAuto = equalIgnoringCase(attr->value(), "auto");
-            if (!dirIsAuto)
-                addCSSProperty(CSSPropertyDirection, attr->value());
-            else
-                removeCSSProperty(CSSPropertyDirection);
-
-            dirAttributeChanged(attr);
-            if (dirIsAuto)
-                addCSSProperty(CSSPropertyUnicodeBidi, unicodeBidiAttributeForDirAuto(this));
-            else if (!hasTagName(bdiTag) && !hasTagName(bdoTag) && !hasTagName(outputTag))
-                addCSSProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
-            else
-                removeCSSProperty(CSSPropertyUnicodeBidi);
-        }
-    } else if (attr->name() == draggableAttr) {
-        const AtomicString& value = attr->value();
-        if (equalIgnoringCase(value, "true")) {
-            addCSSProperty(CSSPropertyWebkitUserDrag, CSSValueElement);
-            addCSSProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-        } else if (equalIgnoringCase(value, "false")) {
-            addCSSProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-            removeCSSProperty(CSSPropertyWebkitUserSelect);
-        } else
-            removeCSSProperties(CSSPropertyWebkitUserDrag, CSSPropertyWebkitUserSelect);
 #if ENABLE(MICRODATA)
     } else if (attr->name() == itempropAttr) {
         setItemProp(attr->value());
@@ -365,7 +366,7 @@ static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<Documen
     }
 
     if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->data(), ec);
+        toText(element->firstChild())->setData(toText(fragment->firstChild())->data(), ec);
         return;
     }
 
@@ -385,7 +386,7 @@ static void replaceChildrenWithText(HTMLElement* element, const String& text, Ex
 #endif
 
     if (hasOneTextChild(element)) {
-        static_cast<Text*>(element->firstChild())->setData(text, ec);
+        toText(element->firstChild())->setData(text, ec);
         return;
     }
 
@@ -434,8 +435,8 @@ static void mergeWithNextTextNode(PassRefPtr<Node> node, ExceptionCode& ec)
     if (!next || !next->isTextNode())
         return;
     
-    RefPtr<Text> textNode = static_cast<Text*>(node.get());
-    RefPtr<Text> textNext = static_cast<Text*>(next);
+    RefPtr<Text> textNode = toText(node.get());
+    RefPtr<Text> textNext = toText(next);
     textNode->appendData(textNext->data(), ec);
     if (ec)
         return;
@@ -678,17 +679,7 @@ void HTMLElement::insertAdjacentText(const String& where, const String& text, Ex
     insertAdjacent(where, textNode.get(), ec);
 }
 
-void HTMLElement::addHTMLAlignment(Attribute* attr)
-{
-    addHTMLAlignmentToStyledElement(this, attr);
-}
-
-void HTMLElement::removeHTMLAlignment()
-{
-    removeCSSProperties(CSSPropertyFloat, CSSPropertyVerticalAlign);
-}
-
-void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Attribute* attr)
+void HTMLElement::applyAlignmentAttributeToStyle(Attribute* attr, StylePropertySet* style)
 {
     // Vertical alignment with respect to the current baseline of the text
     // right or left means floating images.
@@ -718,14 +709,10 @@ void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Attrib
         verticalAlignValue = CSSValueTextTop;
 
     if (floatValue != CSSValueInvalid)
-        element->addCSSProperty(CSSPropertyFloat, floatValue);
-    else
-        element->removeCSSProperty(CSSPropertyFloat);
+        addPropertyToAttributeStyle(style, CSSPropertyFloat, floatValue);
 
     if (verticalAlignValue != CSSValueInvalid)
-        element->addCSSProperty(CSSPropertyVerticalAlign, verticalAlignValue);
-    else
-        element->removeCSSProperty(CSSPropertyVerticalAlign);
+        addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, verticalAlignValue);
 }
 
 bool HTMLElement::supportsFocus() const
@@ -749,27 +736,6 @@ String HTMLElement::contentEditable() const
     return "inherit";
 }
 
-void HTMLElement::setContentEditable(Attribute* attr) 
-{
-    const AtomicString& enabled = attr->value();
-    if (enabled.isNull())
-        removeCSSProperties(CSSPropertyWebkitUserModify, CSSPropertyWordWrap, CSSPropertyWebkitNbspMode, CSSPropertyWebkitLineBreak);
-    else if (enabled.isEmpty() || equalIgnoringCase(enabled, "true")) {
-        addCSSProperty(CSSPropertyWebkitUserModify, CSSValueReadWrite);
-        addCSSProperty(CSSPropertyWordWrap, CSSValueBreakWord);
-        addCSSProperty(CSSPropertyWebkitNbspMode, CSSValueSpace);
-        addCSSProperty(CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
-    } else if (equalIgnoringCase(enabled, "false")) {
-        addCSSProperty(CSSPropertyWebkitUserModify, CSSValueReadOnly);
-        removeCSSProperties(CSSPropertyWordWrap, CSSPropertyWebkitNbspMode, CSSPropertyWebkitLineBreak);
-    } else if (equalIgnoringCase(enabled, "plaintext-only")) {
-        addCSSProperty(CSSPropertyWebkitUserModify, CSSValueReadWritePlaintextOnly);
-        addCSSProperty(CSSPropertyWordWrap, CSSValueBreakWord);
-        addCSSProperty(CSSPropertyWebkitNbspMode, CSSValueSpace);
-        addCSSProperty(CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
-    }
-}
-
 void HTMLElement::setContentEditable(const String& enabled, ExceptionCode& ec)
 {
     if (equalIgnoringCase(enabled, "true"))
@@ -832,6 +798,42 @@ void HTMLElement::setTabIndex(int value)
     setAttribute(tabindexAttr, String::number(value));
 }
 
+TranslateAttributeMode HTMLElement::translateAttributeMode() const
+{
+    const AtomicString& value = getAttribute(translateAttr);
+
+    if (value == nullAtom)
+        return TranslateAttributeInherit;
+    if (equalIgnoringCase(value, "yes") || equalIgnoringCase(value, ""))
+        return TranslateAttributeYes;
+    if (equalIgnoringCase(value, "no"))
+        return TranslateAttributeNo;
+
+    return TranslateAttributeInherit;
+}
+
+bool HTMLElement::translate() const
+{
+    for (const Node* n = this; n; n = n->parentNode()) {
+        if (n->isHTMLElement()) {
+            TranslateAttributeMode mode = static_cast<const HTMLElement*>(n)->translateAttributeMode();
+            if (mode != TranslateAttributeInherit) {
+                ASSERT(mode == TranslateAttributeYes || mode == TranslateAttributeNo);
+                return mode == TranslateAttributeYes;
+            }
+        }
+    }
+
+    // Default on the root element is translate=yes.
+    return true;
+}
+
+void HTMLElement::setTranslate(bool enable)
+{
+    setAttribute(translateAttr, enable ? "yes" : "no");
+}
+
+
 HTMLCollection* HTMLElement::children()
 {
     return ensureCachedHTMLCollection(NodeChildren);
@@ -1065,6 +1067,137 @@ void HTMLElement::setItemValueText(const String& value, ExceptionCode& ec)
 }
 #endif
 
+void HTMLElement::addHTMLLengthToStyle(StylePropertySet* style, int propertyID, const String& value)
+{
+    // FIXME: This function should not spin up the CSS parser, but should instead just figure out the correct
+    // length unit and make the appropriate parsed value.
+
+    // strip attribute garbage..
+    StringImpl* v = value.impl();
+    if (v) {
+        unsigned int l = 0;
+
+        while (l < v->length() && (*v)[l] <= ' ')
+            l++;
+
+        for (; l < v->length(); l++) {
+            UChar cc = (*v)[l];
+            if (cc > '9')
+                break;
+            if (cc < '0') {
+                if (cc == '%' || cc == '*')
+                    l++;
+                if (cc != '.')
+                    break;
+            }
+        }
+
+        if (l != v->length()) {
+            addPropertyToAttributeStyle(style, propertyID, v->substring(0, l));
+            return;
+        }
+    }
+
+    addPropertyToAttributeStyle(style, propertyID, value);
+}
+
+static RGBA32 parseColorStringWithCrazyLegacyRules(const String& colorString)
+{
+    // Per spec, only look at the first 128 digits of the string.
+    const size_t maxColorLength = 128;
+    // We'll pad the buffer with two extra 0s later, so reserve two more than the max.
+    Vector<char, maxColorLength+2> digitBuffer;
+
+    size_t i = 0;
+    // Skip a leading #.
+    if (colorString[0] == '#')
+        i = 1;
+
+    // Grab the first 128 characters, replacing non-hex characters with 0.
+    // Non-BMP characters are replaced with "00" due to them appearing as two "characters" in the String.
+    for (; i < colorString.length() && digitBuffer.size() < maxColorLength; i++) {
+        if (!isASCIIHexDigit(colorString[i]))
+            digitBuffer.append('0');
+        else
+            digitBuffer.append(colorString[i]);
+    }
+
+    if (!digitBuffer.size())
+        return Color::black;
+
+    // Pad the buffer out to at least the next multiple of three in size.
+    digitBuffer.append('0');
+    digitBuffer.append('0');
+
+    if (digitBuffer.size() < 6)
+        return makeRGB(toASCIIHexValue(digitBuffer[0]), toASCIIHexValue(digitBuffer[1]), toASCIIHexValue(digitBuffer[2]));
+
+    // Split the digits into three components, then search the last 8 digits of each component.
+    ASSERT(digitBuffer.size() >= 6);
+    size_t componentLength = digitBuffer.size() / 3;
+    size_t componentSearchWindowLength = min<size_t>(componentLength, 8);
+    size_t redIndex = componentLength - componentSearchWindowLength;
+    size_t greenIndex = componentLength * 2 - componentSearchWindowLength;
+    size_t blueIndex = componentLength * 3 - componentSearchWindowLength;
+    // Skip digits until one of them is non-zero, or we've only got two digits left in the component.
+    while (digitBuffer[redIndex] == '0' && digitBuffer[greenIndex] == '0' && digitBuffer[blueIndex] == '0' && (componentLength - redIndex) > 2) {
+        redIndex++;
+        greenIndex++;
+        blueIndex++;
+    }
+    ASSERT(redIndex + 1 < componentLength);
+    ASSERT(greenIndex >= componentLength);
+    ASSERT(greenIndex + 1 < componentLength * 2);
+    ASSERT(blueIndex >= componentLength * 2);
+    ASSERT(blueIndex + 1 < digitBuffer.size());
+
+    int redValue = toASCIIHexValue(digitBuffer[redIndex], digitBuffer[redIndex + 1]);
+    int greenValue = toASCIIHexValue(digitBuffer[greenIndex], digitBuffer[greenIndex + 1]);
+    int blueValue = toASCIIHexValue(digitBuffer[blueIndex], digitBuffer[blueIndex + 1]);
+    return makeRGB(redValue, greenValue, blueValue);
+}
+
+// Color parsing that matches HTML's "rules for parsing a legacy color value"
+void HTMLElement::addHTMLColorToStyle(StylePropertySet* style, int propertyID, const String& attributeValue)
+{
+    // An empty string doesn't apply a color. (One containing only whitespace does, which is why this check occurs before stripping.)
+    if (attributeValue.isEmpty())
+        return;
+
+    String colorString = attributeValue.stripWhiteSpace();
+
+    // "transparent" doesn't apply a color either.
+    if (equalIgnoringCase(colorString, "transparent"))
+        return;
+
+    // If the string is a named CSS color or a 3/6-digit hex color, use that.
+    Color parsedColor(colorString);
+    if (!parsedColor.isValid())
+        parsedColor.setRGB(parseColorStringWithCrazyLegacyRules(colorString));
+
+    style->setProperty(propertyID, document()->cssValuePool()->createColorValue(parsedColor.rgb()));
+}
+
+void StyledElement::copyNonAttributeProperties(const Element* sourceElement)
+{
+    ASSERT(sourceElement);
+    ASSERT(sourceElement->isStyledElement());
+
+    const StyledElement* source = static_cast<const StyledElement*>(sourceElement);
+    if (!source->inlineStyleDecl())
+        return;
+
+    StylePropertySet* inlineStyle = ensureInlineStyleDecl();
+    inlineStyle->copyPropertiesFrom(*source->inlineStyleDecl());
+    inlineStyle->setStrictParsing(source->inlineStyleDecl()->useStrictParsing());
+
+    setIsStyleAttributeValid(source->isStyleAttributeValid());
+    setIsSynchronizingStyleAttribute(source->isSynchronizingStyleAttribute());
+    
+    Element::copyNonAttributeProperties(sourceElement);
+}
+
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 47197261a..9d463cd77 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -35,6 +35,12 @@ class HTMLFormElement;
 class MicroDataItemValue;
 #endif
 
+enum TranslateAttributeMode {
+    TranslateAttributeYes,
+    TranslateAttributeNo,
+    TranslateAttributeInherit
+};
+
 class HTMLElement : public StyledElement {
 public:
     static PassRefPtr<HTMLElement> create(const QualifiedName& tagName, Document*);
@@ -68,6 +74,9 @@ public:
     bool spellcheck() const;
     void setSpellcheck(bool);
 
+    bool translate() const;
+    void setTranslate(bool);
+
     void click();
 
     virtual void accessKeyAction(bool sendMouseEvents);
@@ -79,8 +88,6 @@ public:
 
     HTMLFormElement* form() const { return virtualForm(); }
 
-    static void addHTMLAlignmentToStyledElement(StyledElement*, Attribute*);
-
     HTMLFormElement* findFormAncestor() const;
 
     TextDirection directionalityIfhasDirAutoAttribute(bool& isAuto) const;
@@ -93,11 +100,15 @@ public:
 protected:
     HTMLElement(const QualifiedName& tagName, Document*);
 
-    void addHTMLAlignment(Attribute*);
-    void removeHTMLAlignment();
+    void addHTMLLengthToStyle(StylePropertySet*, int propertyID, const String& value);
+    void addHTMLColorToStyle(StylePropertySet*, int propertyID, const String& color);
+
+    void applyAlignmentAttributeToStyle(Attribute*, StylePropertySet*);
+    void applyBorderAttributeToStyle(Attribute*, StylePropertySet*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    void applyBorderAttribute(Attribute*);
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     void calculateAndAdjustDirectionality();
@@ -107,9 +118,7 @@ protected:
 private:
     virtual String nodeName() const;
 
-    void mapLanguageAttributeToLocale(Attribute*);
-
-    void setContentEditable(Attribute*);
+    void mapLanguageAttributeToLocale(Attribute*, StylePropertySet*);
 
     virtual HTMLFormElement* virtualForm() const;
 
@@ -121,6 +130,8 @@ private:
     void adjustDirectionalityIfNeededAfterChildrenChanged(Node* beforeChange, int childCountDelta);
     TextDirection directionality(Node** strongDirectionalityTextNode= 0) const;
 
+    TranslateAttributeMode translateAttributeMode() const;
+
 #if ENABLE(MICRODATA)
     virtual String itemValueText() const;
     virtual void setItemValueText(const String&, ExceptionCode&);
diff --git a/Source/WebCore/html/HTMLElement.idl b/Source/WebCore/html/HTMLElement.idl
index 308010f40..8d5a0688d 100644
--- a/Source/WebCore/html/HTMLElement.idl
+++ b/Source/WebCore/html/HTMLElement.idl
@@ -22,13 +22,15 @@ module html {
 
     interface [
         JSGenerateToNativeObject,
-        JSCustomPushEventHandlerScope
+        JSCustomPushEventHandlerScope,
+        V8CustomToJSObject
     ] HTMLElement : Element {
                  // iht.com relies on id returning the empty string when no id is present. 
                  // Other browsers do this as well. So we don't convert null to JS null.
                  attribute [Reflect] DOMString id;
                  attribute [Reflect] DOMString title;
                  attribute [Reflect] DOMString lang;
+                 attribute boolean             translate;
                  attribute [Reflect] DOMString dir;
                  attribute [Reflect=class] DOMString className;
                  readonly attribute DOMTokenList classList;
@@ -49,14 +51,14 @@ module html {
                  attribute [TreatNullAs=NullString] DOMString outerText
                      setter raises(DOMException);
 
-        Element insertAdjacentElement(in [Optional=CallWithDefaultValue] DOMString where,
-                                      in [Optional=CallWithDefaultValue] Element element)
+        Element insertAdjacentElement(in [Optional=DefaultIsUndefined] DOMString where,
+                                      in [Optional=DefaultIsUndefined] Element element)
             raises(DOMException);
-        void insertAdjacentHTML(in [Optional=CallWithDefaultValue] DOMString where,
-                                in [Optional=CallWithDefaultValue] DOMString html)
+        void insertAdjacentHTML(in [Optional=DefaultIsUndefined] DOMString where,
+                                in [Optional=DefaultIsUndefined] DOMString html)
             raises(DOMException);
-        void insertAdjacentText(in [Optional=CallWithDefaultValue] DOMString where,
-                                in [Optional=CallWithDefaultValue] DOMString text)
+        void insertAdjacentText(in [Optional=DefaultIsUndefined] DOMString where,
+                                in [Optional=DefaultIsUndefined] DOMString text)
             raises(DOMException);
 
         readonly attribute HTMLCollection children;
@@ -88,6 +90,8 @@ module html {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString titleDisplayString;
 #endif
+
+        void click();
     };
 
 }
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index 1d64ecaae..06cb9b1e9 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -74,6 +74,24 @@ RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings()
     return findWidgetRenderer(this);
 }
 
+bool HTMLEmbedElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == hiddenAttr)
+        return true;
+    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+}
+
+void HTMLEmbedElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == hiddenAttr) {
+        if (equalIgnoringCase(attr->value(), "yes") || equalIgnoringCase(attr->value(), "true")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWidth, 0, CSSPrimitiveValue::CSS_PX);
+            addPropertyToAttributeStyle(style, CSSPropertyHeight, 0, CSSPrimitiveValue::CSS_PX);
+        }
+    } else
+        HTMLPlugInImageElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLEmbedElement::parseAttribute(Attribute* attr)
 {
     const AtomicString& value = attr->value();
@@ -94,14 +112,6 @@ void HTMLEmbedElement::parseAttribute(Attribute* attr)
                 m_imageLoader = adoptPtr(new HTMLImageLoader(this));
             m_imageLoader->updateFromElementIgnoringPreviousError();
         }
-    } else if (attr->name() == hiddenAttr) {
-        if (equalIgnoringCase(value.string(), "yes") || equalIgnoringCase(value.string(), "true")) {
-            // FIXME: Not dynamic, since we add this but don't remove it, but it may be OK for now
-            // that this rarely-used attribute won't work properly if you remove it.
-            addCSSLength(CSSPropertyWidth, "0");
-            addCSSLength(CSSPropertyHeight, "0");
-        } else
-            removeCSSProperties(CSSPropertyWidth, CSSPropertyHeight);
     } else
         HTMLPlugInImageElement::parseAttribute(attr);
 }
@@ -164,7 +174,7 @@ void HTMLEmbedElement::updateWidget(PluginCreationOption pluginCreationOption)
 
     SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
     // FIXME: beforeLoad could have detached the renderer!  Just like in the <object> case above.
-    loader->requestObject(this, m_url, getAttribute(nameAttr), m_serviceType, paramNames, paramValues);
+    loader->requestObject(this, m_url, getNameAttribute(), m_serviceType, paramNames, paramValues);
 }
 
 bool HTMLEmbedElement::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/WebCore/html/HTMLEmbedElement.h b/Source/WebCore/html/HTMLEmbedElement.h
index f37760361..f0fca2224 100644
--- a/Source/WebCore/html/HTMLEmbedElement.h
+++ b/Source/WebCore/html/HTMLEmbedElement.h
@@ -35,6 +35,8 @@ private:
     HTMLEmbedElement(const QualifiedName&, Document*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual void insertedIntoDocument();
diff --git a/Source/WebCore/html/HTMLEmbedElement.idl b/Source/WebCore/html/HTMLEmbedElement.idl
index 8ccc38830..b6e3c166a 100644
--- a/Source/WebCore/html/HTMLEmbedElement.idl
+++ b/Source/WebCore/html/HTMLEmbedElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         CustomNamedSetter,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomCall
     ] HTMLEmbedElement : HTMLElement {
     attribute [Reflect] DOMString align;
@@ -42,7 +42,7 @@ module html {
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-    [CheckAccessToNode] SVGDocument getSVGDocument() raises(DOMException);
+    [CheckSecurityForNode] SVGDocument getSVGDocument() raises(DOMException);
 #endif
 #endif
     };
diff --git a/Source/WebCore/html/HTMLFontElement.cpp b/Source/WebCore/html/HTMLFontElement.cpp
index 86f52984a..a7c2e950b 100644
--- a/Source/WebCore/html/HTMLFontElement.cpp
+++ b/Source/WebCore/html/HTMLFontElement.cpp
@@ -26,6 +26,8 @@
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "CSSValueList.h"
+#include "CSSValuePool.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include <wtf/text/StringBuilder.h>
@@ -158,26 +160,26 @@ bool HTMLFontElement::cssValueFromFontSizeNumber(const String& s, int& size)
     return true;
 }
 
-void HTMLFontElement::parseAttribute(Attribute* attr)
+bool HTMLFontElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == sizeAttr || attr->name() == colorAttr || attr->name() == faceAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLFontElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == sizeAttr) {
         int size = 0;
         if (cssValueFromFontSizeNumber(attr->value(), size))
-            addCSSProperty(CSSPropertyFontSize, size);
-        else
-            removeCSSProperty(CSSPropertyFontSize);
-    } else if (attr->name() == colorAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyColor);
-        else
-            addCSSColor(CSSPropertyColor, attr->value());
-    } else if (attr->name() == faceAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyFontFamily);
-        else
-            addCSSProperty(CSSPropertyFontFamily, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyFontSize, size);
+    } else if (attr->name() == colorAttr)
+        addHTMLColorToStyle(style, CSSPropertyColor, attr->value());
+    else if (attr->name() == faceAttr) {
+        if (RefPtr<CSSValueList> fontFaceValue = document()->cssValuePool()->createFontFaceValue(attr->value(), document()->elementSheet()))
+            style->setProperty(CSSProperty(CSSPropertyFontFamily, fontFaceValue.release()));
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLFontElement.h b/Source/WebCore/html/HTMLFontElement.h
index eea8b44fb..f24332c31 100644
--- a/Source/WebCore/html/HTMLFontElement.h
+++ b/Source/WebCore/html/HTMLFontElement.h
@@ -37,7 +37,8 @@ public:
 private:
     HTMLFontElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLFormCollection.cpp b/Source/WebCore/html/HTMLFormCollection.cpp
index 919e09c01..684e3a5aa 100644
--- a/Source/WebCore/html/HTMLFormCollection.cpp
+++ b/Source/WebCore/html/HTMLFormCollection.cpp
@@ -164,7 +164,7 @@ void HTMLFormCollection::updateNameCache() const
         if (associatedElement->isEnumeratable()) {
             HTMLElement* element = toHTMLElement(associatedElement);
             const AtomicString& idAttrVal = element->getIdAttribute();
-            const AtomicString& nameAttrVal = element->getAttribute(nameAttr);
+            const AtomicString& nameAttrVal = element->getNameAttribute();
             if (!idAttrVal.isEmpty()) {
                 append(m_cache.idCache, idAttrVal, element);
                 foundInputElements.add(idAttrVal.impl());
@@ -179,7 +179,7 @@ void HTMLFormCollection::updateNameCache() const
     for (unsigned i = 0; i < f->m_imageElements.size(); ++i) {
         HTMLImageElement* element = f->m_imageElements[i];
         const AtomicString& idAttrVal = element->getIdAttribute();
-        const AtomicString& nameAttrVal = element->getAttribute(nameAttr);
+        const AtomicString& nameAttrVal = element->getNameAttribute();
         if (!idAttrVal.isEmpty() && !foundInputElements.contains(idAttrVal.impl()))
             append(m_cache.idCache, idAttrVal, element);
         if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && !foundInputElements.contains(nameAttrVal.impl()))
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index c092f617a..8a72df061 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -227,7 +227,7 @@ void HTMLFormControlElement::removedFromDocument()
 
 const AtomicString& HTMLFormControlElement::formControlName() const
 {
-    const AtomicString& name = fastGetAttribute(nameAttr);
+    const AtomicString& name = getNameAttribute();
     return name.isNull() ? emptyAtom : name;
 }
 
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 89f1e7b9b..213b336d9 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -500,7 +500,7 @@ HTMLCollection* HTMLFormElement::elements()
 
 String HTMLFormElement::name() const
 {
-    return getAttribute(nameAttr);
+    return getNameAttribute();
 }
 
 bool HTMLFormElement::noValidate() const
diff --git a/Source/WebCore/html/HTMLFrameElement.idl b/Source/WebCore/html/HTMLFrameElement.idl
index 51a471621..f40f7b1c5 100644
--- a/Source/WebCore/html/HTMLFrameElement.idl
+++ b/Source/WebCore/html/HTMLFrameElement.idl
@@ -32,14 +32,14 @@ module html {
         attribute [Reflect, URL] DOMString src;
 
         // Introduced in DOM Level 2:
-        readonly attribute [CheckAccessToNode] Document contentDocument;
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
 
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-        [CheckAccessToNode] SVGDocument getSVGDocument()
+        [CheckSecurityForNode] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
diff --git a/Source/WebCore/html/HTMLFrameElementBase.cpp b/Source/WebCore/html/HTMLFrameElementBase.cpp
index 727173bb9..0841230da 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.cpp
+++ b/Source/WebCore/html/HTMLFrameElementBase.cpp
@@ -174,7 +174,7 @@ void HTMLFrameElementBase::parseAttribute(Attribute* attr)
 
 void HTMLFrameElementBase::setNameAndOpenURL()
 {
-    m_frameName = getAttribute(nameAttr);
+    m_frameName = getNameAttribute();
     if (m_frameName.isNull())
         m_frameName = getIdAttribute();
     openURL();
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index 4af6342bd..d3fdb97a4 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -64,6 +64,21 @@ PassRefPtr<HTMLFrameSetElement> HTMLFrameSetElement::create(const QualifiedName&
     return adoptRef(new HTMLFrameSetElement(tagName, document));
 }
 
+bool HTMLFrameSetElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == bordercolorAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLFrameSetElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == bordercolorAttr)
+        addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+    else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLFrameSetElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == rowsAttr) {
@@ -98,13 +113,9 @@ void HTMLFrameSetElement::parseAttribute(Attribute* attr)
             m_borderSet = true;
         } else
             m_borderSet = false;
-    } else if (attr->name() == bordercolorAttr) {
+    } else if (attr->name() == bordercolorAttr)
         m_borderColorSet = !attr->isEmpty();
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyBorderColor);
-        else
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-    } else if (attr->name() == onloadAttr)
+    else if (attr->name() == onloadAttr)
         document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onbeforeunloadAttr)
         document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index 187902396..1cd40a290 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -68,6 +68,8 @@ private:
     HTMLFrameSetElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
diff --git a/Source/WebCore/html/HTMLHRElement.cpp b/Source/WebCore/html/HTMLHRElement.cpp
index 5534b929f..8f8b6e140 100644
--- a/Source/WebCore/html/HTMLHRElement.cpp
+++ b/Source/WebCore/html/HTMLHRElement.cpp
@@ -26,6 +26,7 @@
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "CSSValuePool.h"
 #include "HTMLNames.h"
 
 namespace WebCore {
@@ -48,70 +49,52 @@ PassRefPtr<HTMLHRElement> HTMLHRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLHRElement(tagName, document));
 }
 
-void HTMLHRElement::parseAttribute(Attribute* attr)
+bool HTMLHRElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == colorAttr || attr->name() == noshadeAttr || attr->name() == sizeAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLHRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (attr->value().isNull()) {
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        } else if (equalIgnoringCase(attr->value(), "left")) {
-            addCSSProperty(CSSPropertyMarginLeft, "0");
-            addCSSProperty(CSSPropertyMarginRight, CSSValueAuto);
+        if (equalIgnoringCase(attr->value(), "left")) {
+            addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, 0, CSSPrimitiveValue::CSS_PX);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginRight, CSSValueAuto);
         } else if (equalIgnoringCase(attr->value(), "right")) {
-            addCSSProperty(CSSPropertyMarginLeft, CSSValueAuto);
-            addCSSProperty(CSSPropertyMarginRight, "0");
+            addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, CSSValueAuto);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginRight, 0, CSSPrimitiveValue::CSS_PX);
         } else {
-            addCSSProperty(CSSPropertyMarginLeft, CSSValueAuto);
-            addCSSProperty(CSSPropertyMarginRight, CSSValueAuto);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, CSSValueAuto);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginRight, CSSValueAuto);
         }
     } else if (attr->name() == widthAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else {
-            bool ok;
-            int v = attr->value().toInt(&ok);
-            if (ok && !v)
-                addCSSLength(CSSPropertyWidth, "1");
-            else
-                addCSSLength(CSSPropertyWidth, attr->value());
-        }
+        bool ok;
+        int v = attr->value().toInt(&ok);
+        if (ok && !v)
+            addPropertyToAttributeStyle(style, CSSPropertyWidth, 1, CSSPrimitiveValue::CSS_PX);
+        else
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     } else if (attr->name() == colorAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderColor, CSSPropertyBackgroundColor);
-        else {
-            addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
-        }
+        addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
+        addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     } else if (attr->name() == noshadeAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderColor, CSSPropertyBackgroundColor);
-        else {
-            addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-            addCSSColor(CSSPropertyBorderColor, String("grey"));
-            addCSSColor(CSSPropertyBackgroundColor, String("grey"));
-        }
+        addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
+
+        RefPtr<CSSPrimitiveValue> darkGrayValue = document()->cssValuePool()->createColorValue(Color::darkGray);
+        style->setProperty(CSSPropertyBorderColor, darkGrayValue);
+        style->setProperty(CSSPropertyBackgroundColor, darkGrayValue);
     } else if (attr->name() == sizeAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyBorderBottomWidth, CSSPropertyHeight);
-        else {
-            StringImpl* si = attr->value().impl();
-            int size = si->toInt();
-            if (size <= 1) {
-                addCSSProperty(CSSPropertyBorderBottomWidth, String("0"));
-                removeCSSProperty(CSSPropertyHeight);
-            } else {
-                addCSSLength(CSSPropertyHeight, String::number(size-2));
-                removeCSSProperty(CSSPropertyBorderBottomWidth);
-            }
-        }
+        StringImpl* si = attr->value().impl();
+        int size = si->toInt();
+        if (size <= 1)
+            addPropertyToAttributeStyle(style, CSSPropertyBorderBottomWidth, 0, CSSPrimitiveValue::CSS_PX);
+        else
+            addPropertyToAttributeStyle(style, CSSPropertyHeight, size - 2, CSSPrimitiveValue::CSS_PX);
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLHRElement.h b/Source/WebCore/html/HTMLHRElement.h
index f05085b29..728619ac5 100644
--- a/Source/WebCore/html/HTMLHRElement.h
+++ b/Source/WebCore/html/HTMLHRElement.h
@@ -37,7 +37,8 @@ public:
 private:
     HTMLHRElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLIFrameElement.cpp b/Source/WebCore/html/HTMLIFrameElement.cpp
index 5cba88842..a846fa432 100644
--- a/Source/WebCore/html/HTMLIFrameElement.cpp
+++ b/Source/WebCore/html/HTMLIFrameElement.cpp
@@ -48,15 +48,35 @@ PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tag
     return adoptRef(new HTMLIFrameElement(tagName, document));
 }
 
-void HTMLIFrameElement::parseAttribute(Attribute* attr)
+bool HTMLIFrameElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == alignAttr || attr->name() == frameborderAttr)
+        return true;
+    return HTMLFrameElementBase::isPresentationAttribute(attr);
+}
+
+void HTMLIFrameElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == widthAttr)
-        addCSSLength(CSSPropertyWidth, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     else if (attr->name() == heightAttr)
-        addCSSLength(CSSPropertyHeight, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     else if (attr->name() == alignAttr)
-        addHTMLAlignment(attr);
-    else if (attr->name() == nameAttr) {
+        applyAlignmentAttributeToStyle(attr, style);
+    else if (attr->name() == frameborderAttr) {
+        // Frame border doesn't really match the HTML4 spec definition for iframes. It simply adds
+        // a presentational hint that the border should be off if set to zero.
+        if (!attr->isNull() && !attr->value().toInt()) {
+            // Add a rule that nulls out our border width.
+            addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, 0, CSSPrimitiveValue::CSS_PX);
+        }
+    } else
+        HTMLFrameElementBase::collectStyleForAttribute(attr, style);
+}
+
+void HTMLIFrameElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
@@ -64,14 +84,6 @@ void HTMLIFrameElement::parseAttribute(Attribute* attr)
             document->addExtraNamedItem(newName);
         }
         m_name = newName;
-    } else if (attr->name() == frameborderAttr) {
-        // Frame border doesn't really match the HTML4 spec definition for iframes.  It simply adds
-        // a presentational hint that the border should be off if set to zero.
-        if (!attr->isNull() && !attr->value().toInt()) {
-            // Add a rule that nulls out our border width.
-            addCSSLength(CSSPropertyBorderWidth, "0");
-        } else
-            removeCSSProperty(CSSPropertyBorderWidth);
     } else if (attr->name() == sandboxAttr)
         setSandboxFlags(attr->isNull() ? SandboxNone : SecurityContext::parseSandboxPolicy(attr->value()));
     else
diff --git a/Source/WebCore/html/HTMLIFrameElement.h b/Source/WebCore/html/HTMLIFrameElement.h
index bcba2a257..075841091 100644
--- a/Source/WebCore/html/HTMLIFrameElement.h
+++ b/Source/WebCore/html/HTMLIFrameElement.h
@@ -36,6 +36,8 @@ private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
diff --git a/Source/WebCore/html/HTMLIFrameElement.idl b/Source/WebCore/html/HTMLIFrameElement.idl
index 1e88269e0..25f9cb14b 100644
--- a/Source/WebCore/html/HTMLIFrameElement.idl
+++ b/Source/WebCore/html/HTMLIFrameElement.idl
@@ -34,14 +34,14 @@ module html {
         attribute [Reflect] DOMString width;
 
         // Introduced in DOM Level 2:
-        readonly attribute [CheckAccessToNode] Document contentDocument;
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
 
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-        [CheckAccessToNode] SVGDocument getSVGDocument()
+        [CheckSecurityForNode] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
index 6c22edc12..583a23fc8 100644
--- a/Source/WebCore/html/HTMLImageElement.cpp
+++ b/Source/WebCore/html/HTMLImageElement.cpp
@@ -78,6 +78,35 @@ PassRefPtr<HTMLImageElement> HTMLImageElement::createForJSConstructor(Document*
     return image.release();
 }
 
+bool HTMLImageElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == borderAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == valignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    else if (attr->name() == borderAttr)
+        applyBorderAttributeToStyle(attr, style);
+    else if (attr->name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+    } else if (attr->name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+    } else if (attr->name() == alignAttr)
+        applyAlignmentAttributeToStyle(attr, style);
+    else if (attr->name() == valignAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
+    else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLImageElement::parseAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
@@ -86,40 +115,6 @@ void HTMLImageElement::parseAttribute(Attribute* attr)
             toRenderImage(renderer())->updateAltText();
     } else if (attrName == srcAttr)
         m_imageLoader.updateFromElementIgnoringPreviousError();
-    else if (attrName == widthAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
-    else if (attrName == heightAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
-    else if (attrName == borderAttr) {
-        // border="noborder" -> border="0"
-        applyBorderAttribute(attr);
-    } else if (attrName == vspaceAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
-        else {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        }
-    } else if (attrName == hspaceAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        else {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        }
-    } else if (attrName == alignAttr)
-        addHTMLAlignment(attr);
-    else if (attrName == valignAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyVerticalAlign);
-        else
-            addCSSProperty(CSSPropertyVerticalAlign, attr->value());
     else if (attrName == usemapAttr)
         setIsLink(!attr->isNull());
     else if (attrName == onabortAttr)
diff --git a/Source/WebCore/html/HTMLImageElement.h b/Source/WebCore/html/HTMLImageElement.h
index b24d348bb..37a23775a 100644
--- a/Source/WebCore/html/HTMLImageElement.h
+++ b/Source/WebCore/html/HTMLImageElement.h
@@ -84,6 +84,8 @@ protected:
 
 private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 960040fdd..422ac8513 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -51,6 +51,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "SearchInputType.h"
+#include "ShadowRoot.h"
 #include "ScriptEventListener.h"
 #include "WheelEvent.h"
 #include <wtf/MathExtras.h>
@@ -108,6 +109,9 @@ PassRefPtr<HTMLInputElement> HTMLInputElement::create(const QualifiedName& tagNa
 
 void HTMLInputElement::createShadowSubtree()
 {
+    ASSERT(!hasShadowRoot());
+    ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+
     m_inputType->createShadowSubtree();
 }
 
@@ -349,7 +353,7 @@ bool HTMLInputElement::getAllowedValueStepWithDecimalPlaces(AnyStepHandling anyS
     return true;
 }
 
-void HTMLInputElement::applyStep(double count, AnyStepHandling anyStepHandling, bool sendChangeEvent, ExceptionCode& ec)
+void HTMLInputElement::applyStep(double count, AnyStepHandling anyStepHandling, TextFieldEventBehavior eventBehavior, ExceptionCode& ec)
 {
     double step;
     unsigned stepDecimalPlaces, currentDecimalPlaces;
@@ -389,7 +393,7 @@ void HTMLInputElement::applyStep(double count, AnyStepHandling anyStepHandling,
     if (newValue > m_inputType->maximum())
         newValue = m_inputType->maximum();
 
-    setValueAsNumber(newValue, ec, sendChangeEvent);
+    setValueAsNumber(newValue, ec, eventBehavior);
 
     if (AXObjectCache::accessibilityEnabled())
          document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
@@ -416,14 +420,12 @@ double HTMLInputElement::alignValueForStep(double newValue, double step, unsigne
 
 void HTMLInputElement::stepUp(int n, ExceptionCode& ec)
 {
-    bool sendChangeEvent = false;
-    applyStep(n, RejectAny, sendChangeEvent, ec);
+    applyStep(n, RejectAny, DispatchNoEvent, ec);
 }
 
 void HTMLInputElement::stepDown(int n, ExceptionCode& ec)
 {
-    bool sendChangeEvent = false;
-    applyStep(-n, RejectAny, sendChangeEvent, ec);
+    applyStep(-n, RejectAny, DispatchNoEvent, ec);
 }
 
 bool HTMLInputElement::isKeyboardFocusable(KeyboardEvent* event) const
@@ -545,7 +547,7 @@ void HTMLInputElement::updateType()
         registerForSuspensionCallbackIfNeeded();
 
     if (didRespectHeightAndWidth != m_inputType->shouldRespectHeightAndWidthAttributes()) {
-        ASSERT(attributeMap());
+        ASSERT(attributeData());
         if (Attribute* height = getAttributeItem(heightAttr))
             attributeChanged(height);
         if (Attribute* width = getAttributeItem(widthAttr))
@@ -658,6 +660,36 @@ void HTMLInputElement::accessKeyAction(bool sendMouseEvents)
     m_inputType->accessKeyAction(sendMouseEvents);
 }
 
+bool HTMLInputElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == heightAttr || (attr->name() == borderAttr && isImageButton()))
+        return true;
+    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+}
+
+void HTMLInputElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+    } else if (attr->name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+    } else if (attr->name() == alignAttr) {
+        if (m_inputType->shouldRespectAlignAttribute())
+            applyAlignmentAttributeToStyle(attr, style);
+    } else if (attr->name() == widthAttr) {
+        if (m_inputType->shouldRespectHeightAndWidthAttributes())
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    } else if (attr->name() == heightAttr) {
+        if (m_inputType->shouldRespectHeightAndWidthAttributes())
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    } else if (attr->name() == borderAttr && isImageButton())
+        applyBorderAttributeToStyle(attr, style);
+    else
+        return HTMLTextFormControlElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLInputElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == nameAttr) {
@@ -713,29 +745,6 @@ void HTMLInputElement::parseAttribute(Attribute* attr)
         m_inputType->srcAttributeChanged();
     else if (attr->name() == usemapAttr || attr->name() == accesskeyAttr) {
         // FIXME: ignore for the moment
-    } else if (attr->name() == vspaceAttr) {
-        addCSSLength(CSSPropertyMarginTop, attr->value());
-        addCSSLength(CSSPropertyMarginBottom, attr->value());
-    } else if (attr->name() == hspaceAttr) {
-        addCSSLength(CSSPropertyMarginLeft, attr->value());
-        addCSSLength(CSSPropertyMarginRight, attr->value());
-    } else if (attr->name() == alignAttr) {
-        if (m_inputType->shouldRespectAlignAttribute())
-            addHTMLAlignment(attr);
-        else
-            removeHTMLAlignment();
-    } else if (attr->name() == widthAttr) {
-        if (m_inputType->shouldRespectHeightAndWidthAttributes())
-            addCSSLength(CSSPropertyWidth, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWidth);
-    } else if (attr->name() == heightAttr) {
-        if (m_inputType->shouldRespectHeightAndWidthAttributes())
-            addCSSLength(CSSPropertyHeight, attr->value());
-        else
-            removeCSSProperty(CSSPropertyHeight);
-    } else if (attr->name() == borderAttr && isImageButton()) {
-        applyBorderAttribute(attr);
     } else if (attr->name() == onsearchAttr) {
         // Search field and slider attributes all just cause updateFromElement to be called through style recalcing.
         setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
@@ -900,7 +909,7 @@ bool HTMLInputElement::isTextType() const
     return m_inputType->isTextType();
 }
 
-void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
+void HTMLInputElement::setChecked(bool nowChecked, TextFieldEventBehavior eventBehavior)
 {
     if (checked() == nowChecked)
         return;
@@ -925,7 +934,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // unchecked to match other browsers. DOM is not a useful standard for this
     // because it says only to fire change events at "lose focus" time, which is
     // definitely wrong in practice for these types of elements.
-    if (sendChangeEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged()) {
+    if (eventBehavior != DispatchNoEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged()) {
         setTextAsOfLastFormControlChangeEvent(String());
         dispatchFormControlChangeEvent();
     }
@@ -999,7 +1008,7 @@ String HTMLInputElement::valueWithDefault() const
 void HTMLInputElement::setValueForUser(const String& value)
 {
     // Call setValue and make it send a change event.
-    setValue(value, true);
+    setValue(value, DispatchChangeEvent);
 }
 
 const String& HTMLInputElement::suggestedValue() const
@@ -1017,7 +1026,7 @@ void HTMLInputElement::setSuggestedValue(const String& value)
     updateInnerTextValue();
 }
 
-void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
+void HTMLInputElement::setValue(const String& value, TextFieldEventBehavior eventBehavior)
 {
     if (!m_inputType->canSetValue(value))
         return;
@@ -1029,25 +1038,18 @@ void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
     setLastChangeWasNotUserEdit();
     setFormControlValueMatchesRenderer(false);
     m_suggestedValue = String(); // Prevent TextFieldInputType::setValue from using the suggested value.
-    m_inputType->setValue(sanitizedValue, valueChanged, sendChangeEvent);
+    m_inputType->setValue(sanitizedValue, valueChanged, eventBehavior);
 
     if (!valueChanged)
         return;
 
-    if (sendChangeEvent)
-        m_inputType->dispatchChangeEventInResponseToSetValue();
-
-    // FIXME: Why do we do this when !sendChangeEvent?
-    if (isTextField() && (!focused() || !sendChangeEvent))
-        setTextAsOfLastFormControlChangeEvent(value);
-
     notifyFormStateChanged();
 }
 
-void HTMLInputElement::setValueInternal(const String& sanitizedValue, bool sendChangeEvent)
+void HTMLInputElement::setValueInternal(const String& sanitizedValue, TextFieldEventBehavior eventBehavior)
 {
     m_valueIfDirty = sanitizedValue;
-    m_wasModifiedByUser = sendChangeEvent;
+    m_wasModifiedByUser = eventBehavior != DispatchNoEvent;
     setNeedsValidityCheck();
 }
 
@@ -1066,13 +1068,13 @@ double HTMLInputElement::valueAsNumber() const
     return m_inputType->valueAsNumber();
 }
 
-void HTMLInputElement::setValueAsNumber(double newValue, ExceptionCode& ec, bool sendChangeEvent)
+void HTMLInputElement::setValueAsNumber(double newValue, ExceptionCode& ec, TextFieldEventBehavior eventBehavior)
 {
     if (!isfinite(newValue)) {
         ec = NOT_SUPPORTED_ERR;
         return;
     }
-    m_inputType->setValueAsNumber(newValue, sendChangeEvent, ec);
+    m_inputType->setValueAsNumber(newValue, eventBehavior, ec);
 }
 
 String HTMLInputElement::placeholder() const
@@ -1626,7 +1628,6 @@ void HTMLInputElement::stepUpFromRenderer(int n)
     const double nan = numeric_limits<double>::quiet_NaN();
     String currentStringValue = value();
     double current = m_inputType->parseToDouble(currentStringValue, nan);
-    const bool sendChangeEvent = true;
     if (!isfinite(current)) {
         ExceptionCode ec;
         current = m_inputType->defaultValueForStepUp();
@@ -1635,10 +1636,10 @@ void HTMLInputElement::stepUpFromRenderer(int n)
             current = m_inputType->minimum() - nextDiff;
         if (current > m_inputType->maximum() - nextDiff)
             current = m_inputType->maximum() - nextDiff;
-        setValueAsNumber(current, ec, sendChangeEvent);
+        setValueAsNumber(current, ec, DispatchInputAndChangeEvent);
     }
     if ((sign > 0 && current < m_inputType->minimum()) || (sign < 0 && current > m_inputType->maximum()))
-        setValue(m_inputType->serialize(sign > 0 ? m_inputType->minimum() : m_inputType->maximum()), sendChangeEvent);
+        setValue(m_inputType->serialize(sign > 0 ? m_inputType->minimum() : m_inputType->maximum()), DispatchInputAndChangeEvent);
     else {
         ExceptionCode ec;
         if (stepMismatch(value())) {
@@ -1658,14 +1659,14 @@ void HTMLInputElement::stepUpFromRenderer(int n)
             if (newValue > m_inputType->maximum())
                 newValue = m_inputType->maximum();
 
-            setValueAsNumber(newValue, ec, n == 1 || n == -1);
+            setValueAsNumber(newValue, ec, n == 1 || n == -1 ? DispatchInputAndChangeEvent : DispatchNoEvent);
             current = newValue;
             if (n > 1)
-                applyStep(n - 1, AnyIsDefaultStep, sendChangeEvent, ec);
+                applyStep(n - 1, AnyIsDefaultStep, DispatchInputAndChangeEvent, ec);
             else if (n < -1)
-                applyStep(n + 1, AnyIsDefaultStep, sendChangeEvent, ec);
+                applyStep(n + 1, AnyIsDefaultStep, DispatchInputAndChangeEvent, ec);
         } else
-            applyStep(n, AnyIsDefaultStep, sendChangeEvent, ec);
+            applyStep(n, AnyIsDefaultStep, DispatchInputAndChangeEvent, ec);
     }
 }
 
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index b6fa0f623..39cb48ba6 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -121,7 +121,7 @@ public:
     virtual HTMLElement* placeholderElement() const;
 
     bool checked() const { return m_isChecked; }
-    void setChecked(bool, bool sendChangeEvent = false);
+    void setChecked(bool, TextFieldEventBehavior = DispatchNoEvent);
 
     // 'indeterminate' is a state independent of the checked state that causes the control to draw in a way that hides the actual state.
     bool indeterminate() const { return m_isIndeterminate; }
@@ -136,7 +136,7 @@ public:
     void setType(const String&);
 
     String value() const;
-    void setValue(const String&, bool sendChangeEvent = false);
+    void setValue(const String&, TextFieldEventBehavior = DispatchNoEvent);
     void setValueForUser(const String&);
     // Checks if the specified string would be a valid value.
     // We should not call this for types with no string value such as CHECKBOX and RADIO.
@@ -160,7 +160,7 @@ public:
     void setValueAsDate(double, ExceptionCode&);
 
     double valueAsNumber() const;
-    void setValueAsNumber(double, ExceptionCode&, bool sendChangeEvent = false);
+    void setValueAsNumber(double, ExceptionCode&, TextFieldEventBehavior = DispatchNoEvent);
 
     virtual String placeholder() const;
     virtual void setPlaceholder(const String&);
@@ -225,7 +225,7 @@ public:
     // Otherwise, they would be private.
     CheckedRadioButtons& checkedRadioButtons() const;
     void updateCheckedRadioButtons();
-    void setValueInternal(const String&, bool sendChangeEvent);
+    void setValueInternal(const String&, TextFieldEventBehavior);
 
     void cacheSelectionInResponseToSetValue(int caretOffset) { cacheSelection(caretOffset, caretOffset, SelectionHasNoDirection); }
 
@@ -276,6 +276,8 @@ private:
     virtual void accessKeyAction(bool sendMouseEvents);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void finishParsingChildren();
 
     virtual void copyNonAttributeProperties(const Element* source);
@@ -328,7 +330,7 @@ private:
     bool getAllowedValueStepWithDecimalPlaces(AnyStepHandling, double*, unsigned*) const;
 
     // Helper for stepUp()/stepDown().  Adds step value * count to the current value.
-    void applyStep(double count, AnyStepHandling, bool sendChangeEvent, ExceptionCode&);
+    void applyStep(double count, AnyStepHandling, TextFieldEventBehavior, ExceptionCode&);
     double alignValueForStep(double value, double step, unsigned currentDecimalPlaces, unsigned stepDecimalPlaces);
 
 #if ENABLE(DATALIST)
diff --git a/Source/WebCore/html/HTMLInputElement.idl b/Source/WebCore/html/HTMLInputElement.idl
index 4e218b96c..84beb8ac5 100644
--- a/Source/WebCore/html/HTMLInputElement.idl
+++ b/Source/WebCore/html/HTMLInputElement.idl
@@ -50,6 +50,7 @@ module html {
         attribute [Reflect] boolean readOnly;
         attribute [Reflect] boolean required;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
         attribute [ObjCImplementedAsUnsignedLong] DOMString size; // DOM level 2 changed this to a long, but ObjC API is a string
 #else
         attribute unsigned long size; // Changed string -> long -> unsigned long
@@ -74,7 +75,10 @@ module html {
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
         void select();
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void click();
+#endif
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         void setValueForUser(in [TreatNullAs=NullString] DOMString value);
@@ -90,8 +94,8 @@ module html {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         [Custom] void setSelectionRange(in long start, in long end);
 #else
-        [Custom] void setSelectionRange(in [Optional=CallWithDefaultValue] long start, 
-                                        in [Optional=CallWithDefaultValue] long end, 
+        [Custom] void setSelectionRange(in [Optional=DefaultIsUndefined] long start, 
+                                        in [Optional=DefaultIsUndefined] long end, 
                                         in [Optional] DOMString direction);
 #endif
 
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index 85252819a..e10079f64 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -33,6 +33,7 @@
 #include "HTMLOptionElement.h"
 #include "SSLKeyGenerator.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
 
@@ -85,7 +86,7 @@ inline HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Docume
         option->appendChild(Text::create(document, keys[i]), ec);
     }
 
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(select, ec);
 }
@@ -130,8 +131,8 @@ void HTMLKeygenElement::reset()
 
 HTMLSelectElement* HTMLKeygenElement::shadowSelect() const
 {
-    ShadowRoot* shadow = shadowRoot();
-    ASSERT(shadow);
+    ASSERT(hasShadowRoot());
+    ShadowRoot* shadow = shadowRootList()->oldestShadowRoot();
     return shadow ? toHTMLSelectElement(shadow->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/HTMLLIElement.cpp b/Source/WebCore/html/HTMLLIElement.cpp
index f789d32fe..ec7824ea4 100644
--- a/Source/WebCore/html/HTMLLIElement.cpp
+++ b/Source/WebCore/html/HTMLLIElement.cpp
@@ -49,26 +49,37 @@ PassRefPtr<HTMLLIElement> HTMLLIElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLLIElement(tagName, document));
 }
 
-void HTMLLIElement::parseAttribute(Attribute* attr)
+bool HTMLLIElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (attr->name() == valueAttr) {
-        if (renderer() && renderer()->isListItem())
-            parseValue(attr->value());
-    } else if (attr->name() == typeAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyListStyleType);
-        else if (attr->value() == "a")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerAlpha);
+    if (attr->name() == typeAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLLIElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == typeAttr) {
+        if (attr->value() == "a")
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerAlpha);
         else if (attr->value() == "A")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperAlpha);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperAlpha);
         else if (attr->value() == "i")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerRoman);
         else if (attr->value() == "I")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperRoman);
         else if (attr->value() == "1")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueDecimal);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueDecimal);
         else
-            addCSSProperty(CSSPropertyListStyleType, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attr->value());
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLLIElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == valueAttr) {
+        if (renderer() && renderer()->isListItem())
+            parseValue(attr->value());
     } else
         HTMLElement::parseAttribute(attr);
 }
diff --git a/Source/WebCore/html/HTMLLIElement.h b/Source/WebCore/html/HTMLLIElement.h
index 77a90e801..c730408a7 100644
--- a/Source/WebCore/html/HTMLLIElement.h
+++ b/Source/WebCore/html/HTMLLIElement.h
@@ -36,6 +36,8 @@ private:
     HTMLLIElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
 
diff --git a/Source/WebCore/html/HTMLLabelElement.idl b/Source/WebCore/html/HTMLLabelElement.idl
index 9460418cd..bf79680f8 100644
--- a/Source/WebCore/html/HTMLLabelElement.idl
+++ b/Source/WebCore/html/HTMLLabelElement.idl
@@ -24,6 +24,9 @@ module html {
         readonly attribute HTMLFormElement form;
         attribute [Reflect=for] DOMString htmlFor;
         readonly attribute HTMLElement control;
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
     };
 
 }
diff --git a/Source/WebCore/html/HTMLLegendElement.idl b/Source/WebCore/html/HTMLLegendElement.idl
index 8cda34f58..bf755a5bb 100644
--- a/Source/WebCore/html/HTMLLegendElement.idl
+++ b/Source/WebCore/html/HTMLLegendElement.idl
@@ -23,6 +23,9 @@ module html {
     interface HTMLLegendElement : HTMLElement {
         readonly attribute HTMLFormElement form;
         attribute [Reflect] DOMString align;
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
     };
 
 }
diff --git a/Source/WebCore/html/HTMLMarqueeElement.cpp b/Source/WebCore/html/HTMLMarqueeElement.cpp
index 1d883b409..a1445ad55 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.cpp
+++ b/Source/WebCore/html/HTMLMarqueeElement.cpp
@@ -35,83 +35,78 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-// WinIE uses 60ms as the minimum delay by default.
-const int defaultMinimumDelay = 60;
-
 inline HTMLMarqueeElement::HTMLMarqueeElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , ActiveDOMObject(document, this)
-    , m_minimumDelay(defaultMinimumDelay)
 {
     ASSERT(hasTagName(marqueeTag));
 }
 
 PassRefPtr<HTMLMarqueeElement> HTMLMarqueeElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new HTMLMarqueeElement(tagName, document));
+    RefPtr<HTMLMarqueeElement> marqueeElement(adoptRef(new HTMLMarqueeElement(tagName, document)));
+    marqueeElement->suspendIfNeeded();
+    return marqueeElement.release();
+}
+
+int HTMLMarqueeElement::minimumDelay() const
+{
+    if (fastGetAttribute(truespeedAttr).isEmpty()) {
+        // WinIE uses 60ms as the minimum delay by default.
+        return 60;
+    }
+    return 0;
+}
+
+bool HTMLMarqueeElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == scrollamountAttr || attr->name() == scrolldelayAttr || attr->name() == loopAttr || attr->name() == behaviorAttr || attr->name() == directionAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
 }
 
-void HTMLMarqueeElement::parseAttribute(Attribute* attr)
+void HTMLMarqueeElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == widthAttr) {
-        if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyWidth, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWidth);
+        if (!attr->isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     } else if (attr->name() == heightAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyHeight, attr->value());
-        else
-            removeCSSProperty(CSSPropertyHeight);
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     } else if (attr->name() == bgcolorAttr) {
         if (!attr->value().isEmpty())
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
-        else
-            removeCSSProperty(CSSPropertyBackgroundColor);
+            addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     } else if (attr->name() == vspaceAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        } else
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
+            addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+            addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+        }
     } else if (attr->name() == hspaceAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        } else
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
+            addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+            addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+        }
     } else if (attr->name() == scrollamountAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyWebkitMarqueeIncrement, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeIncrement);
+            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeIncrement, attr->value());
     } else if (attr->name() == scrolldelayAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyWebkitMarqueeSpeed, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeSpeed);
+            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeSpeed, attr->value());
     } else if (attr->name() == loopAttr) {
         if (!attr->value().isEmpty()) {
             if (attr->value() == "-1" || equalIgnoringCase(attr->value(), "infinite"))
-                addCSSProperty(CSSPropertyWebkitMarqueeRepetition, CSSValueInfinite);
+                addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeRepetition, CSSValueInfinite);
             else
-                addCSSLength(CSSPropertyWebkitMarqueeRepetition, attr->value());
-        } else
-            removeCSSProperty(CSSPropertyWebkitMarqueeRepetition);
+                addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeRepetition, attr->value());
+        }
     } else if (attr->name() == behaviorAttr) {
         if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyWebkitMarqueeStyle, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeStyle);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeStyle, attr->value());
     } else if (attr->name() == directionAttr) {
         if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyWebkitMarqueeDirection, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeDirection);
-    } else if (attr->name() == truespeedAttr)
-        m_minimumDelay = !attr->isEmpty() ? 0 : defaultMinimumDelay;
-    else
-        HTMLElement::parseAttribute(attr);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeDirection, attr->value());
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 void HTMLMarqueeElement::start()
diff --git a/Source/WebCore/html/HTMLMarqueeElement.h b/Source/WebCore/html/HTMLMarqueeElement.h
index d1e3070d2..8ababa1d9 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.h
+++ b/Source/WebCore/html/HTMLMarqueeElement.h
@@ -34,7 +34,7 @@ class HTMLMarqueeElement : public HTMLElement, private ActiveDOMObject {
 public:
     static PassRefPtr<HTMLMarqueeElement> create(const QualifiedName&, Document*);
 
-    int minimumDelay() const { return m_minimumDelay; }
+    int minimumDelay() const;
 
     // DOM Functions
 
@@ -53,7 +53,8 @@ public:
 private:
     HTMLMarqueeElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     // ActiveDOMObject
     virtual bool canSuspend() const;
@@ -61,8 +62,6 @@ private:
     virtual void resume();
 
     RenderMarquee* renderMarquee() const;
-
-    int m_minimumDelay;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 7e664840b..b956d66d9 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -63,19 +63,23 @@
 #include "MediaQueryEvaluator.h"
 #include "MouseEvent.h"
 #include "MIMETypeRegistry.h"
+#include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScriptController.h"
 #include "ScriptEventListener.h"
 #include "SecurityOrigin.h"
+#include "SecurityPolicy.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "TimeRanges.h"
 #include "UUID.h"
 #include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
+#include <wtf/NonCopyingSort.h>
 #include <wtf/Uint8Array.h>
 #include <wtf/text/CString.h>
 
@@ -235,6 +239,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
 #if ENABLE(VIDEO_TRACK)
     , m_tracksAreReady(true)
     , m_haveVisibleTextTrack(false)
+    , m_lastTextTrackUpdateTime(-1)
     , m_textTracks(0)
     , m_ignoreTrackDisplayUpdate(0)
 #endif
@@ -320,14 +325,13 @@ bool HTMLMediaElement::isMouseFocusable() const
     return false;
 }
 
-void HTMLMediaElement::attributeChanged(Attribute* attr)
+void HTMLMediaElement::parseAttribute(Attribute* attr)
 {
-    HTMLElement::attributeChanged(attr);
-
     const QualifiedName& attrName = attr->name();
+
     if (attrName == srcAttr) {
         // Trigger a reload, as long as the 'src' attribute is present.
-        if (!getAttribute(srcAttr).isEmpty())
+        if (fastHasAttribute(srcAttr))
             scheduleLoad(MediaResource);
     } else if (attrName == controlsAttr)
         configureMediaControls();
@@ -335,13 +339,7 @@ void HTMLMediaElement::attributeChanged(Attribute* attr)
     else if (attrName == loopAttr)
         updateDisableSleep();
 #endif
-}
-
-void HTMLMediaElement::parseAttribute(Attribute* attr)
-{
-    const QualifiedName& attrName = attr->name();
-
-    if (attrName == preloadAttr) {
+    else if (attrName == preloadAttr) {
         String value = attr->value();
 
         if (equalIgnoringCase(value, "none"))
@@ -467,7 +465,12 @@ RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderMedia(this);
 #endif
 }
- 
+
+bool HTMLMediaElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 void HTMLMediaElement::insertedIntoDocument()
 {
     LOG(Media, "HTMLMediaElement::insertedIntoDocument");
@@ -554,6 +557,11 @@ void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 
 void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
 {
+#if ENABLE(VIDEO_TRACK)
+    if (m_pendingLoadFlags & TextTrackResource)
+        configureNewTextTracks();
+#endif
+
     if (m_pendingLoadFlags & MediaResource) {
         if (m_loadState == LoadingFromSourceElement)
             loadNextSourceChild();
@@ -561,11 +569,6 @@ void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
             loadInternal();
     }
 
-#if ENABLE(VIDEO_TRACK)
-    if (m_pendingLoadFlags & TextTrackResource)
-        configureNewTextTracks();
-#endif
-
     m_pendingLoadFlags = 0;
 }
 
@@ -674,6 +677,9 @@ void HTMLMediaElement::prepareForLoad()
         invalidateCachedTime();
         scheduleEvent(eventNames().emptiedEvent);
         updateMediaController();
+#if ENABLE(VIDEO_TRACK)
+        updateActiveTextTrackCues(0);
+#endif
     }
 
     // 5 - Set the playbackRate attribute to the value of the defaultPlaybackRate attribute.
@@ -702,19 +708,6 @@ void HTMLMediaElement::prepareForLoad()
     // event may have already fired by then.
     setShouldDelayLoadEvent(true);
 
-#if ENABLE(VIDEO_TRACK)
-    // HTMLMediaElement::textTracksAreReady will need "... the text tracks whose mode was not in the
-    // disabled state when the element's resource selection algorithm last started".
-    m_textTracksWhenResourceSelectionBegan.clear();
-    if (m_textTracks) {
-        for (unsigned i = 0; i < m_textTracks->length(); ++i) {
-            TextTrack* track = m_textTracks->item(i);
-            if (track->mode() != TextTrack::DISABLED)
-                m_textTracksWhenResourceSelectionBegan.append(track);
-        }
-    }
-#endif
-
     configureMediaControls();
 }
 
@@ -735,6 +728,19 @@ void HTMLMediaElement::loadInternal()
     // put in the the background.
     removeBehaviorRestriction(RequirePageConsentToLoadMediaRestriction);
 
+#if ENABLE(VIDEO_TRACK)
+    // HTMLMediaElement::textTracksAreReady will need "... the text tracks whose mode was not in the
+    // disabled state when the element's resource selection algorithm last started".
+    m_textTracksWhenResourceSelectionBegan.clear();
+    if (m_textTracks) {
+        for (unsigned i = 0; i < m_textTracks->length(); ++i) {
+            TextTrack* track = m_textTracks->item(i);
+            if (track->mode() != TextTrack::DISABLED)
+                m_textTracksWhenResourceSelectionBegan.append(track);
+        }
+    }
+#endif
+
     selectMediaResource();
 }
 
@@ -937,33 +943,237 @@ void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& content
 }
 
 #if ENABLE(VIDEO_TRACK)
+static bool trackIndexCompare(TextTrack* a,
+                              TextTrack* b)
+{
+    return a->trackIndex() - b->trackIndex() < 0;
+}
+
+static bool eventTimeCueCompare(const std::pair<double, TextTrackCue*>& a,
+                                const std::pair<double, TextTrackCue*>& b)
+{
+    // 12 - Sort the tasks in events in ascending time order (tasks with earlier
+    // times first).
+    if (a.first != b.first)
+        return a.first - b.first < 0;
+
+    // If the cues belong to different text tracks, it doesn't make sense to
+    // compare the two tracks by the relative cue order, so return the relative
+    // track order.
+    if (a.second->track() != b.second->track())
+        return trackIndexCompare(a.second->track(), b.second->track());
+
+    // 12 - Further sort tasks in events that have the same time by the
+    // relative text track cue order of the text track cues associated
+    // with these tasks.
+    return a.second->cueIndex() - b.second->cueIndex() < 0;
+}
+
+
 void HTMLMediaElement::updateActiveTextTrackCues(float movieTime)
 {
+    LOG(Media, "HTMLMediaElement::updateActiveTextTracks");
+
+    // 4.8.10.8 Playing the media resource
+
+    //  If the current playback position changes while the steps are running,
+    //  then the user agent must wait for the steps to complete, and then must
+    //  immediately rerun the steps.
     if (ignoreTrackDisplayUpdateRequests())
         return;
-    
-    CueList previouslyActiveCues = m_currentlyActiveCues;
-    bool activeSetChanged = false;
 
-    m_currentlyActiveCues = m_cueTree.allOverlaps(m_cueTree.createInterval(movieTime, movieTime));
-    
-    // FIXME(72171): Events need to be sorted and filtered before dispatching.
-
-    for (size_t i = 0; i < previouslyActiveCues.size(); ++i) {
-        if (!m_currentlyActiveCues.contains(previouslyActiveCues[i])) {
-            previouslyActiveCues[i].data()->setIsActive(false);
-            activeSetChanged = true;
+    // 1 - Let current cues be a list of cues, initialized to contain all the
+    // cues of all the hidden, showing, or showing by default text tracks of the
+    // media element (not the disabled ones) whose start times are less than or
+    // equal to the current playback position and whose end times are greater
+    // than the current playback position.
+    Vector<CueIntervalTree::IntervalType> currentCues;
+
+    // The user agent must synchronously unset [the text track cue active] flag
+    // whenever ... the media element's readyState is changed back to HAVE_NOTHING.
+    if (m_readyState != HAVE_NOTHING && m_player)
+        currentCues = m_cueTree.allOverlaps(m_cueTree.createInterval(movieTime, movieTime));
+
+    Vector<CueIntervalTree::IntervalType> affectedCues;
+    Vector<CueIntervalTree::IntervalType> previousCues;
+    Vector<CueIntervalTree::IntervalType> missedCues;
+
+    // 2 - Let other cues be a list of cues, initialized to contain all the cues
+    // of hidden, showing, and showing by default text tracks of the media
+    // element that are not present in current cues.
+    previousCues = m_currentlyActiveCues;
+
+    // 3 - Let last time be the current playback position at the time this
+    // algorithm was last run for this media element, if this is not the first
+    // time it has run.
+    float lastTime = m_lastTextTrackUpdateTime;
+
+    // 4 - If the current playback position has, since the last time this
+    // algorithm was run, only changed through its usual monotonic increase
+    // during normal playback, then let missed cues be the list of cues in other
+    // cues whose start times are greater than or equal to last time and whose
+    // end times are less than or equal to the current playback position.
+    // Otherwise, let missed cues be an empty list.
+    if (lastTime >= 0 && m_lastSeekTime < movieTime) {
+        Vector<CueIntervalTree::IntervalType> potentiallySkippedCues =
+            m_cueTree.allOverlaps(m_cueTree.createInterval(lastTime, movieTime));
+
+        for (size_t i = 0; i < potentiallySkippedCues.size(); ++i) {
+            float cueStartTime = potentiallySkippedCues[i].low();
+            float cueEndTime = potentiallySkippedCues[i].high();
+
+            // Consider cues that may have been missed since the last seek time.
+            if (cueStartTime > max(m_lastSeekTime, lastTime) && cueEndTime < movieTime)
+                missedCues.append(potentiallySkippedCues[i]);
         }
     }
-    for (size_t i = 0; i < m_currentlyActiveCues.size(); ++i) {
-        if (!previouslyActiveCues.contains(m_currentlyActiveCues[i])) {
-            m_currentlyActiveCues[i].data()->setIsActive(true);
+
+    m_lastTextTrackUpdateTime = movieTime;
+
+    // 5 - If the time was reached through the usual monotonic increase of the
+    // current playback position during normal playback, and if the user agent
+    // has not fired a timeupdate event at the element in the past 15 to 250ms
+    // and is not still running event handlers for such an event, then the user
+    // agent must queue a task to fire a simple event named timeupdate at the
+    // element. (In the other cases, such as explicit seeks, relevant events get
+    // fired as part of the overall process of changing the current playback
+    // position.)
+    if (m_lastSeekTime <= lastTime)
+        scheduleTimeupdateEvent(false);
+
+    // Explicitly cache vector sizes, as their content is constant from here.
+    size_t currentCuesSize = currentCues.size();
+    size_t missedCuesSize = missedCues.size();
+    size_t previousCuesSize = previousCues.size();
+
+    // 6 - If all of the cues in current cues have their text track cue active
+    // flag set, none of the cues in other cues have their text track cue active
+    // flag set, and missed cues is empty, then abort these steps.
+    bool activeSetChanged = missedCuesSize;
+
+    for (size_t i = 0; !activeSetChanged && i < previousCuesSize; ++i)
+        if (!currentCues.contains(previousCues[i]) && previousCues[i].data()->isActive())
+            activeSetChanged = true;
+
+    for (size_t i = 0; !activeSetChanged && i < currentCuesSize; ++i) {
+        if (!currentCues[i].data()->isActive())
             activeSetChanged = true;
-        }
     }
-    
-    // FIXME(72173): Pause the media element for cues going past their endTime
-    // during a monotonic time increase.
+
+    if (!activeSetChanged)
+        return;
+
+    // 7 - If the time was reached through the usual monotonic increase of the
+    // current playback position during normal playback, and there are cues in
+    // other cues that have their text track cue pause-on-exi flag set and that
+    // either have their text track cue active flag set or are also in missed
+    // cues, then immediately pause the media element.
+    for (size_t i = 0; !m_paused && i < previousCuesSize; ++i) {
+        if (previousCues[i].data()->pauseOnExit()
+            && previousCues[i].data()->isActive()
+            && !currentCues.contains(previousCues[i]))
+            pause();
+    }
+
+    for (size_t i = 0; !m_paused && i < missedCuesSize; ++i) {
+        if (missedCues[i].data()->pauseOnExit())
+            pause();
+    }
+
+    // 8 - Let events be a list of tasks, initially empty. Each task in this
+    // list will be associated with a text track, a text track cue, and a time,
+    // which are used to sort the list before the tasks are queued.
+    Vector<std::pair<double, TextTrackCue*> > eventTasks;
+
+    // 8 - Let affected tracks be a list of text tracks, initially empty.
+    Vector<TextTrack*> affectedTracks;
+
+    for (size_t i = 0; i < missedCuesSize; ++i) {
+        // 9 - For each text track cue in missed cues, prepare an event named enter
+        // for the TextTrackCue object with the text track cue start time.
+        eventTasks.append(std::make_pair(missedCues[i].data()->startTime(),
+                                         missedCues[i].data()));
+
+        // 10 - For each text track in missed cues, prepare an event
+        // named exit for the TextTrackCue object with the text track cue end
+        // time.
+        eventTasks.append(std::make_pair(missedCues[i].data()->endTime(),
+                                         missedCues[i].data()));
+    }
+
+    for (size_t i = 0; i < previousCuesSize; ++i) {
+        // 10 - For each text track cue in other cues that has its text
+        // track cue active flag set prepare an event named exit for the
+        // TextTrackCue object with the text track cue end time.
+        if (!currentCues.contains(previousCues[i]))
+            eventTasks.append(std::make_pair(previousCues[i].data()->endTime(),
+                                             previousCues[i].data()));
+    }
+
+    for (size_t i = 0; i < currentCuesSize; ++i) {
+        // 11 - For each text track cue in current cues that does not have its
+        // text track cue active flag set, prepare an event named enter for the
+        // TextTrackCue object with the text track cue start time.
+        if (!previousCues.contains(currentCues[i]))
+            eventTasks.append(std::make_pair(currentCues[i].data()->startTime(),
+                                             currentCues[i].data()));
+    }
+
+    // 12 - Sort the tasks in events in ascending time order (tasks with earlier
+    // times first).
+    nonCopyingSort(eventTasks.begin(), eventTasks.end(), eventTimeCueCompare);
+
+    for (size_t i = 0; i < eventTasks.size(); ++i) {
+        if (!affectedTracks.contains(eventTasks[i].second->track()))
+            affectedTracks.append(eventTasks[i].second->track());
+
+        // 13 - Queue each task in events, in list order.
+        RefPtr<Event> event;
+
+        // Each event in eventTasks may be either an enterEvent or an exitEvent,
+        // depending on the time that is associated with the event. This
+        // correctly identifies the type of the event, since the startTime is
+        // always less than the endTime.
+        if (eventTasks[i].first == eventTasks[i].second->startTime())
+            event = Event::create(eventNames().enterEvent, false, false);
+        else
+            event = Event::create(eventNames().exitEvent, false, false);
+
+        event->setTarget(eventTasks[i].second);
+        m_asyncEventQueue.enqueueEvent(event.release());
+    }
+
+    // 14 - Sort affected tracks in the same order as the text tracks appear in
+    // the media element's list of text tracks, and remove duplicates.
+    nonCopyingSort(affectedTracks.begin(), affectedTracks.end(), trackIndexCompare);
+
+    // 15 - For each text track in affected tracks, in the list order, queue a
+    // task to fire a simple event named cuechange at the TextTrack object, and,
+    // if the text track has a corresponding track element, to then fire a
+    // simple event named cuechange at the track element as well.
+    for (size_t i = 0; i < affectedTracks.size(); ++i) {
+        RefPtr<Event> event = Event::create(eventNames().cuechangeEvent, false, false);
+        event->setTarget(affectedTracks[i]);
+
+        m_asyncEventQueue.enqueueEvent(event.release());
+
+        // Fire syncronous cue change event for track elements.
+        if (affectedTracks[i]->trackType() == TextTrack::TrackElement)
+            affectedTracks[i]->fireCueChangeEvent();
+    }
+
+    // 16 - Set the text track cue active flag of all the cues in the current
+    // cues, and unset the text track cue active flag of all the cues in the
+    // other cues.
+    for (size_t i = 0; i < currentCuesSize; ++i)
+        currentCues[i].data()->setIsActive(true);
+
+    for (size_t i = 0; i < previousCuesSize; ++i)
+        if (!currentCues.contains(previousCues[i]))
+            previousCues[i].data()->setIsActive(false);
+
+    // Update the current active cues.
+    m_currentlyActiveCues = currentCues;
 
     if (activeSetChanged && hasMediaControls())
         mediaControls()->updateTextTrackDisplay();
@@ -1313,21 +1523,32 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
     bool wasPotentiallyPlaying = potentiallyPlaying();
 
     ReadyState oldState = m_readyState;
-    m_readyState = static_cast<ReadyState>(state);
+    ReadyState newState = static_cast<ReadyState>(state);
 
 #if ENABLE(VIDEO_TRACK)
     bool tracksAreReady = textTracksAreReady();
 
-    if (m_readyState == oldState && m_tracksAreReady == tracksAreReady)
+    if (newState == oldState && m_tracksAreReady == tracksAreReady)
         return;
 
     m_tracksAreReady = tracksAreReady;
 #else
-    if (m_readyState == oldState)
+    if (newState == oldState)
         return;
     bool tracksAreReady = true;
 #endif
     
+    if (tracksAreReady)
+        m_readyState = newState;
+    else {
+        // If a media file has text tracks the readyState may not progress beyond HAVE_FUTURE_DATA until
+        // the text tracks are ready, regardless of the state of the media file.
+        if (newState <= HAVE_METADATA)
+            m_readyState = newState;
+        else
+            m_readyState = HAVE_CURRENT_DATA;
+    }
+    
     if (oldState > m_readyStateMaximum)
         m_readyStateMaximum = oldState;
 
@@ -1350,7 +1571,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
         }
     }
 
-    if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA && tracksAreReady) {
+    if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
         prepareMediaFragmentURI();
         scheduleEvent(eventNames().durationchangeEvent);
         scheduleEvent(eventNames().loadedmetadataEvent);
@@ -1362,7 +1583,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 
     bool shouldUpdateDisplayState = false;
 
-    if (m_readyState >= HAVE_CURRENT_DATA && oldState < HAVE_CURRENT_DATA && !m_haveFiredLoadedData && tracksAreReady) {
+    if (m_readyState >= HAVE_CURRENT_DATA && oldState < HAVE_CURRENT_DATA && !m_haveFiredLoadedData) {
         m_haveFiredLoadedData = true;
         shouldUpdateDisplayState = true;
         scheduleEvent(eventNames().loadeddataEvent);
@@ -1405,6 +1626,9 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 
     updatePlayState();
     updateMediaController();
+#if ENABLE(VIDEO_TRACK)
+    updateActiveTextTrackCues(currentTime());
+#endif
 }
 
 #if ENABLE(MEDIA_SOURCE)
@@ -2680,6 +2904,10 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
     LOG(Media, "HTMLMediaElement::mediaPlayerTimeChanged");
 
+#if ENABLE(VIDEO_TRACK)
+    updateActiveTextTrackCues(currentTime());
+#endif
+
     beginProcessingMediaPlayerCallback();
 
     invalidateCachedTime();
@@ -2728,9 +2956,6 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
         m_sentEndEvent = false;
 
     updatePlayState();
-#if ENABLE(VIDEO_TRACK)
-    updateActiveTextTrackCues(now);
-#endif
     endProcessingMediaPlayerCallback();
 }
 
@@ -3143,6 +3368,9 @@ void HTMLMediaElement::userCancelledLoad()
     // Reset m_readyState since m_player is gone.
     m_readyState = HAVE_NOTHING;
     updateMediaController();
+#if ENABLE(VIDEO_TRACK)
+    updateActiveTextTrackCues(0);
+#endif
 }
 
 bool HTMLMediaElement::canSuspend() const
@@ -3519,15 +3747,15 @@ void HTMLMediaElement::privateBrowsingStateDidChange()
 
 MediaControls* HTMLMediaElement::mediaControls()
 {
-    return toMediaControls(shadowRoot()->firstChild());
+    return toMediaControls(shadowRootList()->oldestShadowRoot()->firstChild());
 }
 
 bool HTMLMediaElement::hasMediaControls()
 {
-    if (!shadowRoot())
+    if (!hasShadowRoot())
         return false;
 
-    Node* node = shadowRoot()->firstChild();
+    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
     return node && node->isMediaControls();
 }
 
@@ -3816,6 +4044,14 @@ bool HTMLMediaElement::shouldDisableSleep() const
 }
 #endif
 
+String HTMLMediaElement::mediaPlayerReferrer() const
+{
+    Frame* frame = document()->frame();
+    if (!frame)
+        return String();
+
+    return SecurityPolicy::generateReferrerHeader(document()->referrerPolicy(), m_currentSrc, frame->loader()->outgoingReferrer());
 }
 
+}
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index 76c24cbab..126b78f57 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -337,9 +337,9 @@ private:
 
     virtual bool supportsFocus() const;
     virtual bool isMouseFocusable() const;
-    virtual void attributeChanged(Attribute*) OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
     virtual void didRecalcStyle(StyleChange);
@@ -389,6 +389,8 @@ private:
     virtual String mediaPlayerSourceURL() const;
 #endif
 
+    virtual String mediaPlayerReferrer() const OVERRIDE;
+
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
     void playbackProgressTimerFired(Timer<HTMLMediaElement>*);
@@ -595,10 +597,13 @@ private:
 #if ENABLE(VIDEO_TRACK)
     bool m_tracksAreReady : 1;
     bool m_haveVisibleTextTrack : 1;
+    float m_lastTextTrackUpdateTime;
 
     RefPtr<TextTrackList> m_textTracks;
     Vector<RefPtr<TextTrack> > m_textTracksWhenResourceSelectionBegan;
+
     CueIntervalTree m_cueTree;
+
     CueList m_currentlyActiveCues;
     int m_ignoreTrackDisplayUpdate;
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.idl b/Source/WebCore/html/HTMLMediaElement.idl
index 4260c2025..55d06f3ca 100644
--- a/Source/WebCore/html/HTMLMediaElement.idl
+++ b/Source/WebCore/html/HTMLMediaElement.idl
@@ -46,7 +46,7 @@ module html {
     readonly attribute TimeRanges buffered;
     void load() 
         raises (DOMException);
-    DOMString canPlayType(in [Optional=CallWithDefaultValue] DOMString type);
+    DOMString canPlayType(in [Optional=DefaultIsUndefined] DOMString type);
 
     // ready state
     const unsigned short HAVE_NOTHING = 0;
@@ -117,7 +117,7 @@ module html {
     readonly attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackList textTracks;
 #endif
 
-    attribute [Reflect, TreatNullAs=NullString, ConvertNullStringToNull] DOMString mediaGroup;
+    attribute [Reflect, TreatNullAs=NullString] DOMString mediaGroup;
     attribute [CustomSetter] MediaController controller;
 };
 }
diff --git a/Source/WebCore/html/HTMLMetaElement.cpp b/Source/WebCore/html/HTMLMetaElement.cpp
index fd1f40392..820ad4471 100644
--- a/Source/WebCore/html/HTMLMetaElement.cpp
+++ b/Source/WebCore/html/HTMLMetaElement.cpp
@@ -94,7 +94,7 @@ String HTMLMetaElement::httpEquiv() const
 
 String HTMLMetaElement::name() const
 {
-    return getAttribute(nameAttr);
+    return getNameAttribute();
 }
 
 #if ENABLE(MICRODATA)
diff --git a/Source/WebCore/html/HTMLMeterElement.cpp b/Source/WebCore/html/HTMLMeterElement.cpp
index a1fdaf6c7..3be84e33d 100644
--- a/Source/WebCore/html/HTMLMeterElement.cpp
+++ b/Source/WebCore/html/HTMLMeterElement.cpp
@@ -26,6 +26,7 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FormDataList.h"
+#include "NodeRenderingContext.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
@@ -60,6 +61,11 @@ RenderObject* HTMLMeterElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderMeter(this);
 }
 
+bool HTMLMeterElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 const AtomicString& HTMLMeterElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, meter, ("meter"));
@@ -234,7 +240,7 @@ void HTMLMeterElement::didElementStateChange()
 
 void HTMLMeterElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
 
     RefPtr<MeterBarElement> bar = MeterBarElement::create(document());
     m_value = MeterValueElement::create(document());
diff --git a/Source/WebCore/html/HTMLMeterElement.h b/Source/WebCore/html/HTMLMeterElement.h
index fb71bc922..dc5e7ccf5 100644
--- a/Source/WebCore/html/HTMLMeterElement.h
+++ b/Source/WebCore/html/HTMLMeterElement.h
@@ -70,6 +70,7 @@ private:
     virtual bool recalcWillValidate() const { return false; }
     virtual const AtomicString& formControlType() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void attach();
 
diff --git a/Source/WebCore/html/HTMLNameCollection.cpp b/Source/WebCore/html/HTMLNameCollection.cpp
index aaf5b4d02..280c800a7 100644
--- a/Source/WebCore/html/HTMLNameCollection.cpp
+++ b/Source/WebCore/html/HTMLNameCollection.cpp
@@ -61,7 +61,7 @@ Element* HTMLNameCollection::itemAfter(Element* previous) const
                     e->hasTagName(appletTag) ||
                     e->hasTagName(embedTag) ||
                     e->hasTagName(objectTag))
-                    if (e->getAttribute(nameAttr) == m_name)
+                    if (e->getNameAttribute() == m_name)
                         return e;
                 if (e->getIdAttribute() == m_name)
                     return e;
@@ -71,17 +71,17 @@ Element* HTMLNameCollection::itemAfter(Element* previous) const
                 // applets and object by id, and images by id but only if they have
                 // a name attribute (this very strange rule matches IE)
                 if (e->hasTagName(formTag) || e->hasTagName(embedTag) || e->hasTagName(iframeTag)) {
-                    if (e->getAttribute(nameAttr) == m_name)
+                    if (e->getNameAttribute() == m_name)
                         return e;
                 } else if (e->hasTagName(appletTag)) {
-                    if (e->getAttribute(nameAttr) == m_name || e->getIdAttribute() == m_name)
+                    if (e->getNameAttribute() == m_name || e->getIdAttribute() == m_name)
                         return e;
                 } else if (e->hasTagName(objectTag)) {
-                    if ((e->getAttribute(nameAttr) == m_name || e->getIdAttribute() == m_name)
+                    if ((e->getNameAttribute() == m_name || e->getIdAttribute() == m_name)
                             && static_cast<HTMLObjectElement*>(e)->isDocNamedItem())
                         return e;
                 } else if (e->hasTagName(imgTag)) {
-                    if (e->getAttribute(nameAttr) == m_name || (e->getIdAttribute() == m_name && e->hasAttribute(nameAttr)))
+                    if (e->getNameAttribute() == m_name || (e->getIdAttribute() == m_name && e->hasName()))
                         return e;
                 }
                 break;
diff --git a/Source/WebCore/html/HTMLOListElement.cpp b/Source/WebCore/html/HTMLOListElement.cpp
index 2bfa2ff43..1f7e28dfe 100644
--- a/Source/WebCore/html/HTMLOListElement.cpp
+++ b/Source/WebCore/html/HTMLOListElement.cpp
@@ -54,22 +54,33 @@ PassRefPtr<HTMLOListElement> HTMLOListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLOListElement(tagName, document));
 }
 
-void HTMLOListElement::parseAttribute(Attribute* attr)
+bool HTMLOListElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == typeAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLOListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == typeAttr) {
         if (attr->value() == "a")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerAlpha);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerAlpha);
         else if (attr->value() == "A")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperAlpha);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperAlpha);
         else if (attr->value() == "i")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerRoman);
         else if (attr->value() == "I")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperRoman);
         else if (attr->value() == "1")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueDecimal);
-        else
-            removeCSSProperty(CSSPropertyListStyleType);
-    } else if (attr->name() == startAttr) {
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueDecimal);
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLOListElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == startAttr) {
         int oldStart = start();
         bool canParse;
         int parsedStart = attr->value().toInt(&canParse);
diff --git a/Source/WebCore/html/HTMLOListElement.h b/Source/WebCore/html/HTMLOListElement.h
index 0731fb007..9f0eafb0b 100644
--- a/Source/WebCore/html/HTMLOListElement.h
+++ b/Source/WebCore/html/HTMLOListElement.h
@@ -54,6 +54,8 @@ private:
     void recalculateItemCount();
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     int m_start;
     unsigned m_itemCount;
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index e2bef0157..406a3eb3e 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -77,6 +77,21 @@ RenderWidget* HTMLObjectElement::renderWidgetForJSBindings()
     return renderPart(); // This will return 0 if the renderer is not a RenderPart.
 }
 
+bool HTMLObjectElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == borderAttr)
+        return true;
+    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+}
+
+void HTMLObjectElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == borderAttr)
+        applyBorderAttributeToStyle(attr, style);
+    else
+        HTMLPlugInImageElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLObjectElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == formAttr)
@@ -108,8 +123,6 @@ void HTMLObjectElement::parseAttribute(Attribute* attr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onbeforeloadAttr)
         setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == borderAttr)
-        applyBorderAttribute(attr);
     else
         HTMLPlugInImageElement::parseAttribute(attr);
 }
@@ -207,7 +220,7 @@ bool HTMLObjectElement::hasFallbackContent() const
     for (Node* child = firstChild(); child; child = child->nextSibling()) {
         // Ignore whitespace-only text, and <param> tags, any other content is fallback content.
         if (child->isTextNode()) {
-            if (!static_cast<Text*>(child)->containsOnlyWhitespace())
+            if (!toText(child)->containsOnlyWhitespace())
                 return true;
         } else if (!child->hasTagName(paramTag))
             return true;
@@ -300,7 +313,7 @@ void HTMLObjectElement::updateWidget(PluginCreationOption pluginCreationOption)
         return;
 
     SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
-    bool success = beforeLoadAllowedLoad && hasValidClassId() && loader->requestObject(this, url, getAttribute(nameAttr), serviceType, paramNames, paramValues);
+    bool success = beforeLoadAllowedLoad && hasValidClassId() && loader->requestObject(this, url, getNameAttribute(), serviceType, paramNames, paramValues);
     if (!success && fallbackContent)
         renderFallbackContent();
 }
@@ -414,7 +427,7 @@ void HTMLObjectElement::updateDocNamedItem()
             if (isRecognizedTagName(element->tagQName()) && !element->hasTagName(paramTag))
                 isNamedItem = false;
         } else if (child->isTextNode()) {
-            if (!static_cast<Text*>(child)->containsOnlyWhitespace())
+            if (!toText(child)->containsOnlyWhitespace())
                 isNamedItem = false;
         } else
             isNamedItem = false;
@@ -423,10 +436,10 @@ void HTMLObjectElement::updateDocNamedItem()
     if (isNamedItem != wasNamedItem && document()->isHTMLDocument()) {
         HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
         if (isNamedItem) {
-            document->addNamedItem(fastGetAttribute(nameAttr));
+            document->addNamedItem(getNameAttribute());
             document->addExtraNamedItem(getIdAttribute());
         } else {
-            document->removeNamedItem(fastGetAttribute(nameAttr));
+            document->removeNamedItem(getNameAttribute());
             document->removeExtraNamedItem(getIdAttribute());
         }
     }
@@ -440,7 +453,7 @@ bool HTMLObjectElement::containsJavaApplet() const
         
     for (Element* child = firstElementChild(); child; child = child->nextElementSibling()) {
         if (child->hasTagName(paramTag)
-                && equalIgnoringCase(child->getAttribute(nameAttr), "type")
+                && equalIgnoringCase(child->getNameAttribute(), "type")
                 && MIMETypeRegistry::isJavaAppletMIMEType(child->getAttribute(valueAttr).string()))
             return true;
         if (child->hasTagName(objectTag)
@@ -501,7 +514,7 @@ bool HTMLObjectElement::appendFormData(FormDataList& encoding, bool)
 
 const AtomicString& HTMLObjectElement::formControlName() const
 {
-    const AtomicString& name = fastGetAttribute(nameAttr);
+    const AtomicString& name = getNameAttribute();
     return name.isNull() ? emptyAtom : name;
 }
 
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index 85bf16f8b..112dcc6af 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -67,6 +67,9 @@ private:
     HTMLObjectElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+
     virtual void insertedIntoTree(bool deep);
     virtual void removedFromTree(bool deep);
 
diff --git a/Source/WebCore/html/HTMLObjectElement.idl b/Source/WebCore/html/HTMLObjectElement.idl
index 4553fbc06..f1055fdb8 100644
--- a/Source/WebCore/html/HTMLObjectElement.idl
+++ b/Source/WebCore/html/HTMLObjectElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         CustomNamedSetter,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomCall
     ] HTMLObjectElement : HTMLElement {
         readonly attribute HTMLFormElement form;
@@ -49,11 +49,11 @@ module html {
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
         // Introduced in DOM Level 2:
-        readonly attribute [CheckAccessToNode] Document contentDocument;
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-        [CheckAccessToNode] SVGDocument getSVGDocument() raises(DOMException);
+        [CheckSecurityForNode] SVGDocument getSVGDocument() raises(DOMException);
 #endif
 #endif
 
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index 73f6ffa91..9fef31841 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -147,7 +147,7 @@ void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
     // Handle the common special case where there's exactly 1 child node, and it's a text node.
     Node* child = firstChild();
     if (child && child->isTextNode() && !child->nextSibling())
-        static_cast<Text *>(child)->setData(text, ec);
+        toText(child)->setData(text, ec);
     else {
         removeChildren();
         appendChild(Text::create(document(), text), ec);
diff --git a/Source/WebCore/html/HTMLOptionElement.idl b/Source/WebCore/html/HTMLOptionElement.idl
index 73e9c3bdf..99681f2c1 100644
--- a/Source/WebCore/html/HTMLOptionElement.idl
+++ b/Source/WebCore/html/HTMLOptionElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         JSGenerateToNativeObject,
-        NamedConstructor=Option(in [Optional=CallWithNullValue] DOMString data, in [Optional=CallWithNullValue] DOMString value, in [Optional=CallWithDefaultValue] boolean defaultSelected, in [Optional=CallWithDefaultValue] boolean selected),
+        NamedConstructor=Option(in [Optional=DefaultIsNullString] DOMString data, in [Optional=DefaultIsNullString] DOMString value, in [Optional=DefaultIsUndefined] boolean defaultSelected, in [Optional=DefaultIsUndefined] boolean selected),
         ConstructorRaisesException
     ] HTMLOptionElement : HTMLElement {
         readonly attribute HTMLFormElement form;
diff --git a/Source/WebCore/html/HTMLOptionsCollection.idl b/Source/WebCore/html/HTMLOptionsCollection.idl
index b28643994..0476e65fc 100644
--- a/Source/WebCore/html/HTMLOptionsCollection.idl
+++ b/Source/WebCore/html/HTMLOptionsCollection.idl
@@ -28,10 +28,10 @@ module html {
                  attribute [Custom] unsigned long length
                         setter raises (DOMException);
 
-        [Custom] void add(in [Optional=CallWithDefaultValue] HTMLOptionElement option, 
+        [Custom] void add(in [Optional=DefaultIsUndefined] HTMLOptionElement option, 
                           in [Optional] unsigned long index)
              raises (DOMException);
-        [Custom] void remove(in [Optional=CallWithDefaultValue] unsigned long index);
+        [Custom] void remove(in [Optional=DefaultIsUndefined] unsigned long index);
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         Node item(in unsigned long index); 
diff --git a/Source/WebCore/html/HTMLParagraphElement.cpp b/Source/WebCore/html/HTMLParagraphElement.cpp
index 6cc9f51b8..c8f6ad3ee 100644
--- a/Source/WebCore/html/HTMLParagraphElement.cpp
+++ b/Source/WebCore/html/HTMLParagraphElement.cpp
@@ -44,21 +44,26 @@ PassRefPtr<HTMLParagraphElement> HTMLParagraphElement::create(const QualifiedNam
     return adoptRef(new HTMLParagraphElement(tagName, document));
 }
 
-void HTMLParagraphElement::parseAttribute(Attribute* attr)
+bool HTMLParagraphElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLParagraphElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
-        else if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitCenter);
+        if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
         else if (equalIgnoringCase(attr->value(), "left"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitLeft);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
         else if (equalIgnoringCase(attr->value(), "right"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitRight);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addCSSProperty(CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLParagraphElement.h b/Source/WebCore/html/HTMLParagraphElement.h
index 0c8c290bb..86a85a63a 100644
--- a/Source/WebCore/html/HTMLParagraphElement.h
+++ b/Source/WebCore/html/HTMLParagraphElement.h
@@ -34,7 +34,8 @@ public:
 private:
     HTMLParagraphElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index 66d60922c..8c0f302a2 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -140,36 +140,29 @@ Widget* HTMLPlugInElement::pluginWidget()
     return renderWidget->widget();
 }
 
-void HTMLPlugInElement::parseAttribute(Attribute* attr)
+bool HTMLPlugInElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr)
+        return true;
+    return HTMLFrameOwnerElement::isPresentationAttribute(attr);
+}
+
+void HTMLPlugInElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == widthAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     else if (attr->name() == heightAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     else if (attr->name() == vspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
-        else {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
     } else if (attr->name() == hspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        else {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
     } else if (attr->name() == alignAttr)
-        addHTMLAlignment(attr);
+        applyAlignmentAttributeToStyle(attr, style);
     else
-        HTMLFrameOwnerElement::parseAttribute(attr);
+        HTMLFrameOwnerElement::collectStyleForAttribute(attr, style);
 }
 
 void HTMLPlugInElement::defaultEventHandler(Event* event)
diff --git a/Source/WebCore/html/HTMLPlugInElement.h b/Source/WebCore/html/HTMLPlugInElement.h
index 8c2214167..10c1ea791 100644
--- a/Source/WebCore/html/HTMLPlugInElement.h
+++ b/Source/WebCore/html/HTMLPlugInElement.h
@@ -58,7 +58,8 @@ protected:
 
     virtual void detach();
     virtual void removedFromDocument();
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     bool m_inBeforeLoadEventHandler;
     // Subclasses should use guardedDispatchBeforeLoadEvent instead of calling dispatchBeforeLoadEvent directly.
diff --git a/Source/WebCore/html/HTMLPreElement.cpp b/Source/WebCore/html/HTMLPreElement.cpp
index 7ed85fccd..09c08977a 100644
--- a/Source/WebCore/html/HTMLPreElement.cpp
+++ b/Source/WebCore/html/HTMLPreElement.cpp
@@ -42,20 +42,19 @@ PassRefPtr<HTMLPreElement> HTMLPreElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLPreElement(tagName, document));
 }
 
-void HTMLPreElement::parseAttribute(Attribute* attr)
+bool HTMLPreElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (attr->name() == widthAttr) {
-        // FIXME: Implement this some day.  Width on a <pre> is the # of characters that
-        // we should size the pre to.  We basically need to take the width of a space,
-        // multiply by the value of the attribute and then set that as the width CSS
-        // property.
-    } else if (attr->name() == wrapAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWhiteSpace);
-        else
-            addCSSProperty(CSSPropertyWhiteSpace, CSSValuePreWrap);
-    } else
-        return HTMLElement::parseAttribute(attr);
+    if (attr->name() == wrapAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLPreElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == wrapAttr)
+        style->setProperty(CSSPropertyWhiteSpace, CSSValuePreWrap);
+    else
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLPreElement.h b/Source/WebCore/html/HTMLPreElement.h
index 3ad3152f1..778204898 100644
--- a/Source/WebCore/html/HTMLPreElement.h
+++ b/Source/WebCore/html/HTMLPreElement.h
@@ -34,7 +34,8 @@ public:
 private:
     HTMLPreElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index 0c2372581..78bbde32b 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -26,6 +26,7 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FormDataList.h"
+#include "NodeRenderingContext.h"
 #include "HTMLDivElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
@@ -64,6 +65,11 @@ RenderObject* HTMLProgressElement::createRenderer(RenderArena* arena, RenderStyl
     return new (arena) RenderProgress(this);
 }
 
+bool HTMLProgressElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 bool HTMLProgressElement::supportsFocus() const
 {
     return Node::supportsFocus() && !disabled();
@@ -153,7 +159,7 @@ void HTMLProgressElement::didElementStateChange()
 
 void HTMLProgressElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
 
     RefPtr<ProgressBarElement> bar = ProgressBarElement::create(document());
     m_value = ProgressValueElement::create(document());
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index 731f80b4a..dfd006799 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -58,6 +58,7 @@ private:
     virtual const AtomicString& formControlType() const;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLScriptElement.cpp b/Source/WebCore/html/HTMLScriptElement.cpp
index 1df19a63b..cabc21374 100644
--- a/Source/WebCore/html/HTMLScriptElement.cpp
+++ b/Source/WebCore/html/HTMLScriptElement.cpp
@@ -58,19 +58,14 @@ void HTMLScriptElement::childrenChanged(bool changedByParser, Node* beforeChange
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
-void HTMLScriptElement::attributeChanged(Attribute* attr)
-{
-    if (attr->name() == asyncAttr)
-        handleAsyncAttribute();
-    HTMLElement::attributeChanged(attr);
-}
-
 void HTMLScriptElement::parseAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
 
     if (attrName == srcAttr)
         handleSourceAttribute(attr->value());
+    else if (attr->name() == asyncAttr)
+        handleAsyncAttribute();
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attrName == onbeforeloadAttr)
@@ -91,7 +86,7 @@ void HTMLScriptElement::setText(const String &value)
     int numChildren = childNodeCount();
 
     if (numChildren == 1 && firstChild()->isTextNode()) {
-        static_cast<Text*>(firstChild())->setData(value, ec);
+        toText(firstChild())->setData(value, ec);
         return;
     }
 
diff --git a/Source/WebCore/html/HTMLScriptElement.h b/Source/WebCore/html/HTMLScriptElement.h
index 61d9de094..07c89abf6 100644
--- a/Source/WebCore/html/HTMLScriptElement.h
+++ b/Source/WebCore/html/HTMLScriptElement.h
@@ -47,7 +47,6 @@ private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void insertedIntoDocument();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    virtual void attributeChanged(Attribute*) OVERRIDE;
 
     virtual bool isURLAttribute(Attribute*) const;
 
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index 1b96d226f..a2c31dcda 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -42,6 +42,7 @@
 #include "HTMLOptionsCollection.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderListBox.h"
 #include "RenderMenuList.h"
@@ -256,6 +257,17 @@ void HTMLSelectElement::setValue(const String &value)
     setSelectedIndex(-1);
 }
 
+bool HTMLSelectElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr) {
+        // Don't map 'align' attribute. This matches what Firefox, Opera and IE do.
+        // See http://bugs.webkit.org/show_bug.cgi?id=12072
+        return false;
+    }
+
+    return HTMLFormControlElementWithState::isPresentationAttribute(attr);
+}
+
 void HTMLSelectElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == sizeAttr) {
@@ -282,9 +294,6 @@ void HTMLSelectElement::parseAttribute(Attribute* attr)
         parseMultipleAttribute(attr);
     else if (attr->name() == accesskeyAttr) {
         // FIXME: ignore for the moment.
-    } else if (attr->name() == alignAttr) {
-        // Don't map 'align' attribute. This matches what Firefox, Opera and IE do.
-        // See http://bugs.webkit.org/show_bug.cgi?id=12072
     } else if (attr->name() == onchangeAttr)
         setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     else
@@ -317,6 +326,11 @@ RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*
     return new (arena) RenderListBox(this);
 }
 
+bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
+}
+
 HTMLOptionsCollection* HTMLSelectElement::options()
 {
     if (!m_optionsCollection)
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index 8d9b738a4..77c081e6f 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -122,7 +122,9 @@ private:
     virtual void restoreFormControlState(const String&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
 
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
     virtual bool appendFormData(FormDataList&, bool);
 
diff --git a/Source/WebCore/html/HTMLSelectElement.idl b/Source/WebCore/html/HTMLSelectElement.idl
index 5d60ef4f8..4f0b82662 100644
--- a/Source/WebCore/html/HTMLSelectElement.idl
+++ b/Source/WebCore/html/HTMLSelectElement.idl
@@ -52,8 +52,8 @@ module html {
         attribute [Reflect] boolean required;
         attribute long size;
         
-        [ObjCLegacyUnnamedParameters] void add(in [Optional=CallWithDefaultValue] HTMLElement element, 
-                                in [Optional=CallWithDefaultValue] HTMLElement before) raises(DOMException);
+        [ObjCLegacyUnnamedParameters] void add(in [Optional=DefaultIsUndefined] HTMLElement element, 
+                                in [Optional=DefaultIsUndefined] HTMLElement before) raises(DOMException);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // In JavaScript, we support both option index and option object parameters.
@@ -65,8 +65,8 @@ module html {
 
         // These methods are not in DOM Level 2 IDL, but are mentioned in the standard:
         // "The contained options can be directly accessed through the select element as a collection."
-        Node item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
-        Node namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
+        Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
         readonly attribute NodeList labels;
     };
 
diff --git a/Source/WebCore/html/HTMLStyleElement.cpp b/Source/WebCore/html/HTMLStyleElement.cpp
index 4156ce5f1..2070d56ce 100644
--- a/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/Source/WebCore/html/HTMLStyleElement.cpp
@@ -27,6 +27,7 @@
 #include "Attribute.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScriptEventListener.h"
 #include "ScriptableDocumentParser.h"
 
@@ -87,38 +88,50 @@ void HTMLStyleElement::registerWithScopingNode()
     // Therefore we cannot rely on scoped()!
     ASSERT(!m_isRegisteredWithScopingNode);
     ASSERT(inDocument());
-    if (!m_isRegisteredWithScopingNode) {
-        Element* scope = parentElement();
-        if (!scope)
-            return;
+    if (m_isRegisteredWithScopingNode)
+        return;
+    if (!RuntimeEnabledFeatures::styleScopedEnabled())
+        return;
+
+    ContainerNode* scope = parentNode();
+    if (!scope)
+        return;
+    if (!scope->isElementNode() && !scope->isShadowRoot()) {
+        // DocumentFragment nodes should never be inDocument,
+        // <style> should not be a child of Document, PI or some such.
+        ASSERT_NOT_REACHED();
+        return;
+    }
 
-        scope->registerScopedHTMLStyleChild();
-        scope->setNeedsStyleRecalc();
-        if (inDocument() && !document()->parsing() && document()->renderer())
-            document()->styleSelectorChanged(DeferRecalcStyle);
+    scope->registerScopedHTMLStyleChild();
+    scope->setNeedsStyleRecalc();
+    if (inDocument() && !document()->parsing() && document()->renderer())
+        document()->styleSelectorChanged(DeferRecalcStyle);
 
-        m_isRegisteredWithScopingNode = true;
-    }
+    m_isRegisteredWithScopingNode = true;
 }
 
 void HTMLStyleElement::unregisterWithScopingNode()
 {
     // Note: We cannot rely on the 'scoped' element still being present when this method is invoked.
     // Therefore we cannot rely on scoped()!
-    ASSERT(m_isRegisteredWithScopingNode);
-    if (m_isRegisteredWithScopingNode) {
-        Element* scope = parentElement();
-        ASSERT(scope);
-        if (scope) {
-            ASSERT(scope->hasScopedHTMLStyleChild());
-            scope->unregisterScopedHTMLStyleChild();
-            scope->setNeedsStyleRecalc();
-        }
-        if (inDocument() && !document()->parsing() && document()->renderer())
-            document()->styleSelectorChanged(DeferRecalcStyle);
-
-        m_isRegisteredWithScopingNode = false;
+    ASSERT(m_isRegisteredWithScopingNode || !RuntimeEnabledFeatures::styleScopedEnabled());
+    if (!m_isRegisteredWithScopingNode)
+        return;
+    if (!RuntimeEnabledFeatures::styleScopedEnabled())
+        return;
+
+    ContainerNode* scope = parentNode();
+    ASSERT(scope);
+    if (scope) {
+        ASSERT(scope->hasScopedHTMLStyleChild());
+        scope->unregisterScopedHTMLStyleChild();
+        scope->setNeedsStyleRecalc();
     }
+    if (inDocument() && !document()->parsing() && document()->renderer())
+        document()->styleSelectorChanged(DeferRecalcStyle);
+
+    m_isRegisteredWithScopingNode = false;
 }
 #endif
 
@@ -149,7 +162,7 @@ void HTMLStyleElement::willRemove()
     // That is, because willRemove() is also called if an ancestor is removed from the document.
     // Now, if we want to register <style scoped> even if it's not inDocument,
     // we'd need to find a way to discern whether that is the case, or whether <style scoped> itself is about to be removed.
-    ASSERT(!scoped() || !inDocument() || m_isRegisteredWithScopingNode);
+    ASSERT(!scoped() || !inDocument() || m_isRegisteredWithScopingNode || !RuntimeEnabledFeatures::styleScopedEnabled());
     if (m_isRegisteredWithScopingNode)
         unregisterWithScopingNode();
     HTMLElement::willRemove();
diff --git a/Source/WebCore/html/HTMLStyleElement.h b/Source/WebCore/html/HTMLStyleElement.h
index 9c50ee240..39d140067 100644
--- a/Source/WebCore/html/HTMLStyleElement.h
+++ b/Source/WebCore/html/HTMLStyleElement.h
@@ -74,7 +74,9 @@ private:
     void registerWithScopingNode();
     void unregisterWithScopingNode();
 
+#if ENABLE(STYLE_SCOPED)
     bool m_isRegisteredWithScopingNode;
+#endif
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLStyleElement.idl b/Source/WebCore/html/HTMLStyleElement.idl
index 7a1b62295..1b9abd47a 100644
--- a/Source/WebCore/html/HTMLStyleElement.idl
+++ b/Source/WebCore/html/HTMLStyleElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface HTMLStyleElement : HTMLElement {
         attribute boolean disabled;
-        attribute [Conditional=STYLE_SCOPED] boolean scoped;
+        attribute [Conditional=STYLE_SCOPED, V8EnabledAtRuntime=styleScoped] boolean scoped;
         attribute [Reflect] DOMString media;
         attribute [Reflect] DOMString type;
 
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index f57a5db23..a3494af81 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -27,11 +27,13 @@
 #include "HTMLContentElement.h"
 #include "HTMLDetailsElement.h"
 #include "HTMLNames.h"
+#include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSummary.h"
-
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 
 namespace WebCore {
 
@@ -71,9 +73,14 @@ RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderSummary(this);
 }
 
+bool HTMLSummaryElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 void HTMLSummaryElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(DetailsMarkerControl::create(document()), ASSERT_NO_EXCEPTION, true);
     root->appendChild(SummaryContentElement::create(document()), ASSERT_NO_EXCEPTION, true);
@@ -106,20 +113,49 @@ static bool isClickableControl(Node* node)
     return host && host->isFormControlElement();
 }
 
+bool HTMLSummaryElement::supportsFocus() const
+{
+    return isMainSummary();
+}
+
 void HTMLSummaryElement::defaultEventHandler(Event* event)
 {
-    HTMLElement::defaultEventHandler(event);
-    if (!isMainSummary() || !renderer() || !renderer()->isSummary() || !event->isMouseEvent() || event->type() != eventNames().clickEvent || event->defaultHandled())
-        return;
-    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
-    if (mouseEvent->button() != LeftButton)
-        return;
-    if (isClickableControl(event->target()->toNode()))
-        return;
+    if (isMainSummary() && renderer() && renderer()->isSummary()) {
+        if (event->type() == eventNames().DOMActivateEvent && !isClickableControl(event->target()->toNode())) {
+            if (HTMLDetailsElement* details = detailsElement())
+                details->toggleOpen();
+            event->setDefaultHandled();
+            return;
+        }
+
+        if (event->isKeyboardEvent()) {
+            if (event->type() == eventNames().keydownEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+                setActive(true, true);
+                // No setDefaultHandled() - IE dispatches a keypress in this case.
+                return;
+            }
+            if (event->type() == eventNames().keypressEvent) {
+                switch (static_cast<KeyboardEvent*>(event)->charCode()) {
+                case '\r':
+                    dispatchSimulatedClick(event);
+                    event->setDefaultHandled();
+                    return;
+                case ' ':
+                    // Prevent scrolling down the page.
+                    event->setDefaultHandled();
+                    return;
+                }
+            }
+            if (event->type() == eventNames().keyupEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+                if (active())
+                    dispatchSimulatedClick(event);
+                event->setDefaultHandled();
+                return;
+            }
+        }
+    }
 
-    if (HTMLDetailsElement* details = detailsElement())
-        details->toggleOpen();
-    event->setDefaultHandled();
+    HTMLElement::defaultEventHandler(event);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLSummaryElement.h b/Source/WebCore/html/HTMLSummaryElement.h
index 43ab73fad..49a2d0bac 100644
--- a/Source/WebCore/html/HTMLSummaryElement.h
+++ b/Source/WebCore/html/HTMLSummaryElement.h
@@ -36,10 +36,13 @@ private:
     HTMLSummaryElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
 
     void createShadowSubtree();
     HTMLDetailsElement* detailsElement() const;
+
+    bool supportsFocus() const OVERRIDE;
 };
 
 }
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.cpp b/Source/WebCore/html/HTMLTableCaptionElement.cpp
index 88450d43a..c327d0f85 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/Source/WebCore/html/HTMLTableCaptionElement.cpp
@@ -34,7 +34,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 inline HTMLTableCaptionElement::HTMLTableCaptionElement(const QualifiedName& tagName, Document* document)
-    : HTMLTablePartElement(tagName, document)
+    : HTMLElement(tagName, document)
 {
     ASSERT(hasTagName(captionTag));
 }
@@ -44,15 +44,20 @@ PassRefPtr<HTMLTableCaptionElement> HTMLTableCaptionElement::create(const Qualif
     return adoptRef(new HTMLTableCaptionElement(tagName, document));
 }
 
-void HTMLTableCaptionElement::parseAttribute(Attribute* attr)
+bool HTMLTableCaptionElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLTableCaptionElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyCaptionSide, attr->value());
-        else
-            removeCSSProperty(CSSPropertyCaptionSide);
+        if (!attr->isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyCaptionSide, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.h b/Source/WebCore/html/HTMLTableCaptionElement.h
index da40e821d..a43141f40 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.h
+++ b/Source/WebCore/html/HTMLTableCaptionElement.h
@@ -26,18 +26,19 @@
 #ifndef HTMLTableCaptionElement_h
 #define HTMLTableCaptionElement_h
 
-#include "HTMLTablePartElement.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
 
-class HTMLTableCaptionElement : public HTMLTablePartElement {
+class HTMLTableCaptionElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLTableCaptionElement> create(const QualifiedName&, Document*);
 
 private:
     HTMLTableCaptionElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLTableCellElement.cpp b/Source/WebCore/html/HTMLTableCellElement.cpp
index 84a1c9654..7664673f3 100644
--- a/Source/WebCore/html/HTMLTableCellElement.cpp
+++ b/Source/WebCore/html/HTMLTableCellElement.cpp
@@ -75,46 +75,50 @@ int HTMLTableCellElement::cellIndex() const
     return index;
 }
 
-void HTMLTableCellElement::parseAttribute(Attribute* attr)
+bool HTMLTableCellElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (attr->name() == rowspanAttr) {
-        if (renderer() && renderer()->isTableCell())
-            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
-    } else if (attr->name() == colspanAttr) {
-        if (renderer() && renderer()->isTableCell())
-            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
-    } else if (attr->name() == nowrapAttr) {
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyWhiteSpace);
-        else
-            addCSSProperty(CSSPropertyWhiteSpace, CSSValueWebkitNowrap);
+    if (attr->name() == nowrapAttr || attr->name() == widthAttr || attr->name() == heightAttr)
+        return true;
+    return HTMLTablePartElement::isPresentationAttribute(attr);
+}
 
+void HTMLTableCellElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == nowrapAttr) {
+        addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValueWebkitNowrap);
     } else if (attr->name() == widthAttr) {
         if (!attr->value().isEmpty()) {
             int widthInt = attr->value().toInt();
             if (widthInt > 0) // width="0" is ignored for compatibility with WinIE.
-                addCSSLength(CSSPropertyWidth, attr->value());
-        } else
-            removeCSSProperty(CSSPropertyWidth);
+                addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+        }
     } else if (attr->name() == heightAttr) {
         if (!attr->value().isEmpty()) {
             int heightInt = attr->value().toInt();
             if (heightInt > 0) // height="0" is ignored for compatibility with WinIE.
-                addCSSLength(CSSPropertyHeight, attr->value());
-        } else
-            removeCSSProperty(CSSPropertyHeight);
+                addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+        }
+    } else
+        HTMLTablePartElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLTableCellElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == rowspanAttr) {
+        if (renderer() && renderer()->isTableCell())
+            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
+    } else if (attr->name() == colspanAttr) {
+        if (renderer() && renderer()->isTableCell())
+            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
     } else
         HTMLTablePartElement::parseAttribute(attr);
 }
 
 StylePropertySet* HTMLTableCellElement::additionalAttributeStyle()
 {
-    ContainerNode* p = parentNode();
-    while (p && !p->hasTagName(tableTag))
-        p = p->parentNode();
-    if (!p)
-        return 0;
-    return static_cast<HTMLTableElement*>(p)->additionalCellStyle();
+    if (HTMLTableElement* table = findParentTable())
+        return table->additionalCellStyle();
+    return 0;
 }
 
 bool HTMLTableCellElement::isURLAttribute(Attribute *attr) const
diff --git a/Source/WebCore/html/HTMLTableCellElement.h b/Source/WebCore/html/HTMLTableCellElement.h
index 5c32d6a9d..7ca11271f 100644
--- a/Source/WebCore/html/HTMLTableCellElement.h
+++ b/Source/WebCore/html/HTMLTableCellElement.h
@@ -54,6 +54,8 @@ private:
     HTMLTableCellElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLTableColElement.cpp b/Source/WebCore/html/HTMLTableColElement.cpp
index 0c83e781c..db75b2544 100644
--- a/Source/WebCore/html/HTMLTableColElement.cpp
+++ b/Source/WebCore/html/HTMLTableColElement.cpp
@@ -47,6 +47,21 @@ PassRefPtr<HTMLTableColElement> HTMLTableColElement::create(const QualifiedName&
     return adoptRef(new HTMLTableColElement(tagName, document));
 }
 
+bool HTMLTableColElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr)
+        return true;
+    return HTMLTablePartElement::isPresentationAttribute(attr);
+}
+
+void HTMLTableColElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else
+        HTMLTablePartElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLTableColElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == spanAttr) {
@@ -55,15 +70,13 @@ void HTMLTableColElement::parseAttribute(Attribute* attr)
             renderer()->updateFromElement();
     } else if (attr->name() == widthAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSLength(CSSPropertyWidth, attr->value());
             if (renderer() && renderer()->isTableCol()) {
                 RenderTableCol* col = toRenderTableCol(renderer());
                 int newWidth = width().toInt();
                 if (newWidth != col->width())
                     col->setNeedsLayoutAndPrefWidthsRecalc();
             }
-        } else
-            removeCSSProperty(CSSPropertyWidth);
+        }
     } else
         HTMLTablePartElement::parseAttribute(attr);
 }
@@ -72,12 +85,9 @@ StylePropertySet* HTMLTableColElement::additionalAttributeStyle()
 {
     if (!hasLocalName(colgroupTag))
         return 0;
-    ContainerNode* p = parentNode();
-    while (p && !p->hasTagName(tableTag))
-        p = p->parentNode();
-    if (!p)
-        return 0;
-    return static_cast<HTMLTableElement*>(p)->additionalGroupStyle(false);
+    if (HTMLTableElement* table = findParentTable())
+        return table->additionalGroupStyle(false);
+    return 0;
 }
 
 void HTMLTableColElement::setSpan(int n)
diff --git a/Source/WebCore/html/HTMLTableColElement.h b/Source/WebCore/html/HTMLTableColElement.h
index 01cea8e1b..960ee8448 100644
--- a/Source/WebCore/html/HTMLTableColElement.h
+++ b/Source/WebCore/html/HTMLTableColElement.h
@@ -43,6 +43,8 @@ private:
     HTMLTableColElement(const QualifiedName& tagName, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
     int m_span;
diff --git a/Source/WebCore/html/HTMLTableElement.cpp b/Source/WebCore/html/HTMLTableElement.cpp
index be3aaa2ce..9420d9518 100644
--- a/Source/WebCore/html/HTMLTableElement.cpp
+++ b/Source/WebCore/html/HTMLTableElement.cpp
@@ -26,6 +26,7 @@
 #include "HTMLTableElement.h"
 
 #include "Attribute.h"
+#include "CSSImageValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
@@ -266,102 +267,118 @@ static bool setTableCellsChanged(Node* n)
     return cellChanged;
 }
 
+static bool getBordersFromFrameAttributeValue(const AtomicString& value, bool& borderTop, bool& borderRight, bool& borderBottom, bool& borderLeft)
+{
+    borderTop = false;
+    borderRight = false;
+    borderBottom = false;
+    borderLeft = false;
+
+    if (equalIgnoringCase(value, "above"))
+        borderTop = true;
+    else if (equalIgnoringCase(value, "below"))
+        borderBottom = true;
+    else if (equalIgnoringCase(value, "hsides"))
+        borderTop = borderBottom = true;
+    else if (equalIgnoringCase(value, "vsides"))
+        borderLeft = borderRight = true;
+    else if (equalIgnoringCase(value, "lhs"))
+        borderLeft = true;
+    else if (equalIgnoringCase(value, "rhs"))
+        borderRight = true;
+    else if (equalIgnoringCase(value, "box") || equalIgnoringCase(value, "border"))
+        borderTop = borderBottom = borderLeft = borderRight = true;
+    else if (!equalIgnoringCase(value, "void"))
+        return false;
+    return true;
+}
+
+void HTMLTableElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    else if (attr->name() == borderAttr) {
+        int borderWidth = attr->isEmpty() ? 1 : attr->value().toInt();
+        addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, borderWidth, CSSPrimitiveValue::CSS_PX);
+    } else if (attr->name() == bordercolorAttr) {
+        if (!attr->isEmpty())
+            addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+    } else if (attr->name() == bgcolorAttr)
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
+    else if (attr->name() == backgroundAttr) {
+        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
+        if (!url.isEmpty())
+            style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
+    } else if (attr->name() == valignAttr) {
+        if (!attr->isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
+    } else if (attr->name() == cellspacingAttr) {
+        if (!attr->isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyBorderSpacing, attr->value());
+    } else if (attr->name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+    } else if (attr->name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+    } else if (attr->name() == alignAttr) {
+        if (!attr->value().isEmpty()) {
+            if (equalIgnoringCase(attr->value(), "center")) {
+                addPropertyToAttributeStyle(style, CSSPropertyWebkitMarginStart, CSSValueAuto);
+                addPropertyToAttributeStyle(style, CSSPropertyWebkitMarginEnd, CSSValueAuto);
+            } else
+                addPropertyToAttributeStyle(style, CSSPropertyFloat, attr->value());
+        }
+    } else if (attr->name() == rulesAttr) {
+        // The presence of a valid rules attribute causes border collapsing to be enabled.
+        if (m_rulesAttr != UnsetRules)
+            addPropertyToAttributeStyle(style, CSSPropertyBorderCollapse, CSSValueCollapse);
+    } else if (attr->name() == frameAttr) {
+        bool borderTop;
+        bool borderRight;
+        bool borderBottom;
+        bool borderLeft;
+        if (getBordersFromFrameAttributeValue(attr->value(), borderTop, borderRight, borderBottom, borderLeft)) {
+            addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, CSSValueThin);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderTopStyle, borderTop ? CSSValueSolid : CSSValueHidden);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderBottomStyle, borderBottom ? CSSValueSolid : CSSValueHidden);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderLeftStyle, borderLeft ? CSSValueSolid : CSSValueHidden);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderRightStyle, borderRight ? CSSValueSolid : CSSValueHidden);
+        }
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+bool HTMLTableElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == valignAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == cellspacingAttr || attr->name() == borderAttr || attr->name() == bordercolorAttr || attr->name() == frameAttr || attr->name() == rulesAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
 void HTMLTableElement::parseAttribute(Attribute* attr)
 {
     CellBorders bordersBefore = cellBorders();
     unsigned short oldPadding = m_padding;
 
-    if (attr->name() == widthAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
-    else if (attr->name() == heightAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
-    else if (attr->name() == borderAttr)  {
+    if (attr->name() == borderAttr)  {
+        // FIXME: This attribute is a mess.
         m_borderAttr = true;
-
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyBorderWidth);
-        else {
-            int border = 0;
-            if (attr->isEmpty())
-                border = 1;
-            else
-                border = attr->value().toInt();
+        if (!attr->isNull()) {
+            int border = attr->isEmpty() ? 1 : attr->value().toInt();
             m_borderAttr = border;
-            addCSSLength(CSSPropertyBorderWidth, String::number(border));
         }
-    } else if (attr->name() == bgcolorAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyBackgroundColor);
-        else
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
-    else if (attr->name() == bordercolorAttr) {
+    } else if (attr->name() == bordercolorAttr) {
         m_borderColorAttr = !attr->isEmpty();
-        if (!attr->isEmpty())
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-        else
-            removeCSSProperty(CSSPropertyBorderColor);
-    } else if (attr->name() == backgroundAttr) {
-        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
-        if (!url.isEmpty())
-            addCSSImageProperty(CSSPropertyBackgroundImage, document()->completeURL(url).string());
-        else
-            removeCSSProperty(CSSPropertyBackgroundImage);
     } else if (attr->name() == frameAttr) {
-        // Cache the value of "frame" so that the table can examine it later.
-        m_frameAttr = false;
-        
-        // Whether or not to hide the top/right/bottom/left borders.
-        const int cTop = 0;
-        const int cRight = 1;
-        const int cBottom = 2;
-        const int cLeft = 3;
-        bool borders[4] = { false, false, false, false };
-        
-        // void, above, below, hsides, vsides, lhs, rhs, box, border
-        if (equalIgnoringCase(attr->value(), "void"))
-            m_frameAttr = true;
-        else if (equalIgnoringCase(attr->value(), "above")) {
-            m_frameAttr = true;
-            borders[cTop] = true;
-        } else if (equalIgnoringCase(attr->value(), "below")) {
-            m_frameAttr = true;
-            borders[cBottom] = true;
-        } else if (equalIgnoringCase(attr->value(), "hsides")) {
-            m_frameAttr = true;
-            borders[cTop] = borders[cBottom] = true;
-        } else if (equalIgnoringCase(attr->value(), "vsides")) {
-            m_frameAttr = true;
-            borders[cLeft] = borders[cRight] = true;
-        } else if (equalIgnoringCase(attr->value(), "lhs")) {
-            m_frameAttr = true;
-            borders[cLeft] = true;
-        } else if (equalIgnoringCase(attr->value(), "rhs")) {
-            m_frameAttr = true;
-            borders[cRight] = true;
-        } else if (equalIgnoringCase(attr->value(), "box") ||
-                   equalIgnoringCase(attr->value(), "border")) {
-            m_frameAttr = true;
-            borders[cTop] = borders[cBottom] = borders[cLeft] = borders[cRight] = true;
-        }
-        
-        // Now map in the border styles of solid and hidden respectively.
-        if (m_frameAttr) {
-            addCSSProperty(CSSPropertyBorderTopWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderBottomWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderLeftWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderRightWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderTopStyle, borders[cTop] ? CSSValueSolid : CSSValueHidden);
-            addCSSProperty(CSSPropertyBorderBottomStyle, borders[cBottom] ? CSSValueSolid : CSSValueHidden);
-            addCSSProperty(CSSPropertyBorderLeftStyle, borders[cLeft] ? CSSValueSolid : CSSValueHidden);
-            addCSSProperty(CSSPropertyBorderRightStyle, borders[cRight] ? CSSValueSolid : CSSValueHidden);
-        } else
-            removeCSSProperties(CSSPropertyBorderTopWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderTopStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderRightStyle);
+        // FIXME: This attribute is a mess.
+        bool borderTop;
+        bool borderRight;
+        bool borderBottom;
+        bool borderLeft;
+        m_frameAttr = getBordersFromFrameAttributeValue(attr->value(), borderTop, borderRight, borderBottom, borderLeft);
     } else if (attr->name() == rulesAttr) {
         m_rulesAttr = UnsetRules;
         if (equalIgnoringCase(attr->value(), "none"))
@@ -374,17 +391,6 @@ void HTMLTableElement::parseAttribute(Attribute* attr)
             m_rulesAttr = ColsRules;
         if (equalIgnoringCase(attr->value(), "all"))
             m_rulesAttr = AllRules;
-        
-        // The presence of a valid rules attribute causes border collapsing to be enabled.
-        if (m_rulesAttr != UnsetRules)
-            addCSSProperty(CSSPropertyBorderCollapse, CSSValueCollapse);
-        else
-            removeCSSProperty(CSSPropertyBorderCollapse);
-    } else if (attr->name() == cellspacingAttr) {
-        if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyBorderSpacing, attr->value());
-        else
-            removeCSSProperty(CSSPropertyBorderSpacing);
     } else if (attr->name() == cellpaddingAttr) {
         if (!attr->value().isEmpty())
             m_padding = max(0, attr->value().toInt());
@@ -392,34 +398,6 @@ void HTMLTableElement::parseAttribute(Attribute* attr)
             m_padding = 1;
     } else if (attr->name() == colsAttr) {
         // ###
-    } else if (attr->name() == vspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
-        else {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        }
-    } else if (attr->name() == hspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        else {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        }
-    } else if (attr->name() == alignAttr) {
-        if (!attr->value().isEmpty()) {
-            if (equalIgnoringCase(attr->value(), "center")) {
-                addCSSProperty(CSSPropertyWebkitMarginStart, CSSValueAuto);
-                addCSSProperty(CSSPropertyWebkitMarginEnd, CSSValueAuto);
-            } else
-                addCSSProperty(CSSPropertyFloat, attr->value());
-        } else
-            removeCSSProperties(CSSPropertyWebkitMarginStart, CSSPropertyWebkitMarginEnd, CSSPropertyFloat);
-    } else if (attr->name() == valignAttr) {
-        if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyVerticalAlign, attr->value());
-        else
-            removeCSSProperty(CSSPropertyVerticalAlign);
     } else
         HTMLElement::parseAttribute(attr);
 
diff --git a/Source/WebCore/html/HTMLTableElement.h b/Source/WebCore/html/HTMLTableElement.h
index ef8ccde6e..d9b86a8fc 100644
--- a/Source/WebCore/html/HTMLTableElement.h
+++ b/Source/WebCore/html/HTMLTableElement.h
@@ -73,6 +73,8 @@ private:
     HTMLTableElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isURLAttribute(Attribute*) const;
 
     // Used to obtain either a solid or outset border decl and to deal with the frame and rules attributes.
diff --git a/Source/WebCore/html/HTMLTableElement.idl b/Source/WebCore/html/HTMLTableElement.idl
index 7c046eb6e..5e3bb0cf7 100644
--- a/Source/WebCore/html/HTMLTableElement.idl
+++ b/Source/WebCore/html/HTMLTableElement.idl
@@ -46,8 +46,8 @@ module html {
         HTMLElement createCaption();
         void deleteCaption();
 
-        HTMLElement insertRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
-        void deleteRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
+        HTMLElement insertRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
+        void deleteRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/html/HTMLTablePartElement.cpp b/Source/WebCore/html/HTMLTablePartElement.cpp
index 8fd747bd8..8a39260af 100644
--- a/Source/WebCore/html/HTMLTablePartElement.cpp
+++ b/Source/WebCore/html/HTMLTablePartElement.cpp
@@ -26,64 +26,73 @@
 #include "HTMLTablePartElement.h"
 
 #include "Attribute.h"
+#include "CSSImageValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
+#include "HTMLTableElement.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-void HTMLTablePartElement::parseAttribute(Attribute* attr)
+bool HTMLTablePartElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == bordercolorAttr || attr->name() == valignAttr || attr->name() == alignAttr || attr->name() == heightAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLTablePartElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == bgcolorAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyBackgroundColor);
-        else
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     else if (attr->name() == backgroundAttr) {
         String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (!url.isEmpty())
-            addCSSImageProperty(CSSPropertyBackgroundImage, document()->completeURL(url).string());
-        else
-            removeCSSProperty(CSSPropertyBackgroundImage);
+            style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
     } else if (attr->name() == bordercolorAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-            addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-        } else
-            removeCSSProperties(CSSPropertyBorderColor, CSSPropertyBorderTopStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderRightStyle);
+            addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
+        }
     } else if (attr->name() == valignAttr) {
-        if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyVerticalAlign, attr->value());
+        if (equalIgnoringCase(attr->value(), "top"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueTop);
+        else if (equalIgnoringCase(attr->value(), "middle"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueMiddle);
+        else if (equalIgnoringCase(attr->value(), "bottom"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueBottom);
+        else if (equalIgnoringCase(attr->value(), "baseline"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueBaseline);
         else
-            removeCSSProperty(CSSPropertyVerticalAlign);
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
     } else if (attr->name() == alignAttr) {
-        const AtomicString& v = attr->value();
-        if (v.isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
-        else if (equalIgnoringCase(v, "middle") || equalIgnoringCase(v, "center"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitCenter);
-        else if (equalIgnoringCase(v, "absmiddle"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueCenter);
-        else if (equalIgnoringCase(v, "left"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitLeft);
-        else if (equalIgnoringCase(v, "right"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitRight);
+        if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
+        else if (equalIgnoringCase(attr->value(), "absmiddle"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueCenter);
+        else if (equalIgnoringCase(attr->value(), "left"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
+        else if (equalIgnoringCase(attr->value(), "right"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addCSSProperty(CSSPropertyTextAlign, v);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else if (attr->name() == heightAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyHeight, attr->value());
-        else
-            removeCSSProperty(CSSPropertyHeight);
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+HTMLTableElement* HTMLTablePartElement::findParentTable() const
+{
+    ContainerNode* parent = parentNode();
+    while (parent && !parent->hasTagName(tableTag))
+        parent = parent->parentNode();
+    return static_cast<HTMLTableElement*>(parent);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLTablePartElement.h b/Source/WebCore/html/HTMLTablePartElement.h
index c139bbe3c..49f75b3d5 100644
--- a/Source/WebCore/html/HTMLTablePartElement.h
+++ b/Source/WebCore/html/HTMLTablePartElement.h
@@ -30,6 +30,8 @@
 
 namespace WebCore {
 
+class HTMLTableElement;
+
 class HTMLTablePartElement : public HTMLElement {
 protected:
     HTMLTablePartElement(const QualifiedName& tagName, Document* document)
@@ -37,7 +39,10 @@ protected:
     {
     }
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+
+    HTMLTableElement* findParentTable() const;
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLTableRowElement.idl b/Source/WebCore/html/HTMLTableRowElement.idl
index 482c61f7d..b16d754af 100644
--- a/Source/WebCore/html/HTMLTableRowElement.idl
+++ b/Source/WebCore/html/HTMLTableRowElement.idl
@@ -29,8 +29,8 @@ module html {
         attribute [Reflect=char] DOMString ch;
         attribute [Reflect=charoff] DOMString chOff;
         attribute [Reflect] DOMString vAlign;
-        HTMLElement insertCell(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
-        void deleteCell(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
+        HTMLElement insertCell(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
+        void deleteCell(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/html/HTMLTableSectionElement.cpp b/Source/WebCore/html/HTMLTableSectionElement.cpp
index 0e7872d12..f450fea25 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.cpp
+++ b/Source/WebCore/html/HTMLTableSectionElement.cpp
@@ -49,12 +49,9 @@ PassRefPtr<HTMLTableSectionElement> HTMLTableSectionElement::create(const Qualif
 
 StylePropertySet* HTMLTableSectionElement::additionalAttributeStyle()
 {
-    ContainerNode* p = parentNode();
-    while (p && !p->hasTagName(tableTag))
-        p = p->parentNode();
-    if (!p)
-        return 0;
-    return static_cast<HTMLTableElement*>(p)->additionalGroupStyle(true);
+    if (HTMLTableElement* table = findParentTable())
+        return table->additionalGroupStyle(true);
+    return 0;
 }
 
 // these functions are rather slow, since we need to get the row at
diff --git a/Source/WebCore/html/HTMLTableSectionElement.idl b/Source/WebCore/html/HTMLTableSectionElement.idl
index 1553b5ea1..88f53369b 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.idl
+++ b/Source/WebCore/html/HTMLTableSectionElement.idl
@@ -28,8 +28,8 @@ module html {
         attribute [Reflect=charoff] DOMString chOff;
         attribute [Reflect] DOMString vAlign;
         readonly attribute HTMLCollection rows;
-        HTMLElement insertRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
-        void deleteRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
+        HTMLElement insertRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
+        void deleteRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index bff7574be..f110ef695 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -38,6 +38,7 @@
 #include "HTMLNames.h"
 #include "RenderTextControlMultiLine.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 #include "TextControlInnerElements.h"
 #include "TextIterator.h"
@@ -84,7 +85,7 @@ PassRefPtr<HTMLTextAreaElement> HTMLTextAreaElement::create(const QualifiedName&
 
 void HTMLTextAreaElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(TextControlInnerTextElement::create(document()), ASSERT_NO_EXCEPTION);
 }
@@ -117,7 +118,34 @@ void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChan
     setInnerTextValue(value());
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
-    
+
+bool HTMLTextAreaElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr) {
+        // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
+        // See http://bugs.webkit.org/show_bug.cgi?id=7075
+        return false;
+    }
+
+    if (attr->name() == wrapAttr)
+        return true;
+    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+}
+
+void HTMLTextAreaElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == wrapAttr) {
+        if (shouldWrapText()) {
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePreWrap);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
+        } else {
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePre);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueNormal);
+        }
+    } else
+        HTMLTextFormControlElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLTextAreaElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == rowsAttr) {
@@ -150,23 +178,11 @@ void HTMLTextAreaElement::parseAttribute(Attribute* attr)
             wrap = SoftWrap;
         if (wrap != m_wrap) {
             m_wrap = wrap;
-
-            if (shouldWrapText()) {
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValuePreWrap);
-                addCSSProperty(CSSPropertyWordWrap, CSSValueBreakWord);
-            } else {
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValuePre);
-                addCSSProperty(CSSPropertyWordWrap, CSSValueNormal);
-            }
-
             if (renderer())
                 renderer()->setNeedsLayoutAndPrefWidthsRecalc();
         }
     } else if (attr->name() == accesskeyAttr) {
         // ignore for the moment
-    } else if (attr->name() == alignAttr) {
-        // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
-        // See http://bugs.webkit.org/show_bug.cgi?id=7075
     } else if (attr->name() == maxlengthAttr)
         setNeedsValidityCheck();
     else
@@ -278,7 +294,7 @@ String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue,
 
 HTMLElement* HTMLTextAreaElement::innerTextElement() const
 {
-    Node* node = shadowRoot()->firstChild();
+    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
     ASSERT(!node || node->hasTagName(divTag));
     return toHTMLElement(node);
 }
@@ -360,7 +376,7 @@ String HTMLTextAreaElement::defaultValue() const
     // Since there may be comments, ignore nodes other than text nodes.
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
-            value += static_cast<Text*>(n)->data();
+            value += toText(n)->data();
     }
 
     return value;
@@ -455,7 +471,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     String placeholderText = strippedPlaceholder();
     if (placeholderText.isEmpty()) {
         if (m_placeholder) {
-            shadowRoot()->removeChild(m_placeholder.get(), ec);
+            shadowRootList()->oldestShadowRoot()->removeChild(m_placeholder.get(), ec);
             ASSERT(!ec);
             m_placeholder.clear();
         }
@@ -464,7 +480,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        shadowRoot()->insertBefore(m_placeholder, shadowRoot()->firstChild()->nextSibling(), ec);
+        shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, shadowRootList()->oldestShadowRoot()->firstChild()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index c2bbc718c..615af2585 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -94,6 +94,8 @@ private:
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool appendFormData(FormDataList&, bool);
     virtual void reset();
diff --git a/Source/WebCore/html/HTMLTextAreaElement.idl b/Source/WebCore/html/HTMLTextAreaElement.idl
index 3b76115e5..f6ed37503 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.idl
+++ b/Source/WebCore/html/HTMLTextAreaElement.idl
@@ -40,6 +40,9 @@ module html {
         attribute [TreatNullAs=NullString] DOMString value;
         readonly attribute unsigned long textLength;
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
         void select();
 
         readonly attribute boolean willValidate;
@@ -54,8 +57,8 @@ module html {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void setSelectionRange(in long start, in long end);
 #else
-        void setSelectionRange(in [Optional=CallWithDefaultValue] long start, 
-                               in [Optional=CallWithDefaultValue] long end, 
+        void setSelectionRange(in [Optional=DefaultIsUndefined] long start, 
+                               in [Optional=DefaultIsUndefined] long end, 
                                in [Optional] DOMString direction);
 #endif
         readonly attribute NodeList labels;
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.cpp b/Source/WebCore/html/HTMLTextFormControlElement.cpp
index c7f64903f..f47e1f209 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLTextFormControlElement.cpp
@@ -37,6 +37,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderBox.h"
 #include "RenderTextControl.h"
@@ -64,6 +65,11 @@ HTMLTextFormControlElement::~HTMLTextFormControlElement()
 {
 }
 
+bool HTMLTextFormControlElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
+}
+
 void HTMLTextFormControlElement::insertedIntoDocument()
 {
     HTMLFormControlElement::insertedIntoDocument();
@@ -153,7 +159,7 @@ void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderVal
     if (!placeholder)
         return;
     ExceptionCode ec = 0;
-    placeholder->ensureInlineStyleDecl()->setProperty(CSSPropertyVisibility, placeholderShouldBeVisible() ? "visible" : "hidden", ec);
+    placeholder->setInlineStyleProperty(CSSPropertyVisibility, placeholderShouldBeVisible() ? "visible" : "hidden", ec);
     ASSERT(!ec);
 }
 
@@ -493,7 +499,7 @@ String HTMLTextFormControlElement::innerTextValue() const
         if (node->hasTagName(brTag))
             result.append(newlineCharacter);
         else if (node->isTextNode())
-            result.append(static_cast<Text*>(node)->data());
+            result.append(toText(node)->data());
     }
     return finishText(result);
 }
@@ -540,7 +546,7 @@ String HTMLTextFormControlElement::valueWithHardLineBreaks() const
         if (node->hasTagName(brTag))
             result.append(newlineCharacter);
         else if (node->isTextNode()) {
-            String data = static_cast<Text*>(node)->data();
+            String data = toText(node)->data();
             unsigned length = data.length();
             unsigned position = 0;
             while (breakNode == node && breakOffset <= length) {
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.h b/Source/WebCore/html/HTMLTextFormControlElement.h
index 8aff29093..59cd741dd 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.h
+++ b/Source/WebCore/html/HTMLTextFormControlElement.h
@@ -34,6 +34,7 @@ class RenderTextControl;
 class VisiblePosition;
 
 enum TextFieldSelectionDirection { SelectionHasNoDirection, SelectionHasForwardDirection, SelectionHasBackwardDirection };
+enum TextFieldEventBehavior { DispatchNoEvent, DispatchChangeEvent, DispatchInputAndChangeEvent };
 
 class HTMLTextFormControlElement : public HTMLFormControlElementWithState {
 public:
@@ -81,14 +82,14 @@ public:
 
     String directionForFormData() const;
 
+    void setTextAsOfLastFormControlChangeEvent(const String& text) { m_textAsOfLastFormControlChangeEvent = text; }
+
 protected:
     HTMLTextFormControlElement(const QualifiedName&, Document*, HTMLFormElement*);
     virtual void updatePlaceholderText() = 0;
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
 
-    void setTextAsOfLastFormControlChangeEvent(const String& text) { m_textAsOfLastFormControlChangeEvent = text; }
-    
     void cacheSelection(int start, int end, TextFieldSelectionDirection direction)
     {
         m_cachedSelectionStart = start;
@@ -113,6 +114,7 @@ private:
 
     virtual void dispatchFocusEvent(PassRefPtr<Node> oldFocusedNode);
     virtual void dispatchBlurEvent(PassRefPtr<Node> newFocusedNode);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
 
     bool isPlaceholderEmpty() const;
 
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index 69f1f84bc..6e7884b8b 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -70,7 +70,7 @@ String HTMLTitleElement::text() const
     
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
-            val += static_cast<Text*>(n)->data();
+            val += toText(n)->data();
     }
 
     return val;
@@ -92,7 +92,7 @@ void HTMLTitleElement::setText(const String &value)
     int numChildren = childNodeCount();
     
     if (numChildren == 1 && firstChild()->isTextNode())
-        static_cast<Text*>(firstChild())->setData(value, ec);
+        toText(firstChild())->setData(value, ec);
     else {  
         // We make a copy here because entity of "value" argument can be Document::m_title,
         // which goes empty during removeChildren() invocation below,
diff --git a/Source/WebCore/html/HTMLTrackElement.cpp b/Source/WebCore/html/HTMLTrackElement.cpp
index ea2ad05c7..f3578dacf 100644
--- a/Source/WebCore/html/HTMLTrackElement.cpp
+++ b/Source/WebCore/html/HTMLTrackElement.cpp
@@ -92,6 +92,20 @@ void HTMLTrackElement::parseAttribute(Attribute* attribute)
 {
     const QualifiedName& attrName = attribute->name();
 
+    if (RuntimeEnabledFeatures::webkitVideoTrackEnabled()) {
+        if (attrName == srcAttr) {
+            if (!attribute->isEmpty() && mediaElement())
+                scheduleLoad();
+            // 4.8.10.12.3 Sourcing out-of-band text tracks
+            // As the kind, label, and srclang attributes are set, changed, or removed, the text track must update accordingly...
+        } else if (attrName == kindAttr)
+            track()->setKind(attribute->value());
+        else if (attrName == labelAttr)
+            track()->setLabel(attribute->value());
+        else if (attrName == srclangAttr)
+            track()->setLanguage(attribute->value());
+    }
+
     if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
     else if (attrName == onerrorAttr)
@@ -100,28 +114,6 @@ void HTMLTrackElement::parseAttribute(Attribute* attribute)
         HTMLElement::parseAttribute(attribute);
 }
 
-void HTMLTrackElement::attributeChanged(Attribute* attr)
-{
-    HTMLElement::attributeChanged(attr);
-
-    if (!RuntimeEnabledFeatures::webkitVideoTrackEnabled())
-        return;
-
-    const QualifiedName& attrName = attr->name();
-    if (attrName == srcAttr) {
-        if (!getAttribute(srcAttr).isEmpty() && mediaElement())
-            scheduleLoad();
-
-    // 4.8.10.12.3 Sourcing out-of-band text tracks
-    // As the kind, label, and srclang attributes are set, changed, or removed, the text track must update accordingly...
-    } else if (attrName == kindAttr)
-        track()->setKind(attr->value());
-    else if (attrName == labelAttr)
-        track()->setLabel(attr->value());
-    else if (attrName == srclangAttr)
-        track()->setLanguage(attr->value());
-}
-
 KURL HTMLTrackElement::src() const
 {
     return document()->completeURL(getAttribute(srcAttr));
diff --git a/Source/WebCore/html/HTMLTrackElement.h b/Source/WebCore/html/HTMLTrackElement.h
index d3a05544a..ce1247c69 100644
--- a/Source/WebCore/html/HTMLTrackElement.h
+++ b/Source/WebCore/html/HTMLTrackElement.h
@@ -76,7 +76,6 @@ private:
     virtual ~HTMLTrackElement();
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual void attributeChanged(Attribute*) OVERRIDE;
 
     virtual void insertedIntoDocument() OVERRIDE;
     virtual void removedFromDocument() OVERRIDE;
diff --git a/Source/WebCore/html/HTMLUListElement.cpp b/Source/WebCore/html/HTMLUListElement.cpp
index cc3c06999..e18d2a71c 100644
--- a/Source/WebCore/html/HTMLUListElement.cpp
+++ b/Source/WebCore/html/HTMLUListElement.cpp
@@ -47,15 +47,19 @@ PassRefPtr<HTMLUListElement> HTMLUListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLUListElement(tagName, document));
 }
 
-void HTMLUListElement::parseAttribute(Attribute* attr)
+bool HTMLUListElement::isPresentationAttribute(Attribute* attr) const
 {
     if (attr->name() == typeAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyListStyleType);
-        else
-            addCSSProperty(CSSPropertyListStyleType, attr->value());
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLUListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == typeAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attr->value());
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLUListElement.h b/Source/WebCore/html/HTMLUListElement.h
index c7867469f..ea6510da0 100644
--- a/Source/WebCore/html/HTMLUListElement.h
+++ b/Source/WebCore/html/HTMLUListElement.h
@@ -35,7 +35,8 @@ public:
 private:
     HTMLUListElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index c59f995e4..64428d815 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -54,7 +54,9 @@ inline HTMLVideoElement::HTMLVideoElement(const QualifiedName& tagName, Document
 
 PassRefPtr<HTMLVideoElement> HTMLVideoElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
-    return adoptRef(new HTMLVideoElement(tagName, document, createdByParser));
+    RefPtr<HTMLVideoElement> videoElement(adoptRef(new HTMLVideoElement(tagName, document, createdByParser)));
+    videoElement->suspendIfNeeded();
+    return videoElement.release();
 }
 
 bool HTMLVideoElement::rendererIsNeeded(const NodeRenderingContext& context) 
@@ -93,6 +95,23 @@ void HTMLVideoElement::detach()
         m_imageLoader.clear();
 }
 
+void HTMLVideoElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    else
+        HTMLMediaElement::collectStyleForAttribute(attr, style);
+}
+
+bool HTMLVideoElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr)
+        return true;
+    return HTMLMediaElement::isPresentationAttribute(attr);
+}
+
 void HTMLVideoElement::parseAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
@@ -113,17 +132,7 @@ void HTMLVideoElement::parseAttribute(Attribute* attr)
                 toRenderImage(renderer())->imageResource()->setCachedImage(0); 
         }
 #endif
-    } else if (attrName == widthAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
-    else if (attrName == heightAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
-    else
+    } else
         HTMLMediaElement::parseAttribute(attr);
 }
 
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index e8f6331ef..59efd882b 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -76,6 +76,8 @@ private:
     virtual void attach();
     virtual void detach();
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
     virtual bool supportsFullscreen() const;
diff --git a/Source/WebCore/html/HiddenInputType.cpp b/Source/WebCore/html/HiddenInputType.cpp
index fc103975b..951b6d826 100644
--- a/Source/WebCore/html/HiddenInputType.cpp
+++ b/Source/WebCore/html/HiddenInputType.cpp
@@ -87,7 +87,7 @@ bool HiddenInputType::storesValueSeparateFromAttribute()
     return false;
 }
 
-void HiddenInputType::setValue(const String& sanitizedValue, bool, bool)
+void HiddenInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
 {
     element()->setAttribute(valueAttr, sanitizedValue);
 }
diff --git a/Source/WebCore/html/HiddenInputType.h b/Source/WebCore/html/HiddenInputType.h
index fd86fbc1f..9e8982c54 100644
--- a/Source/WebCore/html/HiddenInputType.h
+++ b/Source/WebCore/html/HiddenInputType.h
@@ -51,7 +51,7 @@ private:
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
     virtual bool isHiddenType() const OVERRIDE;
     virtual bool shouldRespectHeightAndWidthAttributes() OVERRIDE;
-    virtual void setValue(const String&, bool, bool) OVERRIDE;
+    virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/ImageData.idl b/Source/WebCore/html/ImageData.idl
index bbfa460a3..c85945417 100644
--- a/Source/WebCore/html/ImageData.idl
+++ b/Source/WebCore/html/ImageData.idl
@@ -29,7 +29,7 @@
 module html {
 
     interface [
-        JSCustomToJS
+        CustomToJSObject
     ] ImageData {
         readonly attribute long width;
         readonly attribute long height;
diff --git a/Source/WebCore/html/ImageDocument.cpp b/Source/WebCore/html/ImageDocument.cpp
index dc95a0d71..eb8e82198 100644
--- a/Source/WebCore/html/ImageDocument.cpp
+++ b/Source/WebCore/html/ImageDocument.cpp
@@ -253,7 +253,7 @@ void ImageDocument::resizeImageToFit()
     m_imageElement->setWidth(static_cast<int>(imageSize.width() * scale));
     m_imageElement->setHeight(static_cast<int>(imageSize.height() * scale));
     
-    m_imageElement->ensureInlineStyleDecl()->setProperty(CSSPropertyCursor, "-webkit-zoom-in", false);
+    m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-in", false);
 }
 
 void ImageDocument::imageClicked(int x, int y)
@@ -307,9 +307,9 @@ void ImageDocument::restoreImageSize()
     m_imageElement->setHeight(imageSize.height());
     
     if (imageFitsInWindow())
-        m_imageElement->ensureInlineStyleDecl()->removeProperty(CSSPropertyCursor);
+        m_imageElement->removeInlineStyleProperty(CSSPropertyCursor);
     else
-        m_imageElement->ensureInlineStyleDecl()->setProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
+        m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
         
     m_didShrinkImage = false;
 }
@@ -340,9 +340,9 @@ void ImageDocument::windowSizeChanged()
     // and set it to a zoom out cursor if the image doesn't fit
     if (!m_shouldShrinkImage) {
         if (fitsInWindow)
-            m_imageElement->ensureInlineStyleDecl()->removeProperty(CSSPropertyCursor);
+            m_imageElement->removeInlineStyleProperty(CSSPropertyCursor);
         else
-            m_imageElement->ensureInlineStyleDecl()->setProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
+            m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
         return;
     }
     
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index f34e6eb32..f34b93b5f 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -56,6 +56,7 @@
 #include "ResetInputType.h"
 #include "SearchInputType.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SubmitInputType.h"
 #include "TelephoneInputType.h"
 #include "TextInputType.h"
@@ -192,7 +193,7 @@ double InputType::valueAsNumber() const
     return numeric_limits<double>::quiet_NaN();
 }
 
-void InputType::setValueAsNumber(double, bool, ExceptionCode& ec) const
+void InputType::setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode& ec) const
 {
     ec = INVALID_STATE_ERR;
 }
@@ -378,7 +379,11 @@ void InputType::createShadowSubtree()
 
 void InputType::destroyShadowSubtree()
 {
-    element()->removeShadowRoot();
+    if (!element()->hasShadowRoot())
+        return;
+
+    if (ShadowRoot* root = element()->shadowRootList()->oldestShadowRoot())
+        root->removeAllChildren();
 }
 
 double InputType::parseToDouble(const String&, double defaultValue) const
@@ -535,15 +540,12 @@ bool InputType::storesValueSeparateFromAttribute()
     return true;
 }
 
-void InputType::setValue(const String& sanitizedValue, bool, bool sendChangeEvent)
+void InputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    element()->setValueInternal(sanitizedValue, sendChangeEvent);
+    element()->setValueInternal(sanitizedValue, eventBehavior);
     element()->setNeedsStyleRecalc();
-}
-
-void InputType::dispatchChangeEventInResponseToSetValue()
-{
-    element()->dispatchFormControlChangeEvent();
+    if (valueChanged && eventBehavior != DispatchNoEvent)
+        element()->dispatchFormControlChangeEvent();
 }
 
 bool InputType::canSetValue(const String&)
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index c76aacc8f..6b0f9c15a 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -32,6 +32,7 @@
 #ifndef InputType_h
 #define InputType_h
 
+#include "HTMLTextFormControlElement.h"
 #include <wtf/Forward.h>
 #include <wtf/FastAllocBase.h>
 #include <wtf/Noncopyable.h>
@@ -126,7 +127,7 @@ public:
     virtual double valueAsDate() const;
     virtual void setValueAsDate(double, ExceptionCode&) const;
     virtual double valueAsNumber() const;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const;
 
     // Validation functions
 
@@ -225,8 +226,7 @@ public:
     virtual bool shouldSendChangeEventAfterCheckedChanged();
     virtual bool canSetValue(const String&);
     virtual bool storesValueSeparateFromAttribute();
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent);
-    virtual void dispatchChangeEventInResponseToSetValue();
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior);
     virtual bool shouldResetOnDocumentActivation();
     virtual bool shouldRespectListAttribute();
     virtual bool shouldRespectSpeechAttribute();
diff --git a/Source/WebCore/html/MediaController.idl b/Source/WebCore/html/MediaController.idl
index 1899dc3d8..d3f33485b 100644
--- a/Source/WebCore/html/MediaController.idl
+++ b/Source/WebCore/html/MediaController.idl
@@ -28,7 +28,7 @@ module html {
         Conditional=VIDEO,
         Constructor,
         CallWith=ScriptExecutionContext,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         EventTarget
     ] MediaController {
         readonly attribute TimeRanges buffered;
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 3a4d420cd..560a4515b 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -83,7 +83,7 @@ double NumberInputType::valueAsNumber() const
     return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
 }
 
-void NumberInputType::setValueAsNumber(double newValue, bool sendChangeEvent, ExceptionCode& ec) const
+void NumberInputType::setValueAsNumber(double newValue, TextFieldEventBehavior eventBehavior, ExceptionCode& ec) const
 {
     if (newValue < -numeric_limits<float>::max()) {
         ec = INVALID_STATE_ERR;
@@ -93,7 +93,7 @@ void NumberInputType::setValueAsNumber(double newValue, bool sendChangeEvent, Ex
         ec = INVALID_STATE_ERR;
         return;
     }
-    element()->setValue(serialize(newValue), sendChangeEvent);
+    element()->setValue(serialize(newValue), eventBehavior);
 }
 
 bool NumberInputType::typeMismatchFor(const String& value) const
diff --git a/Source/WebCore/html/NumberInputType.h b/Source/WebCore/html/NumberInputType.h
index 26e7986c3..1afef8a69 100644
--- a/Source/WebCore/html/NumberInputType.h
+++ b/Source/WebCore/html/NumberInputType.h
@@ -43,7 +43,7 @@ private:
     NumberInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual double valueAsNumber() const OVERRIDE;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const OVERRIDE;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
     virtual bool typeMismatchFor(const String&) const OVERRIDE;
     virtual bool typeMismatch() const OVERRIDE;
     virtual bool rangeUnderflow(const String&) const OVERRIDE;
diff --git a/Source/WebCore/html/RadioInputType.cpp b/Source/WebCore/html/RadioInputType.cpp
index d31cc2daf..cea0132e8 100644
--- a/Source/WebCore/html/RadioInputType.cpp
+++ b/Source/WebCore/html/RadioInputType.cpp
@@ -161,7 +161,7 @@ PassOwnPtr<ClickHandlingState> RadioInputType::willDispatchClick()
         element()->setIndeterminate(false);
 #endif
 
-    element()->setChecked(true, true);
+    element()->setChecked(true, DispatchChangeEvent);
 
     return state.release();
 }
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index acfe1cca5..a174ce7af 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -42,6 +42,7 @@
 #include "PlatformMouseEvent.h"
 #include "RenderSlider.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SliderThumbElement.h"
 #include "StepRange.h"
 #include <limits>
@@ -78,9 +79,9 @@ double RangeInputType::valueAsNumber() const
     return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
 }
 
-void RangeInputType::setValueAsNumber(double newValue, bool sendChangeEvent, ExceptionCode&) const
+void RangeInputType::setValueAsNumber(double newValue, TextFieldEventBehavior eventBehavior, ExceptionCode&) const
 {
-    element()->setValue(serialize(newValue), sendChangeEvent);
+    element()->setValue(serialize(newValue), eventBehavior);
 }
 
 bool RangeInputType::supportsRequired() const
@@ -157,7 +158,10 @@ void RangeInputType::handleMouseDownEvent(MouseEvent* event)
         return;
 
     Node* targetNode = event->target()->toNode();
-    if (event->button() != LeftButton || !targetNode || (targetNode != element() && !targetNode->isDescendantOf(element()->shadowRoot())))
+    if (event->button() != LeftButton || !targetNode)
+        return;
+    ASSERT(element()->hasShadowRoot());
+    if (targetNode != element() && !targetNode->isDescendantOf(element()->shadowRootList()->oldestShadowRoot()))
         return;
     SliderThumbElement* thumb = sliderThumbElementOf(element());
     if (targetNode == thumb)
@@ -220,8 +224,8 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
 
     if (newValue != current) {
         ExceptionCode ec;
-        bool sendChangeEvent = true;
-        setValueAsNumber(newValue, sendChangeEvent, ec);
+        TextFieldEventBehavior eventBehavior = DispatchChangeEvent;
+        setValueAsNumber(newValue, eventBehavior, ec);
 
         if (AXObjectCache::accessibilityEnabled())
             element()->document()->axObjectCache()->postNotification(element()->renderer(), AXObjectCache::AXValueChanged, true);
@@ -233,6 +237,8 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
 
 void RangeInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
+
     Document* document = element()->document();
     RefPtr<HTMLDivElement> track = HTMLDivElement::create(document);
     track->setShadowPseudoId("-webkit-slider-runnable-track");
@@ -241,7 +247,7 @@ void RangeInputType::createShadowSubtree()
     RefPtr<HTMLElement> container = SliderContainerElement::create(document);
     container->appendChild(track.release(), ec);
     container->appendChild(TrackLimiterElement::create(document), ec);
-    element()->ensureShadowRoot()->appendChild(container.release(), ec);
+    element()->shadowRootList()->oldestShadowRoot()->appendChild(container.release(), ec);
 }
 
 RenderObject* RangeInputType::createRenderer(RenderArena* arena, RenderStyle*) const
@@ -285,9 +291,9 @@ void RangeInputType::minOrMaxAttributeChanged()
     element()->setNeedsStyleRecalc();
 }
 
-void RangeInputType::setValue(const String& value, bool valueChanged, bool sendChangeEvent)
+void RangeInputType::setValue(const String& value, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    InputType::setValue(value, valueChanged, sendChangeEvent);
+    InputType::setValue(value, valueChanged, eventBehavior);
 
     if (!valueChanged)
         return;
diff --git a/Source/WebCore/html/RangeInputType.h b/Source/WebCore/html/RangeInputType.h
index e75193098..abf2ea674 100644
--- a/Source/WebCore/html/RangeInputType.h
+++ b/Source/WebCore/html/RangeInputType.h
@@ -46,7 +46,7 @@ private:
     virtual bool isRangeControl() const OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual double valueAsNumber() const OVERRIDE;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const OVERRIDE;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
     virtual bool supportsRequired() const OVERRIDE;
     virtual bool rangeUnderflow(const String&) const OVERRIDE;
     virtual bool rangeOverflow(const String&) const OVERRIDE;
@@ -66,7 +66,7 @@ private:
     virtual String serialize(double) const OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual void minOrMaxAttributeChanged() OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual String fallbackValue() const OVERRIDE;
     virtual String sanitizeValue(const String& proposedValue) const OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
index 3ec15bcde..d56f47d4e 100644
--- a/Source/WebCore/html/TextFieldInputType.cpp
+++ b/Source/WebCore/html/TextFieldInputType.cpp
@@ -43,6 +43,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "TextControlInnerElements.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
@@ -77,29 +78,51 @@ bool TextFieldInputType::canSetSuggestedValue()
     return true;
 }
 
-void TextFieldInputType::setValue(const String& sanitizedValue, bool valueChanged, bool sendChangeEvent)
+void TextFieldInputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    InputType::setValue(sanitizedValue, valueChanged, sendChangeEvent);
+    // Grab this input element to keep reference even if JS event handler
+    // changes input type.
+    RefPtr<HTMLInputElement> input(element());
+
+    // We don't ask InputType::setValue to dispatch events because
+    // TextFieldInputType dispatches events different way from InputType.
+    InputType::setValue(sanitizedValue, valueChanged, DispatchNoEvent);
 
     if (valueChanged)
-        element()->updateInnerTextValue();
+        input->updateInnerTextValue();
 
     unsigned max = visibleValue().length();
-    if (element()->focused())
-        element()->setSelectionRange(max, max);
+    if (input->focused())
+        input->setSelectionRange(max, max);
     else
-        element()->cacheSelectionInResponseToSetValue(max);
-}
+        input->cacheSelectionInResponseToSetValue(max);
 
-void TextFieldInputType::dispatchChangeEventInResponseToSetValue()
-{
-    // If the user is still editing this field, dispatch an input event rather than a change event.
-    // The change event will be dispatched when editing finishes.
-    if (element()->focused()) {
-        element()->dispatchFormControlInputEvent();
+    if (!valueChanged)
         return;
+
+    switch (eventBehavior) {
+    case DispatchChangeEvent:
+        // If the user is still editing this field, dispatch an input event rather than a change event.
+        // The change event will be dispatched when editing finishes.
+        if (input->focused())
+            input->dispatchFormControlInputEvent();
+        else
+            input->dispatchFormControlChangeEvent();
+        break;
+
+    case DispatchInputAndChangeEvent: {
+        input->dispatchFormControlInputEvent();
+        input->dispatchFormControlChangeEvent();
+        break;
     }
-    InputType::dispatchChangeEventInResponseToSetValue();
+
+    case DispatchNoEvent:
+        break;
+    }
+
+    // FIXME: Why do we do this when eventBehavior == DispatchNoEvent
+    if (!input->focused() || eventBehavior == DispatchNoEvent)
+        input->setTextAsOfLastFormControlChangeEvent(sanitizedValue);
 }
 
 void TextFieldInputType::handleKeydownEvent(KeyboardEvent* event)
@@ -189,6 +212,8 @@ bool TextFieldInputType::needsContainer() const
 
 void TextFieldInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
+
     ASSERT(!m_innerText);
     ASSERT(!m_innerBlock);
     ASSERT(!m_innerSpinButton);
@@ -201,11 +226,11 @@ void TextFieldInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     m_innerText = TextControlInnerTextElement::create(document);
     if (!createsContainer) {
-        element()->ensureShadowRoot()->appendChild(m_innerText, ec);
+        element()->shadowRootList()->oldestShadowRoot()->appendChild(m_innerText, ec);
         return;
     }
 
-    ShadowRoot* shadowRoot = element()->ensureShadowRoot();
+    ShadowRoot* shadowRoot = element()->shadowRootList()->oldestShadowRoot();
     m_container = HTMLDivElement::create(document);
     m_container->setShadowPseudoId("-webkit-textfield-decoration-container");
     shadowRoot->appendChild(m_container, ec);
@@ -367,7 +392,7 @@ void TextFieldInputType::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(element()->document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        element()->shadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
+        element()->shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/TextFieldInputType.h b/Source/WebCore/html/TextFieldInputType.h
index f94018bb0..d26e28a9b 100644
--- a/Source/WebCore/html/TextFieldInputType.h
+++ b/Source/WebCore/html/TextFieldInputType.h
@@ -73,8 +73,7 @@ private:
     virtual bool shouldSubmitImplicitly(Event*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
     virtual bool shouldUseInputMethod() const OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
-    virtual void dispatchChangeEventInResponseToSetValue() OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual String sanitizeValue(const String&) const OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
     virtual HTMLElement* placeholderElement() const OVERRIDE;
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index bc3c45489..7653951b0 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -44,6 +44,7 @@
 #include "RenderObject.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -119,14 +120,13 @@ static void adjustBubblePosition(const LayoutRect& hostRect, HTMLElement* bubble
         hostY -= containerLocation.y() + container->borderTop();
     }
 
-    StylePropertySet* style = bubble->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyTop, hostY + hostRect.height(), CSSPrimitiveValue::CSS_PX);
+    bubble->setInlineStyleProperty(CSSPropertyTop, hostY + hostRect.height(), CSSPrimitiveValue::CSS_PX);
     // The 'left' value of ::-webkit-validation-bubble-arrow.
     const int bubbleArrowTopOffset = 32;
     double bubbleX = hostX;
     if (hostRect.width() / 2 < bubbleArrowTopOffset)
         bubbleX = max(hostX + hostRect.width() / 2 - bubbleArrowTopOffset, 0.0);
-    style->setProperty(CSSPropertyLeft, bubbleX, CSSPrimitiveValue::CSS_PX);
+    bubble->setInlineStyleProperty(CSSPropertyLeft, bubbleX, CSSPrimitiveValue::CSS_PX);
 }
 
 void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
@@ -137,7 +137,7 @@ void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
     m_bubble->setShadowPseudoId("-webkit-validation-bubble");
     // Need to force position:absolute because RenderMenuList doesn't assume it
     // contains non-absolute or non-fixed renderers as children.
-    m_bubble->ensureInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueAbsolute);
+    m_bubble->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
     ExceptionCode ec = 0;
     host->ensureShadowRoot()->appendChild(m_bubble.get(), ec);
     ASSERT(!ec);
@@ -187,7 +187,7 @@ void ValidationMessage::deleteBubbleTree(Timer<ValidationMessage>*)
         m_messageBody = 0;
         HTMLElement* host = toHTMLElement(m_element);
         ExceptionCode ec;
-        host->shadowRoot()->removeChild(m_bubble.get(), ec);
+        host->shadowRootList()->oldestShadowRoot()->removeChild(m_bubble.get(), ec);
         m_bubble = 0;
     }
     m_message = String();
diff --git a/Source/WebCore/html/canvas/ArrayBufferView.idl b/Source/WebCore/html/canvas/ArrayBufferView.idl
index ed158bfae..0e934e6cb 100644
--- a/Source/WebCore/html/canvas/ArrayBufferView.idl
+++ b/Source/WebCore/html/canvas/ArrayBufferView.idl
@@ -25,7 +25,7 @@
 
 module html {
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables,
         OmitConstructor
     ] ArrayBufferView {
diff --git a/Source/WebCore/html/canvas/CanvasGradient.idl b/Source/WebCore/html/canvas/CanvasGradient.idl
index 75b19279b..496d4c1b1 100644
--- a/Source/WebCore/html/canvas/CanvasGradient.idl
+++ b/Source/WebCore/html/canvas/CanvasGradient.idl
@@ -27,8 +27,8 @@ module html {
 
     interface CanvasGradient {
 
-        void addColorStop(in [Optional=CallWithDefaultValue] float offset, 
-                          in [Optional=CallWithDefaultValue] DOMString color)
+        void addColorStop(in [Optional=DefaultIsUndefined] float offset, 
+                          in [Optional=DefaultIsUndefined] DOMString color)
             raises (DOMException);
 
     };
diff --git a/Source/WebCore/html/canvas/CanvasPixelArray.idl b/Source/WebCore/html/canvas/CanvasPixelArray.idl
index a12c8ce9b..8c0836b09 100644
--- a/Source/WebCore/html/canvas/CanvasPixelArray.idl
+++ b/Source/WebCore/html/canvas/CanvasPixelArray.idl
@@ -31,7 +31,8 @@ module html {
     interface [
         OmitConstructor,
         NumericIndexedGetter,
-        CustomIndexedSetter
+        CustomIndexedSetter,
+        V8CustomToJSObject
     ] CanvasPixelArray {
 #if !defined(V8_BINDING) || !V8_BINDING
         readonly attribute long length;
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext.h b/Source/WebCore/html/canvas/CanvasRenderingContext.h
index 53278788d..124729cbe 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext.h
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext.h
@@ -55,7 +55,6 @@ public:
     virtual bool isAccelerated() const { return false; }
 
     virtual void paintRenderingResultsToCanvas() {}
-    virtual bool paintsIntoCanvasBuffer() const { return true; }
 
 #if USE(ACCELERATED_COMPOSITING)
     virtual PlatformLayer* platformLayer() const { return 0; }
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext.idl b/Source/WebCore/html/canvas/CanvasRenderingContext.idl
index acdd0b75c..b9373931f 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext.idl
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext.idl
@@ -28,7 +28,7 @@ module html {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
-        JSCustomToJS
+        JSCustomToJSObject
     ] CanvasRenderingContext {
 
         readonly attribute HTMLCanvasElement canvas;
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index b0e053ff3..0d195ac50 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -155,20 +155,6 @@ bool CanvasRenderingContext2D::isAccelerated() const
 #endif
 }
 
-bool CanvasRenderingContext2D::paintsIntoCanvasBuffer() const
-{
-#if ENABLE(ACCELERATED_2D_CANVAS) && USE(ACCELERATED_COMPOSITING)
-    if (!isAccelerated())
-        return true;
-
-    RenderBox* renderBox = canvas()->renderBox();
-    if (renderBox && renderBox->hasLayer() && renderBox->layer()->hasAcceleratedCompositing())
-        return false;
-#endif
-    return true;
-}
-
-
 void CanvasRenderingContext2D::reset()
 {
     unwindStateStack();
@@ -669,9 +655,8 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     AffineTransform ctm = state().m_transform;
     if (!ctm.isInvertible())
         return;
-    c->concatCTM(c->getCTM().inverse());
-    c->concatCTM(canvas()->baseTransform());
-    state().m_transform = ctm.inverse() * state().m_transform;
+    c->setCTM(canvas()->baseTransform());
+    state().m_transform = AffineTransform();
     m_path.transform(ctm);
 
     state().m_invertibleCTM = true;
@@ -1920,7 +1905,7 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
 
     String declarationText("font: ");
     declarationText += newFont;
-    parser.parseDeclaration(tempDecl.get(), declarationText);
+    parser.parseDeclaration(tempDecl.get(), declarationText, 0, 0);
     if (tempDecl->isEmpty())
         return;
 
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
index 1f481b755..5581ee9d5 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -67,7 +67,6 @@ public:
 
     virtual bool is2d() const { return true; }
     virtual bool isAccelerated() const;
-    virtual bool paintsIntoCanvasBuffer() const;
 
     CanvasStyle* strokeStyle() const;
     void setStrokeStyle(PassRefPtr<CanvasStyle>);
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl b/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
index d4560f7a0..cec5ce7bb 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -30,38 +30,38 @@ module html {
         void save();
         void restore();
 
-        void scale(in [Optional=CallWithDefaultValue] float sx,
-                   in [Optional=CallWithDefaultValue] float sy);
-        void rotate(in [Optional=CallWithDefaultValue] float angle);
-        void translate(in [Optional=CallWithDefaultValue] float tx,
-                       in [Optional=CallWithDefaultValue] float ty);
-        void transform(in [Optional=CallWithDefaultValue] float m11,
-                       in [Optional=CallWithDefaultValue] float m12,
-                       in [Optional=CallWithDefaultValue] float m21,
-                       in [Optional=CallWithDefaultValue] float m22,
-                       in [Optional=CallWithDefaultValue] float dx,
-                       in [Optional=CallWithDefaultValue] float dy);
-        void setTransform(in [Optional=CallWithDefaultValue] float m11,
-                          in [Optional=CallWithDefaultValue] float m12,
-                          in [Optional=CallWithDefaultValue] float m21,
-                          in [Optional=CallWithDefaultValue] float m22,
-                          in [Optional=CallWithDefaultValue] float dx,
-                          in [Optional=CallWithDefaultValue] float dy);
+        void scale(in [Optional=DefaultIsUndefined] float sx,
+                   in [Optional=DefaultIsUndefined] float sy);
+        void rotate(in [Optional=DefaultIsUndefined] float angle);
+        void translate(in [Optional=DefaultIsUndefined] float tx,
+                       in [Optional=DefaultIsUndefined] float ty);
+        void transform(in [Optional=DefaultIsUndefined] float m11,
+                       in [Optional=DefaultIsUndefined] float m12,
+                       in [Optional=DefaultIsUndefined] float m21,
+                       in [Optional=DefaultIsUndefined] float m22,
+                       in [Optional=DefaultIsUndefined] float dx,
+                       in [Optional=DefaultIsUndefined] float dy);
+        void setTransform(in [Optional=DefaultIsUndefined] float m11,
+                          in [Optional=DefaultIsUndefined] float m12,
+                          in [Optional=DefaultIsUndefined] float m21,
+                          in [Optional=DefaultIsUndefined] float m22,
+                          in [Optional=DefaultIsUndefined] float dx,
+                          in [Optional=DefaultIsUndefined] float dy);
 
         attribute float globalAlpha;
         attribute [TreatNullAs=NullString] DOMString globalCompositeOperation;
 
-        CanvasGradient createLinearGradient(in [Optional=CallWithDefaultValue] float x0,
-                                            in [Optional=CallWithDefaultValue] float y0,
-                                            in [Optional=CallWithDefaultValue] float x1,
-                                            in [Optional=CallWithDefaultValue] float y1)
+        CanvasGradient createLinearGradient(in [Optional=DefaultIsUndefined] float x0,
+                                            in [Optional=DefaultIsUndefined] float y0,
+                                            in [Optional=DefaultIsUndefined] float x1,
+                                            in [Optional=DefaultIsUndefined] float y1)
             raises (DOMException);
-        CanvasGradient createRadialGradient(in [Optional=CallWithDefaultValue] float x0,
-                                            in [Optional=CallWithDefaultValue] float y0,
-                                            in [Optional=CallWithDefaultValue] float r0,
-                                            in [Optional=CallWithDefaultValue] float x1,
-                                            in [Optional=CallWithDefaultValue] float y1,
-                                            in [Optional=CallWithDefaultValue] float r1)
+        CanvasGradient createRadialGradient(in [Optional=DefaultIsUndefined] float x0,
+                                            in [Optional=DefaultIsUndefined] float y0,
+                                            in [Optional=DefaultIsUndefined] float r0,
+                                            in [Optional=DefaultIsUndefined] float x1,
+                                            in [Optional=DefaultIsUndefined] float y1,
+                                            in [Optional=DefaultIsUndefined] float r1)
             raises (DOMException);
 
         attribute float lineWidth;
@@ -80,71 +80,71 @@ module html {
         attribute float webkitLineDashOffset;
 #endif
 
-        void clearRect(in [Optional=CallWithDefaultValue] float x,
-                       in [Optional=CallWithDefaultValue] float y,
-                       in [Optional=CallWithDefaultValue] float width,
-                       in [Optional=CallWithDefaultValue] float height);
-        void fillRect(in [Optional=CallWithDefaultValue] float x,
-                      in [Optional=CallWithDefaultValue] float y,
-                      in [Optional=CallWithDefaultValue] float width,
-                      in [Optional=CallWithDefaultValue] float height);
+        void clearRect(in [Optional=DefaultIsUndefined] float x,
+                       in [Optional=DefaultIsUndefined] float y,
+                       in [Optional=DefaultIsUndefined] float width,
+                       in [Optional=DefaultIsUndefined] float height);
+        void fillRect(in [Optional=DefaultIsUndefined] float x,
+                      in [Optional=DefaultIsUndefined] float y,
+                      in [Optional=DefaultIsUndefined] float width,
+                      in [Optional=DefaultIsUndefined] float height);
 
         void beginPath();
         void closePath();
-        void moveTo(in [Optional=CallWithDefaultValue] float x,
-                    in [Optional=CallWithDefaultValue] float y);
-        void lineTo(in [Optional=CallWithDefaultValue] float x,
-                    in [Optional=CallWithDefaultValue] float y);
-        void quadraticCurveTo(in [Optional=CallWithDefaultValue] float cpx,
-                              in [Optional=CallWithDefaultValue] float cpy,
-                              in [Optional=CallWithDefaultValue] float x,
-                              in [Optional=CallWithDefaultValue] float y);
-        void bezierCurveTo(in [Optional=CallWithDefaultValue] float cp1x,
-                           in [Optional=CallWithDefaultValue] float cp1y,
-                           in [Optional=CallWithDefaultValue] float cp2x,
-                           in [Optional=CallWithDefaultValue] float cp2y,
-                           in [Optional=CallWithDefaultValue] float x,
-                           in [Optional=CallWithDefaultValue] float y);
-        void arcTo(in [Optional=CallWithDefaultValue] float x1,
-                   in [Optional=CallWithDefaultValue] float y1,
-                   in [Optional=CallWithDefaultValue] float x2,
-                   in [Optional=CallWithDefaultValue] float y2,
-                   in [Optional=CallWithDefaultValue] float radius)
-            raises (DOMException);
-        void rect(in [Optional=CallWithDefaultValue] float x,
-                  in [Optional=CallWithDefaultValue] float y,
-                  in [Optional=CallWithDefaultValue] float width,
-                  in [Optional=CallWithDefaultValue] float height);
-        void arc(in [Optional=CallWithDefaultValue] float x,
-                 in [Optional=CallWithDefaultValue] float y,
-                 in [Optional=CallWithDefaultValue] float radius,
-                 in [Optional=CallWithDefaultValue] float startAngle,
-                 in [Optional=CallWithDefaultValue] float endAngle,
-                 in [Optional=CallWithDefaultValue] boolean anticlockwise)
+        void moveTo(in [Optional=DefaultIsUndefined] float x,
+                    in [Optional=DefaultIsUndefined] float y);
+        void lineTo(in [Optional=DefaultIsUndefined] float x,
+                    in [Optional=DefaultIsUndefined] float y);
+        void quadraticCurveTo(in [Optional=DefaultIsUndefined] float cpx,
+                              in [Optional=DefaultIsUndefined] float cpy,
+                              in [Optional=DefaultIsUndefined] float x,
+                              in [Optional=DefaultIsUndefined] float y);
+        void bezierCurveTo(in [Optional=DefaultIsUndefined] float cp1x,
+                           in [Optional=DefaultIsUndefined] float cp1y,
+                           in [Optional=DefaultIsUndefined] float cp2x,
+                           in [Optional=DefaultIsUndefined] float cp2y,
+                           in [Optional=DefaultIsUndefined] float x,
+                           in [Optional=DefaultIsUndefined] float y);
+        void arcTo(in [Optional=DefaultIsUndefined] float x1,
+                   in [Optional=DefaultIsUndefined] float y1,
+                   in [Optional=DefaultIsUndefined] float x2,
+                   in [Optional=DefaultIsUndefined] float y2,
+                   in [Optional=DefaultIsUndefined] float radius)
+            raises (DOMException);
+        void rect(in [Optional=DefaultIsUndefined] float x,
+                  in [Optional=DefaultIsUndefined] float y,
+                  in [Optional=DefaultIsUndefined] float width,
+                  in [Optional=DefaultIsUndefined] float height);
+        void arc(in [Optional=DefaultIsUndefined] float x,
+                 in [Optional=DefaultIsUndefined] float y,
+                 in [Optional=DefaultIsUndefined] float radius,
+                 in [Optional=DefaultIsUndefined] float startAngle,
+                 in [Optional=DefaultIsUndefined] float endAngle,
+                 in [Optional=DefaultIsUndefined] boolean anticlockwise)
             raises (DOMException);
         void fill();
         void stroke();
         void clip();
-        boolean isPointInPath(in [Optional=CallWithDefaultValue] float x,
-                              in [Optional=CallWithDefaultValue] float y);
+        boolean isPointInPath(in [Optional=DefaultIsUndefined] float x,
+                              in [Optional=DefaultIsUndefined] float y);
 
         // text
         attribute DOMString font;
         attribute DOMString textAlign;
         attribute DOMString textBaseline;
 
-        TextMetrics measureText(in [Optional=CallWithDefaultValue] DOMString text);
+        TextMetrics measureText(in [Optional=DefaultIsUndefined] DOMString text);
 
         // other
 
-        void setAlpha(in [Optional=CallWithDefaultValue] float alpha);
-        void setCompositeOperation(in [Optional=CallWithDefaultValue] DOMString compositeOperation);
+        void setAlpha(in [Optional=DefaultIsUndefined] float alpha);
+        void setCompositeOperation(in [Optional=DefaultIsUndefined] DOMString compositeOperation);
 
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        void setLineWidth(in [Optional=CallWithDefaultValue] float width);
-        void setLineCap(in [Optional=CallWithDefaultValue] DOMString cap);
-        void setLineJoin(in [Optional=CallWithDefaultValue] DOMString join);
-        void setMiterLimit(in [Optional=CallWithDefaultValue] float limit);
+        void setLineWidth(in [Optional=DefaultIsUndefined] float width);
+        void setLineCap(in [Optional=DefaultIsUndefined] DOMString cap);
+        void setLineJoin(in [Optional=DefaultIsUndefined] DOMString join);
+        void setMiterLimit(in [Optional=DefaultIsUndefined] float limit);
 #endif
 
         void clearShadow();
@@ -162,10 +162,10 @@ module html {
         void setFillColor(in float r, in float g, in float b, in float a);
         void setFillColor(in float c, in float m, in float y, in float k, in float a);
 
-        void strokeRect(in [Optional=CallWithDefaultValue] float x,
-                        in [Optional=CallWithDefaultValue] float y,
-                        in [Optional=CallWithDefaultValue] float width,
-                        in [Optional=CallWithDefaultValue] float height,
+        void strokeRect(in [Optional=DefaultIsUndefined] float x,
+                        in [Optional=DefaultIsUndefined] float y,
+                        in [Optional=DefaultIsUndefined] float width,
+                        in [Optional=DefaultIsUndefined] float height,
                         in [Optional] float lineWidth);
 
         void drawImage(in HTMLImageElement image, in float x, in float y)
@@ -217,8 +217,8 @@ module html {
         attribute [Custom] custom fillStyle;
 
         // pixel manipulation
-        ImageData getImageData(in [Optional=CallWithDefaultValue] float sx, in [Optional=CallWithDefaultValue] float sy,
-                               in [Optional=CallWithDefaultValue] float sw, in [Optional=CallWithDefaultValue] float sh)
+        ImageData getImageData(in [Optional=DefaultIsUndefined] float sx, in [Optional=DefaultIsUndefined] float sy,
+                               in [Optional=DefaultIsUndefined] float sw, in [Optional=DefaultIsUndefined] float sh)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/html/canvas/DOMWindowWebGL.idl b/Source/WebCore/html/canvas/DOMWindowWebGL.idl
new file mode 100644
index 000000000..92056d3da
--- /dev/null
+++ b/Source/WebCore/html/canvas/DOMWindowWebGL.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=WEBGL,
+        Supplemental=DOMWindow
+    ] DOMWindowWebGL {
+        attribute WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute WebGLBufferConstructor WebGLBuffer;
+        attribute WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute WebGLProgramConstructor WebGLProgram;
+        attribute WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute WebGLShaderConstructor WebGLShader;
+        attribute WebGLTextureConstructor WebGLTexture;
+        attribute WebGLUniformLocationConstructor WebGLUniformLocation;
+    };
+
+}
diff --git a/Source/WebCore/html/canvas/DataView.idl b/Source/WebCore/html/canvas/DataView.idl
index 9530220dc..27bad0e47 100755
--- a/Source/WebCore/html/canvas/DataView.idl
+++ b/Source/WebCore/html/canvas/DataView.idl
@@ -27,7 +27,7 @@ module html {
 
     interface [
         CustomConstructor,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] DataView : ArrayBufferView {
         // All these methods raise an exception if they would read or write beyond the end of the view.
diff --git a/Source/WebCore/html/canvas/Float32Array.idl b/Source/WebCore/html/canvas/Float32Array.idl
index 785ed819c..5e619a7ea 100644
--- a/Source/WebCore/html/canvas/Float32Array.idl
+++ b/Source/WebCore/html/canvas/Float32Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Float32Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Float32Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Float32Array subarray(in [Optional=DefaultIsUndefined] long start, 
                               in [Optional] long end);
 
         // void set(in Float32Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Float64Array.idl b/Source/WebCore/html/canvas/Float64Array.idl
index 7180811fa..f4c448a45 100644
--- a/Source/WebCore/html/canvas/Float64Array.idl
+++ b/Source/WebCore/html/canvas/Float64Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Float64Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 8;
 
         readonly attribute unsigned long length;
-        Float64Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Float64Array subarray(in [Optional=DefaultIsUndefined] long start, 
                               in [Optional] long end);
 
         // void set(in Float64Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int16Array.idl b/Source/WebCore/html/canvas/Int16Array.idl
index 40e18d530..b7ddc1e7c 100644
--- a/Source/WebCore/html/canvas/Int16Array.idl
+++ b/Source/WebCore/html/canvas/Int16Array.idl
@@ -30,13 +30,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Int16Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 2;
 
         readonly attribute unsigned long length;
-        Int16Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Int16Array subarray(in [Optional=DefaultIsUndefined] long start, 
                             in [Optional] long end);
 
         // void set(in Int16Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int32Array.idl b/Source/WebCore/html/canvas/Int32Array.idl
index 0f5320ac4..950437aec 100644
--- a/Source/WebCore/html/canvas/Int32Array.idl
+++ b/Source/WebCore/html/canvas/Int32Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Int32Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Int32Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Int32Array subarray(in [Optional=DefaultIsUndefined] long start, 
                             in [Optional] long end);
 
         // void set(in Int32Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int8Array.idl b/Source/WebCore/html/canvas/Int8Array.idl
index 9984ada66..da0c8f166 100644
--- a/Source/WebCore/html/canvas/Int8Array.idl
+++ b/Source/WebCore/html/canvas/Int8Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Int8Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Int8Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Int8Array subarray(in [Optional=DefaultIsUndefined] long start, 
                            in [Optional] long end);
 
         // void set(in Int8Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/OESVertexArrayObject.idl b/Source/WebCore/html/canvas/OESVertexArrayObject.idl
index c4adf99d8..c3d366676 100644
--- a/Source/WebCore/html/canvas/OESVertexArrayObject.idl
+++ b/Source/WebCore/html/canvas/OESVertexArrayObject.idl
@@ -33,8 +33,8 @@ module html {
         const unsigned int VERTEX_ARRAY_BINDING_OES = 0x85B5;
         
         [StrictTypeChecking] WebGLVertexArrayObjectOES createVertexArrayOES();
-        [StrictTypeChecking] void         deleteVertexArrayOES(in [Optional=CallWithDefaultValue] WebGLVertexArrayObjectOES arrayObject);
-        [StrictTypeChecking] boolean      isVertexArrayOES(in [Optional=CallWithDefaultValue] WebGLVertexArrayObjectOES arrayObject);
-        [StrictTypeChecking] void         bindVertexArrayOES(in [Optional=CallWithDefaultValue] WebGLVertexArrayObjectOES arrayObject) raises(DOMException);
+        [StrictTypeChecking] void         deleteVertexArrayOES(in [Optional=DefaultIsUndefined] WebGLVertexArrayObjectOES arrayObject);
+        [StrictTypeChecking] boolean      isVertexArrayOES(in [Optional=DefaultIsUndefined] WebGLVertexArrayObjectOES arrayObject);
+        [StrictTypeChecking] void         bindVertexArrayOES(in [Optional=DefaultIsUndefined] WebGLVertexArrayObjectOES arrayObject) raises(DOMException);
     };
 }
diff --git a/Source/WebCore/html/canvas/Uint16Array.idl b/Source/WebCore/html/canvas/Uint16Array.idl
index 83877b582..33627bfce 100644
--- a/Source/WebCore/html/canvas/Uint16Array.idl
+++ b/Source/WebCore/html/canvas/Uint16Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint16Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 2;
 
         readonly attribute unsigned long length;
-        Uint16Array subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint16Array subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // void set(in Uint16Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint32Array.idl b/Source/WebCore/html/canvas/Uint32Array.idl
index 2726473cb..7bb4ca39b 100644
--- a/Source/WebCore/html/canvas/Uint32Array.idl
+++ b/Source/WebCore/html/canvas/Uint32Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint32Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Uint32Array subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint32Array subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // void set(in Uint32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint8Array.idl b/Source/WebCore/html/canvas/Uint8Array.idl
index 4892da8a8..fbbafc320 100644
--- a/Source/WebCore/html/canvas/Uint8Array.idl
+++ b/Source/WebCore/html/canvas/Uint8Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint8Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Uint8Array subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint8Array subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // void set(in Uint8Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint8ClampedArray.idl b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
index a9a49f362..fd006e455 100644
--- a/Source/WebCore/html/canvas/Uint8ClampedArray.idl
+++ b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint8ClampedArray : Uint8Array {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Uint8ClampedArray subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint8ClampedArray subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // FIXME: Missing other setters!
         // void set(in Uint8ClampedArray array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/WebGLDebugShaders.idl b/Source/WebCore/html/canvas/WebGLDebugShaders.idl
index 82d047550..ee330b6ae 100644
--- a/Source/WebCore/html/canvas/WebGLDebugShaders.idl
+++ b/Source/WebCore/html/canvas/WebGLDebugShaders.idl
@@ -29,6 +29,6 @@ module html {
         JSGenerateIsReachable=ImplContext,
         OmitConstructor
     ] WebGLDebugShaders {
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString getTranslatedShaderSource(in WebGLShader shader) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString getTranslatedShaderSource(in WebGLShader shader) raises(DOMException);
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index 9a5a295b5..cfb6505a9 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -719,11 +719,6 @@ PassRefPtr<ImageData> WebGLRenderingContext::paintRenderingResultsToImageData()
     return imageData;
 }
 
-bool WebGLRenderingContext::paintsIntoCanvasBuffer() const
-{
-    return m_context->paintsIntoCanvasBuffer();
-}
-
 void WebGLRenderingContext::reshape(int width, int height)
 {
     // This is an approximation because at WebGLRenderingContext level we don't
@@ -4890,7 +4885,21 @@ bool WebGLRenderingContext::validateStencilFunc(const char* functionName, GC3Den
 
 void WebGLRenderingContext::printWarningToConsole(const String& message)
 {
-    canvas()->document()->frame()->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, canvas()->document()->url().string());
+    if (!canvas())
+        return;
+    Document* document = canvas()->document();
+    if (!document)
+        return;
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+    DOMWindow* window = frame->domWindow();
+    if (!window)
+        return;
+    Console* console = window->console();
+    if (!console)
+        return;
+    console->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, document->url().string());
 }
 
 bool WebGLRenderingContext::validateFramebufferFuncParameters(const char* functionName, GC3Denum target, GC3Denum attachment)
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index 0449eade1..be9c8cf3c 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -77,7 +77,6 @@ public:
 
     virtual bool is3d() const { return true; }
     virtual bool isAccelerated() const { return true; }
-    virtual bool paintsIntoCanvasBuffer() const;
 
     int drawingBufferWidth() const;
     int drawingBufferHeight() const;
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.idl b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
index 6db811dd8..3aed43643 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.idl
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -542,18 +542,18 @@ module html {
         [StrictTypeChecking, Custom] void getParameter();
         // any getProgramParameter(in WebGLProgram program, in unsigned long pname) raises(DOMException);
         [StrictTypeChecking, Custom] void getProgramParameter();
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString getProgramInfoLog(in WebGLProgram program) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString getProgramInfoLog(in WebGLProgram program) raises(DOMException);
         // any getRenderbufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
         [StrictTypeChecking, Custom] void getRenderbufferParameter();
         // any getShaderParameter(in WebGLShader shader, in unsigned long pname) raises(DOMException);
         [StrictTypeChecking, Custom] void getShaderParameter() raises(DOMException);
 
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString    getShaderInfoLog(in WebGLShader shader) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString    getShaderInfoLog(in WebGLShader shader) raises(DOMException);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
 
         // DOMString[] getSupportedExtensions()
         [StrictTypeChecking, Custom] void getSupportedExtensions();
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index 98885743e..9cc3a0316 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -53,7 +53,6 @@ inline bool isNumberedHeaderElement(ContainerNode* node)
 inline bool isRootNode(ContainerNode* node)
 {
     return node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE
-        || node->nodeType() == Node::SHADOW_ROOT_NODE
         || node->hasTagName(htmlTag);
 }
 
@@ -310,7 +309,7 @@ void HTMLElementStack::popUntilForeignContentScopeMarker()
     
 void HTMLElementStack::pushRootNode(PassRefPtr<ContainerNode> rootNode)
 {
-    ASSERT(rootNode->nodeType() == Node::DOCUMENT_FRAGMENT_NODE || rootNode->nodeType() == Node::SHADOW_ROOT_NODE);
+    ASSERT(rootNode->nodeType() == Node::DOCUMENT_FRAGMENT_NODE);
     pushRootNodeCommon(rootNode);
 }
 
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index f604f82c7..5697e80c8 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -180,8 +180,7 @@ inline bool isInHTMLNamespace(Node* node)
     // A DocumentFragment takes the place of the document element when parsing
     // fragments and should be considered in the HTML namespace.
     return node->namespaceURI() == HTMLNames::xhtmlNamespaceURI
-        || node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE
-        || node->nodeType() == Node::SHADOW_ROOT_NODE; // FIXME: Does this also apply to ShadowRoot?
+        || node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE; // FIXME: Does this also apply to ShadowRoot?
 }
 
 
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 9d839120d..3b5414913 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -586,10 +586,8 @@ void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken& token)
     notImplemented(); // Acknowledge self-closing flag
     processFakeStartTag(formTag);
     RefPtr<Attribute> actionAttribute = token.getAttributeItem(actionAttr);
-    if (actionAttribute) {
-        ASSERT(m_tree.currentElement()->hasTagName(formTag));
-        m_tree.currentElement()->setAttribute(actionAttr, actionAttribute->value());
-    }
+    if (actionAttribute)
+        m_tree.form()->setAttribute(actionAttr, actionAttribute->value());
     processFakeStartTag(hrTag);
     processFakeStartTag(labelTag);
     RefPtr<Attribute> promptAttribute = token.getAttributeItem(promptAttr);
diff --git a/Source/WebCore/html/parser/XSSAuditor.cpp b/Source/WebCore/html/parser/XSSAuditor.cpp
index 138a67118..8fde1a5d7 100644
--- a/Source/WebCore/html/parser/XSSAuditor.cpp
+++ b/Source/WebCore/html/parser/XSSAuditor.cpp
@@ -36,6 +36,7 @@
 #include "FrameLoaderClient.h"
 #include "HTMLDocumentParser.h"
 #include "HTMLNames.h"
+#include "HTMLTokenizer.h"
 #include "HTMLParamElement.h"
 #include "HTMLParserIdioms.h"
 #include "SecurityOrigin.h"
@@ -54,7 +55,7 @@ static bool isNonCanonicalCharacter(UChar c)
     // We remove all non-ASCII characters, including non-printable ASCII characters.
     //
     // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
-    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
+    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the
     // adverse effect that we remove any legitimate zeros from a string.
     //
     // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
@@ -71,7 +72,7 @@ static bool isRequiredForInjection(UChar c)
     return (c == '\'' || c == '"' || c == '<' || c == '>');
 }
 
-static bool isTerminatingCharacter(UChar c) 
+static bool isTerminatingCharacter(UChar c)
 {
     return (c == '&' || c == '/' || c == '"' || c == '\'' || c == '<');
 }
@@ -81,26 +82,21 @@ static bool isHTMLQuote(UChar c)
     return (c == '"' || c == '\'');
 }
 
-static bool isHTMLNewline(UChar c)
+static bool isJSNewline(UChar c)
 {
-    return (c == '\n' || c == '\r');
+    // Per ecma-262 section 7.3 Line Terminators.
+    return (c == '\n' || c == '\r' || c == 0x2028 || c == 0x2029);
 }
 
-static bool startsHTMLEndTagAt(const String& string, size_t start)
-{
-    return (start + 1 < string.length() && string[start] == '<' && string[start+1] == '/');
-}    
-
-
 static bool startsHTMLCommentAt(const String& string, size_t start)
 {
     return (start + 3 < string.length() && string[start] == '<' && string[start+1] == '!' && string[start+2] == '-' && string[start+3] == '-');
-}    
+}
 
 static bool startsSingleLineCommentAt(const String& string, size_t start)
 {
     return (start + 1 < string.length() && string[start] == '/' && string[start+1] == '/');
-}    
+}
 
 static bool startsMultiLineCommentAt(const String& string, size_t start)
 {
@@ -137,23 +133,6 @@ static bool isDangerousHTTPEquiv(const String& value)
     return equalIgnoringCase(equiv, "refresh") || equalIgnoringCase(equiv, "set-cookie");
 }
 
-static bool containsJavaScriptURL(const Vector<UChar, 32>& value)
-{
-    static const char javaScriptScheme[] = "javascript:";
-    static const size_t lengthOfJavaScriptScheme = sizeof(javaScriptScheme) - 1;
-
-    size_t i;
-    for (i = 0; i < value.size(); ++i) {
-        if (!isHTMLSpace(value[i]))
-            break;
-    }
-
-    if (value.size() - i < lengthOfJavaScriptScheme)
-        return false;
-
-    return equalIgnoringCase(value.data() + i, javaScriptScheme, lengthOfJavaScriptScheme);
-}
-
 static inline String decode16BitUnicodeEscapeSequences(const String& string)
 {
     // Note, the encoding is ignored since each %u-escape sequence represents a UTF-16 code unit.
@@ -176,7 +155,6 @@ static String fullyDecodeString(const String& string, const TextResourceDecoder*
         oldWorkingStringLength = workingString.length();
         workingString = decode16BitUnicodeEscapeSequences(decodeStandardURLEscapeSequences(workingString, encoding));
     } while (workingString.length() < oldWorkingStringLength);
-    ASSERT(!workingString.isEmpty());
     workingString.replace('+', ' ');
     workingString = canonicalize(workingString);
     return workingString;
@@ -187,6 +165,8 @@ XSSAuditor::XSSAuditor(HTMLDocumentParser* parser)
     , m_isEnabled(false)
     , m_xssProtection(XSSProtectionEnabled)
     , m_state(Uninitialized)
+    , m_shouldAllowCDATA(false)
+    , m_scriptTagNestingLevel(0)
     , m_notifiedClient(false)
 {
     ASSERT(m_parser);
@@ -204,7 +184,7 @@ void XSSAuditor::init()
     const int suffixTreeDepth = 5;
 
     ASSERT(m_state == Uninitialized);
-    m_state = Initial;
+    m_state = Initialized;
 
     if (!m_isEnabled)
         return;
@@ -257,28 +237,21 @@ void XSSAuditor::init()
 
 void XSSAuditor::filterToken(HTMLToken& token)
 {
-    if (m_state == Uninitialized) {
+    if (m_state == Uninitialized)
         init();
-        ASSERT(m_state == Initial);
-    }
-
+   
+    ASSERT(m_state == Initialized);
     if (!m_isEnabled || m_xssProtection == XSSProtectionDisabled)
         return;
 
     bool didBlockScript = false;
-
-    switch (m_state) {
-    case Uninitialized:
-        ASSERT_NOT_REACHED();
-        break;
-    case Initial:
-        didBlockScript = filterTokenInitial(token);
-        break;
-    case AfterScriptStartTag:
-        didBlockScript = filterTokenAfterScriptStartTag(token);
-        ASSERT(m_state == Initial);
-        m_cachedSnippet = String();
-        break;
+    if (token.type() == HTMLTokenTypes::StartTag)
+        didBlockScript = filterStartToken(token);
+    else if (m_scriptTagNestingLevel) {
+        if (token.type() == HTMLTokenTypes::Character)
+            didBlockScript = filterCharacterToken(token);
+        else if (token.type() == HTMLTokenTypes::EndTag)
+            filterEndToken(token);
     }
 
     if (didBlockScript) {
@@ -300,18 +273,15 @@ void XSSAuditor::filterToken(HTMLToken& token)
     }
 }
 
-bool XSSAuditor::filterTokenInitial(HTMLToken& token)
+bool XSSAuditor::filterStartToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
-
-    if (token.type() != HTMLTokenTypes::StartTag)
-        return false;
-
     bool didBlockScript = eraseDangerousAttributesIfInjected(token);
 
-    if (hasName(token, scriptTag))
+    if (hasName(token, scriptTag)) {
         didBlockScript |= filterScriptToken(token);
-    else if (hasName(token, objectTag))
+        ASSERT(m_shouldAllowCDATA || !m_scriptTagNestingLevel);
+        m_scriptTagNestingLevel++;
+    } else if (hasName(token, objectTag))
         didBlockScript |= filterObjectToken(token);
     else if (hasName(token, paramTag))
         didBlockScript |= filterParamToken(token);
@@ -331,16 +301,18 @@ bool XSSAuditor::filterTokenInitial(HTMLToken& token)
     return didBlockScript;
 }
 
-bool XSSAuditor::filterTokenAfterScriptStartTag(HTMLToken& token)
+void XSSAuditor::filterEndToken(HTMLToken& token)
 {
-    ASSERT(m_state == AfterScriptStartTag);
-    m_state = Initial;
-
-    if (token.type() != HTMLTokenTypes::Character) {
-        ASSERT(token.type() == HTMLTokenTypes::EndTag || token.type() == HTMLTokenTypes::EndOfFile);
-        return false;
+    ASSERT(m_scriptTagNestingLevel);
+    if (hasName(token, scriptTag)) {
+        m_scriptTagNestingLevel--;
+        ASSERT(m_shouldAllowCDATA || !m_scriptTagNestingLevel);
     }
+}
 
+bool XSSAuditor::filterCharacterToken(HTMLToken& token)
+{
+    ASSERT(m_scriptTagNestingLevel);
     TextResourceDecoder* decoder = m_parser->document()->decoder();
     if (isContainedInRequest(fullyDecodeString(m_cachedSnippet, decoder))) {
         int start = 0;
@@ -357,21 +329,19 @@ bool XSSAuditor::filterTokenAfterScriptStartTag(HTMLToken& token)
 
 bool XSSAuditor::filterScriptToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, scriptTag));
 
     if (eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute))
         return true;
 
-    m_state = AfterScriptStartTag;
     m_cachedSnippet = m_parser->sourceForToken(token);
+    m_shouldAllowCDATA = m_parser->tokenizer()->shouldAllowCDATA();
     return false;
 }
 
 bool XSSAuditor::filterObjectToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, objectTag));
 
@@ -386,7 +356,6 @@ bool XSSAuditor::filterObjectToken(HTMLToken& token)
 
 bool XSSAuditor::filterParamToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, paramTag));
 
@@ -405,7 +374,6 @@ bool XSSAuditor::filterParamToken(HTMLToken& token)
 
 bool XSSAuditor::filterEmbedToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, embedTag));
 
@@ -420,7 +388,6 @@ bool XSSAuditor::filterEmbedToken(HTMLToken& token)
 
 bool XSSAuditor::filterAppletToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, appletTag));
 
@@ -434,7 +401,6 @@ bool XSSAuditor::filterAppletToken(HTMLToken& token)
 
 bool XSSAuditor::filterIframeToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, iframeTag));
 
@@ -443,7 +409,6 @@ bool XSSAuditor::filterIframeToken(HTMLToken& token)
 
 bool XSSAuditor::filterMetaToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, metaTag));
 
@@ -452,7 +417,6 @@ bool XSSAuditor::filterMetaToken(HTMLToken& token)
 
 bool XSSAuditor::filterBaseToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, baseTag));
 
@@ -461,7 +425,6 @@ bool XSSAuditor::filterBaseToken(HTMLToken& token)
 
 bool XSSAuditor::filterFormToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, formTag));
 
@@ -476,7 +439,7 @@ bool XSSAuditor::eraseDangerousAttributesIfInjected(HTMLToken& token)
     for (size_t i = 0; i < token.attributes().size(); ++i) {
         const HTMLToken::Attribute& attribute = token.attributes().at(i);
         bool isInlineEventHandler = isNameOfInlineEventHandler(attribute.m_name);
-        bool valueContainsJavaScriptURL = isInlineEventHandler ? false : containsJavaScriptURL(attribute.m_value);
+        bool valueContainsJavaScriptURL = !isInlineEventHandler && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(String(attribute.m_value.data(), attribute.m_value.size())));
         if (!isInlineEventHandler && !valueContainsJavaScriptURL)
             continue;
         // Beware of trailing characters which came from the page itself, not the 
@@ -540,8 +503,6 @@ String XSSAuditor::snippetForRange(const HTMLToken& token, int start, int end)
 
 String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTMLToken::Attribute& attribute, AttributeKind treatment)
 {
-    const size_t kMaximumSnippetLength = 100;
-
     // The range doesn't inlcude the character which terminates the value. So,
     // for an input of |name="value"|, the snippet is |name="value|. For an
     // unquoted input of |name=value |, the snippet is |name=value|.
@@ -549,7 +510,7 @@ String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTML
     int start = attribute.m_nameRange.m_start - token.startIndex();
     int end = attribute.m_valueRange.m_end - token.startIndex();
     String decodedSnippet = fullyDecodeString(snippetForRange(token, start, end), m_parser->document()->decoder());
-    decodedSnippet.truncate(kMaximumSnippetLength);
+    decodedSnippet.truncate(kMaximumFragmentLengthTarget);
     if (treatment == SrcLikeAttribute) {
         int slashCount;
         size_t currentLength;
@@ -592,8 +553,6 @@ bool XSSAuditor::isSameOriginResource(const String& url)
 
 String XSSAuditor::snippetForJavaScript(const String& string)
 {
-    const size_t kMaximumFragmentLengthTarget = 100;
-
     size_t startPosition = 0;
     size_t endPosition = string.length();
     size_t foundPosition = notFound;
@@ -602,8 +561,17 @@ String XSSAuditor::snippetForJavaScript(const String& string)
     while (startPosition < endPosition) {
         while (startPosition < endPosition && isHTMLSpace(string[startPosition]))
             startPosition++;
+
+        // Under SVG/XML rules, only HTML comment syntax matters and the parser returns
+        // these as a separate comment tokens. Having consumed whitespace, we need not look
+        // further for these.
+        if (m_shouldAllowCDATA)
+            break;
+
+        // Under HTML rules, both the HTML and JS comment synatx matters, and the HTML
+        // comment ends at the end of the line, not with -->.
         if (startsHTMLCommentAt(string, startPosition) || startsSingleLineCommentAt(string, startPosition)) {
-            while (startPosition < endPosition && !isHTMLNewline(string[startPosition]))
+            while (startPosition < endPosition && !isJSNewline(string[startPosition]))
                 startPosition++;
         } else if (startsMultiLineCommentAt(string, startPosition)) {
             if ((foundPosition = string.find("*/", startPosition)) != notFound)
@@ -614,29 +582,29 @@ String XSSAuditor::snippetForJavaScript(const String& string)
             break;
     }
 
-    // Stop at next comment, or at a closing script tag (which may have been included with
-    // the code fragment because of buffering in the HTMLSourceTracker), or when we exceed
-    // the maximum length target. After hitting the length target, we can only stop at a
-    // point where we know we are not in the middle of a %-escape sequence. For the sake of
-    // simplicity, approximate stopping at a close script tag by stopping at any close tag,
-    // and approximate not stopping inside a (possibly multiply encoded) %-esacpe sequence
-    // by breaking on whitespace only. We should have enough text in these cases to avoid
-    // false positives.
+    // Stop at next comment (using the same rules as above for SVG/XML vs HTML), or when
+    // we exceed the maximum length target. After hitting the length target, we can only
+    // stop at a point where we know we are not in the middle of a %-escape sequence. For
+    // the sake of simplicity, approximate not stopping inside a (possibly multiply encoded)
+    // %-esacpe sequence by breaking on whitespace only. We should have enough text in
+    // these cases to avoid false positives.
     for (foundPosition = startPosition; foundPosition < endPosition; foundPosition++) {
-        if (startsSingleLineCommentAt(string, foundPosition) || startsMultiLineCommentAt(string, foundPosition) || startsHTMLEndTagAt(string, foundPosition)) {
-            endPosition = foundPosition + 2;
-            break;
-        }
-        if (startsHTMLCommentAt(string, foundPosition)) {
-            endPosition = foundPosition + 4;
-            break;
+        if (!m_shouldAllowCDATA) {
+            if (startsSingleLineCommentAt(string, foundPosition) || startsMultiLineCommentAt(string, foundPosition)) {
+                endPosition = foundPosition + 2;
+                break;
+            }
+            if (startsHTMLCommentAt(string, foundPosition)) {
+                endPosition = foundPosition + 4;
+                break;
+            }
         }
         if (foundPosition > startPosition + kMaximumFragmentLengthTarget && isHTMLSpace(string[foundPosition])) {
             endPosition = foundPosition;
             break;
         }
     }
-    
+
     return string.substring(startPosition, endPosition - startPosition);
 }
 
diff --git a/Source/WebCore/html/parser/XSSAuditor.h b/Source/WebCore/html/parser/XSSAuditor.h
index 89b7b8c65..713cd0b6f 100644
--- a/Source/WebCore/html/parser/XSSAuditor.h
+++ b/Source/WebCore/html/parser/XSSAuditor.h
@@ -42,10 +42,11 @@ public:
     void filterToken(HTMLToken&);
 
 private:
+    static const size_t kMaximumFragmentLengthTarget = 100;
+
     enum State {
         Uninitialized,
-        Initial,
-        AfterScriptStartTag,
+        Initialized
     };
 
     enum AttributeKind {
@@ -55,9 +56,9 @@ private:
 
     void init();
 
-    bool filterTokenInitial(HTMLToken&);
-    bool filterTokenAfterScriptStartTag(HTMLToken&);
-
+    bool filterStartToken(HTMLToken&);
+    void filterEndToken(HTMLToken&);
+    bool filterCharacterToken(HTMLToken&);
     bool filterScriptToken(HTMLToken&);
     bool filterObjectToken(HTMLToken&);
     bool filterParamToken(HTMLToken&);
@@ -88,6 +89,8 @@ private:
 
     State m_state;
     String m_cachedSnippet;
+    bool m_shouldAllowCDATA;
+    unsigned m_scriptTagNestingLevel;
     bool m_notifiedClient;
 };
 
diff --git a/Source/WebCore/html/shadow/ContentInclusionSelector.h b/Source/WebCore/html/shadow/ContentInclusionSelector.h
deleted file mode 100644
index 0f0b1978e..000000000
--- a/Source/WebCore/html/shadow/ContentInclusionSelector.h
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ContentInclusionSelector_h
-#define ContentInclusionSelector_h
-
-#include <wtf/Forward.h>
-#include <wtf/HashSet.h>
-#include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-class Element;
-class HTMLContentElement;
-class Node;
-class ShadowRoot;
-
-class ShadowInclusion : public RefCounted<ShadowInclusion> {
-public:
-    static PassRefPtr<ShadowInclusion> create(HTMLContentElement*, Node*);
-
-    HTMLContentElement* includer() const { return m_includer; }
-    Node* content() const { return m_content.get(); }
-    ShadowInclusion* next() const { return m_next.get(); }
-    ShadowInclusion* previous() const { return m_previous.get(); }
-
-    void append(PassRefPtr<ShadowInclusion>);
-    void unlink();
-
-private:
-    ShadowInclusion(HTMLContentElement*, Node*);
-
-    HTMLContentElement* m_includer;
-    RefPtr<Node> m_content;
-    RefPtr<ShadowInclusion> m_next;
-    RefPtr<ShadowInclusion> m_previous;
-};
-
-inline ShadowInclusion::ShadowInclusion(HTMLContentElement* includer, Node* content)
-    : m_includer(includer), m_content(content)
-{ }
-
-inline PassRefPtr<ShadowInclusion> ShadowInclusion::create(HTMLContentElement* includer, Node* content)
-{
-    return adoptRef(new ShadowInclusion(includer, content));
-}
-
-class ShadowInclusionList {
-public:
-    ShadowInclusionList();
-    ~ShadowInclusionList();
-
-    ShadowInclusion* first() const { return m_first.get(); }
-    ShadowInclusion* last() const { return m_last.get(); }
-    ShadowInclusion* find(Node*) const;
-    bool isEmpty() const { return !m_first; }
-
-    void clear();
-    void append(PassRefPtr<ShadowInclusion>);
-
-private:
-    RefPtr<ShadowInclusion> m_first;
-    RefPtr<ShadowInclusion> m_last;
-};
-
-
-class ShadowInclusionSet {
-public:
-    void add(ShadowInclusion* value) { m_set.add(value); }
-    void remove(ShadowInclusion* value) { m_set.remove(value); }
-    bool isEmpty() const { return m_set.isEmpty(); }
-    ShadowInclusion* find(Node* key) const;
-
-private:
-    struct Translator {
-    public:
-        static unsigned hash(const Node* key) { return PtrHash<const Node*>::hash(key); }
-        static bool equal(const ShadowInclusion* inclusion, const Node* content) { return inclusion->content() == content; }
-    };
-
-    struct Hash {
-        static unsigned hash(ShadowInclusion* key) { return PtrHash<const Node*>::hash(key->content()); }
-        static bool equal(ShadowInclusion* a, ShadowInclusion* b) { return a->content() == b->content(); }
-        static const bool safeToCompareToEmptyOrDeleted = false;
-    };
-
-    typedef HashSet<ShadowInclusion*, Hash> PointerSet;
-
-    PointerSet m_set;
-};
-
-inline ShadowInclusion* ShadowInclusionSet::find(Node* key) const
-{
-    PointerSet::iterator found = m_set.find<Node*, ShadowInclusionSet::Translator>(key);
-    return found != m_set.end() ? *found : 0;
-}
-
-class ContentInclusionSelector {
-    WTF_MAKE_NONCOPYABLE(ContentInclusionSelector);
-public:
-    ContentInclusionSelector();
-    ~ContentInclusionSelector();
-
-    void select(HTMLContentElement*, ShadowInclusionList*);
-    void unselect(ShadowInclusionList*);
-    ShadowInclusion* findFor(Node* key) const;
-
-    void willSelectOver(ShadowRoot*);
-    void didSelect();
-    bool hasCandidates() const { return !m_candidates.isEmpty(); }
-
-private:
-    void removeFromSet(ShadowInclusionList*);
-    void addToSet(ShadowInclusionList*);
-
-    Vector<RefPtr<Node> > m_candidates;
-    ShadowInclusionSet m_inclusionSet;
-};
-
-}
-
-#endif
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.cpp b/Source/WebCore/html/shadow/HTMLContentElement.cpp
index 961dd1d30..989acaee6 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentElement.cpp
@@ -27,11 +27,12 @@
 #include "config.h"
 #include "HTMLContentElement.h"
 
-#include "ContentInclusionSelector.h"
 #include "ContentSelectorQuery.h"
+#include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "QualifiedName.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -59,8 +60,7 @@ PassRefPtr<HTMLContentElement> HTMLContentElement::create(const QualifiedName& t
 }
 
 HTMLContentElement::HTMLContentElement(const QualifiedName& name, Document* document)
-    : HTMLElement(name, document)
-    , m_inclusions(adoptPtr(new ShadowInclusionList()))
+    : InsertionPoint(name, document)
 {
 }
 
@@ -74,32 +74,32 @@ void HTMLContentElement::attach()
 
     // Before calling StyledElement::attach, selector must be calculated.
     if (root) {
-        ContentInclusionSelector* selector = root->ensureInclusions();
-        selector->unselect(m_inclusions.get());
-        selector->select(this, m_inclusions.get());
+        HTMLContentSelector* selector = root->list()->ensureSelector();
+        selector->unselect(&m_selections);
+        selector->select(this, &m_selections);
     }
 
-    HTMLElement::attach();
+    InsertionPoint::attach();
 
     if (root) {
-        for (ShadowInclusion* inclusion = m_inclusions->first(); inclusion; inclusion = inclusion->next())
-            inclusion->content()->attach();
+        for (HTMLContentSelection* selection = m_selections.first(); selection; selection = selection->next())
+            selection->node()->attach();
     }
 }
 
 void HTMLContentElement::detach()
 {
     if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode())) {
-        if (ContentInclusionSelector* selector = root->inclusions())
-            selector->unselect(m_inclusions.get());
+        if (HTMLContentSelector* selector = root->list()->selector())
+            selector->unselect(&m_selections);
 
-        // When content element is detached, shadow tree should be recreated to re-calculate inclusions for
+        // When content element is detached, shadow tree should be recreated to re-calculate selector for
         // other content elements.
-        root->setNeedsReattachHostChildrenAndShadow();
+        root->list()->setNeedsReattachHostChildrenAndShadow();
     }
 
-    ASSERT(m_inclusions->isEmpty());
-    HTMLElement::detach();
+    ASSERT(m_selections.isEmpty());
+    InsertionPoint::detach();
 }
 
 const AtomicString& HTMLContentElement::select() const
@@ -122,9 +122,9 @@ void HTMLContentElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == selectAttr) {
         if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode()))
-            root->setNeedsReattachHostChildrenAndShadow();
+            root->list()->setNeedsReattachHostChildrenAndShadow();
     } else
-        HTMLElement::parseAttribute(attr);
+        InsertionPoint::parseAttribute(attr);
 }
 
 }
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.h b/Source/WebCore/html/shadow/HTMLContentElement.h
index 6e1816c78..c2a1c1e36 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.h
+++ b/Source/WebCore/html/shadow/HTMLContentElement.h
@@ -31,18 +31,14 @@
 #ifndef HTMLContentElement_h
 #define HTMLContentElement_h
 
-#include "ContentInclusionSelector.h"
-#include "HTMLElement.h"
+#include "InsertionPoint.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
-class ContentSelectorQuery;
-class ShadowInclusionList;
-
 // NOTE: Current implementation doesn't support dynamic insertion/deletion of HTMLContentElement.
 // You should create HTMLContentElement during the host construction.
-class HTMLContentElement : public HTMLElement {
+class HTMLContentElement : public InsertionPoint {
 public:
     static PassRefPtr<HTMLContentElement> create(const QualifiedName&, Document*);
     static PassRefPtr<HTMLContentElement> create(Document*);
@@ -60,9 +56,6 @@ public:
     // See https://bugs.webkit.org/show_bug.cgi?id=76261
     void setSelect(const AtomicString&);
 
-    const ShadowInclusionList* inclusions() const { return m_inclusions.get(); }
-    bool hasInclusion() const { return inclusions()->first(); }
-
     virtual bool isSelectValid() const;
 
 protected:
@@ -74,8 +67,6 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) { return 0; }
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-
-    OwnPtr<ShadowInclusionList> m_inclusions;
 };
 
 inline HTMLContentElement* toHTMLContentElement(Node* node)
diff --git a/Source/WebCore/html/shadow/ContentInclusionSelector.cpp b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
index 6b541a5ae..5c30ff6e1 100644
--- a/Source/WebCore/html/shadow/ContentInclusionSelector.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
@@ -25,7 +25,7 @@
  */
 
 #include "config.h"
-#include "ContentInclusionSelector.h"
+#include "HTMLContentSelector.h"
 
 #include "ContentSelectorQuery.h"
 #include "HTMLContentElement.h"
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-void ShadowInclusion::append(PassRefPtr<ShadowInclusion> next)
+void HTMLContentSelection::append(PassRefPtr<HTMLContentSelection> next)
 {
     ASSERT(!m_next);
     ASSERT(!next->previous());
@@ -42,13 +42,13 @@ void ShadowInclusion::append(PassRefPtr<ShadowInclusion> next)
     m_next->m_previous = this;
 }
 
-void ShadowInclusion::unlink()
+void HTMLContentSelection::unlink()
 {
     ASSERT(!m_previous); // Can be called only for a head.
-    RefPtr<ShadowInclusion> item = this;
+    RefPtr<HTMLContentSelection> item = this;
     while (item) {
         ASSERT(!item->previous());
-        RefPtr<ShadowInclusion> nextItem = item->m_next;
+        RefPtr<HTMLContentSelection> nextItem = item->m_next;
         item->m_next.clear();
         if (nextItem)
             nextItem->m_previous.clear();
@@ -56,26 +56,26 @@ void ShadowInclusion::unlink()
     }
 }
 
-ShadowInclusionList::ShadowInclusionList()
+HTMLContentSelectionList::HTMLContentSelectionList()
 {
 }
 
-ShadowInclusionList::~ShadowInclusionList()
+HTMLContentSelectionList::~HTMLContentSelectionList()
 {
     ASSERT(isEmpty());
 }
 
-ShadowInclusion* ShadowInclusionList::find(Node* content) const
+HTMLContentSelection* HTMLContentSelectionList::find(Node* node) const
 {
-    for (ShadowInclusion* item = first(); item; item = item->next()) {
-        if (content == item->content())
+    for (HTMLContentSelection* item = first(); item; item = item->next()) {
+        if (node == item->node())
             return item;
     }
     
     return 0;
 }
 
-void ShadowInclusionList::clear()
+void HTMLContentSelectionList::clear()
 {
     if (isEmpty()) {
         ASSERT(!m_last);
@@ -87,7 +87,7 @@ void ShadowInclusionList::clear()
     m_last.clear();
 }
 
-void ShadowInclusionList::append(PassRefPtr<ShadowInclusion> child)
+void HTMLContentSelectionList::append(PassRefPtr<HTMLContentSelection> child)
 {
     if (isEmpty()) {
         ASSERT(!m_last);
@@ -99,18 +99,18 @@ void ShadowInclusionList::append(PassRefPtr<ShadowInclusion> child)
     m_last = m_last->next();
 }
 
-ContentInclusionSelector::ContentInclusionSelector()
+HTMLContentSelector::HTMLContentSelector()
 {
 }
 
-ContentInclusionSelector::~ContentInclusionSelector()
+HTMLContentSelector::~HTMLContentSelector()
 {
     ASSERT(m_candidates.isEmpty());
 }
 
-void ContentInclusionSelector::select(HTMLContentElement* contentElement, ShadowInclusionList* inclusions)
+void HTMLContentSelector::select(HTMLContentElement* contentElement, HTMLContentSelectionList* selections)
 {
-    ASSERT(inclusions->isEmpty());
+    ASSERT(selections->isEmpty());
 
     ContentSelectorQuery query(contentElement);
     for (size_t i = 0; i < m_candidates.size(); ++i) {
@@ -120,35 +120,37 @@ void ContentInclusionSelector::select(HTMLContentElement* contentElement, Shadow
         if (!query.matches(child))
             continue;
 
-        RefPtr<ShadowInclusion> inclusion = ShadowInclusion::create(contentElement, child);
-        inclusions->append(inclusion);
-        m_inclusionSet.add(inclusion.get());
+        RefPtr<HTMLContentSelection> selection = HTMLContentSelection::create(contentElement, child);
+
+        selections->append(selection);
+        m_selectionSet.add(selection.get());
         m_candidates[i] = 0;
     }
 }
 
-void ContentInclusionSelector::unselect(ShadowInclusionList* list)
+void HTMLContentSelector::unselect(HTMLContentSelectionList* list)
 {
-    for (ShadowInclusion* inclusion = list->first(); inclusion; inclusion = inclusion->next())
-        m_inclusionSet.remove(inclusion);
+    for (HTMLContentSelection* selection = list->first(); selection; selection = selection->next())
+        m_selectionSet.remove(selection);
     list->clear();
 }
 
-ShadowInclusion* ContentInclusionSelector::findFor(Node* key) const
+HTMLContentSelection* HTMLContentSelector::findFor(Node* key) const
 {
-    return m_inclusionSet.find(key);
+    return m_selectionSet.find(key);
 }
 
-void ContentInclusionSelector::didSelect()
+void HTMLContentSelector::didSelect()
 {
     m_candidates.clear();
 }
 
-void ContentInclusionSelector::willSelectOver(ShadowRoot* scope)
+void HTMLContentSelector::willSelectOver(Element* shadowHost)
 {
     if (!m_candidates.isEmpty())
         return;
-    for (Node* node = scope->shadowHost()->firstChild(); node; node = node->nextSibling())
+    ASSERT(shadowHost);
+    for (Node* node = shadowHost->firstChild(); node; node = node->nextSibling())
         m_candidates.append(node);
 }
 
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.h b/Source/WebCore/html/shadow/HTMLContentSelector.h
new file mode 100644
index 000000000..29bd6163f
--- /dev/null
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.h
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLContentSelector_h
+#define HTMLContentSelector_h
+
+#include <wtf/Forward.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Element;
+class HTMLContentElement;
+class InsertionPoint;
+class Node;
+class ShadowRoot;
+
+class HTMLContentSelection : public RefCounted<HTMLContentSelection> {
+public:
+    static PassRefPtr<HTMLContentSelection> create(InsertionPoint*, Node*);
+
+    InsertionPoint* insertionPoint() const { return m_insertionPoint; }
+    Node* node() const { return m_node.get(); }
+    HTMLContentSelection* next() const { return m_next.get(); }
+    HTMLContentSelection* previous() const { return m_previous.get(); }
+
+    void append(PassRefPtr<HTMLContentSelection>);
+    void unlink();
+
+private:
+    HTMLContentSelection(InsertionPoint*, Node*);
+
+    InsertionPoint* m_insertionPoint;
+    RefPtr<Node> m_node;
+    RefPtr<HTMLContentSelection> m_next;
+    RefPtr<HTMLContentSelection> m_previous;
+};
+
+inline HTMLContentSelection::HTMLContentSelection(InsertionPoint* insertionPoint, Node* node)
+    : m_insertionPoint(insertionPoint), m_node(node)
+{ }
+
+inline PassRefPtr<HTMLContentSelection> HTMLContentSelection::create(InsertionPoint* insertionPoint, Node* node)
+{
+    return adoptRef(new HTMLContentSelection(insertionPoint, node));
+}
+
+class HTMLContentSelectionList {
+public:
+    HTMLContentSelectionList();
+    ~HTMLContentSelectionList();
+
+    HTMLContentSelection* first() const { return m_first.get(); }
+    HTMLContentSelection* last() const { return m_last.get(); }
+    HTMLContentSelection* find(Node*) const;
+    bool isEmpty() const { return !m_first; }
+
+    void clear();
+    void append(PassRefPtr<HTMLContentSelection>);
+
+private:
+    RefPtr<HTMLContentSelection> m_first;
+    RefPtr<HTMLContentSelection> m_last;
+};
+
+
+class HTMLContentSelectionSet {
+public:
+    void add(HTMLContentSelection* value) { m_set.add(value); }
+    void remove(HTMLContentSelection* value) { m_set.remove(value); }
+    bool isEmpty() const { return m_set.isEmpty(); }
+    HTMLContentSelection* find(Node* key) const;
+
+private:
+    struct Translator {
+    public:
+        static unsigned hash(const Node* key) { return PtrHash<const Node*>::hash(key); }
+        static bool equal(const HTMLContentSelection* selection, const Node* node) { return selection->node() == node; }
+    };
+
+    struct Hash {
+        static unsigned hash(HTMLContentSelection* key) { return PtrHash<const Node*>::hash(key->node()); }
+        static bool equal(HTMLContentSelection* a, HTMLContentSelection* b) { return a->node() == b->node(); }
+        static const bool safeToCompareToEmptyOrDeleted = false;
+    };
+
+    typedef HashSet<HTMLContentSelection*, Hash> PointerSet;
+
+    PointerSet m_set;
+};
+
+inline HTMLContentSelection* HTMLContentSelectionSet::find(Node* key) const
+{
+    PointerSet::iterator found = m_set.find<Node*, HTMLContentSelectionSet::Translator>(key);
+    return found != m_set.end() ? *found : 0;
+}
+
+class HTMLContentSelector {
+    WTF_MAKE_NONCOPYABLE(HTMLContentSelector);
+public:
+    HTMLContentSelector();
+    ~HTMLContentSelector();
+
+    void select(HTMLContentElement*, HTMLContentSelectionList*);
+    void unselect(HTMLContentSelectionList*);
+    HTMLContentSelection* findFor(Node* key) const;
+
+    void willSelectOver(Element* shadowHost);
+    void didSelect();
+    bool hasCandidates() const { return !m_candidates.isEmpty(); }
+
+private:
+    void removeFromSet(HTMLContentSelectionList*);
+    void addToSet(HTMLContentSelectionList*);
+
+    Vector<RefPtr<Node> > m_candidates;
+    HTMLContentSelectionSet m_selectionSet;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.h b/Source/WebCore/html/shadow/HTMLShadowElement.h
index bfc85e2fb..151c7a2ab 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.h
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.h
@@ -45,6 +45,7 @@ public:
 
 private:
     HTMLShadowElement(const QualifiedName&, Document*);
+    virtual bool isShadowElement() const { return true; }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.idl b/Source/WebCore/html/shadow/HTMLShadowElement.idl
index 1310a1482..94facb7be 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.idl
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.idl
@@ -32,7 +32,7 @@ module html {
 
     interface [
         Conditional=SHADOW_DOM,
-        EnabledAtRuntime=shadowDOM
+        V8EnabledAtRuntime=shadowDOM
     ] HTMLShadowElement : HTMLElement {
     };
 
diff --git a/Source/WebCore/html/shadow/InsertionPoint.cpp b/Source/WebCore/html/shadow/InsertionPoint.cpp
new file mode 100644
index 000000000..e99dc26d2
--- /dev/null
+++ b/Source/WebCore/html/shadow/InsertionPoint.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InsertionPoint.h"
+
+namespace WebCore {
+
+InsertionPoint::InsertionPoint(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
+    , m_selections()
+{
+}
+
+InsertionPoint::~InsertionPoint()
+{
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/html/shadow/InsertionPoint.h b/Source/WebCore/html/shadow/InsertionPoint.h
new file mode 100644
index 000000000..292439032
--- /dev/null
+++ b/Source/WebCore/html/shadow/InsertionPoint.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InsertionPoint_h
+#define InsertionPoint_h
+
+#include "HTMLContentSelector.h"
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class InsertionPoint : public HTMLElement {
+public:
+    virtual ~InsertionPoint();
+
+    const HTMLContentSelectionList* selections() const { return &m_selections; }
+    bool hasSelection() const { return m_selections.first(); }
+
+protected:
+    InsertionPoint(const QualifiedName&, Document*);
+    HTMLContentSelectionList m_selections;
+};
+
+inline bool isInsertionPoint(Node* node)
+{
+    // FIXME: <shadow> should also be InsertionPoint.
+    // https://bugs.webkit.org/show_bug.cgi?id=78596
+    if (!node || node->isContentElement())
+        return true;
+
+    return false;
+}
+
+inline InsertionPoint* toInsertionPoint(Node* node)
+{
+    ASSERT(isInsertionPoint(node));
+    return static_cast<InsertionPoint*>(node);
+}
+
+} // namespace WebCore
+
+#endif // InsertionPoint_h
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index e932e73d3..1f69e3cc6 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -92,12 +92,12 @@ MediaControlElement::MediaControlElement(Document* document)
 
 void MediaControlElement::show()
 {
-    ensureInlineStyleDecl()->removeProperty(CSSPropertyDisplay);
+    removeInlineStyleProperty(CSSPropertyDisplay);
 }
 
 void MediaControlElement::hide()
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueNone);
+    setInlineStyleProperty(CSSPropertyDisplay, CSSValueNone);
 }
 
 // ----------------------------
@@ -175,17 +175,15 @@ void MediaControlPanelElement::endDrag()
 
 void MediaControlPanelElement::setPosition(const LayoutPoint& position)
 {
-    StylePropertySet* style = ensureInlineStyleDecl();
-
     double left = position.x();
     double top = position.y();
 
     // Set the left and top to control the panel's position; this depends on it being absolute positioned.
     // Set the margin to zero since the position passed in will already include the effect of the margin.
-    style->setProperty(CSSPropertyLeft, left, CSSPrimitiveValue::CSS_PX);
-    style->setProperty(CSSPropertyTop, top, CSSPrimitiveValue::CSS_PX);
-    style->setProperty(CSSPropertyMarginLeft, 0.0, CSSPrimitiveValue::CSS_PX);
-    style->setProperty(CSSPropertyMarginTop, 0.0, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyLeft, left, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyTop, top, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyMarginLeft, 0.0, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyMarginTop, 0.0, CSSPrimitiveValue::CSS_PX);
 
     ExceptionCode ignored;
     classList()->add("dragged", ignored);
@@ -193,12 +191,10 @@ void MediaControlPanelElement::setPosition(const LayoutPoint& position)
 
 void MediaControlPanelElement::resetPosition()
 {
-    StylePropertySet* style = ensureInlineStyleDecl();
-
-    style->removeProperty(CSSPropertyLeft);
-    style->removeProperty(CSSPropertyTop);
-    style->removeProperty(CSSPropertyMarginLeft);
-    style->removeProperty(CSSPropertyMarginTop);
+    removeInlineStyleProperty(CSSPropertyLeft);
+    removeInlineStyleProperty(CSSPropertyTop);
+    removeInlineStyleProperty(CSSPropertyMarginLeft);
+    removeInlineStyleProperty(CSSPropertyMarginTop);
 
     ExceptionCode ignored;
     classList()->remove("dragged", ignored);
@@ -211,10 +207,9 @@ void MediaControlPanelElement::makeOpaque()
 
     double duration = document()->page() ? document()->page()->theme()->mediaControlsFadeInDuration() : 0;
 
-    StylePropertySet* style = ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
-    style->setProperty(CSSPropertyWebkitTransitionDuration, duration, CSSPrimitiveValue::CSS_S);
-    style->setProperty(CSSPropertyOpacity, 1.0, CSSPrimitiveValue::CSS_NUMBER);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionDuration, duration, CSSPrimitiveValue::CSS_S);
+    setInlineStyleProperty(CSSPropertyOpacity, 1.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = true;
 }
@@ -224,10 +219,9 @@ void MediaControlPanelElement::makeTransparent()
     if (!m_opaque)
         return;
 
-    StylePropertySet* style = ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
-    style->setProperty(CSSPropertyWebkitTransitionDuration, document()->page()->theme()->mediaControlsFadeOutDuration(), CSSPrimitiveValue::CSS_S);
-    style->setProperty(CSSPropertyOpacity, 0.0, CSSPrimitiveValue::CSS_NUMBER);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionDuration, document()->page()->theme()->mediaControlsFadeOutDuration(), CSSPrimitiveValue::CSS_S);
+    setInlineStyleProperty(CSSPropertyOpacity, 0.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = false;
 }
@@ -434,12 +428,12 @@ MediaControlInputElement::MediaControlInputElement(Document* document, MediaCont
 
 void MediaControlInputElement::show()
 {
-    ensureInlineStyleDecl()->removeProperty(CSSPropertyDisplay);
+    removeInlineStyleProperty(CSSPropertyDisplay);
 }
 
 void MediaControlInputElement::hide()
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueNone);
+    setInlineStyleProperty(CSSPropertyDisplay, CSSValueNone);
 }
 
 
@@ -493,6 +487,7 @@ PassRefPtr<MediaControlPanelMuteButtonElement> MediaControlPanelMuteButtonElemen
     ASSERT(controls);
 
     RefPtr<MediaControlPanelMuteButtonElement> button = adoptRef(new MediaControlPanelMuteButtonElement(document, controls));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -521,6 +516,7 @@ inline MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteBu
 PassRefPtr<MediaControlVolumeSliderMuteButtonElement> MediaControlVolumeSliderMuteButtonElement::create(Document* document)
 {
     RefPtr<MediaControlVolumeSliderMuteButtonElement> button = adoptRef(new MediaControlVolumeSliderMuteButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -541,6 +537,7 @@ inline MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* do
 PassRefPtr<MediaControlPlayButtonElement> MediaControlPlayButtonElement::create(Document* document)
 {
     RefPtr<MediaControlPlayButtonElement> button = adoptRef(new MediaControlPlayButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -660,6 +657,7 @@ inline MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElemen
 PassRefPtr<MediaControlSeekForwardButtonElement> MediaControlSeekForwardButtonElement::create(Document* document)
 {
     RefPtr<MediaControlSeekForwardButtonElement> button = adoptRef(new MediaControlSeekForwardButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -680,6 +678,7 @@ inline MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement(Docu
 PassRefPtr<MediaControlSeekBackButtonElement> MediaControlSeekBackButtonElement::create(Document* document)
 {
     RefPtr<MediaControlSeekBackButtonElement> button = adoptRef(new MediaControlSeekBackButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -700,6 +699,7 @@ inline MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document
 PassRefPtr<MediaControlRewindButtonElement> MediaControlRewindButtonElement::create(Document* document)
 {
     RefPtr<MediaControlRewindButtonElement> button = adoptRef(new MediaControlRewindButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -730,6 +730,7 @@ inline MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeBu
 PassRefPtr<MediaControlReturnToRealtimeButtonElement> MediaControlReturnToRealtimeButtonElement::create(Document* document)
 {
     RefPtr<MediaControlReturnToRealtimeButtonElement> button = adoptRef(new MediaControlReturnToRealtimeButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     button->hide();
     return button.release();
@@ -760,6 +761,7 @@ inline MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCa
 PassRefPtr<MediaControlToggleClosedCaptionsButtonElement> MediaControlToggleClosedCaptionsButtonElement::create(Document* document)
 {
     RefPtr<MediaControlToggleClosedCaptionsButtonElement> button = adoptRef(new MediaControlToggleClosedCaptionsButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     button->hide();
     return button.release();
@@ -801,6 +803,7 @@ PassRefPtr<MediaControlTimelineElement> MediaControlTimelineElement::create(Docu
     ASSERT(controls);
 
     RefPtr<MediaControlTimelineElement> timeline = adoptRef(new MediaControlTimelineElement(document, controls));
+    timeline->createShadowSubtree();
     timeline->setType("range");
     timeline->setAttribute(precisionAttr, "float");
     return timeline.release();
@@ -865,6 +868,7 @@ inline MediaControlVolumeSliderElement::MediaControlVolumeSliderElement(Document
 PassRefPtr<MediaControlVolumeSliderElement> MediaControlVolumeSliderElement::create(Document* document)
 {
     RefPtr<MediaControlVolumeSliderElement> slider = adoptRef(new MediaControlVolumeSliderElement(document));
+    slider->createShadowSubtree();
     slider->setType("range");
     slider->setAttribute(precisionAttr, "float");
     slider->setAttribute(maxAttr, "1");
@@ -915,6 +919,7 @@ inline MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSl
 PassRefPtr<MediaControlFullscreenVolumeSliderElement> MediaControlFullscreenVolumeSliderElement::create(Document* document)
 {
     RefPtr<MediaControlFullscreenVolumeSliderElement> slider = adoptRef(new MediaControlFullscreenVolumeSliderElement(document));
+    slider->createShadowSubtree();
     slider->setType("range");
     slider->setAttribute(precisionAttr, "float");
     slider->setAttribute(maxAttr, "1");
@@ -940,6 +945,7 @@ PassRefPtr<MediaControlFullscreenButtonElement> MediaControlFullscreenButtonElem
     ASSERT(controls);
 
     RefPtr<MediaControlFullscreenButtonElement> button = adoptRef(new MediaControlFullscreenButtonElement(document, controls));
+    button->createShadowSubtree();
     button->setType("button");
     button->hide();
     return button.release();
@@ -983,6 +989,7 @@ inline MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolum
 PassRefPtr<MediaControlFullscreenVolumeMinButtonElement> MediaControlFullscreenVolumeMinButtonElement::create(Document* document)
 {
     RefPtr<MediaControlFullscreenVolumeMinButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMinButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -1013,6 +1020,7 @@ inline MediaControlFullscreenVolumeMaxButtonElement::MediaControlFullscreenVolum
 PassRefPtr<MediaControlFullscreenVolumeMaxButtonElement> MediaControlFullscreenVolumeMaxButtonElement::create(Document* document)
 {
     RefPtr<MediaControlFullscreenVolumeMaxButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMaxButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -1197,13 +1205,13 @@ void MediaControlTextTrackContainerElement::updateSizes()
     float fontSize = m_videoDisplaySize.size().height() * videoHeightFontSizePercentage;
     if (fontSize != m_fontSize) {
         m_fontSize = fontSize;
-        ensureInlineStyleDecl()->setProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
+        setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
     }
 
     LayoutUnit bottom = static_cast<LayoutUnit>(m_videoDisplaySize.y() + m_videoDisplaySize.height() - (m_videoDisplaySize.height() * trackBottomMultiplier));
     if (bottom != m_bottom) {
         m_bottom = bottom;
-        ensureInlineStyleDecl()->setProperty(CSSPropertyBottom, String::number(bottom) + "px");
+        setInlineStyleProperty(CSSPropertyBottom, String::number(bottom) + "px");
     }
 }
 
diff --git a/Source/WebCore/html/shadow/MeterShadowElement.cpp b/Source/WebCore/html/shadow/MeterShadowElement.cpp
index 410535414..bc5ea6295 100644
--- a/Source/WebCore/html/shadow/MeterShadowElement.cpp
+++ b/Source/WebCore/html/shadow/MeterShadowElement.cpp
@@ -93,7 +93,7 @@ const AtomicString& MeterValueElement::shadowPseudoId() const
 
 void MeterValueElement::setWidthPercentage(double width)
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
+    setInlineStyleProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
 }
 
 
diff --git a/Source/WebCore/html/shadow/ProgressShadowElement.cpp b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
index ecd35544f..548571302 100644
--- a/Source/WebCore/html/shadow/ProgressShadowElement.cpp
+++ b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
@@ -73,7 +73,7 @@ const AtomicString& ProgressValueElement::shadowPseudoId() const
 
 void ProgressValueElement::setWidthPercentage(double width)
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
+    setInlineStyleProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
 }
 
 }
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 319a11e80..7558924ce 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -43,6 +43,7 @@
 #include "RenderSlider.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "StepRange.h"
 #include <wtf/MathExtras.h>
 
@@ -66,7 +67,7 @@ inline static bool hasVerticalAppearance(HTMLInputElement* input)
 SliderThumbElement* sliderThumbElementOf(Node* node)
 {
     ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->shadowRoot();
+    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
     ASSERT(shadow);
     Node* thumb = shadow->firstChild()->firstChild()->firstChild();
     ASSERT(thumb);
@@ -141,7 +142,7 @@ void RenderSliderContainer::layout()
     Length inputHeight = input->renderer()->style()->height();
     RenderObject* trackRenderer = node()->firstChild()->renderer();
     if (!isVertical && input->renderer()->isSlider() && !inputHeight.isFixed() && !inputHeight.isPercent()) {
-        RenderObject* thumbRenderer = input->shadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
+        RenderObject* thumbRenderer = input->shadowRootList()->oldestShadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
         if (thumbRenderer) {
             style()->setHeight(thumbRenderer->style()->height());
             if (trackRenderer)
@@ -334,9 +335,8 @@ PassRefPtr<TrackLimiterElement> TrackLimiterElement::create(Document* document)
 {
     RefPtr<TrackLimiterElement> element = adoptRef(new TrackLimiterElement(document));
 
-    StylePropertySet* style = element->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyVisibility, CSSValueHidden);
-    style->setProperty(CSSPropertyPosition, CSSValueStatic);
+    element->setInlineStyleProperty(CSSPropertyVisibility, CSSValueHidden);
+    element->setInlineStyleProperty(CSSPropertyPosition, CSSValueStatic);
 
     return element.release();
 }
@@ -355,7 +355,8 @@ const AtomicString& TrackLimiterElement::shadowPseudoId() const
 TrackLimiterElement* trackLimiterElementOf(Node* node)
 {
     ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->shadowRoot();
+    ASSERT(node->toInputElement()->hasShadowRoot());
+    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
     ASSERT(shadow);
     Node* limiter = shadow->firstChild()->lastChild();
     ASSERT(limiter);
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index 808ffa31e..2fc35f20e 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -474,7 +474,7 @@ void InputFieldSpeechButtonElement::setState(SpeechInputState state)
 
 SpeechInput* InputFieldSpeechButtonElement::speechInput()
 {
-    return document()->page() ? document()->page()->speechInput() : 0;
+    return SpeechInput::from(document()->page());
 }
 
 void InputFieldSpeechButtonElement::didCompleteRecording(int)
@@ -520,7 +520,8 @@ void InputFieldSpeechButtonElement::setRecognitionResult(int, const SpeechInputR
 void InputFieldSpeechButtonElement::attach()
 {
     ASSERT(!m_listenerId);
-    m_listenerId = document()->page()->speechInput()->registerListener(this);
+    if (SpeechInput* input = SpeechInput::from(document()->page()))
+        m_listenerId = input->registerListener(this);
     HTMLDivElement::attach();
 }
 
@@ -550,7 +551,7 @@ void InputFieldSpeechButtonElement::startSpeechInput()
     AtomicString language = input->computeInheritedLanguage();
     String grammar = input->getAttribute(webkitgrammarAttr);
     // FIXME: this should probably respect transforms
-    IntRect rect = renderer()->view()->frameView()->contentsToWindow(renderer()->absoluteBoundingBoxRectIgnoringTransforms());
+    IntRect rect = pixelSnappedIntRect(renderer()->view()->frameView()->contentsToWindow(renderer()->absoluteBoundingBoxRectIgnoringTransforms()));
     if (speechInput()->startRecognition(m_listenerId, rect, language, grammar, document()->securityOrigin()))
         setState(Recording);
 }
diff --git a/Source/WebCore/html/LoadableTextTrack.cpp b/Source/WebCore/html/track/LoadableTextTrack.cpp
index b48d8c7cb..400b42c2c 100644
--- a/Source/WebCore/html/LoadableTextTrack.cpp
+++ b/Source/WebCore/html/track/LoadableTextTrack.cpp
@@ -125,9 +125,10 @@ void LoadableTextTrack::cueLoadingCompleted(TextTrackLoader* loader, bool loadin
 
 void LoadableTextTrack::fireCueChangeEvent()
 {
-    TextTrack::fireCueChangeEvent();
+    RefPtr<Event> event = Event::create(eventNames().cuechangeEvent, false, false);
     ExceptionCode ec = 0;
-    m_trackElement->dispatchEvent(Event::create(eventNames().cuechangeEvent, false, false), ec);
+
+    m_trackElement->dispatchEvent(event, ec);
 }
 
 size_t LoadableTextTrack::trackElementIndex()
diff --git a/Source/WebCore/html/LoadableTextTrack.h b/Source/WebCore/html/track/LoadableTextTrack.h
index b70122536..783cdfa7f 100644
--- a/Source/WebCore/html/LoadableTextTrack.h
+++ b/Source/WebCore/html/track/LoadableTextTrack.h
@@ -57,10 +57,12 @@ public:
     void scheduleLoad(const KURL&);
 
     virtual void clearClient();
-    
+
     size_t trackElementIndex();
     HTMLTrackElement* trackElement() { return m_trackElement; }
 
+    virtual void fireCueChangeEvent();
+
 private:
     // TextTrackLoaderClient
     virtual bool shouldLoadCues(TextTrackLoader*) { return true; }
@@ -71,8 +73,6 @@ private:
     LoadableTextTrack(HTMLTrackElement*, const String& kind, const String& label, const String& language, bool isDefault);
 
     void loadTimerFired(Timer<LoadableTextTrack>*);
-    
-    virtual void fireCueChangeEvent();
 
     HTMLTrackElement* m_trackElement;
     Timer<LoadableTextTrack> m_loadTimer;
diff --git a/Source/WebCore/html/TextTrack.cpp b/Source/WebCore/html/track/TextTrack.cpp
index bdfbaa205..175171fd3 100644
--- a/Source/WebCore/html/TextTrack.cpp
+++ b/Source/WebCore/html/track/TextTrack.cpp
@@ -37,11 +37,15 @@
 
 #include "Event.h"
 #include "ExceptionCode.h"
+#include "HTMLMediaElement.h"
 #include "TextTrackCueList.h"
+#include "TextTrackList.h"
 #include "TrackBase.h"
 
 namespace WebCore {
 
+static const int invalidTrackIndex = -1;
+
 const AtomicString& TextTrack::subtitlesKeyword()
 {
     DEFINE_STATIC_LOCAL(const AtomicString, subtitles, ("subtitles"));
@@ -82,6 +86,7 @@ TextTrack::TextTrack(ScriptExecutionContext* context, TextTrackClient* client, c
     , m_trackType(type)
     , m_readinessState(NotLoaded)
     , m_showingByDefault(false)
+    , m_trackIndex(invalidTrackIndex)
 {
     setKind(kind);
 }
@@ -155,16 +160,13 @@ TextTrack::Mode TextTrack::mode() const
 
 TextTrackCueList* TextTrack::cues()
 {
-    if (!m_cues)
-        m_cues = TextTrackCueList::create();    
-
     // 4.8.10.12.5 If the text track mode ... is not the text track disabled mode,
     // then the cues attribute must return a live TextTrackCueList object ...
     // Otherwise, it must return null. When an object is returned, the
     // same object must be returned each time.
     // http://www.whatwg.org/specs/web-apps/current-work/#dom-texttrack-cues
-    if (m_cues && m_mode != TextTrack::DISABLED)
-        return m_cues.get();
+    if (m_mode != TextTrack::DISABLED)
+        return ensureTextTrackCueList();
     return 0;
 }
 
@@ -208,7 +210,7 @@ void TextTrack::addCue(PassRefPtr<TextTrackCue> prpCue, ExceptionCode& ec)
     // 3. If the given cue is already listed in the method's TextTrack object's text
     // track's text track list of cues, then throw an InvalidStateError exception.
     // 4. Add cue to the method's TextTrack object's text track's text track list of cues.
-    if (!m_cues->add(cue)) {
+    if (!ensureTextTrackCueList()->add(cue)) {
         ec = INVALID_STATE_ERR;
         return;
     }
@@ -236,7 +238,7 @@ void TextTrack::removeCue(TextTrackCue* cue, ExceptionCode& ec)
     // 2. If the given cue is not currently listed in the method's TextTrack 
     // object's text track's text track list of cues, then throw a NotFoundError exception.
     // 3. Remove cue from the method's TextTrack object's text track's text track list of cues.
-    if (!m_cues->remove(cue)) {
+    if (!m_cues || !m_cues->remove(cue)) {
         ec = INVALID_STATE_ERR;
         return;
     }
@@ -246,12 +248,6 @@ void TextTrack::removeCue(TextTrackCue* cue, ExceptionCode& ec)
         m_client->textTrackRemoveCue(this, cue);
 }
 
-void TextTrack::fireCueChangeEvent()
-{
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventNames().cuechangeEvent, false, false), ec);
-}
-    
 void TextTrack::cueWillChange(TextTrackCue* cue)
 {
     if (!m_client)
@@ -271,6 +267,29 @@ void TextTrack::cueDidChange(TextTrackCue* cue)
     m_client->textTrackAddCue(this, cue);
 }
 
+int TextTrack::trackIndex()
+{
+    ASSERT(m_mediaElement);
+
+    if (m_trackIndex == invalidTrackIndex)
+        m_trackIndex = m_mediaElement->textTracks()->getTrackIndex(this);
+
+    return m_trackIndex;
+}
+
+void TextTrack::invalidateTrackIndex()
+{
+    m_trackIndex = invalidTrackIndex;
+}
+
+TextTrackCueList* TextTrack::ensureTextTrackCueList()
+{
+    if (!m_cues)
+        m_cues = TextTrackCueList::create();
+
+    return m_cues.get();
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/html/TextTrack.h b/Source/WebCore/html/track/TextTrack.h
index f6ecec848..9a8eb8bb4 100644
--- a/Source/WebCore/html/TextTrack.h
+++ b/Source/WebCore/html/track/TextTrack.h
@@ -59,7 +59,7 @@ public:
         return adoptRef(new TextTrack(context, client, kind, label, language, AddTrack));
     }
     virtual ~TextTrack();
-    
+
     void setMediaElement(HTMLMediaElement* element) { m_mediaElement = element; }
     HTMLMediaElement* mediaElement() { return m_mediaElement; }
 
@@ -99,21 +99,26 @@ public:
     void addCue(PassRefPtr<TextTrackCue>, ExceptionCode&);
     void removeCue(TextTrackCue*, ExceptionCode&);
 
+    virtual void fireCueChangeEvent() { };
+
     void cueWillChange(TextTrackCue*);
     void cueDidChange(TextTrackCue*);
-    
-    virtual void fireCueChangeEvent();
+
     DEFINE_ATTRIBUTE_EVENT_LISTENER(cuechange);
 
     enum TextTrackType { TrackElement, AddTrack, InBand };
     TextTrackType trackType() const { return m_trackType; }
 
+    int trackIndex();
+    void invalidateTrackIndex();
+
 protected:
     TextTrack(ScriptExecutionContext*, TextTrackClient*, const String& kind, const String& label, const String& language, TextTrackType);
 
     RefPtr<TextTrackCueList> m_cues;
 
 private:
+    TextTrackCueList* ensureTextTrackCueList();
     HTMLMediaElement* m_mediaElement;
     String m_kind;
     String m_label;
@@ -123,6 +128,7 @@ private:
     TextTrackType m_trackType;
     ReadinessState m_readinessState;
     bool m_showingByDefault;
+    int m_trackIndex;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/TextTrack.idl b/Source/WebCore/html/track/TextTrack.idl
index 845a80c01..845a80c01 100644
--- a/Source/WebCore/html/TextTrack.idl
+++ b/Source/WebCore/html/track/TextTrack.idl
diff --git a/Source/WebCore/html/TextTrackCue.cpp b/Source/WebCore/html/track/TextTrackCue.cpp
index e1c01266e..59c3f3ea0 100644
--- a/Source/WebCore/html/TextTrackCue.cpp
+++ b/Source/WebCore/html/track/TextTrackCue.cpp
@@ -38,11 +38,14 @@
 #include "Event.h"
 #include "DocumentFragment.h"
 #include "TextTrack.h"
+#include "TextTrackCueList.h"
 #include "WebVTTParser.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
+static const int invalidCueIndex = -1;
+
 static const AtomicString& startKeyword()
 {
     DEFINE_STATIC_LOCAL(const AtomicString, start, ("start"));
@@ -87,6 +90,7 @@ TextTrackCue::TextTrackCue(ScriptExecutionContext* context, const String& id, do
     , m_linePosition(-1)
     , m_textPosition(50)
     , m_cueSize(100)
+    , m_cueIndex(invalidCueIndex)
     , m_cueAlignment(Middle)
     , m_scriptExecutionContext(context)
     , m_isActive(false)
@@ -324,6 +328,19 @@ void TextTrackCue::setText(const String& text)
     cueDidChange();
 }
 
+int TextTrackCue::cueIndex()
+{
+    if (m_cueIndex == invalidCueIndex)
+        m_cueIndex = track()->cues()->getCueIndex(this);
+
+    return m_cueIndex;
+}
+
+void TextTrackCue::invalidateCueIndex()
+{
+    m_cueIndex = invalidCueIndex;
+}
+
 PassRefPtr<DocumentFragment> TextTrackCue::getCueAsHTML()
 {
     if (!m_documentFragment)
@@ -337,6 +354,20 @@ void TextTrackCue::setCueHTML(PassRefPtr<DocumentFragment> fragment)
     m_documentFragment = fragment;
 }
 
+bool TextTrackCue::dispatchEvent(PassRefPtr<Event> event)
+{
+    // When a TextTrack's mode is disabled: no cues are active, no events fired.
+    if (!track() || track()->mode() == TextTrack::DISABLED)
+        return false;
+
+    return EventTarget::dispatchEvent(event);
+}
+
+bool TextTrackCue::dispatchEvent(PassRefPtr<Event> event, ExceptionCode &ec)
+{
+    return EventTarget::dispatchEvent(event, ec);
+}
+
 bool TextTrackCue::isActive()
 {
     return m_isActive && track() && track()->mode() != TextTrack::DISABLED;
@@ -345,19 +376,6 @@ bool TextTrackCue::isActive()
 void TextTrackCue::setIsActive(bool active)
 {
     m_isActive = active;
-
-    // When a TextTrack's mode is disabled: No cues are active, no events are fired ...
-    if (!track() || track()->mode() == TextTrack::DISABLED)
-        return;
-
-    ExceptionCode ec = 0;
-    if (active)
-        dispatchEvent(Event::create(eventNames().enterEvent, false, false), ec);
-    else
-        dispatchEvent(Event::create(eventNames().exitEvent, false, false), ec);
-
-    if (m_track)
-        m_track->fireCueChangeEvent();
 }
 
 void TextTrackCue::parseSettings(const String& input)
diff --git a/Source/WebCore/html/TextTrackCue.h b/Source/WebCore/html/track/TextTrackCue.h
index 16faf63ca..b3e0f32a5 100644
--- a/Source/WebCore/html/TextTrackCue.h
+++ b/Source/WebCore/html/track/TextTrackCue.h
@@ -50,7 +50,7 @@ public:
     {
         return adoptRef(new TextTrackCue(context, id, start, end, content, settings, pauseOnExit));
     }
-    
+
     enum Direction { Horizontal, VerticalGrowingLeft, VerticalGrowingRight };
     enum Alignment { Start, Middle, End };
 
@@ -92,12 +92,18 @@ public:
     const String& text() const { return m_content; }
     void setText(const String&);
 
+    int cueIndex();
+    void invalidateCueIndex();
+
     PassRefPtr<DocumentFragment> getCueAsHTML();
     void setCueHTML(PassRefPtr<DocumentFragment>);
 
+    virtual bool dispatchEvent(PassRefPtr<Event>);
+    bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+
     bool isActive();
     void setIsActive(bool);
-    
+
     virtual const AtomicString& interfaceName() const;
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
@@ -118,10 +124,10 @@ private:
     void parseSettings(const String&);
     void cueWillChange();
     void cueDidChange();
-    
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
-    
+
     String m_id;
     double m_startTime;
     double m_endTime;
@@ -130,6 +136,8 @@ private:
     int m_linePosition;
     int m_textPosition;
     int m_cueSize;
+    int m_cueIndex;
+
     Alignment m_cueAlignment;
     RefPtr<DocumentFragment> m_documentFragment;
     RefPtr<TextTrack> m_track;
diff --git a/Source/WebCore/html/TextTrackCue.idl b/Source/WebCore/html/track/TextTrackCue.idl
index 4f7a40bae..12a827959 100644
--- a/Source/WebCore/html/TextTrackCue.idl
+++ b/Source/WebCore/html/track/TextTrackCue.idl
@@ -29,7 +29,7 @@ module html {
         Conditional=VIDEO_TRACK,
         V8EnabledAtRuntime=webkitVideoTrack,
         JSGenerateToNativeObject,
-        Constructor(in DOMString id, in double startTime, in double endTime, in DOMString text, in [Optional=CallWithDefaultValue] DOMString settings, in [Optional=CallWithDefaultValue] boolean pauseOnExit),
+        Constructor(in DOMString id, in double startTime, in double endTime, in DOMString text, in [Optional=DefaultIsUndefined] DOMString settings, in [Optional=DefaultIsUndefined] boolean pauseOnExit),
         CallWith=ScriptExecutionContext,
         EventTarget,
         JSCustomMarkFunction,
diff --git a/Source/WebCore/html/TextTrackCueList.cpp b/Source/WebCore/html/track/TextTrackCueList.cpp
index 34b71ca1b..391b2f651 100644
--- a/Source/WebCore/html/TextTrackCueList.cpp
+++ b/Source/WebCore/html/track/TextTrackCueList.cpp
@@ -40,6 +40,11 @@ unsigned long TextTrackCueList::length() const
     return m_list.size();
 }
 
+unsigned long TextTrackCueList::getCueIndex(TextTrackCue* cue) const
+{
+    return m_list.find(cue);
+}
+
 TextTrackCue* TextTrackCueList::item(unsigned index) const
 {
     if (index < m_list.size())
@@ -88,6 +93,7 @@ bool TextTrackCueList::add(PassRefPtr<TextTrackCue> prpCue, size_t start, size_t
             return false;
 
        m_list.insert(start, cue);
+       invalidateCueIndexes(start);
        return true;
     }
 
@@ -119,6 +125,12 @@ void TextTrackCueList::clear()
     m_list.clear();
 }
 
+void TextTrackCueList::invalidateCueIndexes(size_t start)
+{
+    for (size_t i = start; i < m_list.size(); ++i)
+        m_list[i]->invalidateCueIndex();
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/html/TextTrackCueList.h b/Source/WebCore/html/track/TextTrackCueList.h
index 7a7f90415..90b19a5be 100644
--- a/Source/WebCore/html/TextTrackCueList.h
+++ b/Source/WebCore/html/track/TextTrackCueList.h
@@ -45,6 +45,8 @@ public:
     ~TextTrackCueList() { }
 
     unsigned long length() const;
+    unsigned long getCueIndex(TextTrackCue*) const;
+
     TextTrackCue* item(unsigned index) const;
     TextTrackCue* getCueById(const String&) const;
     TextTrackCueList* activeCues();
@@ -57,10 +59,11 @@ private:
     TextTrackCueList();
     bool add(PassRefPtr<TextTrackCue>, size_t, size_t);
     void clear();
-    
+    void invalidateCueIndexes(size_t);
+
     Vector<RefPtr<TextTrackCue> > m_list;
     RefPtr<TextTrackCueList> m_activeCues;
-    
+
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/TextTrackCueList.idl b/Source/WebCore/html/track/TextTrackCueList.idl
index 551840fe9..551840fe9 100644
--- a/Source/WebCore/html/TextTrackCueList.idl
+++ b/Source/WebCore/html/track/TextTrackCueList.idl
diff --git a/Source/WebCore/html/track/TextTrackList.cpp b/Source/WebCore/html/track/TextTrackList.cpp
index 77d9673d4..ead195071 100644
--- a/Source/WebCore/html/track/TextTrackList.cpp
+++ b/Source/WebCore/html/track/TextTrackList.cpp
@@ -55,6 +55,19 @@ unsigned TextTrackList::length() const
     return m_addTrackTracks.size() + m_elementTracks.size();
 }
 
+unsigned TextTrackList::getTrackIndex(TextTrack *textTrack)
+{
+    if (textTrack->trackType() == TextTrack::TrackElement)
+        return static_cast<LoadableTextTrack*>(textTrack)->trackElementIndex();
+
+    if (textTrack->trackType() == TextTrack::AddTrack)
+        return m_elementTracks.size() + m_addTrackTracks.find(textTrack);
+
+    ASSERT_NOT_REACHED();
+
+    return -1;
+}
+
 TextTrack* TextTrackList::item(unsigned index)
 {
     // 4.8.10.12.1 Text track model
@@ -77,13 +90,21 @@ TextTrack* TextTrackList::item(unsigned index)
 void TextTrackList::append(PassRefPtr<TextTrack> prpTrack)
 {
     RefPtr<TextTrack> track = prpTrack;
-    
+
     if (track->trackType() == TextTrack::AddTrack)
         m_addTrackTracks.append(track);
     else if (track->trackType() == TextTrack::TrackElement) {
         // Insert tracks added for <track> element in tree order.
         size_t index = static_cast<LoadableTextTrack*>(track.get())->trackElementIndex();
         m_elementTracks.insert(index, track);
+
+        // Invalidate the cached index for all the following tracks.
+        for (size_t i = index; i < m_elementTracks.size(); ++i)
+            m_elementTracks[i]->invalidateTrackIndex();
+
+        for (size_t i = 0; i < m_addTrackTracks.size(); ++i)
+            m_addTrackTracks[i]->invalidateTrackIndex();
+
     } else
         ASSERT_NOT_REACHED();
 
diff --git a/Source/WebCore/html/track/TextTrackList.h b/Source/WebCore/html/track/TextTrackList.h
index 88d9af62e..f8f04ffa9 100644
--- a/Source/WebCore/html/track/TextTrackList.h
+++ b/Source/WebCore/html/track/TextTrackList.h
@@ -51,6 +51,8 @@ public:
     ~TextTrackList();
 
     unsigned length() const;
+    unsigned getTrackIndex(TextTrack*);
+
     TextTrack* item(unsigned index);
     void append(PassRefPtr<TextTrack>);
     void remove(TextTrack*);
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.py b/Source/WebCore/inspector/CodeGeneratorInspector.py
index 1bb5bdcdb..0bc7a254b 100755
--- a/Source/WebCore/inspector/CodeGeneratorInspector.py
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.py
@@ -56,7 +56,8 @@ TYPE_NAME_FIX_MAP = {
 }
 
 
-TYPES_WITH_RUNTIME_CAST_SET = frozenset([])
+TYPES_WITH_RUNTIME_CAST_SET = frozenset(["Runtime.RemoteObject", "Runtime.PropertyDescriptor",
+                                         "Debugger.FunctionDetails", "Debugger.CallFrame"])
 
 
 cmdline_parser = optparse.OptionParser()
@@ -180,18 +181,6 @@ class DomainNameFixes:
     skip_js_bind_domains = set(["Runtime", "DOMDebugger"])
 
 
-class CParamType(object):
-    def __init__(self, type, setter_format="%s"):
-        self.type = type
-        self.setter_format = setter_format
-
-    def get_text(self):
-        return self.type
-
-    def get_setter_format(self):
-        return self.setter_format
-
-
 class RawTypes(object):
     @staticmethod
     def get(json_type):
@@ -236,14 +225,6 @@ class RawTypes(object):
         need_internal_runtime_cast_ = False
 
         @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            return cls.default_c_param_type
-
-        @staticmethod
-        def is_event_param_check_optional():
-            return False
-
-        @classmethod
         def request_raw_internal_runtime_cast(cls):
             if not cls.need_internal_runtime_cast_:
                 RawTypes.types_to_generate_validator_.append(cls)
@@ -273,13 +254,6 @@ class RawTypes(object):
 
 
     class String(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT or param_type == ParamType.TYPE_BUILDER_OUTPUT:
-                return cls._ref_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "String"
@@ -314,8 +288,9 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "String"
 
-        _plain_c_type = CParamType("String")
-        _ref_c_type = CParamType("const String&")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.String
 
     class Int(BaseType):
         @staticmethod
@@ -354,7 +329,9 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "int"
 
-        default_c_param_type = CParamType("int")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Int
 
     class Number(BaseType):
         @staticmethod
@@ -389,19 +366,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "double"
 
-        default_c_param_type = CParamType("double")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Number
 
     class Bool(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT:
-                if optional:
-                    return cls._ref_c_type
-                else:
-                    return cls._plain_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "Boolean"
@@ -417,10 +386,6 @@ class RawTypes(object):
             return "boolean"
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def get_validate_method_params():
             class ValidateMethodParams:
                 name = "Boolean"
@@ -440,17 +405,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "bool"
 
-        _plain_c_type = CParamType("bool")
-        _ref_c_type = CParamType("const bool* const", "*%s")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Bool
 
     class Object(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT or param_type == ParamType.TYPE_BUILDER_OUTPUT:
-                return cls._ref_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "Object"
@@ -466,10 +425,6 @@ class RawTypes(object):
             return "object"
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def get_output_argument_prefix():
             return ""
 
@@ -489,17 +444,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "InspectorObject"
 
-        _plain_c_type = CParamType("RefPtr<InspectorObject>")
-        _ref_c_type = CParamType("PassRefPtr<InspectorObject>")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Object
 
     class Any(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT or param_type == ParamType.TYPE_BUILDER_OUTPUT:
-                return cls._ref_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "Value"
@@ -515,12 +464,8 @@ class RawTypes(object):
             raise Exception("Unsupported")
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def generate_validate_method(writer):
-            writer.newline("static void assertAny(InspectorValue* value)\n")
+            writer.newline("static void assertAny(InspectorValue*)\n")
             writer.newline("{\n")
             writer.newline("    // No-op.\n")
             writer.newline("}\n\n\n")
@@ -541,19 +486,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "InspectorValue"
 
-        _plain_c_type = CParamType("RefPtr<InspectorValue>")
-        _ref_c_type = CParamType("PassRefPtr<InspectorValue>")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Any
 
     class Array(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.OUTPUT:
-                return cls._plain_c_type
-            elif param_type == ParamType.INPUT:
-                return cls._plain_c_type
-            else:
-                return cls._ref_c_type
-
         @staticmethod
         def get_getter_name():
             return "Array"
@@ -569,10 +506,6 @@ class RawTypes(object):
             return "object"
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def get_output_argument_prefix():
             return ""
 
@@ -592,15 +525,171 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "InspectorArray"
 
-        _plain_c_type = CParamType("RefPtr<InspectorArray>")
-        _ref_c_type = CParamType("PassRefPtr<InspectorArray>")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Array
+
+
+def replace_right_shift(input_str):
+    return input_str.replace(">>", "> >")
+
 
+class CommandReturnPassModel:
+    class ByReference:
+        def __init__(self, var_type, set_condition):
+            self.var_type = var_type
+            self.set_condition = set_condition
+
+        def get_return_var_type(self):
+            return self.var_type
+
+        @staticmethod
+        def get_output_argument_prefix():
+            return ""
+
+        @staticmethod
+        def get_output_to_raw_expression():
+            return "%s"
+
+        def get_output_parameter_type(self):
+            return self.var_type + "&"
+
+        def get_set_return_condition(self):
+            return self.set_condition
+
+    class ByPointer:
+        def __init__(self, var_type):
+            self.var_type = var_type
+
+        def get_return_var_type(self):
+            return self.var_type
+
+        @staticmethod
+        def get_output_argument_prefix():
+            return "&"
+
+        @staticmethod
+        def get_output_to_raw_expression():
+            return "%s"
+
+        def get_output_parameter_type(self):
+            return self.var_type + "*"
+
+        @staticmethod
+        def get_set_return_condition():
+            return None
+
+
+class TypeModel:
+    class RefPtrBased:
+        def __init__(self, class_name):
+            self.class_name = class_name
+            self.optional = False
+
+        def get_optional(self):
+            result = TypeModel.RefPtrBased(self.class_name)
+            result.optional = True
+            return result
+
+        def get_command_return_pass_model(self):
+            if self.optional:
+                set_condition = "%s"
+            else:
+                set_condition = None
+            return CommandReturnPassModel.ByReference(replace_right_shift("RefPtr<%s>" % self.class_name), set_condition)
+
+        def get_input_param_type_text(self):
+            return replace_right_shift("PassRefPtr<%s>" % self.class_name)
+
+        @staticmethod
+        def get_event_setter_expression_pattern():
+            return "%s"
+
+    class Enum:
+        def __init__(self, base_type_name):
+            self.type_name = base_type_name + "::Enum"
+
+        def get_optional(base_self):
+            class EnumOptional:
+                @classmethod
+                def get_optional(cls):
+                    return cls
+
+                @staticmethod
+                def get_command_return_pass_model():
+                    # FIXME: to be replaced with OptOutput model.
+                    return CommandReturnPassModel.ByPointer(base_self.type_name)
+
+                @staticmethod
+                def get_input_param_type_text():
+                    return base_self.type_name + "*"
+
+                @staticmethod
+                def get_event_setter_expression_pattern():
+                    raise Exception("TODO")
+            return EnumOptional
+
+        def get_command_return_pass_model(self):
+            return CommandReturnPassModel.ByPointer(self.type_name)
+
+        def get_input_param_type_text(self):
+            return self.type_name
+
+        @staticmethod
+        def get_event_setter_expression_pattern():
+            return "%s"
+
+    class ValueType:
+        def __init__(self, type_name, is_heavy):
+            self.type_name = type_name
+            self.is_heavy = is_heavy
+
+        def get_optional(self):
+            return self.ValueOptional(self)
+
+        def get_command_return_pass_model(self):
+            return CommandReturnPassModel.ByPointer(self.type_name)
+
+        def get_input_param_type_text(self):
+            if self.is_heavy:
+                return "const %s&" % self.type_name
+            else:
+                return self.type_name
+
+        @staticmethod
+        def get_event_setter_expression_pattern():
+            return "%s"
+
+        class ValueOptional:
+            def __init__(self, base):
+                self.base = base
+
+            def get_optional(self):
+                return self
+
+            def get_command_return_pass_model(self):
+                # FIXME: to be replaced with OptOutput model.
+                return CommandReturnPassModel.ByPointer(self.base.type_name)
+
+            def get_input_param_type_text(self):
+                return "const %s* const" % self.base.type_name
+
+            @staticmethod
+            def get_event_setter_expression_pattern():
+                return "*%s"
+
+    @classmethod
+    def init_class(cls):
+        cls.Bool = cls.ValueType("bool", False)
+        cls.Int = cls.ValueType("int", False)
+        cls.Number = cls.ValueType("double", False)
+        cls.String = cls.ValueType("String", True)
+        cls.Object = cls.RefPtrBased("InspectorObject")
+        cls.Array = cls.RefPtrBased("InspectorArray")
+        cls.Any = cls.RefPtrBased("InspectorValue")
+
+TypeModel.init_class()
 
-class ParamType(object):
-    INPUT = "input"
-    OUTPUT = "output"
-    EVENT = "event"
-    TYPE_BUILDER_OUTPUT = "typeBuilderOutput"
 
 # Collection of InspectorObject class methods that are likely to be overloaded in generated class.
 # We must explicitly import all overloaded methods or they won't be available to user.
@@ -725,7 +814,7 @@ class TypeBindings:
     def create_ad_hoc_type_declaration(json_typable, context_domain_name, ad_hoc_type_context):
         class Helper:
             is_ad_hoc = True
-            full_name_prefix_for_use = ""
+            full_name_prefix_for_use = ad_hoc_type_context.container_relative_name_prefix
             full_name_prefix_for_impl = ad_hoc_type_context.container_full_name_prefix
 
             @staticmethod
@@ -832,21 +921,21 @@ class TypeBindings:
                         return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::assertCorrectValue"
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::Enum"
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
-                        return cls.get_in_c_type_text(False)
+                        return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::Enum"
 
                     @staticmethod
                     def get_setter_value_expression_pattern():
-                        return "getEnumConstantValue(%s)"
+                        return "TypeBuilder::getEnumConstantValue(%s)"
 
                     @staticmethod
                     def reduce_to_raw_type():
                         return RawTypes.String
 
+                    @staticmethod
+                    def get_type_model():
+                        return TypeModel.Enum(helper.full_name_prefix_for_use + fixed_type_name.class_name)
+
                 return EnumBinding
             else:
                 if helper.is_ad_hoc:
@@ -877,14 +966,14 @@ class TypeBindings:
                             return RawTypes.String
 
                         @staticmethod
+                        def get_type_model():
+                            return TypeModel.String
+
+                        @staticmethod
                         def get_setter_value_expression_pattern():
                             return None
 
                         @classmethod
-                        def get_in_c_type_text(cls, optional):
-                            return cls.reduce_to_raw_type().get_c_param_type(ParamType.EVENT, optional).get_text()
-
-                        @classmethod
                         def get_array_item_c_type_text(cls):
                             return cls.reduce_to_raw_type().get_array_item_raw_c_type_text()
 
@@ -935,16 +1024,16 @@ class TypeBindings:
                             return RawTypes.String
 
                         @staticmethod
+                        def get_type_model():
+                            return TypeModel.ValueType("%s%s" % (helper.full_name_prefix_for_use, fixed_type_name.class_name), True)
+
+                        @staticmethod
                         def get_setter_value_expression_pattern():
                             return None
 
                         @classmethod
-                        def get_in_c_type_text(cls, optional):
-                            return "const %s%s&" % (helper.full_name_prefix_for_use, fixed_type_name.class_name)
-
-                        @classmethod
                         def get_array_item_c_type_text(cls):
-                            return cls.get_in_c_type_text(False)
+                            return "const %s%s&" % (helper.full_name_prefix_for_use, fixed_type_name.class_name)
 
                     return TypedefString
 
@@ -1220,10 +1309,6 @@ class TypeBindings:
                         return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::assertCorrectValue"
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return "PassRefPtr<" + helper.full_name_prefix_for_use + fixed_type_name.class_name + ">"
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
                         return helper.full_name_prefix_for_use + fixed_type_name.class_name
 
@@ -1235,6 +1320,10 @@ class TypeBindings:
                     def reduce_to_raw_type():
                         return RawTypes.Object
 
+                    @staticmethod
+                    def get_type_model():
+                        return TypeModel.RefPtrBased(helper.full_name_prefix_for_use + fixed_type_name.class_name)
+
                     class AdHocTypeContextImpl:
                         def __init__(self, property_name, class_name, resolve_context, ad_hoc_type_list, parent_full_name_prefix):
                             self.property_name = property_name
@@ -1242,6 +1331,7 @@ class TypeBindings:
                             self.resolve_context = resolve_context
                             self.ad_hoc_type_list = ad_hoc_type_list
                             self.container_full_name_prefix = parent_full_name_prefix + class_name + "::"
+                            self.container_relative_name_prefix = ""
 
                         def get_type_name_fix(self):
                             class NameFix:
@@ -1281,10 +1371,6 @@ class TypeBindings:
                         raise Exception("Unsupported")
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return cls.reduce_to_raw_type().get_c_param_type(ParamType.EVENT, optional).get_text()
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
                         return cls.reduce_to_raw_type().get_array_item_raw_c_type_text()
 
@@ -1296,6 +1382,10 @@ class TypeBindings:
                     def reduce_to_raw_type():
                         return RawTypes.Object
 
+                    @staticmethod
+                    def get_type_model():
+                        return TypeModel.Object
+
                 return PlainObjectBinding
         elif json_typable["type"] == "array":
             if "items" in json_typable:
@@ -1304,6 +1394,7 @@ class TypeBindings:
 
                 class AdHocTypeContext:
                     container_full_name_prefix = "<not yet defined>"
+                    container_relative_name_prefix = "<not yet defined>"
 
                     @staticmethod
                     def get_type_name_fix():
@@ -1378,12 +1469,8 @@ class TypeBindings:
                         return cls.get_array_item_c_type_text() + "::assertCorrectValue"
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return "PassRefPtr<TypeBuilder::Array<%s > >" % cls.resolve_data_.item_type_binding.get_array_item_c_type_text()
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
-                        return "TypeBuilder::Array<%s >" % cls.resolve_data_.item_type_binding.get_array_item_c_type_text()
+                        return replace_right_shift("TypeBuilder::Array<%s>" % cls.resolve_data_.item_type_binding.get_array_item_c_type_text())
 
                     @staticmethod
                     def get_setter_value_expression_pattern():
@@ -1393,6 +1480,10 @@ class TypeBindings:
                     def reduce_to_raw_type():
                         return RawTypes.Array
 
+                    @classmethod
+                    def get_type_model(cls):
+                        return TypeModel.RefPtrBased(cls.get_array_item_c_type_text())
+
                 return ArrayBinding
             else:
                 # Fall-through to raw type.
@@ -1422,9 +1513,6 @@ class RawTypeBinding:
     def get_validator_call_text(self):
         return self.raw_type_.get_raw_validator_call_text()
 
-    def get_in_c_type_text(self, optional):
-        return self.raw_type_.get_c_param_type(ParamType.EVENT, optional).get_text()
-
     def get_array_item_c_type_text(self):
         return self.raw_type_.get_array_item_raw_c_type_text()
 
@@ -1434,6 +1522,9 @@ class RawTypeBinding:
     def reduce_to_raw_type(self):
         return self.raw_type_
 
+    def get_type_model(self):
+        return self.raw_type_.get_raw_type_model()
+
 
 class TypeData(object):
     def __init__(self, json_type, json_domain, domain_data):
@@ -2358,7 +2449,7 @@ class MethodGenerateModes:
     class StrictParameterMode:
         @staticmethod
         def get_c_param_type_text(type_binding):
-            return type_binding.get_in_c_type_text(False)
+            return type_binding.get_type_model().get_input_param_type_text()
 
         @staticmethod
         def get_setter_value_expression(param_type_binding, value_ref):
@@ -2371,7 +2462,7 @@ class MethodGenerateModes:
     class RawParameterMode:
         @staticmethod
         def get_c_param_type_text(type_binding):
-            return type_binding.reduce_to_raw_type().get_c_param_type(ParamType.TYPE_BUILDER_OUTPUT, False).get_text()
+            return type_binding.reduce_to_raw_type().get_raw_type_model().get_input_param_type_text()
 
         @staticmethod
         def get_setter_value_expression(param_type_binding, value_ref):
@@ -2380,8 +2471,8 @@ class MethodGenerateModes:
     class CombinedMode:
         @staticmethod
         def get_c_param_type_text(type_binding):
-            return get_annotated_type_text(type_binding.reduce_to_raw_type().get_c_param_type(ParamType.TYPE_BUILDER_OUTPUT, False).get_text(),
-                type_binding.get_in_c_type_text(False))
+            return get_annotated_type_text(type_binding.reduce_to_raw_type().get_raw_type_model().get_input_param_type_text(),
+                type_binding.get_type_model().get_input_param_type_text())
 
         @staticmethod
         def get_setter_value_expression(param_type_binding, value_ref):
@@ -2470,7 +2561,7 @@ class Generator:
             Generator.backend_agent_interface_list.append("    public:\n")
             if "commands" in json_domain:
                 for json_command in json_domain["commands"]:
-                    Generator.process_command(json_command, domain_name, agent_field_name)
+                    Generator.process_command(json_command, domain_name, agent_field_name, agent_interface_name)
             Generator.backend_agent_interface_list.append("\n    protected:\n")
             Generator.backend_agent_interface_list.append("        virtual ~%s() { }\n" % agent_interface_name)
             Generator.backend_agent_interface_list.append("    };\n\n")
@@ -2527,63 +2618,28 @@ class Generator:
             for json_parameter in json_event["parameters"]:
                 parameter_name = json_parameter["name"]
 
-                raw_type = resolve_param_raw_type(json_parameter, domain_name)
+                param_type_binding = Generator.resolve_type_and_generate_ad_hoc(json_parameter, event_name, domain_name, ad_hoc_type_writer, "")
 
-                json_optional = "optional" in json_parameter and json_parameter["optional"]
+                raw_type = param_type_binding.reduce_to_raw_type()
+                raw_type_binding = RawTypeBinding(raw_type)
 
-                optional_mask = raw_type.is_event_param_check_optional()
-                c_type = raw_type.get_c_param_type(ParamType.EVENT, json_optional)
+                optional = bool(json_parameter.get("optional"))
 
                 setter_type = raw_type.get_setter_name()
 
-                optional = optional_mask and json_optional
-
-                ad_hoc_type_list = []
-
-                class AdHocTypeContext:
-                    container_full_name_prefix = "<not yet defined>"
-
-                    @staticmethod
-                    def get_type_name_fix():
-                        class NameFix:
-                            class_name = Capitalizer.lower_camel_case_to_upper(parameter_name)
-
-                            @staticmethod
-                            def output_comment(writer):
-                                writer.newline("// Named after parameter name '%s' while generating event %s.\n" % (parameter_name, event_name))
-
-                        return NameFix
-
-                    @staticmethod
-                    def add_type(binding):
-                        ad_hoc_type_list.append(binding)
-
-                param_type_binding = resolve_param_type(json_parameter, domain_name, AdHocTypeContext)
-
-                class EventForwardListener:
-                    @staticmethod
-                    def add_type_data(type_data):
-                        pass
-
-                class EventResolveContext:
-                    forward_listener = EventForwardListener
-
-                for type in ad_hoc_type_list:
-                    type.resolve_inner(EventResolveContext)
-
-                class EventGenerateContext:
-                    validator_writer = "not supported in EventGenerateContext"
-
-                for type in ad_hoc_type_list:
-                    generator = type.get_code_generator()
-                    if generator:
-                        generator.generate_type_builder(ad_hoc_type_writer, EventGenerateContext)
+                type_model = param_type_binding.get_type_model()
+                raw_type_model = raw_type_binding.get_type_model()
+                if optional:
+                    type_model = type_model.get_optional()
+                    raw_type_model = raw_type_model.get_optional()
 
-                annotated_type = get_annotated_type_text(c_type.get_text(), param_type_binding.get_in_c_type_text(json_optional))
+                annotated_type = get_annotated_type_text(raw_type_model.get_input_param_type_text(), type_model.get_input_param_type_text())
 
                 parameter_list.append("%s %s" % (annotated_type, parameter_name))
 
-                setter_argument = c_type.get_setter_format() % parameter_name
+                setter_argument = raw_type_model.get_event_setter_expression_pattern() % parameter_name
+                if raw_type_binding.get_setter_value_expression_pattern():
+                    setter_argument = raw_type_binding.get_setter_value_expression_pattern() % setter_argument
 
                 setter_code = "    paramsObject->set%s(\"%s\", %s);\n" % (setter_type, parameter_name, setter_argument)
                 if optional:
@@ -2604,12 +2660,16 @@ class Generator:
             domain_name, event_name, join(backend_js_event_param_list, ", ")))
 
     @staticmethod
-    def process_command(json_command, domain_name, agent_field_name):
+    def process_command(json_command, domain_name, agent_field_name, agent_interface_name):
         json_command_name = json_command["name"]
         Generator.method_name_enum_list.append("        k%s_%sCmd," % (domain_name, json_command["name"]))
         Generator.method_handler_list.append("            &InspectorBackendDispatcherImpl::%s_%s," % (domain_name, json_command_name))
         Generator.backend_method_declaration_list.append("    void %s_%s(long callId, InspectorObject* requestMessageObject);" % (domain_name, json_command_name))
 
+        ad_hoc_type_output = []
+        Generator.backend_agent_interface_list.append(ad_hoc_type_output)
+        ad_hoc_type_writer = Writer(ad_hoc_type_output, "        ")
+
         Generator.backend_agent_interface_list.append("        virtual void %s(ErrorString*" % json_command_name)
 
         method_in_code = ""
@@ -2629,21 +2689,28 @@ class Generator:
                 json_param_name = json_parameter["name"]
                 param_raw_type = resolve_param_raw_type(json_parameter, domain_name)
 
-                var_type = param_raw_type.get_c_param_type(ParamType.INPUT, None)
-                formal_param_type = var_type
                 getter_name = param_raw_type.get_getter_name()
 
                 optional = json_parameter.get("optional")
+
+                non_optional_type_model = param_raw_type.get_raw_type_model()
+                if optional:
+                    type_model = non_optional_type_model.get_optional()
+                else:
+                    type_model = non_optional_type_model
+
                 if optional:
                     code = ("    bool %s_valueFound = false;\n"
                             "    %s in_%s = get%s(paramsContainerPtr, \"%s\", &%s_valueFound, protocolErrorsPtr);\n" %
-                           (json_param_name, var_type.get_text(), json_param_name, getter_name, json_param_name, json_param_name))
+                           (json_param_name, non_optional_type_model.get_command_return_pass_model().get_return_var_type(), json_param_name, getter_name, json_param_name, json_param_name))
                     param = ", %s_valueFound ? &in_%s : 0" % (json_param_name, json_param_name)
+                    # FIXME: pass optional refptr-values as PassRefPtr
                     formal_param_type_pattern = "const %s*"
                 else:
                     code = ("    %s in_%s = get%s(paramsContainerPtr, \"%s\", 0, protocolErrorsPtr);\n" %
-                            (var_type.get_text(), json_param_name, getter_name, json_param_name))
+                            (non_optional_type_model.get_command_return_pass_model().get_return_var_type(), json_param_name, getter_name, json_param_name))
                     param = ", in_%s" % json_param_name
+                    # FIXME: pass not-optional refptr-values as NonNullPassRefPtr
                     if param_raw_type.is_heavy_value():
                         formal_param_type_pattern = "const %s&"
                     else:
@@ -2651,7 +2718,7 @@ class Generator:
 
                 method_in_code += code
                 agent_call_param_list.append(param)
-                Generator.backend_agent_interface_list.append(", %s in_%s" % (formal_param_type_pattern % formal_param_type.get_text(), json_param_name))
+                Generator.backend_agent_interface_list.append(", %s in_%s" % (formal_param_type_pattern % non_optional_type_model.get_command_return_pass_model().get_return_var_type(), json_param_name))
 
                 js_bind_type = param_raw_type.get_js_bind_type()
                 js_param_text = "{\"name\": \"%s\", \"type\": \"%s\", \"optional\": %s}" % (
@@ -2671,28 +2738,46 @@ class Generator:
 
                 json_return_name = json_return["name"]
 
-                optional = "optional" in json_return and json_return["optional"]
+                optional = bool(json_return.get("optional"))
+
+                return_type_binding = Generator.resolve_type_and_generate_ad_hoc(json_return, json_command_name, domain_name, ad_hoc_type_writer, agent_interface_name + "::")
 
-                raw_type = resolve_param_raw_type(json_return, domain_name)
+                raw_type = return_type_binding.reduce_to_raw_type()
                 setter_type = raw_type.get_setter_name()
                 initializer = raw_type.get_c_initializer()
-                var_type = raw_type.get_c_param_type(ParamType.OUTPUT, None)
 
-                code = "    %s out_%s = %s;\n" % (var_type.get_text(), json_return_name, initializer)
+                type_model = return_type_binding.get_type_model()
+                if optional:
+                    type_model = type_model.get_optional()
+
+                raw_type_model = return_type_binding.get_type_model()
+                if optional:
+                    raw_type_model = raw_type_model.get_optional()
+
+                code = "    %s out_%s = %s;\n" % (raw_type.get_raw_type_model().get_command_return_pass_model().get_return_var_type(), json_return_name, initializer)
                 param = ", %sout_%s" % (raw_type.get_output_pass_model().get_argument_prefix(), json_return_name)
                 cook = "        result->set%s(\"%s\", out_%s);\n" % (setter_type, json_return_name, json_return_name)
                 if optional:
                     # FIXME: support optional properly. Probably an additional output parameter should be in each case.
                     # FIXME: refactor this condition; it's a hack now.
-                    if var_type.get_text() == "bool" or var_type.get_text().startswith("RefPtr<"):
+                    var_type_text = raw_type.get_raw_type_model().get_command_return_pass_model().get_return_var_type()
+                    if var_type_text == "bool" or var_type_text.startswith("RefPtr<"):
                         cook = ("        if (out_%s)\n    " % json_return_name) + cook
                     else:
                         cook = "        // FIXME: support optional here.\n" + cook
 
+                annotated_type = get_annotated_type_text(raw_type.get_raw_type_model().get_command_return_pass_model().get_return_var_type() + raw_type.get_output_pass_model().get_parameter_type_suffix(),
+                                                         type_model.get_command_return_pass_model().get_output_parameter_type())
+
+                param_name = "out_%s" % json_return_name
+                if optional:
+                    param_name = "opt_" + param_name
+
+                Generator.backend_agent_interface_list.append(", %s %s" % (annotated_type, param_name))
+                response_cook_list.append(cook)
+
                 method_out_code += code
                 agent_call_param_list.append(param)
-                Generator.backend_agent_interface_list.append(", %s%s out_%s" % (var_type.get_text(), raw_type.get_output_pass_model().get_parameter_type_suffix(), json_return_name))
-                response_cook_list.append(cook)
 
                 backend_js_reply_param_list.append("\"%s\"" % json_return_name)
 
@@ -2714,6 +2799,53 @@ class Generator:
         Generator.backend_agent_interface_list.append(") = 0;\n")
 
     @staticmethod
+    def resolve_type_and_generate_ad_hoc(json_param, method_name, domain_name, ad_hoc_type_writer, container_relative_name_prefix_param):
+        param_name = json_param["name"]
+        ad_hoc_type_list = []
+
+        class AdHocTypeContext:
+            container_full_name_prefix = "<not yet defined>"
+            container_relative_name_prefix = container_relative_name_prefix_param
+
+            @staticmethod
+            def get_type_name_fix():
+                class NameFix:
+                    class_name = Capitalizer.lower_camel_case_to_upper(param_name)
+
+                    @staticmethod
+                    def output_comment(writer):
+                        writer.newline("// Named after parameter '%s' while generating command/event %s.\n" % (param_name, method_name))
+
+                return NameFix
+
+            @staticmethod
+            def add_type(binding):
+                ad_hoc_type_list.append(binding)
+
+        type_binding = resolve_param_type(json_param, domain_name, AdHocTypeContext)
+
+        class InterfaceForwardListener:
+            @staticmethod
+            def add_type_data(type_data):
+                pass
+
+        class InterfaceResolveContext:
+            forward_listener = InterfaceForwardListener
+
+        for type in ad_hoc_type_list:
+            type.resolve_inner(InterfaceResolveContext)
+
+        class InterfaceGenerateContext:
+            validator_writer = "not supported in InterfaceGenerateContext"
+
+        for type in ad_hoc_type_list:
+            generator = type.get_code_generator()
+            if generator:
+                generator.generate_type_builder(ad_hoc_type_writer, InterfaceGenerateContext)
+
+        return type_binding
+
+    @staticmethod
     def process_types(type_map):
         output = Generator.type_builder_fragments
 
@@ -2807,7 +2939,7 @@ backend_js_file = open(output_cpp_dirname + "/InspectorBackendStub.js", "w")
 
 backend_h_file.write(Templates.backend_h.substitute(None,
     virtualSetters=join(Generator.backend_virtual_setters_list, "\n"),
-    agentInterfaces=join(Generator.backend_agent_interface_list, ""),
+    agentInterfaces=join(flatten_list(Generator.backend_agent_interface_list), ""),
     methodNamesEnumContent=join(Generator.method_name_enum_list, "\n")))
 
 backend_cpp_file.write(Templates.backend_cpp.substitute(None,
diff --git a/Source/WebCore/inspector/DOMEditor.cpp b/Source/WebCore/inspector/DOMEditor.cpp
index 63afa9639..e1cb23c10 100644
--- a/Source/WebCore/inspector/DOMEditor.cpp
+++ b/Source/WebCore/inspector/DOMEditor.cpp
@@ -33,424 +33,427 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "Attribute.h"
-#include "Base64.h"
+#include "DOMPatchSupport.h"
 #include "Document.h"
-#include "DocumentFragment.h"
-#include "HTMLDocument.h"
-#include "HTMLDocumentParser.h"
-#include "HTMLElement.h"
-#include "HTMLHeadElement.h"
-#include "HTMLNames.h"
+#include "Element.h"
+#include "ExceptionCode.h"
+#include "InspectorHistory.h"
 #include "Node.h"
+#include "Text.h"
+
+#include "markup.h"
 
-#include <wtf/Deque.h>
 #include <wtf/RefPtr.h>
-#include <wtf/SHA1.h>
-#include <wtf/text/CString.h>
 
 using namespace std;
 
 namespace WebCore {
 
-using HTMLNames::bodyTag;
-using HTMLNames::headTag;
-using HTMLNames::htmlTag;
+class DOMEditor::RemoveChildAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(RemoveChildAction);
+public:
+    RemoveChildAction(Node* parentNode, Node* node)
+        : InspectorHistory::Action("RemoveChild")
+        , m_parentNode(parentNode)
+        , m_node(node)
+    {
+    }
 
-struct DOMEditor::Digest {
-    explicit Digest(Node* node) : m_node(node) { }
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_anchorNode = m_node->nextSibling();
+        return redo(ec);
+    }
 
-    String m_sha1;
-    String m_attrsSHA1;
-    Node* m_node;
-    Vector<OwnPtr<Digest> > m_children;
-};
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
+    }
 
-DOMEditor::DOMEditor(Document* document) : m_document(document) { }
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_parentNode->removeChild(m_node.get(), ec);
+    }
 
-DOMEditor::~DOMEditor() { }
+private:
+    RefPtr<Node> m_parentNode;
+    RefPtr<Node> m_node;
+    RefPtr<Node> m_anchorNode;
+};
 
-void DOMEditor::patchDocument(const String& markup)
-{
-    RefPtr<HTMLDocument> newDocument = HTMLDocument::create(0, KURL());
-    RefPtr<DocumentParser> parser = HTMLDocumentParser::create(newDocument.get(), false);
-    parser->insert(markup); // Use insert() so that the parser will not yield.
-    parser->finish();
-    parser->detach();
+class DOMEditor::InsertBeforeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(InsertBeforeAction);
+public:
+    InsertBeforeAction(Node* parentNode, PassRefPtr<Node> node, Node* anchorNode)
+        : InspectorHistory::Action("InsertBefore")
+        , m_parentNode(parentNode)
+        , m_node(node)
+        , m_anchorNode(anchorNode)
+    {
+    }
 
-    ExceptionCode ec = 0;
-    OwnPtr<Digest> oldInfo = createDigest(m_document->documentElement(), 0);
-    OwnPtr<Digest> newInfo = createDigest(newDocument->documentElement(), &m_unusedNodesMap);
-    innerPatchNode(oldInfo.get(), newInfo.get(), ec);
+    virtual bool perform(ExceptionCode& ec)
+    {
+        if (m_node->parentNode()) {
+            m_removeChildAction = adoptPtr(new RemoveChildAction(m_node->parentNode(), m_node.get()));
+            if (!m_removeChildAction->perform(ec))
+                return false;
+        }
+        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
+    }
 
-    if (ec) {
-        // Fall back to rewrite.
-        m_document->write(markup);
-        m_document->close();
+    virtual bool undo(ExceptionCode& ec)
+    {
+        if (!m_parentNode->removeChild(m_node.get(), ec))
+            return false;
+        if (m_removeChildAction)
+            return m_removeChildAction->undo(ec);
+        return true;
     }
-}
 
-Node* DOMEditor::patchNode(Node* node, const String& markup, ExceptionCode& ec)
-{
-    // Don't parse <html> as a fragment.
-    if (node->isDocumentNode() || (node->parentNode() && node->parentNode()->isDocumentNode())) {
-        patchDocument(markup);
-        return 0;
-    }
-
-    Node* previousSibling = node->previousSibling();
-    RefPtr<DocumentFragment> fragment = DocumentFragment::create(m_document);
-    fragment->parseHTML(markup, node->parentElement() ? node->parentElement() : m_document->documentElement());
-
-    // Compose the old list.
-    ContainerNode* parentNode = node->parentNode();
-    Vector<OwnPtr<Digest> > oldList;
-    for (Node* child = parentNode->firstChild(); child; child = child->nextSibling())
-        oldList.append(createDigest(child, 0));
-
-    // Compose the new list.
-    String markupCopy = markup;
-    markupCopy.makeLower();
-    Vector<OwnPtr<Digest> > newList;
-    for (Node* child = parentNode->firstChild(); child != node; child = child->nextSibling())
-        newList.append(createDigest(child, 0));
-    for (Node* child = fragment->firstChild(); child; child = child->nextSibling()) {
-        if (child->hasTagName(headTag) && !child->firstChild() && markupCopy.find("</head>") == notFound)
-            continue; // HTML5 parser inserts empty <head> tag whenever it parses <body>
-        if (child->hasTagName(bodyTag) && !child->firstChild() && markupCopy.find("</body>") == notFound)
-            continue; // HTML5 parser inserts empty <body> tag whenever it parses </head>
-        newList.append(createDigest(child, &m_unusedNodesMap));
-    }
-    for (Node* child = node->nextSibling(); child; child = child->nextSibling())
-        newList.append(createDigest(child, 0));
-
-    innerPatchChildren(parentNode, oldList, newList, ec);
-    if (ec) {
-        // Fall back to total replace.
-        ec = 0;
-        parentNode->replaceChild(fragment.release(), node, ec);
-        if (ec)
-            return 0;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        if (m_removeChildAction && !m_removeChildAction->redo(ec))
+            return false;
+        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
     }
-    return previousSibling ? previousSibling->nextSibling() : parentNode->firstChild();
-}
 
-void DOMEditor::innerPatchNode(Digest* oldDigest, Digest* newDigest, ExceptionCode& ec)
-{
-    if (oldDigest->m_sha1 == newDigest->m_sha1)
-        return;
+private:
+    RefPtr<Node> m_parentNode;
+    RefPtr<Node> m_node;
+    RefPtr<Node> m_anchorNode;
+    OwnPtr<RemoveChildAction> m_removeChildAction;
+};
 
-    Node* oldNode = oldDigest->m_node;
-    Node* newNode = newDigest->m_node;
+class DOMEditor::RemoveAttributeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(RemoveAttributeAction);
+public:
+    RemoveAttributeAction(Element* element, const String& name)
+        : InspectorHistory::Action("RemoveAttribute")
+        , m_element(element)
+        , m_name(name)
+    {
+    }
 
-    if (newNode->nodeType() != oldNode->nodeType() || newNode->nodeName() != oldNode->nodeName()) {
-        oldNode->parentNode()->replaceChild(newNode, oldNode, ec);
-        return;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_value = m_element->getAttribute(m_name);
+        return redo(ec);
     }
 
-    if (oldNode->nodeValue() != newNode->nodeValue())
-        oldNode->setNodeValue(newNode->nodeValue(), ec);
-    if (ec)
-        return;
+    virtual bool undo(ExceptionCode& ec)
+    {
+        m_element->setAttribute(m_name, m_value, ec);
+        return true;
+    }
 
-    if (oldNode->nodeType() != Node::ELEMENT_NODE)
-        return;
+    virtual bool redo(ExceptionCode&)
+    {
+        m_element->removeAttribute(m_name);
+        return true;
+    }
 
-    // Patch attributes
-    Element* oldElement = static_cast<Element*>(oldNode);
-    Element* newElement = static_cast<Element*>(newNode);
-    if (oldDigest->m_attrsSHA1 != newDigest->m_attrsSHA1) {
-        // FIXME: Create a function in Element for removing all properties. Take in account whether did/willModifyAttribute are important.
-        if (oldElement->hasAttributesWithoutUpdate()) {
-            while (oldElement->attributeCount())
-                oldElement->removeAttribute(0);
-        }
+private:
+    RefPtr<Element> m_element;
+    String m_name;
+    String m_value;
+};
 
-        // FIXME: Create a function in Element for copying properties. setAttributesFromElement() is close but not enough for this case.
-        if (newElement->hasAttributesWithoutUpdate()) {
-            size_t numAttrs = newElement->attributeCount();
-            for (size_t i = 0; i < numAttrs; ++i) {
-                const Attribute* attribute = newElement->attributeItem(i);
-                oldElement->setAttribute(attribute->name(), attribute->value());
-            }
-        }
+class DOMEditor::SetAttributeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(SetAttributeAction);
+public:
+    SetAttributeAction(Element* element, const String& name, const String& value)
+        : InspectorHistory::Action("SetAttribute")
+        , m_element(element)
+        , m_name(name)
+        , m_value(value)
+        , m_hadAttribute(false)
+    {
     }
 
-    innerPatchChildren(oldElement, oldDigest->m_children, newDigest->m_children, ec);
-    m_unusedNodesMap.remove(newDigest->m_sha1);
-}
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_hadAttribute = m_element->hasAttribute(m_name);
+        if (m_hadAttribute)
+            m_oldValue = m_element->getAttribute(m_name);
+        return redo(ec);
+    }
 
-pair<DOMEditor::ResultMap, DOMEditor::ResultMap>
-DOMEditor::diff(const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList)
-{
-    ResultMap newMap(newList.size());
-    ResultMap oldMap(oldList.size());
+    virtual bool undo(ExceptionCode& ec)
+    {
+        if (m_hadAttribute)
+            m_element->setAttribute(m_name, m_oldValue, ec);
+        else
+            m_element->removeAttribute(m_name);
+        return true;
+    }
 
-    for (size_t i = 0; i < oldMap.size(); ++i) {
-        oldMap[i].first = 0;
-        oldMap[i].second = 0;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        m_element->setAttribute(m_name, m_value, ec);
+        return true;
     }
 
-    for (size_t i = 0; i < newMap.size(); ++i) {
-        newMap[i].first = 0;
-        newMap[i].second = 0;
+private:
+    RefPtr<Element> m_element;
+    String m_name;
+    String m_value;
+    bool m_hadAttribute;
+    String m_oldValue;
+};
+
+class DOMEditor::SetOuterHTMLAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(SetOuterHTMLAction);
+public:
+    SetOuterHTMLAction(Node* node, const String& html)
+        : InspectorHistory::Action("SetOuterHTML")
+        , m_node(node)
+        , m_nextSibling(node->nextSibling())
+        , m_html(html)
+        , m_newNode(0)
+        , m_history(adoptPtr(new InspectorHistory()))
+        , m_domEditor(adoptPtr(new DOMEditor(m_history.get())))
+    {
     }
 
-    // Trim head and tail.
-    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[i]->m_sha1 == newList[i]->m_sha1; ++i) {
-        oldMap[i].first = oldList[i].get();
-        oldMap[i].second = i;
-        newMap[i].first = newList[i].get();
-        newMap[i].second = i;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldHTML = createMarkup(m_node.get());
+        DOMPatchSupport domPatchSupport(m_domEditor.get(), m_node->ownerDocument());
+        m_newNode = domPatchSupport.patchNode(m_node.get(), m_html, ec);
+        return !ec;
     }
-    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[oldList.size() - i - 1]->m_sha1 == newList[newList.size() - i - 1]->m_sha1; ++i) {
-        size_t oldIndex = oldList.size() - i - 1;
-        size_t newIndex = newList.size() - i - 1;
-        oldMap[oldIndex].first = oldList[oldIndex].get();
-        oldMap[oldIndex].second = newIndex;
-        newMap[newIndex].first = newList[newIndex].get();
-        newMap[newIndex].second = oldIndex;
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_history->undo(ec);
     }
 
-    typedef HashMap<String, Vector<size_t> > DiffTable;
-    DiffTable newTable;
-    DiffTable oldTable;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_history->redo(ec);
+    }
 
-    for (size_t i = 0; i < newList.size(); ++i) {
-        DiffTable::iterator it = newTable.add(newList[i]->m_sha1, Vector<size_t>()).first;
-        it->second.append(i);
+    Node* newNode()
+    {
+        return m_newNode;
     }
 
-    for (size_t i = 0; i < oldList.size(); ++i) {
-        DiffTable::iterator it = oldTable.add(oldList[i]->m_sha1, Vector<size_t>()).first;
-        it->second.append(i);
+private:
+    RefPtr<Node> m_node;
+    RefPtr<Node> m_nextSibling;
+    String m_html;
+    String m_oldHTML;
+    Node* m_newNode;
+    OwnPtr<InspectorHistory> m_history;
+    OwnPtr<DOMEditor> m_domEditor;
+};
+
+class DOMEditor::ReplaceWholeTextAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(ReplaceWholeTextAction);
+public:
+    ReplaceWholeTextAction(Text* textNode, const String& text)
+        : InspectorHistory::Action("ReplaceWholeText")
+        , m_textNode(textNode)
+        , m_text(text)
+    {
     }
 
-    for (DiffTable::iterator newIt = newTable.begin(); newIt != newTable.end(); ++newIt) {
-        if (newIt->second.size() != 1)
-            continue;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldText = m_textNode->wholeText();
+        return redo(ec);
+    }
 
-        DiffTable::iterator oldIt = oldTable.find(newIt->first);
-        if (oldIt == oldTable.end() || oldIt->second.size() != 1)
-            continue;
+    virtual bool undo(ExceptionCode& ec)
+    {
+        m_textNode->replaceWholeText(m_oldText, ec);
+        return true;
+    }
 
-        newMap[newIt->second[0]] = make_pair(newList[newIt->second[0]].get(), oldIt->second[0]);
-        oldMap[oldIt->second[0]] = make_pair(oldList[oldIt->second[0]].get(), newIt->second[0]);
+    virtual bool redo(ExceptionCode& ec)
+    {
+        m_textNode->replaceWholeText(m_text, ec);
+        return true;
     }
 
-    for (size_t i = 0; newList.size() > 0 && i < newList.size() - 1; ++i) {
-        if (!newMap[i].first || newMap[i + 1].first)
-            continue;
+private:
+    RefPtr<Text> m_textNode;
+    String m_text;
+    String m_oldText;
+};
 
-        size_t j = newMap[i].second + 1;
-        if (j < oldMap.size() && !oldMap[j].first && newList[i + 1]->m_sha1 == oldList[j]->m_sha1) {
-            newMap[i + 1] = make_pair(newList[i + 1].get(), j);
-            oldMap[j] = make_pair(oldList[j].get(), i + 1);
-        }
+class DOMEditor::ReplaceChildNodeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(ReplaceChildNodeAction);
+public:
+    ReplaceChildNodeAction(Node* parentNode, PassRefPtr<Node> newNode, Node* oldNode)
+        : InspectorHistory::Action("ReplaceChildNode")
+        , m_parentNode(parentNode)
+        , m_newNode(newNode)
+        , m_oldNode(oldNode)
+    {
     }
 
-    for (size_t i = newList.size() - 1; newList.size() > 0 && i > 0; --i) {
-        if (!newMap[i].first || newMap[i - 1].first || newMap[i].second <= 0)
-            continue;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
 
-        size_t j = newMap[i].second - 1;
-        if (!oldMap[j].first && newList[i - 1]->m_sha1 == oldList[j]->m_sha1) {
-            newMap[i - 1] = make_pair(newList[i - 1].get(), j);
-            oldMap[j] = make_pair(oldList[j].get(), i - 1);
-        }
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_parentNode->replaceChild(m_oldNode, m_newNode.get(), ec);
     }
 
-    return make_pair(oldMap, newMap);
-}
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_parentNode->replaceChild(m_newNode, m_oldNode.get(), ec);
+    }
 
-void DOMEditor::innerPatchChildren(ContainerNode* parentNode, const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList, ExceptionCode& ec)
-{
-    pair<ResultMap, ResultMap> resultMaps = diff(oldList, newList);
-    ResultMap& oldMap = resultMaps.first;
-    ResultMap& newMap = resultMaps.second;
-
-    Digest* oldHead = 0;
-    Digest* oldBody = 0;
-
-    // 1. First strip everything except for the nodes that retain. Collect pending merges.
-    HashMap<Digest*, Digest*> merges;
-    for (size_t i = 0; i < oldList.size(); ++i) {
-        if (oldMap[i].first)
-            continue;
-
-        // Always match <head> and <body> tags with each other - we can't remove them from the DOM
-        // upon patching.
-        if (oldList[i]->m_node->hasTagName(headTag)) {
-            oldHead = oldList[i].get();
-            continue;
-        }
-        if (oldList[i]->m_node->hasTagName(bodyTag)) {
-            oldBody = oldList[i].get();
-            continue;
-        }
+private:
+    RefPtr<Node> m_parentNode;
+    RefPtr<Node> m_newNode;
+    RefPtr<Node> m_oldNode;
+};
 
-        // Check if this change is between stable nodes. If it is, consider it as "modified".
-        if (!m_unusedNodesMap.contains(oldList[i]->m_sha1) && (!i || oldMap[i - 1].first) && (i == oldMap.size() - 1 || oldMap[i + 1].first)) {
-            size_t anchorCandidate = i ? oldMap[i - 1].second + 1 : 0;
-            size_t anchorAfter = i == oldMap.size() - 1 ? anchorCandidate + 1 : oldMap[i + 1].second;
-            if (anchorAfter - anchorCandidate == 1 && anchorCandidate < newList.size())
-                merges.set(newList[anchorCandidate].get(), oldList[i].get());
-            else {
-                removeChild(oldList[i].get(), ec);
-                if (ec)
-                    return;
-            }
-        } else {
-            removeChild(oldList[i].get(), ec);
-            if (ec)
-                return;
-        }
+class DOMEditor::SetNodeValueAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(SetNodeValueAction);
+public:
+    SetNodeValueAction(Node* node, const String& value)
+        : InspectorHistory::Action("SetNodeValue")
+        , m_node(node)
+        , m_value(value)
+    {
     }
 
-    // Mark retained nodes as used.
-    for (size_t i = 0; i < newList.size(); ++i) {
-        if (newMap[i].first)
-            markNodeAsUsed(newMap[i].first);
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldValue = m_node->nodeValue();
+        return redo(ec);
     }
 
-    // Mark <head> and <body> nodes for merge.
-    if (oldHead || oldBody) {
-        for (size_t i = 0; i < newList.size(); ++i) {
-            if (oldHead && newList[i]->m_node->hasTagName(headTag))
-                merges.set(newList[i].get(), oldHead);
-            if (oldBody && newList[i]->m_node->hasTagName(bodyTag))
-                merges.set(newList[i].get(), oldBody);
-        }
+    virtual bool undo(ExceptionCode& ec)
+    {
+        m_node->setNodeValue(m_oldValue, ec);
+        return !ec;
     }
 
-    // 2. Patch nodes marked for merge.
-    for (HashMap<Digest*, Digest*>::iterator it = merges.begin(); it != merges.end(); ++it) {
-        innerPatchNode(it->second, it->first, ec);
-        if (ec)
-            return;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        m_node->setNodeValue(m_value, ec);
+        return !ec;
     }
 
-    // 3. Insert missing nodes.
-    for (size_t i = 0; i < newMap.size(); ++i) {
-        if (newMap[i].first || merges.contains(newList[i].get()))
-            continue;
+private:
+    RefPtr<Node> m_node;
+    String m_value;
+    String m_oldValue;
+};
 
-        ExceptionCode ec = 0;
-        insertBefore(parentNode, newList[i].get(), parentNode->childNode(i), ec);
-        if (ec)
-            return;
-    }
+DOMEditor::DOMEditor(InspectorHistory* history) : m_history(history) { }
 
-    // 4. Then put all nodes that retained into their slots (sort by new index).
-    for (size_t i = 0; i < oldMap.size(); ++i) {
-        if (!oldMap[i].first)
-            continue;
-        RefPtr<Node> node = oldMap[i].first->m_node;
-        Node* anchorNode = parentNode->childNode(oldMap[i].second);
-        if (node.get() == anchorNode)
-            continue;
-        if (node->hasTagName(bodyTag) || node->hasTagName(headTag))
-            continue; // Never move head or body, move the rest of the nodes around them.
+DOMEditor::~DOMEditor() { }
 
-        parentNode->insertBefore(node, anchorNode, ec);
-        if (ec)
-            return;
-    }
+bool DOMEditor::insertBefore(Node* parentNode, PassRefPtr<Node> node, Node* anchorNode, ExceptionCode& ec)
+{
+    return m_history->perform(adoptPtr(new InsertBeforeAction(parentNode, node, anchorNode)), ec);
 }
 
-static void addStringToSHA1(SHA1& sha1, const String& string)
+bool DOMEditor::removeChild(Node* parentNode, Node* node, ExceptionCode& ec)
 {
-    CString cString = string.utf8();
-    sha1.addBytes(reinterpret_cast<const uint8_t*>(cString.data()), cString.length());
+    return m_history->perform(adoptPtr(new RemoveChildAction(parentNode, node)), ec);
 }
 
-PassOwnPtr<DOMEditor::Digest> DOMEditor::createDigest(Node* node, UnusedNodesMap* unusedNodesMap)
+bool DOMEditor::setAttribute(Element* element, const String& name, const String& value, ExceptionCode& ec)
 {
-    Digest* digest = new Digest(node);
-
-    SHA1 sha1;
-
-    Node::NodeType nodeType = node->nodeType();
-    sha1.addBytes(reinterpret_cast<const uint8_t*>(&nodeType), sizeof(nodeType));
-    addStringToSHA1(sha1, node->nodeName());
-    addStringToSHA1(sha1, node->nodeValue());
-
-    if (node->nodeType() == Node::ELEMENT_NODE) {
-        Node* child = node->firstChild();
-        while (child) {
-            OwnPtr<Digest> childInfo = createDigest(child, unusedNodesMap);
-            addStringToSHA1(sha1, childInfo->m_sha1);
-            child = child->nextSibling();
-            digest->m_children.append(childInfo.release());
-        }
-        Element* element = static_cast<Element*>(node);
-
-        if (element->hasAttributesWithoutUpdate()) {
-            size_t numAttrs = element->attributeCount();
-            SHA1 attrsSHA1;
-            for (size_t i = 0; i < numAttrs; ++i) {
-                const Attribute* attribute = element->attributeItem(i);
-                addStringToSHA1(attrsSHA1, attribute->name().toString());
-                addStringToSHA1(attrsSHA1, attribute->value());
-            }
-            Vector<uint8_t, 20> attrsHash;
-            attrsSHA1.computeHash(attrsHash);
-            digest->m_attrsSHA1 = base64Encode(reinterpret_cast<const char*>(attrsHash.data()), 10);
-            addStringToSHA1(sha1, digest->m_attrsSHA1);
-        }
-    }
+    return m_history->perform(adoptPtr(new SetAttributeAction(element, name, value)), ec);
+}
+
+bool DOMEditor::removeAttribute(Element* element, const String& name, ExceptionCode& ec)
+{
+    return m_history->perform(adoptPtr(new RemoveAttributeAction(element, name)), ec);
+}
 
-    Vector<uint8_t, 20> hash;
-    sha1.computeHash(hash);
-    digest->m_sha1 = base64Encode(reinterpret_cast<const char*>(hash.data()), 10);
-    if (unusedNodesMap)
-        unusedNodesMap->add(digest->m_sha1, digest);
-    return adoptPtr(digest);
+bool DOMEditor::setOuterHTML(Node* node, const String& html, Node** newNode, ExceptionCode& ec)
+{
+    OwnPtr<SetOuterHTMLAction> action = adoptPtr(new SetOuterHTMLAction(node, html));
+    SetOuterHTMLAction* rawAction = action.get();
+    bool result = m_history->perform(action.release(), ec);
+    if (result)
+        *newNode = rawAction->newNode();
+    return result;
 }
 
-void DOMEditor::insertBefore(ContainerNode* parentNode, Digest* digest, Node* anchor, ExceptionCode& ec)
+bool DOMEditor::replaceWholeText(Text* textNode, const String& text, ExceptionCode& ec)
 {
-    parentNode->insertBefore(digest->m_node, anchor, ec);
-    markNodeAsUsed(digest);
+    return m_history->perform(adoptPtr(new ReplaceWholeTextAction(textNode, text)), ec);
 }
 
-void DOMEditor::removeChild(Digest* oldDigest, ExceptionCode& ec)
+bool DOMEditor::replaceChild(Node* parentNode, PassRefPtr<Node> newNode, Node* oldNode, ExceptionCode& ec)
 {
-    RefPtr<Node> oldNode = oldDigest->m_node;
-    oldNode->parentNode()->removeChild(oldNode.get(), ec);
-
-    // Diff works within levels. In order not to lose the node identity when user
-    // prepends his HTML with "<div>" (i.e. all nodes are shifted to the next nested level),
-    // prior to dropping the original node on the floor, check whether new DOM has a digest
-    // with matching sha1. If it does, replace it with the original DOM chunk. Chances are
-    // high that it will get merged back into the original DOM during the further patching.
-
-    UnusedNodesMap::iterator it = m_unusedNodesMap.find(oldDigest->m_sha1);
-    if (it != m_unusedNodesMap.end()) {
-        Digest* newDigest = it->second;
-        Node* newNode = newDigest->m_node;
-        newNode->parentNode()->replaceChild(oldNode, newNode, ec);
-        newDigest->m_node = oldNode.get();
-        markNodeAsUsed(newDigest);
-        return;
-    }
-
-    for (size_t i = 0; i < oldDigest->m_children.size(); ++i)
-        removeChild(oldDigest->m_children[i].get(), ec);
+    return m_history->perform(adoptPtr(new ReplaceChildNodeAction(parentNode, newNode, oldNode)), ec);
 }
 
-void DOMEditor::markNodeAsUsed(Digest* digest)
+bool DOMEditor::setNodeValue(Node* node, const String& value, ExceptionCode& ec)
 {
-    Deque<Digest*> queue;
-    queue.append(digest);
-    while (!queue.isEmpty()) {
-        Digest* first = queue.takeFirst();
-        m_unusedNodesMap.remove(first->m_sha1);
-        for (size_t i = 0; i < first->m_children.size(); ++i)
-            queue.append(first->m_children[i].get());
+    return m_history->perform(adoptPtr(new SetNodeValueAction(node, value)), ec);
+}
+
+static void populateErrorString(const ExceptionCode& ec, ErrorString* errorString)
+{
+    if (ec) {
+        ExceptionCodeDescription description(ec);
+        *errorString = description.name;
     }
 }
 
+bool DOMEditor::insertBefore(Node* parentNode, PassRefPtr<Node> node, Node* anchorNode, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = insertBefore(parentNode, node, anchorNode, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::removeChild(Node* parentNode, Node* node, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = removeChild(parentNode, node, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::setAttribute(Element* element, const String& name, const String& value, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = setAttribute(element, name, value, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::removeAttribute(Element* element, const String& name, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = removeAttribute(element, name, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::setOuterHTML(Node* node, const String& html, Node** newNode, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = setOuterHTML(node, html, newNode, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::replaceWholeText(Text* textNode, const String& text, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = replaceWholeText(textNode, text, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/DOMEditor.h b/Source/WebCore/inspector/DOMEditor.h
index 4affb00b1..264913232 100644
--- a/Source/WebCore/inspector/DOMEditor.h
+++ b/Source/WebCore/inspector/DOMEditor.h
@@ -33,45 +33,53 @@
 
 #include "ExceptionCode.h"
 
-#include <wtf/HashMap.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
-class ContainerNode;
-class Document;
-class NamedNodeMap;
+class Element;
+class InspectorHistory;
 class Node;
+class Text;
 
 #if ENABLE(INSPECTOR)
 
+typedef String ErrorString;
+
 class DOMEditor {
+    WTF_MAKE_NONCOPYABLE(DOMEditor);
 public:
-    explicit DOMEditor(Document*);
-    virtual ~DOMEditor();
-
-    void patchDocument(const String& markup);
-    Node* patchNode(Node*, const String& markup, ExceptionCode&);
+    explicit DOMEditor(InspectorHistory*);
+    ~DOMEditor();
 
-private:
-    struct Digest;
-    typedef Vector<pair<Digest*, size_t> > ResultMap;
-    typedef HashMap<String, Digest*> UnusedNodesMap;
+    bool insertBefore(Node* parentNode, PassRefPtr<Node>, Node* anchorNode, ExceptionCode&);
+    bool removeChild(Node* parentNode, Node*, ExceptionCode&);
+    bool setAttribute(Element*, const String& name, const String& value, ExceptionCode&);
+    bool removeAttribute(Element*, const String& name, ExceptionCode&);
+    bool setOuterHTML(Node*, const String& html, Node** newNode, ExceptionCode&);
+    bool replaceWholeText(Text*, const String& text, ExceptionCode&);
+    bool replaceChild(Node* parentNode, PassRefPtr<Node> newNode, Node* oldNode, ExceptionCode&);
+    bool setNodeValue(Node* parentNode, const String& value, ExceptionCode&);
 
-    void innerPatchNode(Digest* oldNode, Digest* newNode, ExceptionCode&);
-    std::pair<ResultMap, ResultMap> diff(const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren);
-    void innerPatchChildren(ContainerNode*, const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren, ExceptionCode&);
-    PassOwnPtr<Digest> createDigest(Node*, UnusedNodesMap*);
-    void insertBefore(ContainerNode*, Digest*, Node* anchor, ExceptionCode&);
-    void removeChild(Digest*, ExceptionCode&);
-    void markNodeAsUsed(Digest*);
+    bool insertBefore(Node* parentNode, PassRefPtr<Node>, Node* anchorNode, ErrorString*);
+    bool removeChild(Node* parentNode, Node*, ErrorString*);
+    bool setAttribute(Element*, const String& name, const String& value, ErrorString*);
+    bool removeAttribute(Element*, const String& name, ErrorString*);
+    bool setOuterHTML(Node*, const String& html, Node** newNode, ErrorString*);
+    bool replaceWholeText(Text*, const String& text, ErrorString*);
 
-    Document* m_document;
+private:
+    class DOMAction;
+    class RemoveChildAction;
+    class InsertBeforeAction;
+    class RemoveAttributeAction;
+    class SetAttributeAction;
+    class SetOuterHTMLAction;
+    class ReplaceWholeTextAction;
+    class ReplaceChildNodeAction;
+    class SetNodeValueAction;
 
-    UnusedNodesMap m_unusedNodesMap;
+    InspectorHistory* m_history;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
index 7b03c2e1a..70578c72a 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.cpp
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -514,6 +514,12 @@ void getHighlight(Document* document, HighlightData* highlightData, Highlight* h
         getOrDrawRectHighlight(0, document, highlightData, highlight);
 }
 
+void drawOutline(GraphicsContext& context, const LayoutRect& rect, const Color& color)
+{
+    FloatRect outlineRect = rect;
+    drawOutlinedQuad(context, outlineRect, Color(), color);
+}
+
 } // namespace DOMNodeHighlighter
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.h b/Source/WebCore/inspector/DOMNodeHighlighter.h
index d063ae840..f7b6f00f4 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.h
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.h
@@ -31,6 +31,7 @@
 
 #include "Color.h"
 #include "FloatQuad.h"
+#include "LayoutTypes.h"
 
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
@@ -40,8 +41,8 @@ namespace WebCore {
 
 class Color;
 class Document;
+class FrameView;
 class GraphicsContext;
-class IntRect;
 class Node;
 
 struct HighlightData {
@@ -78,6 +79,7 @@ namespace DOMNodeHighlighter {
 
 void drawHighlight(GraphicsContext&, Document*, HighlightData*);
 void getHighlight(Document*, HighlightData*, Highlight*);
+void drawOutline(GraphicsContext&, const LayoutRect&, const Color&);
 
 } // namespace DOMNodeHighlighter
 
diff --git a/Source/WebCore/inspector/DOMPatchSupport.cpp b/Source/WebCore/inspector/DOMPatchSupport.cpp
new file mode 100644
index 000000000..9ed89a33c
--- /dev/null
+++ b/Source/WebCore/inspector/DOMPatchSupport.cpp
@@ -0,0 +1,508 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMPatchSupport.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Attribute.h"
+#include "Base64.h"
+#include "DOMEditor.h"
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "HTMLDocument.h"
+#include "HTMLDocumentParser.h"
+#include "HTMLElement.h"
+#include "HTMLHeadElement.h"
+#include "HTMLNames.h"
+#include "InspectorHistory.h"
+#include "Node.h"
+
+#include <wtf/Deque.h>
+#include <wtf/HashTraits.h>
+#include <wtf/RefPtr.h>
+#include <wtf/SHA1.h>
+#include <wtf/text/CString.h>
+
+using namespace std;
+
+namespace WebCore {
+
+using HTMLNames::bodyTag;
+using HTMLNames::headTag;
+using HTMLNames::htmlTag;
+
+struct DOMPatchSupport::Digest {
+    explicit Digest(Node* node) : m_node(node) { }
+
+    String m_sha1;
+    String m_attrsSHA1;
+    Node* m_node;
+    Vector<OwnPtr<Digest> > m_children;
+};
+
+void DOMPatchSupport::patchDocument(Document* document, const String& markup)
+{
+    InspectorHistory history;
+    DOMEditor domEditor(&history);
+    DOMPatchSupport patchSupport(&domEditor, document);
+    patchSupport.patchDocument(markup);
+}
+
+DOMPatchSupport::DOMPatchSupport(DOMEditor* domEditor, Document* document)
+    : m_domEditor(domEditor)
+    , m_document(document)
+{
+}
+
+DOMPatchSupport::~DOMPatchSupport() { }
+
+void DOMPatchSupport::patchDocument(const String& markup)
+{
+    RefPtr<HTMLDocument> newDocument = HTMLDocument::create(0, KURL());
+    RefPtr<DocumentParser> parser = HTMLDocumentParser::create(newDocument.get(), false);
+    parser->insert(markup); // Use insert() so that the parser will not yield.
+    parser->finish();
+    parser->detach();
+
+    OwnPtr<Digest> oldInfo = createDigest(m_document->documentElement(), 0);
+    OwnPtr<Digest> newInfo = createDigest(newDocument->documentElement(), &m_unusedNodesMap);
+
+    ExceptionCode ec = 0;
+    if (!innerPatchNode(oldInfo.get(), newInfo.get(), ec)) {
+        // Fall back to rewrite.
+        m_document->write(markup);
+        m_document->close();
+    }
+}
+
+Node* DOMPatchSupport::patchNode(Node* node, const String& markup, ExceptionCode& ec)
+{
+    // Don't parse <html> as a fragment.
+    if (node->isDocumentNode() || (node->parentNode() && node->parentNode()->isDocumentNode())) {
+        patchDocument(markup);
+        return 0;
+    }
+
+    Node* previousSibling = node->previousSibling();
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(m_document);
+    fragment->parseHTML(markup, node->parentElement() ? node->parentElement() : m_document->documentElement());
+
+    // Compose the old list.
+    ContainerNode* parentNode = node->parentNode();
+    Vector<OwnPtr<Digest> > oldList;
+    for (Node* child = parentNode->firstChild(); child; child = child->nextSibling())
+        oldList.append(createDigest(child, 0));
+
+    // Compose the new list.
+    String markupCopy = markup;
+    markupCopy.makeLower();
+    Vector<OwnPtr<Digest> > newList;
+    for (Node* child = parentNode->firstChild(); child != node; child = child->nextSibling())
+        newList.append(createDigest(child, 0));
+    for (Node* child = fragment->firstChild(); child; child = child->nextSibling()) {
+        if (child->hasTagName(headTag) && !child->firstChild() && markupCopy.find("</head>") == notFound)
+            continue; // HTML5 parser inserts empty <head> tag whenever it parses <body>
+        if (child->hasTagName(bodyTag) && !child->firstChild() && markupCopy.find("</body>") == notFound)
+            continue; // HTML5 parser inserts empty <body> tag whenever it parses </head>
+        newList.append(createDigest(child, &m_unusedNodesMap));
+    }
+    for (Node* child = node->nextSibling(); child; child = child->nextSibling())
+        newList.append(createDigest(child, 0));
+
+    if (!innerPatchChildren(parentNode, oldList, newList, ec)) {
+        // Fall back to total replace.
+        ec = 0;
+        if (!m_domEditor->replaceChild(parentNode, fragment.release(), node, ec))
+            return 0;
+    }
+    return previousSibling ? previousSibling->nextSibling() : parentNode->firstChild();
+}
+
+bool DOMPatchSupport::innerPatchNode(Digest* oldDigest, Digest* newDigest, ExceptionCode& ec)
+{
+    if (oldDigest->m_sha1 == newDigest->m_sha1)
+        return true;
+
+    Node* oldNode = oldDigest->m_node;
+    Node* newNode = newDigest->m_node;
+
+    if (newNode->nodeType() != oldNode->nodeType() || newNode->nodeName() != oldNode->nodeName())
+        return m_domEditor->replaceChild(oldNode->parentNode(), newNode, oldNode, ec);
+
+    if (oldNode->nodeValue() != newNode->nodeValue()) {
+        if (!m_domEditor->setNodeValue(oldNode, newNode->nodeValue(), ec))
+            return false;
+    }
+
+    if (oldNode->nodeType() != Node::ELEMENT_NODE)
+        return true;
+
+    // Patch attributes
+    Element* oldElement = static_cast<Element*>(oldNode);
+    Element* newElement = static_cast<Element*>(newNode);
+    if (oldDigest->m_attrsSHA1 != newDigest->m_attrsSHA1) {
+        // FIXME: Create a function in Element for removing all properties. Take in account whether did/willModifyAttribute are important.
+        if (oldElement->hasAttributesWithoutUpdate()) {
+            while (oldElement->attributeCount()) {
+                Attribute* attr = oldElement->attributeItem(0);
+                if (!m_domEditor->removeAttribute(oldElement, attr->localName(), ec))
+                    return false;
+            }
+        }
+
+        // FIXME: Create a function in Element for copying properties. setAttributesFromElement() is close but not enough for this case.
+        if (newElement->hasAttributesWithoutUpdate()) {
+            size_t numAttrs = newElement->attributeCount();
+            for (size_t i = 0; i < numAttrs; ++i) {
+                const Attribute* attribute = newElement->attributeItem(i);
+                if (!m_domEditor->setAttribute(oldElement, attribute->name().localName(), attribute->value(), ec))
+                    return false;
+            }
+        }
+    }
+
+    bool result = innerPatchChildren(oldElement, oldDigest->m_children, newDigest->m_children, ec);
+    m_unusedNodesMap.remove(newDigest->m_sha1);
+    return result;
+}
+
+pair<DOMPatchSupport::ResultMap, DOMPatchSupport::ResultMap>
+DOMPatchSupport::diff(const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList)
+{
+    ResultMap newMap(newList.size());
+    ResultMap oldMap(oldList.size());
+
+    for (size_t i = 0; i < oldMap.size(); ++i) {
+        oldMap[i].first = 0;
+        oldMap[i].second = 0;
+    }
+
+    for (size_t i = 0; i < newMap.size(); ++i) {
+        newMap[i].first = 0;
+        newMap[i].second = 0;
+    }
+
+    // Trim head and tail.
+    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[i]->m_sha1 == newList[i]->m_sha1; ++i) {
+        oldMap[i].first = oldList[i].get();
+        oldMap[i].second = i;
+        newMap[i].first = newList[i].get();
+        newMap[i].second = i;
+    }
+    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[oldList.size() - i - 1]->m_sha1 == newList[newList.size() - i - 1]->m_sha1; ++i) {
+        size_t oldIndex = oldList.size() - i - 1;
+        size_t newIndex = newList.size() - i - 1;
+        oldMap[oldIndex].first = oldList[oldIndex].get();
+        oldMap[oldIndex].second = newIndex;
+        newMap[newIndex].first = newList[newIndex].get();
+        newMap[newIndex].second = oldIndex;
+    }
+
+    typedef HashMap<String, Vector<size_t> > DiffTable;
+    DiffTable newTable;
+    DiffTable oldTable;
+
+    for (size_t i = 0; i < newList.size(); ++i) {
+        DiffTable::iterator it = newTable.add(newList[i]->m_sha1, Vector<size_t>()).first;
+        it->second.append(i);
+    }
+
+    for (size_t i = 0; i < oldList.size(); ++i) {
+        DiffTable::iterator it = oldTable.add(oldList[i]->m_sha1, Vector<size_t>()).first;
+        it->second.append(i);
+    }
+
+    for (DiffTable::iterator newIt = newTable.begin(); newIt != newTable.end(); ++newIt) {
+        if (newIt->second.size() != 1)
+            continue;
+
+        DiffTable::iterator oldIt = oldTable.find(newIt->first);
+        if (oldIt == oldTable.end() || oldIt->second.size() != 1)
+            continue;
+
+        newMap[newIt->second[0]] = make_pair(newList[newIt->second[0]].get(), oldIt->second[0]);
+        oldMap[oldIt->second[0]] = make_pair(oldList[oldIt->second[0]].get(), newIt->second[0]);
+    }
+
+    for (size_t i = 0; newList.size() > 0 && i < newList.size() - 1; ++i) {
+        if (!newMap[i].first || newMap[i + 1].first)
+            continue;
+
+        size_t j = newMap[i].second + 1;
+        if (j < oldMap.size() && !oldMap[j].first && newList[i + 1]->m_sha1 == oldList[j]->m_sha1) {
+            newMap[i + 1] = make_pair(newList[i + 1].get(), j);
+            oldMap[j] = make_pair(oldList[j].get(), i + 1);
+        }
+    }
+
+    for (size_t i = newList.size() - 1; newList.size() > 0 && i > 0; --i) {
+        if (!newMap[i].first || newMap[i - 1].first || newMap[i].second <= 0)
+            continue;
+
+        size_t j = newMap[i].second - 1;
+        if (!oldMap[j].first && newList[i - 1]->m_sha1 == oldList[j]->m_sha1) {
+            newMap[i - 1] = make_pair(newList[i - 1].get(), j);
+            oldMap[j] = make_pair(oldList[j].get(), i - 1);
+        }
+    }
+
+#ifdef DEBUG_DOM_PATCH_SUPPORT
+    dumpMap(oldMap, "OLD");
+    dumpMap(newMap, "NEW");
+#endif
+
+    return make_pair(oldMap, newMap);
+}
+
+bool DOMPatchSupport::innerPatchChildren(ContainerNode* parentNode, const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList, ExceptionCode& ec)
+{
+    pair<ResultMap, ResultMap> resultMaps = diff(oldList, newList);
+    ResultMap& oldMap = resultMaps.first;
+    ResultMap& newMap = resultMaps.second;
+
+    Digest* oldHead = 0;
+    Digest* oldBody = 0;
+
+    // 1. First strip everything except for the nodes that retain. Collect pending merges.
+    HashMap<Digest*, Digest*> merges;
+    HashSet<size_t, WTF::IntHash<size_t>, WTF::UnsignedWithZeroKeyHashTraits<size_t> > usedNewOrdinals;
+    for (size_t i = 0; i < oldList.size(); ++i) {
+        if (oldMap[i].first) {
+            if (!usedNewOrdinals.contains(oldMap[i].second)) {
+                usedNewOrdinals.add(oldMap[i].second);
+                continue;
+            }
+            oldMap[i].first = 0;
+            oldMap[i].second = 0;
+        }
+
+        // Always match <head> and <body> tags with each other - we can't remove them from the DOM
+        // upon patching.
+        if (oldList[i]->m_node->hasTagName(headTag)) {
+            oldHead = oldList[i].get();
+            continue;
+        }
+        if (oldList[i]->m_node->hasTagName(bodyTag)) {
+            oldBody = oldList[i].get();
+            continue;
+        }
+
+        // Check if this change is between stable nodes. If it is, consider it as "modified".
+        if (!m_unusedNodesMap.contains(oldList[i]->m_sha1) && (!i || oldMap[i - 1].first) && (i == oldMap.size() - 1 || oldMap[i + 1].first)) {
+            size_t anchorCandidate = i ? oldMap[i - 1].second + 1 : 0;
+            size_t anchorAfter = i == oldMap.size() - 1 ? anchorCandidate + 1 : oldMap[i + 1].second;
+            if (anchorAfter - anchorCandidate == 1 && anchorCandidate < newList.size())
+                merges.set(newList[anchorCandidate].get(), oldList[i].get());
+            else {
+                if (!removeChildAndMoveToNew(oldList[i].get(), ec))
+                    return false;
+            }
+        } else {
+            if (!removeChildAndMoveToNew(oldList[i].get(), ec))
+                return false;
+        }
+    }
+
+    // Mark retained nodes as used, do not reuse node more than once.
+    HashSet<size_t, WTF::IntHash<size_t>, WTF::UnsignedWithZeroKeyHashTraits<size_t> >  usedOldOrdinals;
+    for (size_t i = 0; i < newList.size(); ++i) {
+        if (!newMap[i].first)
+            continue;
+        size_t oldOrdinal = newMap[i].second;
+        if (usedOldOrdinals.contains(oldOrdinal)) {
+            // Do not map node more than once
+            newMap[i].first = 0;
+            newMap[i].second = 0;
+            continue;
+        }
+        usedOldOrdinals.add(oldOrdinal);
+        markNodeAsUsed(newMap[i].first);
+    }
+
+    // Mark <head> and <body> nodes for merge.
+    if (oldHead || oldBody) {
+        for (size_t i = 0; i < newList.size(); ++i) {
+            if (oldHead && newList[i]->m_node->hasTagName(headTag))
+                merges.set(newList[i].get(), oldHead);
+            if (oldBody && newList[i]->m_node->hasTagName(bodyTag))
+                merges.set(newList[i].get(), oldBody);
+        }
+    }
+
+    // 2. Patch nodes marked for merge.
+    for (HashMap<Digest*, Digest*>::iterator it = merges.begin(); it != merges.end(); ++it) {
+        if (!innerPatchNode(it->second, it->first, ec))
+            return false;
+    }
+
+    // 3. Insert missing nodes.
+    for (size_t i = 0; i < newMap.size(); ++i) {
+        if (newMap[i].first || merges.contains(newList[i].get()))
+            continue;
+        if (!insertBeforeAndMarkAsUsed(parentNode, newList[i].get(), parentNode->childNode(i), ec))
+            return false;
+    }
+
+    // 4. Then put all nodes that retained into their slots (sort by new index).
+    for (size_t i = 0; i < oldMap.size(); ++i) {
+        if (!oldMap[i].first)
+            continue;
+        RefPtr<Node> node = oldMap[i].first->m_node;
+        Node* anchorNode = parentNode->childNode(oldMap[i].second);
+        if (node.get() == anchorNode)
+            continue;
+        if (node->hasTagName(bodyTag) || node->hasTagName(headTag))
+            continue; // Never move head or body, move the rest of the nodes around them.
+
+        if (!m_domEditor->insertBefore(parentNode, node.release(), anchorNode, ec))
+            return false;
+    }
+    return true;
+}
+
+static void addStringToSHA1(SHA1& sha1, const String& string)
+{
+    CString cString = string.utf8();
+    sha1.addBytes(reinterpret_cast<const uint8_t*>(cString.data()), cString.length());
+}
+
+PassOwnPtr<DOMPatchSupport::Digest> DOMPatchSupport::createDigest(Node* node, UnusedNodesMap* unusedNodesMap)
+{
+    Digest* digest = new Digest(node);
+
+    SHA1 sha1;
+
+    Node::NodeType nodeType = node->nodeType();
+    sha1.addBytes(reinterpret_cast<const uint8_t*>(&nodeType), sizeof(nodeType));
+    addStringToSHA1(sha1, node->nodeName());
+    addStringToSHA1(sha1, node->nodeValue());
+
+    if (node->nodeType() == Node::ELEMENT_NODE) {
+        Node* child = node->firstChild();
+        while (child) {
+            OwnPtr<Digest> childInfo = createDigest(child, unusedNodesMap);
+            addStringToSHA1(sha1, childInfo->m_sha1);
+            child = child->nextSibling();
+            digest->m_children.append(childInfo.release());
+        }
+        Element* element = static_cast<Element*>(node);
+
+        if (element->hasAttributesWithoutUpdate()) {
+            size_t numAttrs = element->attributeCount();
+            SHA1 attrsSHA1;
+            for (size_t i = 0; i < numAttrs; ++i) {
+                const Attribute* attribute = element->attributeItem(i);
+                addStringToSHA1(attrsSHA1, attribute->name().toString());
+                addStringToSHA1(attrsSHA1, attribute->value());
+            }
+            Vector<uint8_t, 20> attrsHash;
+            attrsSHA1.computeHash(attrsHash);
+            digest->m_attrsSHA1 = base64Encode(reinterpret_cast<const char*>(attrsHash.data()), 10);
+            addStringToSHA1(sha1, digest->m_attrsSHA1);
+        }
+    }
+
+    Vector<uint8_t, 20> hash;
+    sha1.computeHash(hash);
+    digest->m_sha1 = base64Encode(reinterpret_cast<const char*>(hash.data()), 10);
+    if (unusedNodesMap)
+        unusedNodesMap->add(digest->m_sha1, digest);
+    return adoptPtr(digest);
+}
+
+bool DOMPatchSupport::insertBeforeAndMarkAsUsed(ContainerNode* parentNode, Digest* digest, Node* anchor, ExceptionCode& ec)
+{
+    bool result = m_domEditor->insertBefore(parentNode, digest->m_node, anchor, ec);
+    markNodeAsUsed(digest);
+    return result;
+}
+
+bool DOMPatchSupport::removeChildAndMoveToNew(Digest* oldDigest, ExceptionCode& ec)
+{
+    RefPtr<Node> oldNode = oldDigest->m_node;
+    if (!m_domEditor->removeChild(oldNode->parentNode(), oldNode.get(), ec))
+        return false;
+
+    // Diff works within levels. In order not to lose the node identity when user
+    // prepends his HTML with "<div>" (i.e. all nodes are shifted to the next nested level),
+    // prior to dropping the original node on the floor, check whether new DOM has a digest
+    // with matching sha1. If it does, replace it with the original DOM chunk. Chances are
+    // high that it will get merged back into the original DOM during the further patching.
+    UnusedNodesMap::iterator it = m_unusedNodesMap.find(oldDigest->m_sha1);
+    if (it != m_unusedNodesMap.end()) {
+        Digest* newDigest = it->second;
+        Node* newNode = newDigest->m_node;
+        if (!m_domEditor->replaceChild(newNode->parentNode(), oldNode, newNode, ec))
+            return false;
+        newDigest->m_node = oldNode.get();
+        markNodeAsUsed(newDigest);
+        return true;
+    }
+
+    for (size_t i = 0; i < oldDigest->m_children.size(); ++i) {
+        if (!removeChildAndMoveToNew(oldDigest->m_children[i].get(), ec))
+            return false;
+    }
+    return true;
+}
+
+void DOMPatchSupport::markNodeAsUsed(Digest* digest)
+{
+    Deque<Digest*> queue;
+    queue.append(digest);
+    while (!queue.isEmpty()) {
+        Digest* first = queue.takeFirst();
+        m_unusedNodesMap.remove(first->m_sha1);
+        for (size_t i = 0; i < first->m_children.size(); ++i)
+            queue.append(first->m_children[i].get());
+    }
+}
+
+#ifdef DEBUG_DOM_PATCH_SUPPORT
+static String nodeName(Node* node)
+{
+    if (node->document()->isXHTMLDocument())
+         return node->nodeName();
+    return node->nodeName().lower();
+}
+
+void DOMPatchSupport::dumpMap(const ResultMap& map, const String& name)
+{
+    fprintf(stderr, "\n\n");
+    for (size_t i = 0; i < map.size(); ++i)
+        fprintf(stderr, "%s[%lu]: %s (%p) - [%lu]\n", name.utf8().data(), i, map[i].first ? nodeName(map[i].first->m_node).utf8().data() : "", map[i].first, map[i].second);
+}
+#endif
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/DOMPatchSupport.h b/Source/WebCore/inspector/DOMPatchSupport.h
new file mode 100644
index 000000000..4d040f08b
--- /dev/null
+++ b/Source/WebCore/inspector/DOMPatchSupport.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMPatchSupport_h
+#define DOMPatchSupport_h
+
+#include "ExceptionCode.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class ContainerNode;
+class DOMEditor;
+class Document;
+class NamedNodeMap;
+class Node;
+
+#if ENABLE(INSPECTOR)
+
+class DOMPatchSupport {
+    WTF_MAKE_NONCOPYABLE(DOMPatchSupport);
+public:
+    static void patchDocument(Document*, const String& markup);
+
+    DOMPatchSupport(DOMEditor*, Document*);
+    virtual ~DOMPatchSupport();
+
+    void patchDocument(const String& markup);
+    Node* patchNode(Node*, const String& markup, ExceptionCode&);
+
+private:
+    struct Digest;
+    typedef Vector<pair<Digest*, size_t> > ResultMap;
+    typedef HashMap<String, Digest*> UnusedNodesMap;
+
+    bool innerPatchNode(Digest* oldNode, Digest* newNode, ExceptionCode&);
+    std::pair<ResultMap, ResultMap> diff(const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren);
+    bool innerPatchChildren(ContainerNode*, const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren, ExceptionCode&);
+    PassOwnPtr<Digest> createDigest(Node*, UnusedNodesMap*);
+    bool insertBeforeAndMarkAsUsed(ContainerNode*, Digest*, Node* anchor, ExceptionCode&);
+    bool removeChildAndMoveToNew(Digest*, ExceptionCode&);
+    void markNodeAsUsed(Digest*);
+#ifdef DEBUG_DOM_PATCH_SUPPORT
+    void dumpMap(const ResultMap&, const String& name);
+#endif
+
+    DOMEditor* m_domEditor;
+    Document* m_document;
+
+    UnusedNodesMap m_unusedNodesMap;
+};
+
+#endif // ENABLE(INSPECTOR)
+
+} // namespace WebCore
+
+#endif // !defined(DOMPatchSupport_h)
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 6d09b2917..7a0abd70f 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -43,6 +43,12 @@
 #include "PlatformString.h"
 #include "ScriptFunctionCall.h"
 
+using WebCore::TypeBuilder::Array;
+using WebCore::TypeBuilder::Debugger::CallFrame;
+using WebCore::TypeBuilder::Runtime::PropertyDescriptor;
+using WebCore::TypeBuilder::Debugger::FunctionDetails;
+using WebCore::TypeBuilder::Runtime::RemoteObject;
+
 namespace WebCore {
 
 InjectedScript::InjectedScript()
@@ -76,7 +82,7 @@ void InjectedScript::callFunctionOn(ErrorString* errorString, const String& obje
     makeEvalCall(errorString, function, result, wasThrown);
 }
 
-void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptValue& callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, RefPtr<InspectorObject>* result, bool* wasThrown)
+void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptValue& callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, RefPtr<RemoteObject>* result, bool* wasThrown)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluateOnCallFrame");
     function.appendArgument(callFrames);
@@ -85,10 +91,12 @@ void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptV
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
     function.appendArgument(returnByValue);
-    makeEvalCall(errorString, function, result, wasThrown);
+    RefPtr<InspectorObject> resultRaw;
+    makeEvalCall(errorString, function, &resultRaw, wasThrown);
+    *result = RemoteObject::runtimeCast(resultRaw);
 }
 
-void InjectedScript::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<InspectorObject>* result)
+void InjectedScript::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<FunctionDetails>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "getFunctionDetails");
     function.appendArgument(functionId);
@@ -99,7 +107,7 @@ void InjectedScript::getFunctionDetails(ErrorString* errorString, const String&
             *errorString = "Internal error";
         return;
     }
-    *result = resultValue->asObject();
+    *result = FunctionDetails::runtimeCast(resultValue);
 }
 
 void InjectedScript::getProperties(ErrorString* errorString, const String& objectId, bool ownProperties, RefPtr<InspectorArray>* properties)
@@ -114,7 +122,7 @@ void InjectedScript::getProperties(ErrorString* errorString, const String& objec
         *errorString = "Internal error";
         return;
     }
-    *properties = result->asArray();
+    *properties = Array<PropertyDescriptor>::runtimeCast(result);
 }
 
 Node* InjectedScript::nodeForObjectId(const String& objectId)
@@ -126,7 +134,7 @@ Node* InjectedScript::nodeForObjectId(const String& objectId)
     function.appendArgument(objectId);
 
     bool hadException = false;
-    ScriptValue resultValue = function.call(hadException);
+    ScriptValue resultValue = callFunctionWithEvalEnabled(function, hadException);
     ASSERT(!hadException);
 
     return InjectedScriptHost::scriptValueAsNode(resultValue);
@@ -141,20 +149,22 @@ void InjectedScript::releaseObject(const String& objectId)
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-PassRefPtr<InspectorArray> InjectedScript::wrapCallFrames(const ScriptValue& callFrames)
+PassRefPtr<Array<CallFrame> > InjectedScript::wrapCallFrames(const ScriptValue& callFrames)
 {
     ASSERT(!hasNoValue());
     ScriptFunctionCall function(m_injectedScriptObject, "wrapCallFrames");
     function.appendArgument(callFrames);
-    ScriptValue callFramesValue = function.call();
+    bool hadException = false;
+    ScriptValue callFramesValue = callFunctionWithEvalEnabled(function, hadException);
+    ASSERT(!hadException);
     RefPtr<InspectorValue> result = callFramesValue.toInspectorValue(m_injectedScriptObject.scriptState());
     if (result->type() == InspectorValue::TypeArray)
-        return result->asArray();
-    return InspectorArray::create();
+        return Array<CallFrame>::runtimeCast(result);
+    return Array<CallFrame>::create();
 }
 #endif
 
-PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const String& groupName)
+PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const String& groupName) const
 {
     ASSERT(!hasNoValue());
     ScriptFunctionCall wrapFunction(m_injectedScriptObject, "wrapObject");
@@ -162,7 +172,7 @@ PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const
     wrapFunction.appendArgument(groupName);
     wrapFunction.appendArgument(canAccessInspectedWindow());
     bool hadException = false;
-    ScriptValue r = wrapFunction.call(hadException);
+    ScriptValue r = callFunctionWithEvalEnabled(wrapFunction, hadException);
     if (hadException) {
         RefPtr<InspectorObject> result = InspectorObject::create();
         result->setString("description", "<exception>");
@@ -176,6 +186,12 @@ PassRefPtr<InspectorObject> InjectedScript::wrapNode(Node* node, const String& g
     return wrapObject(nodeAsScriptValue(node), groupName);
 }
 
+PassRefPtr<InspectorObject> InjectedScript::wrapSerializedObject(SerializedScriptValue* serializedScriptValue, const String& groupName) const
+{
+    ScriptValue scriptValue = serializedScriptValue->deserializeForInspector(m_injectedScriptObject.scriptState());
+    return scriptValue.hasNoValue() ? 0 : wrapObject(scriptValue, groupName);
+}
+
 void InjectedScript::inspectNode(Node* node)
 {
     ASSERT(!hasNoValue());
@@ -190,24 +206,20 @@ void InjectedScript::releaseObjectGroup(const String& objectGroup)
     ASSERT(!hasNoValue());
     ScriptFunctionCall releaseFunction(m_injectedScriptObject, "releaseObjectGroup");
     releaseFunction.appendArgument(objectGroup);
-    releaseFunction.call();
+    bool hadException = false;
+    callFunctionWithEvalEnabled(releaseFunction, hadException);
+    ASSERT(!hadException);
 }
 
-bool InjectedScript::canAccessInspectedWindow()
+bool InjectedScript::canAccessInspectedWindow() const
 {
     return m_inspectedStateAccessCheck(m_injectedScriptObject.scriptState());
 }
 
-void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
+ScriptValue InjectedScript::callFunctionWithEvalEnabled(ScriptFunctionCall& function, bool& hadException) const
 {
-    if (hasNoValue() || !canAccessInspectedWindow()) {
-        *result = InspectorValue::null();
-        return;
-    }
-
     DOMWindow* domWindow = domWindowFromScriptState(m_injectedScriptObject.scriptState());
     InspectorInstrumentationCookie cookie = domWindow && domWindow->frame() ? InspectorInstrumentation::willCallFunction(domWindow->frame()->page(), "InjectedScript", 1) : InspectorInstrumentationCookie();
-    bool hadException = false;
 
     ScriptState* scriptState = m_injectedScriptObject.scriptState();
     bool evalIsDisabled = false;
@@ -224,6 +236,18 @@ void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValu
         setEvalEnabled(scriptState, false);
 
     InspectorInstrumentation::didCallFunction(cookie);
+    return resultValue;
+}
+
+void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
+{
+    if (hasNoValue() || !canAccessInspectedWindow()) {
+        *result = InspectorValue::null();
+        return;
+    }
+
+    bool hadException = false;
+    ScriptValue resultValue = callFunctionWithEvalEnabled(function, hadException);
 
     ASSERT(!hadException);
     if (!hadException) {
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index f2b7ac152..84d9a78ed 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -32,6 +32,7 @@
 #define InjectedScript_h
 
 #include "InjectedScriptManager.h"
+#include "InspectorTypeBuilder.h"
 #include "ScriptObject.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -48,6 +49,8 @@ class ScriptFunctionCall;
 
 typedef String ErrorString;
 
+#if ENABLE(INSPECTOR)
+
 class InjectedScript {
 public:
     InjectedScript();
@@ -76,19 +79,20 @@ public:
                              const String& objectGroup,
                              bool includeCommandLineAPI,
                              bool returnByValue,
-                             RefPtr<InspectorObject>* result,
+                             RefPtr<TypeBuilder::Runtime::RemoteObject>* result,
                              bool* wasThrown);
-    void getFunctionDetails(ErrorString*, const String& functionId, RefPtr<InspectorObject>* result);
+    void getFunctionDetails(ErrorString*, const String& functionId, RefPtr<TypeBuilder::Debugger::FunctionDetails>* result);
     void getProperties(ErrorString*, const String& objectId, bool ownProperties, RefPtr<InspectorArray>* result);
     Node* nodeForObjectId(const String& objectId);
     void releaseObject(const String& objectId);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    PassRefPtr<InspectorArray> wrapCallFrames(const ScriptValue&);
+    PassRefPtr<TypeBuilder::Array<TypeBuilder::Debugger::CallFrame> > wrapCallFrames(const ScriptValue&);
 #endif
 
-    PassRefPtr<InspectorObject> wrapObject(ScriptValue, const String& groupName);
+    PassRefPtr<InspectorObject> wrapObject(ScriptValue, const String& groupName) const;
     PassRefPtr<InspectorObject> wrapNode(Node*, const String& groupName);
+    PassRefPtr<InspectorObject> wrapSerializedObject(SerializedScriptValue*, const String& groupName) const;
     void inspectNode(Node*);
     void releaseObjectGroup(const String&);
     ScriptState* scriptState() const { return m_injectedScriptObject.scriptState(); }
@@ -98,7 +102,8 @@ private:
     typedef bool (*InspectedStateAccessCheck)(ScriptState*);
     InjectedScript(ScriptObject, InspectedStateAccessCheck);
 
-    bool canAccessInspectedWindow();
+    bool canAccessInspectedWindow() const;
+    ScriptValue callFunctionWithEvalEnabled(ScriptFunctionCall&, bool& hadException) const;
     void makeCall(ScriptFunctionCall&, RefPtr<InspectorValue>* result);
     void makeEvalCall(ErrorString*, ScriptFunctionCall&, RefPtr<InspectorObject>* result, bool* wasThrown);
     ScriptValue nodeAsScriptValue(Node*);
@@ -107,6 +112,8 @@ private:
     InspectedStateAccessCheck m_inspectedStateAccessCheck;
 };
 
+#endif
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/inspector/InjectedScriptHost.cpp b/Source/WebCore/inspector/InjectedScriptHost.cpp
index 47d408a57..6f5022afb 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.cpp
+++ b/Source/WebCore/inspector/InjectedScriptHost.cpp
@@ -75,6 +75,7 @@ InjectedScriptHost::InjectedScriptHost()
     , m_domStorageAgent(0)
     , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
 {
+    m_defaultInspectableObject = adoptPtr(new InspectableObject());
 }
 
 InjectedScriptHost::~InjectedScriptHost()
@@ -91,18 +92,6 @@ void InjectedScriptHost::disconnect()
     m_domStorageAgent = 0;
 }
 
-void InjectedScriptHost::addInspectedNode(Node* node)
-{
-    m_inspectedNodes.prepend(node);
-    while (m_inspectedNodes.size() > 5)
-        m_inspectedNodes.removeLast();
-}
-
-void InjectedScriptHost::clearInspectedNodes()
-{
-    m_inspectedNodes.clear();
-}
-
 void InjectedScriptHost::inspectImpl(PassRefPtr<InspectorValue> object, PassRefPtr<InspectorValue> hints)
 {
     if (m_inspectorAgent)
@@ -122,11 +111,28 @@ void InjectedScriptHost::copyText(const String& text)
     Pasteboard::generalPasteboard()->writePlainText(text);
 }
 
-Node* InjectedScriptHost::inspectedNode(unsigned int num)
+ScriptValue InjectedScriptHost::InspectableObject::get(ScriptState*)
 {
-    if (num < m_inspectedNodes.size())
-        return m_inspectedNodes[num].get();
-    return 0;
+    return ScriptValue();
+};
+
+void InjectedScriptHost::addInspectedObject(PassOwnPtr<InjectedScriptHost::InspectableObject> object)
+{
+    m_inspectedObjects.prepend(object);
+    while (m_inspectedObjects.size() > 5)
+        m_inspectedObjects.removeLast();
+}
+
+void InjectedScriptHost::clearInspectedObjects()
+{
+    m_inspectedObjects.clear();
+}
+
+InjectedScriptHost::InspectableObject* InjectedScriptHost::inspectedObject(unsigned int num)
+{
+    if (num >= m_inspectedObjects.size())
+        return m_defaultInspectableObject.get();
+    return m_inspectedObjects[num].get();
 }
 
 #if ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/inspector/InjectedScriptHost.h b/Source/WebCore/inspector/InjectedScriptHost.h
index 2db466a69..324670611 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.h
+++ b/Source/WebCore/inspector/InjectedScriptHost.h
@@ -78,13 +78,18 @@ public:
 
     void disconnect();
 
-    void addInspectedNode(Node*);
-    void clearInspectedNodes();
+    class InspectableObject {
+    public:
+        virtual ScriptValue get(ScriptState*);
+        virtual ~InspectableObject() { }
+    };
+    void addInspectedObject(PassOwnPtr<InspectableObject>);
+    void clearInspectedObjects();
+    InspectableObject* inspectedObject(unsigned int num);
 
     void inspectImpl(PassRefPtr<InspectorValue> objectToInspect, PassRefPtr<InspectorValue> hints);
     void clearConsoleMessages();
     void copyText(const String& text);
-    Node* inspectedNode(unsigned int num);
 #if ENABLE(SQL_DATABASE)
     int databaseIdImpl(Database*);
 #endif
@@ -105,7 +110,8 @@ private:
 #endif
     InspectorDOMStorageAgent* m_domStorageAgent;
     long m_lastWorkerId;
-    Vector<RefPtr<Node> > m_inspectedNodes;
+    Vector<OwnPtr<InspectableObject> > m_inspectedObjects;
+    OwnPtr<InspectableObject> m_defaultInspectableObject;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InjectedScriptHost.idl b/Source/WebCore/inspector/InjectedScriptHost.idl
index b30a83587..ae146866b 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.idl
+++ b/Source/WebCore/inspector/InjectedScriptHost.idl
@@ -38,7 +38,7 @@ module core {
 
         void copyText(in DOMString text);
         [Custom] void inspect(in DOMObject objectId, in DOMObject hints);
-        [Custom] DOMObject inspectedNode(in int num);
+        [Custom] DOMObject inspectedObject(in int num);
         [Custom] DOMObject internalConstructorName(in DOMObject object);
         [Custom] boolean isHTMLAllCollection(in DOMObject object);
         [Custom] DOMString type(in DOMObject object);
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index 27089a887..79e6c6d98 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -184,12 +184,17 @@ InjectedScript.prototype = {
 
         for (var i = 0; i < descriptors.length; ++i) {
             var descriptor = descriptors[i];
-            if (descriptor.get)
+            if ("get" in descriptor)
                 descriptor.get = this._wrapObject(descriptor.get, objectGroupName);
-            if (descriptor.set)
+            if ("set" in descriptor)
                 descriptor.set = this._wrapObject(descriptor.set, objectGroupName);
             if ("value" in descriptor)
                 descriptor.value = this._wrapObject(descriptor.value, objectGroupName);
+            if (!("configurable" in descriptor))
+                descriptor.configurable = false;
+            if (!("enumerable" in descriptor))
+                descriptor.enumerable = false;
+            
         }
         return descriptors;
     },
@@ -566,7 +571,7 @@ function CommandLineAPI(commandLineAPIImpl, callFrame)
         if (member in inspectedWindow || inScopeVariables(member))
             continue;
 
-        this.__defineGetter__("$" + i, bind(commandLineAPIImpl, commandLineAPIImpl._inspectedNode, i));
+        this.__defineGetter__("$" + i, bind(commandLineAPIImpl, commandLineAPIImpl._inspectedObject, i));
     }
 }
 
@@ -680,9 +685,9 @@ CommandLineAPIImpl.prototype = {
         InjectedScriptHost.clearConsoleMessages();
     },
 
-    _inspectedNode: function(num)
+    _inspectedObject: function(num)
     {
-        return InjectedScriptHost.inspectedNode(num);
+        return InjectedScriptHost.inspectedObject(num);
     },
 
     _normalizeEventTypes: function(types)
diff --git a/Source/WebCore/inspector/Inspector-0.1.json b/Source/WebCore/inspector/Inspector-0.1.json
index 0086d9a58..a5c03035c 100644
--- a/Source/WebCore/inspector/Inspector-0.1.json
+++ b/Source/WebCore/inspector/Inspector-0.1.json
@@ -265,7 +265,7 @@
                 "properties": [
                     { "name": "name", "type": "string", "description": "Property name." },
                     { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." },
-                    { "name": "writable", "type": "boolean", "description": "True if the value associated with the property may be changed (data descriptors only)." },
+                    { "name": "writable", "type": "boolean", "optional": true, "description": "True if the value associated with the property may be changed (data descriptors only)." },
                     { "name": "get", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a getter for the property, or <code>undefined</code> if there is no getter (accessor descriptors only)." },
                     { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
                     { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
diff --git a/Source/WebCore/inspector/Inspector-1.0.json b/Source/WebCore/inspector/Inspector-1.0.json
index 1d3cbdc02..e19e7e060 100644
--- a/Source/WebCore/inspector/Inspector-1.0.json
+++ b/Source/WebCore/inspector/Inspector-1.0.json
@@ -376,7 +376,7 @@
                 "properties": [
                     { "name": "name", "type": "string", "description": "Property name." },
                     { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." },
-                    { "name": "writable", "type": "boolean", "description": "True if the value associated with the property may be changed (data descriptors only)." },
+                    { "name": "writable", "type": "boolean", "optional": true, "description": "True if the value associated with the property may be changed (data descriptors only)." },
                     { "name": "get", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a getter for the property, or <code>undefined</code> if there is no getter (accessor descriptors only)." },
                     { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
                     { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index ffd22de21..24ec72ec9 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -137,7 +137,9 @@
                             "properties": [
                                 { "name": "url", "type": "string", "description": "Resource URL." },
                                 { "name": "type", "$ref": "ResourceType", "description": "Type of this resource." },
-                                { "name": "mimeType", "type": "string", "description": "Resource mimeType as determined by the browser." }
+                                { "name": "mimeType", "type": "string", "description": "Resource mimeType as determined by the browser." },
+                                { "name": "failed", "type": "boolean", "optional": true, "description": "True if the resource failed to load." },
+                                { "name": "canceled", "type": "boolean", "optional": true, "description": "True if the resource was canceled during loading." }
                             ]
                         },
                         "description": "Information about frame resources."
@@ -315,6 +317,14 @@
                     { "name": "height", "type": "integer", "description": "Overriding height value in pixels (minimum 0, maximum 10000000). 0 disables the override." }
                 ],
                 "hidden": true
+            },
+            {
+                "name": "setShowPaintRects",
+                "description": "Requests that backend shows paint rectangles",
+                "parameters": [
+                    { "name": "result", "type": "boolean", "description": "True for showing paint rectangles" }
+                ],
+                "hidden": true
             }
         ],
         "events": [
@@ -377,7 +387,7 @@
                 "properties": [
                     { "name": "name", "type": "string", "description": "Property name." },
                     { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." },
-                    { "name": "writable", "type": "boolean", "description": "True if the value associated with the property may be changed (data descriptors only)." },
+                    { "name": "writable", "type": "boolean", "optional": true, "description": "True if the value associated with the property may be changed (data descriptors only)." },
                     { "name": "get", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a getter for the property, or <code>undefined</code> if there is no getter (accessor descriptors only)." },
                     { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
                     { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
@@ -525,6 +535,12 @@
                 ],
                 "description": "Enables console to refer to the node with given id via $x (see Command Line API for more details $x functions).",
                 "hidden": true
+            },
+            {
+                "name": "addInspectedHeapObject",
+                "parameters": [
+                    { "name": "heapObjectId", "type": "integer" }
+		]
             }
         ],
         "events": [
@@ -971,6 +987,39 @@
                     { "name": "unique", "type": "boolean", "description": "If true, index is unique." },
                     { "name": "multiEntry", "type": "boolean", "description": "If true, index allows multiple entries for a key." }
                 ]
+            },
+            {
+                "id": "Key",
+                "type": "object",
+                "description": "Key.",
+                "properties": [
+                    { "name": "type", "type": "string", "enum": ["number", "string", "date", "array"], "description": "Key type." },
+                    { "name": "number", "type": "number", "optional": true, "description": "Number value." },
+                    { "name": "string", "type": "string", "optional": true, "description": "String value." },
+                    { "name": "date", "type": "number", "optional": true, "description": "Date value." },
+                    { "name": "array", "type": "array", "optional": true, "items": { "$ref": "Key" }, "description": "Array value." }
+                ]
+            },
+            {
+                "id": "KeyRange",
+                "type": "object",
+                "description": "Key range.",
+                "properties": [
+                    { "name": "lower", "$ref": "Key", "optional": true, "description": "Lower bound." },
+                    { "name": "upper", "$ref": "Key", "optional": true, "description": "Upper bound." },
+                    { "name": "lowerOpen", "type": "boolean", "description": "If true lower bound is open." },
+                    { "name": "upperOpen", "type": "boolean", "description": "If true upper bound is open." }
+                ]
+            },
+            {
+                "id": "DataEntry",
+                "type": "object",
+                "description": "Key.",
+                "properties": [
+                    { "name": "key", "$ref": "Key", "description": "Key." },
+                    { "name": "primaryKey", "$ref": "Key", "description": "Primary key." },
+                    { "name": "value", "$ref": "Runtime.RemoteObject", "description": "Value." }
+                ]
             }
         ],
         "commands": [
@@ -994,10 +1043,24 @@
                 "name": "requestDatabase",
                 "parameters": [
                     { "name": "requestId", "type": "integer", "description": "Request id." },
-                    { "name": "frameId", "$ref": "Network.FrameId" },
-                    { "name": "databaseName", "type": "string" }
+                    { "name": "frameId", "$ref": "Network.FrameId", "description": "Frame id." },
+                    { "name": "databaseName", "type": "string", "description": "Database name." }
                 ],
                 "description": "Requests database with given name in given frame."
+            },
+            {
+                "name": "requestData",
+                "parameters": [
+                    { "name": "requestId", "type": "integer", "description": "Request id." },
+                    { "name": "frameId", "$ref": "Network.FrameId", "description": "Frame id." },
+                    { "name": "databaseName", "type": "string", "description": "Database name." },
+                    { "name": "objectStoreName", "type": "string", "description": "Object store name." },
+                    { "name": "indexName", "type": "string", "description": "Index name, empty string for object store data requests." },
+                    { "name": "skipCount", "type": "integer", "description": "Number of records to skip." },
+                    { "name": "pageSize", "type": "integer", "description": "Number of records to fetch." },
+                    { "name": "keyRange", "$ref": "KeyRange", "optional": true, "description": "Key range." }
+                ],
+                "description": "Requests data from object store or index."
             }
         ],
         "events": [
@@ -1014,6 +1077,22 @@
                     { "name": "requestId", "type": "integer", "description": "Request id." },
                     { "name": "databaseWithObjectStores", "$ref": "DatabaseWithObjectStores", "description": "Database with an array of object stores." }
                 ]
+            },
+            {
+                "name": "objectStoreDataLoaded",
+                "parameters": [
+                    { "name": "requestId", "type": "integer", "description": "Request id." },
+                    { "name": "objectStoreDataEntries", "type": "array", "items": { "$ref": "DataEntry" }, "description": "Array of object store data entries." },
+                    { "name": "hasMore", "type": "boolean", "description": "If true, there are more entries to fetch in the given range." }
+                ]
+            },
+            {
+                "name": "indexDataLoaded",
+                "parameters": [
+                    { "name": "requestId", "type": "integer", "description": "Request id." },
+                    { "name": "indexDataEntries", "type": "array", "items": { "$ref": "DataEntry" }, "description": "Array of index data entries." },
+                    { "name": "hasMore", "type": "boolean", "description": "If true, there are more entries to fetch in the given range." }
+                ]
             }
         ]
     },
@@ -1523,6 +1602,11 @@
                 "hidden": true
             },
             {
+                "name": "redo",
+                "description": "Re-does the last undone action.",
+                "hidden": true
+            },
+            {
                 "name": "markUndoableState",
                 "description": "Marks last undoable state.",
                 "hidden": true
@@ -1607,10 +1691,14 @@
         "description": "This domain exposes CSS read/write operations. All CSS objects, like stylesheets, rules, and styles, have an associated <code>id</code> used in subsequent operations on the related object. Each object type has a specific <code>id</code> structure, and those are not interchangeable between objects of different kinds. CSS objects can be loaded using the <code>get*ForNode()</code> calls (which accept a DOM node id). Alternatively, a client can discover all the existing stylesheets with the <code>getAllStyleSheets()</code> method and subsequently load the required stylesheet contents using the <code>getStyleSheet[Text]()</code> methods.",
         "types": [
             {
+                "id": "StyleSheetId",
+                "type": "string"
+            },
+            {
                 "id": "CSSStyleId",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "Enclosing stylesheet identifier." },
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Enclosing stylesheet identifier." },
                     { "name": "ordinal", "type": "integer", "description": "The style ordinal within the stylesheet." }
                 ],
                 "description": "This object identifies a CSS style in a unique way."
@@ -1619,7 +1707,7 @@
                 "id": "CSSRuleId",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "Enclosing stylesheet identifier." },
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Enclosing stylesheet identifier." },
                     { "name": "ordinal", "type": "integer", "description": "The rule ordinal within the stylesheet." }
                 ],
                 "description": "This object identifies a CSS rule in a unique way."
@@ -1655,7 +1743,7 @@
                 "id": "CSSStyleSheetHeader",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "The stylesheet identifier."},
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "The stylesheet identifier."},
                     { "name": "sourceURL", "type": "string", "description": "Stylesheet resource URL."},
                     { "name": "title", "type": "string", "description": "Stylesheet title."},
                     { "name": "disabled", "type": "boolean", "description": "Denotes whether the stylesheet is disabled."}
@@ -1666,7 +1754,7 @@
                 "id": "CSSStyleSheetBody",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "The stylesheet identifier."},
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "The stylesheet identifier."},
                     { "name": "rules", "type": "array", "items": { "$ref": "CSSRule" }, "description": "Stylesheet resource URL."},
                     { "name": "text", "type": "string", "optional": true, "description": "Stylesheet resource contents (if available)."}
                 ],
@@ -1827,7 +1915,7 @@
             {
                 "name": "getStyleSheet",
                 "parameters": [
-                    { "name": "styleSheetId", "type": "string" }
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" }
                 ],
                 "returns": [
                     { "name": "styleSheet", "$ref": "CSSStyleSheetBody", "description": "Stylesheet contents for the specified <code>styleSheetId</code>." }
@@ -1837,7 +1925,7 @@
             {
                 "name": "getStyleSheetText",
                 "parameters": [
-                    { "name": "styleSheetId", "type": "string" }
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" }
                 ],
                 "returns": [
                     { "name": "text", "type": "string", "description": "The stylesheet text." }
@@ -1847,7 +1935,7 @@
             {
                 "name": "setStyleSheetText",
                 "parameters": [
-                    { "name": "styleSheetId", "type": "string" },
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" },
                     { "name": "text", "type": "string" }
                 ],
                 "description": "Sets the new stylesheet text, thereby invalidating all existing <code>CSSStyleId</code>'s and <code>CSSRuleId</code>'s contained by this stylesheet."
@@ -1920,6 +2008,13 @@
             {
                 "name": "mediaQueryResultChanged",
                 "description": "Fires whenever a MediaQuery result changes (for example, after a browser window has been resized.) The current implementation considers only viewport-dependent media features."
+            },
+            {
+                "name": "styleSheetChanged",
+                "parameters": [
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" }
+                ],
+                "description": "Fired whenever a stylesheet is changed as a result of the client operation."
             }
         ]
     },
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index ec4ce1d6c..31d516603 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -150,7 +150,7 @@ void InspectorAgent::disable(ErrorString*)
 
 void InspectorAgent::domContentLoadedEventFired()
 {
-    m_injectedScriptManager->injectedScriptHost()->clearInspectedNodes();
+    m_injectedScriptManager->injectedScriptHost()->clearInspectedObjects();
 }
 
 bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
diff --git a/Source/WebCore/inspector/InspectorAllInOne.cpp b/Source/WebCore/inspector/InspectorAllInOne.cpp
index 35173cb9e..b12230432 100644
--- a/Source/WebCore/inspector/InspectorAllInOne.cpp
+++ b/Source/WebCore/inspector/InspectorAllInOne.cpp
@@ -25,6 +25,15 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include "ConsoleMessage.cpp"
+#include "ContentSearchUtils.cpp"
+#include "DOMEditor.cpp"
+#include "DOMNodeHighlighter.cpp"
+#include "DOMPatchSupport.cpp"
+#include "IdentifiersFactory.cpp"
+#include "InjectedScript.cpp"
+#include "InjectedScriptHost.cpp"
+#include "InjectedScriptManager.cpp"
 #include "InspectorAgent.cpp"
 #include "InspectorApplicationCacheAgent.cpp"
 #include "InspectorBaseAgent.cpp"
@@ -32,6 +41,7 @@
 #include "InspectorClient.cpp"
 #include "InspectorConsoleAgent.cpp"
 #include "InspectorController.cpp"
+#include "InspectorCounters.cpp"
 #include "InspectorDOMAgent.cpp"
 #include "InspectorDOMDebuggerAgent.cpp"
 #include "InspectorDOMStorageAgent.cpp"
@@ -56,3 +66,16 @@
 #include "InspectorTimelineAgent.cpp"
 #include "InspectorValues.cpp"
 #include "InspectorWorkerAgent.cpp"
+#include "InstrumentingAgents.cpp"
+#include "NetworkResourcesData.cpp"
+#include "PageConsoleAgent.cpp"
+#include "PageDebuggerAgent.cpp"
+#include "PageRuntimeAgent.cpp"
+#include "ScriptArguments.cpp"
+#include "ScriptCallFrame.cpp"
+#include "ScriptCallStack.cpp"
+#include "TimelineRecordFactory.cpp"
+#include "WorkerConsoleAgent.cpp"
+#include "WorkerDebuggerAgent.cpp"
+#include "WorkerInspectorController.cpp"
+#include "WorkerRuntimeAgent.cpp"
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index 05d22bd06..1f4f713a8 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -221,68 +221,63 @@ PassRefPtr<InspectorObject> SelectorProfile::toInspectorObject() const
 class InspectorCSSAgent::StyleSheetAction : public InspectorHistory::Action {
     WTF_MAKE_NONCOPYABLE(StyleSheetAction);
 public:
-    StyleSheetAction(const String& name, InspectorCSSAgent* cssAgent, const String& styleSheetId)
+    StyleSheetAction(const String& name, InspectorStyleSheet* styleSheet)
         : InspectorHistory::Action(name)
-        , m_cssAgent(cssAgent)
-        , m_styleSheetId(styleSheetId)
+        , m_styleSheet(styleSheet)
     {
     }
 
-    virtual bool perform(ErrorString* errorString)
-    {
-        InspectorStyleSheet* styleSheet = m_cssAgent->assertStyleSheetForId(errorString, m_styleSheetId);
-        if (!styleSheet)
-            return false;
-        return perform(styleSheet, errorString);
-    }
-
-    virtual bool undo(ErrorString* errorString)
-    {
-        InspectorStyleSheet* styleSheet = m_cssAgent->assertStyleSheetForId(errorString, m_styleSheetId);
-        if (!styleSheet)
-            return false;
-        return undo(styleSheet, errorString);
-    }
-
-    virtual bool perform(InspectorStyleSheet*, ErrorString*) = 0;
-
-    virtual bool undo(InspectorStyleSheet*, ErrorString*) = 0;
-
 protected:
-    InspectorCSSAgent* m_cssAgent;
-    String m_styleSheetId;
+    RefPtr<InspectorStyleSheet> m_styleSheet;
 };
 
 class InspectorCSSAgent::SetStyleSheetTextAction : public InspectorCSSAgent::StyleSheetAction {
     WTF_MAKE_NONCOPYABLE(SetStyleSheetTextAction);
 public:
-    SetStyleSheetTextAction(InspectorCSSAgent* cssAgent, const String& styleSheetId, const String& text)
-        : InspectorCSSAgent::StyleSheetAction("SetStyleSheetText", cssAgent, styleSheetId)
+    SetStyleSheetTextAction(InspectorStyleSheet* styleSheet, const String& text)
+        : InspectorCSSAgent::StyleSheetAction("SetStyleSheetText", styleSheet)
         , m_text(text)
     {
     }
 
-    virtual bool perform(InspectorStyleSheet* inspectorStyleSheet, ErrorString*)
+    virtual bool perform(ExceptionCode& ec)
     {
-        if (!inspectorStyleSheet->getText(&m_oldText))
+        if (!m_styleSheet->getText(&m_oldText))
             return false;
+        return redo(ec);
+    }
 
-        if (inspectorStyleSheet->setText(m_text)) {
-            inspectorStyleSheet->reparseStyleSheet(m_text);
+    virtual bool undo(ExceptionCode&)
+    {
+        if (m_styleSheet->setText(m_oldText)) {
+            m_styleSheet->reparseStyleSheet(m_oldText);
             return true;
         }
         return false;
     }
 
-    virtual bool undo(InspectorStyleSheet* inspectorStyleSheet, ErrorString*)
+    virtual bool redo(ExceptionCode&)
     {
-        if (inspectorStyleSheet->setText(m_oldText)) {
-            inspectorStyleSheet->reparseStyleSheet(m_oldText);
+        if (m_styleSheet->setText(m_text)) {
+            m_styleSheet->reparseStyleSheet(m_text);
             return true;
         }
         return false;
     }
 
+    virtual String mergeId()
+    {
+        return String::format("SetStyleSheetText %s", m_styleSheet->id().utf8().data());
+    }
+
+    virtual void merge(PassOwnPtr<Action> action)
+    {
+        ASSERT(action->mergeId() == mergeId());
+
+        SetStyleSheetTextAction* other = static_cast<SetStyleSheetTextAction*>(action.get());
+        m_text = other->m_text;
+    }
+
 private:
     String m_text;
     String m_oldText;
@@ -291,8 +286,8 @@ private:
 class InspectorCSSAgent::SetPropertyTextAction : public InspectorCSSAgent::StyleSheetAction {
     WTF_MAKE_NONCOPYABLE(SetPropertyTextAction);
 public:
-    SetPropertyTextAction(InspectorCSSAgent* cssAgent, const String& styleSheetId, const InspectorCSSId& cssId, unsigned propertyIndex, const String& text, bool overwrite)
-        : InspectorCSSAgent::StyleSheetAction("SetPropertyText", cssAgent, styleSheetId)
+    SetPropertyTextAction(InspectorStyleSheet* styleSheet, const InspectorCSSId& cssId, unsigned propertyIndex, const String& text, bool overwrite)
+        : InspectorCSSAgent::StyleSheetAction("SetPropertyText", styleSheet)
         , m_cssId(cssId)
         , m_propertyIndex(propertyIndex)
         , m_text(text)
@@ -305,10 +300,21 @@ public:
         return mergeId() + ": " + m_oldText + " -> " + m_text;
     }
 
-    virtual bool perform(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        String placeholder;
+        return m_styleSheet->setPropertyText(m_cssId, m_propertyIndex, m_overwrite ? m_oldText : "", true, &placeholder, ec);
+    }
+
+    virtual bool redo(ExceptionCode& ec)
     {
         String oldText;
-        bool result = inspectorStyleSheet->setPropertyText(errorString, m_cssId, m_propertyIndex, m_text, m_overwrite, &oldText);
+        bool result = m_styleSheet->setPropertyText(m_cssId, m_propertyIndex, m_text, m_overwrite, &oldText, ec);
         m_oldText = oldText.stripWhiteSpace();
         // FIXME: remove this once the model handles this case.
         if (!m_oldText.endsWith(";"))
@@ -316,15 +322,9 @@ public:
         return result;
     }
 
-    virtual bool undo(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
-    {
-        String placeholder;
-        return inspectorStyleSheet->setPropertyText(errorString, m_cssId, m_propertyIndex, m_overwrite ? m_oldText : "", true, &placeholder);
-    }
-
     virtual String mergeId()
     {
-        return String::format("SetPropertyText %s:%u:%s", m_styleSheetId.utf8().data(), m_propertyIndex, m_overwrite ? "true" : "false");
+        return String::format("SetPropertyText %s:%u:%s", m_styleSheet->id().utf8().data(), m_propertyIndex, m_overwrite ? "true" : "false");
     }
 
     virtual void merge(PassOwnPtr<Action> action)
@@ -346,22 +346,27 @@ private:
 class InspectorCSSAgent::TogglePropertyAction : public InspectorCSSAgent::StyleSheetAction {
     WTF_MAKE_NONCOPYABLE(TogglePropertyAction);
 public:
-    TogglePropertyAction(InspectorCSSAgent* cssAgent, const String& styleSheetId, const InspectorCSSId& cssId, unsigned propertyIndex, bool disable)
-        : InspectorCSSAgent::StyleSheetAction("ToggleProperty", cssAgent, styleSheetId)
+    TogglePropertyAction(InspectorStyleSheet* styleSheet, const InspectorCSSId& cssId, unsigned propertyIndex, bool disable)
+        : InspectorCSSAgent::StyleSheetAction("ToggleProperty", styleSheet)
         , m_cssId(cssId)
         , m_propertyIndex(propertyIndex)
         , m_disable(disable)
     {
     }
 
-    virtual bool perform(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
     {
-        return inspectorStyleSheet->toggleProperty(errorString, m_cssId, m_propertyIndex, m_disable);
+        return m_styleSheet->toggleProperty(m_cssId, m_propertyIndex, !m_disable, ec);
     }
 
-    virtual bool undo(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
+    virtual bool redo(ExceptionCode& ec)
     {
-      return inspectorStyleSheet->toggleProperty(errorString, m_cssId, m_propertyIndex, !m_disable);
+        return m_styleSheet->toggleProperty(m_cssId, m_propertyIndex, m_disable, ec);
     }
 
 private:
@@ -370,6 +375,76 @@ private:
     bool m_disable;
 };
 
+class InspectorCSSAgent::SetRuleSelectorAction : public InspectorCSSAgent::StyleSheetAction {
+    WTF_MAKE_NONCOPYABLE(SetRuleSelectorAction);
+public:
+    SetRuleSelectorAction(InspectorStyleSheet* styleSheet, const InspectorCSSId& cssId, const String& selector)
+        : InspectorCSSAgent::StyleSheetAction("SetRuleSelector", styleSheet)
+        , m_cssId(cssId)
+        , m_selector(selector)
+    {
+    }
+
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldSelector = m_styleSheet->ruleSelector(m_cssId, ec);
+        if (ec)
+            return false;
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_styleSheet->setRuleSelector(m_cssId, m_oldSelector, ec);
+    }
+
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_styleSheet->setRuleSelector(m_cssId, m_selector, ec);
+    }
+
+private:
+    InspectorCSSId m_cssId;
+    String m_selector;
+    String m_oldSelector;
+};
+
+class InspectorCSSAgent::AddRuleAction : public InspectorCSSAgent::StyleSheetAction {
+    WTF_MAKE_NONCOPYABLE(AddRuleAction);
+public:
+    AddRuleAction(InspectorStyleSheet* styleSheet, const String& selector)
+        : InspectorCSSAgent::StyleSheetAction("AddRule", styleSheet)
+        , m_selector(selector)
+    {
+    }
+
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_styleSheet->deleteRule(m_newId, ec);
+    }
+
+    virtual bool redo(ExceptionCode& ec)
+    {
+        CSSStyleRule* cssStyleRule = m_styleSheet->addRule(m_selector, ec);
+        if (ec)
+            return false;
+        m_newId = m_styleSheet->ruleId(cssStyleRule);
+        return true;
+    }
+
+    InspectorCSSId newRuleId() { return m_newId; }
+
+private:
+    InspectorCSSId m_newId;
+    String m_selector;
+    String m_oldSelector;
+};
+
 // static
 CSSStyleRule* InspectorCSSAgent::asCSSStyleRule(CSSRule* rule)
 {
@@ -559,7 +634,7 @@ void InspectorCSSAgent::getComputedStyleForNode(ErrorString* errorString, int no
 
     recalcStyleForPseudoStateIfNeeded(element, forcedPseudoClasses ? forcedPseudoClasses->get() : 0);
 
-    RefPtr<CSSComputedStyleDeclaration> computedStyleInfo = computedStyle(element, true);
+    RefPtr<CSSComputedStyleDeclaration> computedStyleInfo = CSSComputedStyleDeclaration::create(element, true);
     RefPtr<InspectorStyle> inspectorStyle = InspectorStyle::create(InspectorCSSId(), computedStyleInfo, 0);
     style = inspectorStyle->buildArrayForComputedStyle();
 }
@@ -597,8 +672,13 @@ void InspectorCSSAgent::getStyleSheetText(ErrorString* errorString, const String
 
 void InspectorCSSAgent::setStyleSheetText(ErrorString* errorString, const String& styleSheetId, const String& text)
 {
-    m_domAgent->history()->perform(adoptPtr(new SetStyleSheetTextAction(this, styleSheetId, text)), errorString);
-    m_domAgent->history()->markUndoableState();
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, styleSheetId);
+    if (!inspectorStyleSheet)
+        return;
+
+    ExceptionCode ec = 0;
+    m_domAgent->history()->perform(adoptPtr(new SetStyleSheetTextAction(inspectorStyleSheet, text)), ec);
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>& result)
@@ -610,9 +690,11 @@ void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<I
     if (!inspectorStyleSheet)
         return;
 
-    bool success = m_domAgent->history()->perform(adoptPtr(new SetPropertyTextAction(this, compoundId.styleSheetId(), compoundId, propertyIndex, text, overwrite)), errorString);
+    ExceptionCode ec = 0;
+    bool success = m_domAgent->history()->perform(adoptPtr(new SetPropertyTextAction(inspectorStyleSheet, compoundId, propertyIndex, text, overwrite)), ec);
     if (success)
         result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorCSSAgent::toggleProperty(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, bool disable, RefPtr<InspectorObject>& result)
@@ -624,10 +706,11 @@ void InspectorCSSAgent::toggleProperty(ErrorString* errorString, const RefPtr<In
     if (!inspectorStyleSheet)
         return;
 
-    bool success = m_domAgent->history()->perform(adoptPtr(new TogglePropertyAction(this, compoundId.styleSheetId(), compoundId, propertyIndex, disable)), errorString);
+    ExceptionCode ec = 0;
+    bool success = m_domAgent->history()->perform(adoptPtr(new TogglePropertyAction(inspectorStyleSheet, compoundId, propertyIndex, disable)), ec);
     if (success)
         result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
-    m_domAgent->history()->markUndoableState();
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorObject>& result)
@@ -639,27 +722,40 @@ void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<I
     if (!inspectorStyleSheet)
         return;
 
-    bool success = inspectorStyleSheet->setRuleSelector(compoundId, selector);
-    if (!success)
-        return;
+    ExceptionCode ec = 0;
+    bool success = m_domAgent->history()->perform(adoptPtr(new SetRuleSelectorAction(inspectorStyleSheet, compoundId, selector)), ec);
+    if (success)
+        result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 
-    result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(compoundId));
+    if (success)
+        result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(compoundId));
 }
 
-void InspectorCSSAgent::addRule(ErrorString*, const int contextNodeId, const String& selector, RefPtr<InspectorObject>& result)
+void InspectorCSSAgent::addRule(ErrorString* errorString, const int contextNodeId, const String& selector, RefPtr<InspectorObject>& result)
 {
-    Node* node = m_domAgent->nodeForId(contextNodeId);
+    Node* node = m_domAgent->assertNode(errorString, contextNodeId);
     if (!node)
         return;
 
     InspectorStyleSheet* inspectorStyleSheet = viaInspectorStyleSheet(node->document(), true);
-    if (!inspectorStyleSheet)
+    if (!inspectorStyleSheet) {
+        *errorString = "No target stylesheet found";
         return;
-    CSSStyleRule* newRule = inspectorStyleSheet->addRule(selector);
-    if (!newRule)
+    }
+
+    ExceptionCode ec = 0;
+    OwnPtr<AddRuleAction> action = adoptPtr(new AddRuleAction(inspectorStyleSheet, selector));
+    AddRuleAction* rawAction = action.get();
+    bool success = m_domAgent->history()->perform(action.release(), ec);
+    if (!success) {
+        *errorString = InspectorDOMAgent::toErrorString(ec);
         return;
+    }
 
-    result = inspectorStyleSheet->buildObjectForRule(newRule);
+    InspectorCSSId ruleId = rawAction->newRuleId();
+    CSSStyleRule* rule = inspectorStyleSheet->ruleForId(ruleId);
+    result = inspectorStyleSheet->buildObjectForRule(rule);
 }
 
 void InspectorCSSAgent::getSupportedCSSProperties(ErrorString*, RefPtr<InspectorArray>& cssProperties)
@@ -725,7 +821,7 @@ InspectorStyleSheetForInlineStyle* InspectorCSSAgent::asInspectorStyleSheet(Elem
             return 0;
 
         String newStyleSheetId = String::number(m_lastStyleSheetId++);
-        RefPtr<InspectorStyleSheetForInlineStyle> inspectorStyleSheet = InspectorStyleSheetForInlineStyle::create(newStyleSheetId, element, "regular");
+        RefPtr<InspectorStyleSheetForInlineStyle> inspectorStyleSheet = InspectorStyleSheetForInlineStyle::create(newStyleSheetId, element, "regular", this);
         m_idToInspectorStyleSheet.set(newStyleSheetId, inspectorStyleSheet);
         m_nodeToInspectorStyleSheet.set(element, inspectorStyleSheet);
         return inspectorStyleSheet.get();
@@ -768,7 +864,7 @@ InspectorStyleSheet* InspectorCSSAgent::bindStyleSheet(CSSStyleSheet* styleSheet
     if (!inspectorStyleSheet) {
         String id = String::number(m_lastStyleSheetId++);
         Document* document = styleSheet->findDocument();
-        inspectorStyleSheet = InspectorStyleSheet::create(id, styleSheet, detectOrigin(styleSheet, document), InspectorDOMAgent::documentURLString(document));
+        inspectorStyleSheet = InspectorStyleSheet::create(id, styleSheet, detectOrigin(styleSheet, document), InspectorDOMAgent::documentURLString(document), this);
         m_idToInspectorStyleSheet.set(id, inspectorStyleSheet);
         m_cssStyleSheetToInspectorStyleSheet.set(styleSheet, inspectorStyleSheet);
     }
@@ -809,7 +905,7 @@ InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* documen
         return 0;
     CSSStyleSheet* cssStyleSheet = static_cast<CSSStyleSheet*>(styleSheet);
     String id = String::number(m_lastStyleSheetId++);
-    inspectorStyleSheet = InspectorStyleSheet::create(id, cssStyleSheet, "inspector", InspectorDOMAgent::documentURLString(document));
+    inspectorStyleSheet = InspectorStyleSheet::create(id, cssStyleSheet, "inspector", InspectorDOMAgent::documentURLString(document), this);
     m_idToInspectorStyleSheet.set(id, inspectorStyleSheet);
     m_cssStyleSheetToInspectorStyleSheet.set(cssStyleSheet, inspectorStyleSheet);
     m_documentToInspectorStyleSheet.set(document, inspectorStyleSheet);
@@ -913,6 +1009,12 @@ void InspectorCSSAgent::didModifyDOMAttr(Element* element)
     it->second->didModifyElementAttribute();
 }
 
+void InspectorCSSAgent::styleSheetChanged(InspectorStyleSheet* styleSheet)
+{
+    if (m_frontend)
+        m_frontend->styleSheetChanged(styleSheet->id());
+}
+
 void InspectorCSSAgent::clearPseudoState(bool recalcStyles)
 {
     RefPtr<Element> element = m_lastElementWithPseudoState;
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 4afd9fb1c..e7ee76572 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -54,7 +54,11 @@ class SelectorProfile;
 
 #if ENABLE(INSPECTOR)
 
-class InspectorCSSAgent : public InspectorBaseAgent<InspectorCSSAgent>, public InspectorDOMAgent::DOMListener, public InspectorBackendDispatcher::CSSCommandHandler {
+class InspectorCSSAgent
+    : public InspectorBaseAgent<InspectorCSSAgent>
+    , public InspectorDOMAgent::DOMListener
+    , public InspectorBackendDispatcher::CSSCommandHandler
+    , public InspectorStyleSheet::Listener {
     WTF_MAKE_NONCOPYABLE(InspectorCSSAgent);
 public:
     static CSSStyleRule* asCSSStyleRule(CSSRule*);
@@ -102,6 +106,8 @@ private:
     class SetStyleSheetTextAction;
     class SetPropertyTextAction;
     class TogglePropertyAction;
+    class SetRuleSelectorAction;
+    class AddRuleAction;
 
     InspectorCSSAgent(InstrumentingAgents*, InspectorState*, InspectorDOMAgent*);
 
@@ -123,11 +129,14 @@ private:
     PassRefPtr<InspectorArray> buildArrayForRuleList(CSSRuleList* ruleList);
     PassRefPtr<InspectorObject> buildObjectForAttributesStyle(Element*);
 
-    // InspectorDOMAgent::DOMListener interface
+    // InspectorDOMAgent::DOMListener implementation
     virtual void didRemoveDocument(Document*);
     virtual void didRemoveDOMNode(Node*);
     virtual void didModifyDOMAttr(Element*);
 
+    // InspectorCSSAgent::Listener implementation
+    virtual void styleSheetChanged(InspectorStyleSheet*);
+
     void clearPseudoState(bool recalcStyles);
 
     InspectorFrontend::CSS* m_frontend;
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 4f7db0c6a..ad51add56 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -41,6 +41,8 @@
 #include "ScriptArguments.h"
 #include "ScriptCallFrame.h"
 #include "ScriptCallStack.h"
+#include "ScriptObject.h"
+#include "ScriptProfiler.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -279,6 +281,22 @@ void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> console
     }
 }
 
+class InspectableHeapObject : public InjectedScriptHost::InspectableObject {
+public:
+    explicit InspectableHeapObject(int heapObjectId) : m_heapObjectId(heapObjectId) { }
+    virtual ScriptValue get(ScriptState*)
+    {
+        return ScriptProfiler::objectByHeapObjectId(m_heapObjectId);
+    }
+private:
+    int m_heapObjectId;
+};
+
+void InspectorConsoleAgent::addInspectedHeapObject(ErrorString*, int inspectedHeapObjectId)
+{
+    m_injectedScriptManager->injectedScriptHost()->addInspectedObject(adoptPtr(new InspectableHeapObject(inspectedHeapObjectId)));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.h b/Source/WebCore/inspector/InspectorConsoleAgent.h
index 302429a45..4ba4aaa2d 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.h
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.h
@@ -85,6 +85,7 @@ public:
 #endif
     virtual void setMonitoringXHREnabled(ErrorString*, bool enabled);
     virtual void addInspectedNode(ErrorString*, int nodeId) = 0;
+    virtual void addInspectedHeapObject(ErrorString*, int inspectedHeapObjectId);
 
 protected:
     void addConsoleMessage(PassOwnPtr<ConsoleMessage>);
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index a942d0888..c08721d9b 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -83,8 +83,9 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     m_inspectorAgent = inspectorAgentPtr.get();
     m_agents.append(inspectorAgentPtr.release());
 
-    OwnPtr<InspectorPageAgent> pageAgentPtr(InspectorPageAgent::create(m_instrumentingAgents.get(), page, m_state.get(), m_injectedScriptManager.get()));
+    OwnPtr<InspectorPageAgent> pageAgentPtr(InspectorPageAgent::create(m_instrumentingAgents.get(), page, m_state.get(), m_injectedScriptManager.get(), inspectorClient));
     InspectorPageAgent* pageAgent = pageAgentPtr.get();
+    m_pageAgent = pageAgentPtr.get();
     m_agents.append(pageAgentPtr.release());
 
     OwnPtr<InspectorDOMAgent> domAgentPtr(InspectorDOMAgent::create(m_instrumentingAgents.get(), pageAgent, inspectorClient, m_state.get(), m_injectedScriptManager.get()));
@@ -100,7 +101,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
-    m_agents.append(InspectorIndexedDBAgent::create(m_instrumentingAgents.get(), m_state.get(), pageAgent));
+    m_agents.append(InspectorIndexedDBAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), pageAgent));
 #endif
 
 #if ENABLE(FILE_SYSTEM)
@@ -109,13 +110,8 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     OwnPtr<InspectorDOMStorageAgent> domStorageAgentPtr(InspectorDOMStorageAgent::create(m_instrumentingAgents.get(), m_state.get()));
     InspectorDOMStorageAgent* domStorageAgent = domStorageAgentPtr.get();
     m_agents.append(domStorageAgentPtr.release());
-
-
-    OwnPtr<InspectorMemoryAgent>memoryAgentPtr = InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, m_domAgent);
-    InspectorMemoryAgent* memoryAgent = memoryAgentPtr.get();
-    m_agents.append(memoryAgentPtr.release());
-
-    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get(), memoryAgent));
+    m_agents.append(InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, m_domAgent));
+    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get()));
     m_agents.append(InspectorApplicationCacheAgent::create(m_instrumentingAgents.get(), m_state.get(), pageAgent));
 
     OwnPtr<InspectorResourceAgent> resourceAgentPtr(InspectorResourceAgent::create(m_instrumentingAgents.get(), pageAgent, inspectorClient, m_state.get()));
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index bbea2a6d6..5ee2330e1 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -51,6 +51,7 @@ class InspectorDOMAgent;
 class InspectorDebuggerAgent;
 class InspectorFrontend;
 class InspectorFrontendClient;
+class InspectorPageAgent;
 class InspectorProfilerAgent;
 class InspectorResourceAgent;
 class InspectorState;
@@ -68,7 +69,6 @@ public:
     ~InspectorController();
 
     static PassOwnPtr<InspectorController> create(Page*, InspectorClient*);
-
     void inspectedPageDestroyed();
 
     bool enabled() const;
@@ -108,6 +108,8 @@ public:
 
     void setResourcesDataSizeLimitsFromInternals(int maximumResourcesContentSize, int maximumSingleResourceContentSize);
 
+    InspectorPageAgent* pageAgent() const { return m_pageAgent; }
+
 private:
     InspectorController(Page*, InspectorClient*);
 
@@ -121,6 +123,7 @@ private:
     InspectorAgent* m_inspectorAgent;
     InspectorDOMAgent* m_domAgent;
     InspectorResourceAgent* m_resourceAgent;
+    InspectorPageAgent* m_pageAgent;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     InspectorDebuggerAgent* m_debuggerAgent;
     InspectorProfilerAgent* m_profilerAgent;
diff --git a/Source/WebCore/inspector/InspectorCounters.cpp b/Source/WebCore/inspector/InspectorCounters.cpp
new file mode 100644
index 000000000..70697077b
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorCounters.cpp
@@ -0,0 +1,47 @@
+/*
+* Copyright (C) 2012 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "InspectorCounters.h"
+
+#if ENABLE(INSPECTOR)
+
+namespace WebCore {
+
+int InspectorCounters::s_counters[CounterTypeLength];
+
+int InspectorCounters::counterValue(CounterType type)
+{
+    return s_counters[type];
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorCounters.h b/Source/WebCore/inspector/InspectorCounters.h
new file mode 100644
index 000000000..03dc11072
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorCounters.h
@@ -0,0 +1,73 @@
+/*
+* Copyright (C) 2012 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorCounters_h
+#define InspectorCounters_h
+
+namespace WebCore {
+
+class InspectorCounters {
+public:
+    enum CounterType {
+        DocumentCounter,
+        NodeCounter,
+        JSEventListenerCounter,
+        CounterTypeLength
+    };
+
+    static inline void incrementCounter(CounterType type)
+    {
+#if ENABLE(INSPECTOR)
+        ++s_counters[type];
+#endif
+    }
+
+    static inline void decrementCounter(CounterType type)
+    {
+#if ENABLE(INSPECTOR)
+        --s_counters[type];
+#endif
+    }
+
+#if ENABLE(INSPECTOR)
+    static int counterValue(CounterType);
+#endif
+
+private:
+    InspectorCounters();
+
+#if ENABLE(INSPECTOR)
+    static int s_counters[CounterTypeLength];
+#endif
+};
+
+} // namespace WebCore
+
+#endif // !defined(InspectorCounters_h)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 98185c178..0dea859fa 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -48,6 +48,7 @@
 #include "CookieJar.h"
 #include "DOMEditor.h"
 #include "DOMNodeHighlighter.h"
+#include "DOMPatchSupport.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "DocumentFragment.h"
@@ -66,6 +67,7 @@
 #include "InjectedScriptManager.h"
 #include "InspectorClient.h"
 #include "InspectorFrontend.h"
+#include "InspectorHistory.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
@@ -177,250 +179,14 @@ void RevalidateStyleAttributeTask::onTimer(Timer<RevalidateStyleAttributeTask>*)
     m_elements.clear();
 }
 
-class InspectorDOMAgent::DOMAction : public InspectorHistory::Action {
-public:
-    DOMAction(const String& name) : InspectorHistory::Action(name) { }
-
-    virtual bool perform(ErrorString* errorString)
-    {
-        ExceptionCode ec = 0;
-        bool result = perform(ec);
-        if (ec) {
-            ExceptionCodeDescription description(ec);
-            *errorString = description.name;
-        }
-        return result && !ec;
-    }
-
-    virtual bool undo(ErrorString* errorString)
-    {
-        ExceptionCode ec = 0;
-        bool result = undo(ec);
-        if (ec) {
-            ExceptionCodeDescription description(ec);
-            *errorString = description.name;
-        }
-        return result && !ec;
-    }
-
-    virtual bool perform(ExceptionCode&) = 0;
-
-    virtual bool undo(ExceptionCode&) = 0;
-
-private:
-    RefPtr<Node> m_parentNode;
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_anchorNode;
-};
-
-class InspectorDOMAgent::RemoveChildAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(RemoveChildAction);
-public:
-    RemoveChildAction(Node* parentNode, Node* node)
-        : InspectorDOMAgent::DOMAction("RemoveChild")
-        , m_parentNode(parentNode)
-        , m_node(node)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_anchorNode = m_node->nextSibling();
-        return m_parentNode->removeChild(m_node.get(), ec);
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
-    }
-
-private:
-    RefPtr<Node> m_parentNode;
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_anchorNode;
-};
-
-class InspectorDOMAgent::InsertBeforeAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(InsertBeforeAction);
-public:
-    InsertBeforeAction(Node* parentNode, Node* node, Node* anchorNode)
-        : InspectorDOMAgent::DOMAction("InsertBefore")
-        , m_parentNode(parentNode)
-        , m_node(node)
-        , m_anchorNode(anchorNode)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        if (m_node->parentNode()) {
-            m_removeChildAction = adoptPtr(new RemoveChildAction(m_node->parentNode(), m_node.get()));
-            if (!m_removeChildAction->perform(ec))
-                return false;
-        }
-        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        if (m_removeChildAction)
-            return m_removeChildAction->undo(ec);
-
-        return m_parentNode->removeChild(m_node.get(), ec);
-    }
-
-private:
-    RefPtr<Node> m_parentNode;
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_anchorNode;
-    OwnPtr<RemoveChildAction> m_removeChildAction;
-};
-
-class InspectorDOMAgent::RemoveAttributeAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(RemoveAttributeAction);
-public:
-    RemoveAttributeAction(Element* element, const String& name)
-        : InspectorDOMAgent::DOMAction("RemoveAttribute")
-        , m_element(element)
-        , m_name(name)
-    {
-    }
-
-    virtual bool perform(ExceptionCode&)
-    {
-        m_value = m_element->getAttribute(m_name);
-        m_element->removeAttribute(m_name);
-        return true;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        m_element->setAttribute(m_name, m_value, ec);
-        return true;
-    }
-
-private:
-    RefPtr<Element> m_element;
-    String m_name;
-    String m_value;
-};
-
-class InspectorDOMAgent::SetAttributeAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(SetAttributeAction);
-public:
-    SetAttributeAction(Element* element, const String& name, const String& value)
-        : InspectorDOMAgent::DOMAction("SetAttribute")
-        , m_element(element)
-        , m_name(name)
-        , m_value(value)
-        , m_hadAttribute(false)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_hadAttribute = m_element->hasAttribute(m_name);
-        if (m_hadAttribute)
-            m_oldValue = m_element->getAttribute(m_name);
-        m_element->setAttribute(m_name, m_value, ec);
-        return !ec;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        if (m_hadAttribute)
-            m_element->setAttribute(m_name, m_oldValue, ec);
-        else
-            m_element->removeAttribute(m_name);
-        return true;
-    }
-
-private:
-    RefPtr<Element> m_element;
-    String m_name;
-    String m_value;
-    bool m_hadAttribute;
-    String m_oldValue;
-};
-
-class InspectorDOMAgent::SetOuterHTMLAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(SetOuterHTMLAction);
-public:
-    SetOuterHTMLAction(Node* node, const String& html)
-        : InspectorDOMAgent::DOMAction("SetOuterHTML")
-        , m_node(node)
-        , m_nextSibling(node->nextSibling())
-        , m_html(html)
-        , m_newNode(0)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_oldHTML = createMarkup(m_node.get());
-        DOMEditor domEditor(m_node->ownerDocument());
-        m_newNode = domEditor.patchNode(m_node.get(), m_html, ec);
-        return !ec;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        DOMEditor domEditor(m_newNode->ownerDocument());
-        Node* node = domEditor.patchNode(m_newNode, m_oldHTML, ec);
-        if (ec || !node)
-            return false;
-        // HTML editing could have produced extra nodes. Remove them if necessary.
-        node = node->nextSibling();
-
-        while (!ec && node && node != m_nextSibling.get()) {
-            Node* nodeToRemove = node;
-            node = node->nextSibling();
-            nodeToRemove->remove(ec);
-        }
-        return !ec;
-    }
-
-    Node* newNode()
-    {
-        return m_newNode;
-    }
-
-private:
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_nextSibling;
-    String m_html;
-    String m_oldHTML;
-    Node* m_newNode;
-};
-
-class InspectorDOMAgent::ReplaceWholeTextAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(ReplaceWholeTextAction);
-public:
-    ReplaceWholeTextAction(Text* textNode, const String& text)
-        : DOMAction("ReplaceWholeText")
-        , m_textNode(textNode)
-        , m_text(text)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_oldText = m_textNode->wholeText();
-        m_textNode->replaceWholeText(m_text, ec);
-        return true;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        m_textNode->replaceWholeText(m_oldText, ec);
-        return true;
+String InspectorDOMAgent::toErrorString(const ExceptionCode& ec)
+{
+    if (ec) {
+        ExceptionCodeDescription description(ec);
+        return description.name;
     }
-
-private:
-    RefPtr<Text> m_textNode;
-    String m_text;
-    String m_oldText;
-};
+    return "";
+}
 
 InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, InspectorPageAgent* pageAgent, InspectorClient* client, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : InspectorBaseAgent<InspectorDOMAgent>("DOM", instrumentingAgents, inspectorState)
@@ -431,7 +197,7 @@ InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, I
     , m_domListener(0)
     , m_lastNodeId(1)
     , m_searchingForNode(false)
-    , m_history(adoptPtr(new InspectorHistory()))
+    , m_suppressAttributeModifiedEvent(false)
 {
 }
 
@@ -445,6 +211,9 @@ InspectorDOMAgent::~InspectorDOMAgent()
 void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
 {
     ASSERT(!m_frontend);
+    m_history = adoptPtr(new InspectorHistory());
+    m_domEditor = adoptPtr(new DOMEditor(m_history.get()));
+
     m_frontend = frontend->dom();
     m_instrumentingAgents->setInspectorDOMAgent(this);
     m_document = m_pageAgent->mainFrame()->document();
@@ -456,6 +225,9 @@ void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
 void InspectorDOMAgent::clearFrontend()
 {
     ASSERT(m_frontend);
+
+    m_history.clear();
+    m_domEditor.clear();
     setSearchingForNode(false, 0);
 
     ErrorString error;
@@ -499,7 +271,8 @@ Node* InspectorDOMAgent::highlightedNode() const
 
 void InspectorDOMAgent::reset()
 {
-    m_history->reset();
+    if (m_history)
+        m_history->reset();
     m_searchResults.clear();
     discardBindings();
     if (m_revalidateStyleAttrTask)
@@ -630,7 +403,7 @@ void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>& root)
 void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
 {
     Node* node = nodeForId(nodeId);
-    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE))
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) || node->isShadowRoot())
         return;
     if (m_childrenRequested.contains(nodeId))
         return;
@@ -765,8 +538,7 @@ void InspectorDOMAgent::setAttributeValue(ErrorString* errorString, int elementI
     if (!element)
         return;
 
-    m_history->perform(adoptPtr(new SetAttributeAction(element, name, value)), errorString);
-    m_history->markUndoableState();
+    m_domEditor->setAttribute(element, name, value, errorString);
 }
 
 void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elementId, const String& text, const String* const name)
@@ -778,13 +550,13 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
     ExceptionCode ec = 0;
     RefPtr<Element> parsedElement = element->document()->createElement("span", ec);
     if (ec) {
-        *errorString = "Internal error: could not set attribute value";
+        *errorString = InspectorDOMAgent::toErrorString(ec);
         return;
     }
 
     toHTMLElement(parsedElement.get())->setInnerHTML("<span " + text + "></span>", ec);
     if (ec) {
-        *errorString = "Could not parse value as attributes";
+        *errorString = InspectorDOMAgent::toErrorString(ec);
         return;
     }
 
@@ -796,7 +568,7 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
 
     Element* childElement = toElement(child);
     if (!childElement->hasAttributes() && name) {
-        m_history->perform(adoptPtr(new RemoveAttributeAction(element, *name)), errorString);
+        m_domEditor->removeAttribute(element, *name, errorString);
         return;
     }
 
@@ -806,14 +578,12 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
         // Add attribute pair
         const Attribute* attribute = childElement->attributeItem(i);
         foundOriginalAttribute = foundOriginalAttribute || (name && attribute->name().toString() == *name);
-        if (!m_history->perform(adoptPtr(new SetAttributeAction(element, attribute->name().toString(), attribute->value())), errorString))
+        if (!m_domEditor->setAttribute(element, attribute->name().toString(), attribute->value(), errorString))
             return;
     }
 
     if (!foundOriginalAttribute && name && !name->stripWhiteSpace().isEmpty())
-        m_history->perform(adoptPtr(new RemoveAttributeAction(element, *name)), errorString);
-
-    m_history->markUndoableState();
+        m_domEditor->removeAttribute(element, *name, errorString);
 }
 
 void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId, const String& name)
@@ -822,8 +592,7 @@ void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId,
     if (!element)
         return;
 
-    m_history->perform(adoptPtr(new RemoveAttributeAction(element, name)), errorString);
-    m_history->markUndoableState();
+    m_domEditor->removeAttribute(element, name, errorString);
 }
 
 void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
@@ -838,8 +607,7 @@ void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
         return;
     }
 
-    m_history->perform(adoptPtr(new RemoveChildAction(parentNode, node)), errorString);
-    m_history->markUndoableState();
+    m_domEditor->removeChild(parentNode, node, errorString);
 }
 
 void InspectorDOMAgent::setNodeName(ErrorString* errorString, int nodeId, const String& tagName, int* newId)
@@ -861,17 +629,16 @@ void InspectorDOMAgent::setNodeName(ErrorString* errorString, int nodeId, const
     // Copy over the original node's children.
     Node* child;
     while ((child = oldNode->firstChild())) {
-        if (!m_history->perform(adoptPtr(new InsertBeforeAction(newElem.get(), child, 0)), errorString))
+        if (!m_domEditor->insertBefore(newElem.get(), child, 0, errorString))
             return;
     }
 
     // Replace the old node with the new node
     ContainerNode* parent = oldNode->parentNode();
-    if (!m_history->perform(adoptPtr(new InsertBeforeAction(parent, newElem.get(), oldNode->nextSibling())), errorString))
+    if (!m_domEditor->insertBefore(parent, newElem.get(), oldNode->nextSibling(), errorString))
         return;
-    if (!m_history->perform(adoptPtr(new RemoveChildAction(parent, oldNode)), errorString))
+    if (!m_domEditor->removeChild(parent, oldNode, errorString))
         return;
-    m_history->markUndoableState();
 
     *newId = pushNodePathToFrontend(newElem.get());
     if (m_childrenRequested.contains(nodeId))
@@ -890,8 +657,8 @@ void InspectorDOMAgent::getOuterHTML(ErrorString* errorString, int nodeId, WTF::
 void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const String& outerHTML)
 {
     if (!nodeId) {
-        DOMEditor domEditor(m_document.get());
-        domEditor.patchDocument(outerHTML);
+        DOMPatchSupport domPatchSupport(m_domEditor.get(), m_document.get());
+        domPatchSupport.patchDocument(outerHTML);
         return;
     }
 
@@ -905,16 +672,9 @@ void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const
         return;
     }
 
-    DOMEditor domEditor(document);
-
-    OwnPtr<SetOuterHTMLAction> action = adoptPtr(new SetOuterHTMLAction(node, outerHTML));
-    SetOuterHTMLAction* rawAction = action.get();
     Node* newNode = 0;
-    if (!m_history->perform(action.release(), errorString))
+    if (!m_domEditor->setOuterHTML(node, outerHTML, &newNode, errorString))
         return;
-    m_history->markUndoableState();
-
-    newNode = rawAction->newNode();
 
     if (!newNode) {
         // The only child node has been deleted.
@@ -939,7 +699,7 @@ void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const
         return;
     }
 
-    m_history->perform(adoptPtr(new ReplaceWholeTextAction(static_cast<Text*>(node), value)), errorString);
+    m_domEditor->replaceWholeText(toText(node), value, errorString);
 }
 
 void InspectorDOMAgent::getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>& listenersArray)
@@ -1297,9 +1057,8 @@ void InspectorDOMAgent::moveTo(ErrorString* errorString, int nodeId, int targetE
         }
     }
 
-    if (!m_history->perform(adoptPtr(new InsertBeforeAction(targetElement, node, anchorNode)), errorString))
+    if (!m_domEditor->insertBefore(targetElement, node, anchorNode, errorString))
         return;
-    m_history->markUndoableState();
 
     *newNodeId = pushNodePathToFrontend(node);
 }
@@ -1319,7 +1078,16 @@ void InspectorDOMAgent::setTouchEmulationEnabled(ErrorString* error, bool enable
 
 void InspectorDOMAgent::undo(ErrorString* errorString)
 {
-    m_history->undo(errorString);
+    ExceptionCode ec = 0;
+    m_history->undo(ec);
+    *errorString = InspectorDOMAgent::toErrorString(ec);
+}
+
+void InspectorDOMAgent::redo(ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    m_history->redo(ec);
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorDOMAgent::markUndoableState(ErrorString*)
@@ -1391,7 +1159,9 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
         localName = node->localName();
         break;
     case Node::DOCUMENT_FRAGMENT_NODE:
-        break;
+        if (!node->isShadowRoot())
+            break;
+        // Fall through
     case Node::DOCUMENT_NODE:
     case Node::ELEMENT_NODE:
     default:
@@ -1632,8 +1402,18 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
     unbind(node, &m_documentNodeToIdMap);
 }
 
+void InspectorDOMAgent::willModifyDOMAttr(Element*, const AtomicString& oldValue, const AtomicString& newValue)
+{
+    m_suppressAttributeModifiedEvent = (oldValue == newValue);
+}
+
 void InspectorDOMAgent::didModifyDOMAttr(Element* element, const AtomicString& name, const AtomicString& value)
 {
+    bool shouldSuppressEvent = m_suppressAttributeModifiedEvent;
+    m_suppressAttributeModifiedEvent = false;
+    if (shouldSuppressEvent)
+        return;
+
     int id = boundNodeId(element);
     // If node is not mapped yet -> ignore the event.
     if (!id)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index 40f0f81b2..e45d4636a 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -35,7 +35,6 @@
 #include "InjectedScriptManager.h"
 #include "InspectorBaseAgent.h"
 #include "InspectorFrontend.h"
-#include "InspectorHistory.h"
 #include "InspectorValues.h"
 #include "Timer.h"
 
@@ -52,13 +51,14 @@
 namespace WebCore {
 class ContainerNode;
 class CharacterData;
+class DOMEditor;
 class Document;
 class Element;
 class Event;
 class GraphicsContext;
 class InspectorClient;
-class InspectorDOMAgent;
 class InspectorFrontend;
+class InspectorHistory;
 class InspectorPageAgent;
 class IntRect;
 class HitTestResult;
@@ -107,6 +107,8 @@ public:
         return adoptPtr(new InspectorDOMAgent(instrumentingAgents, pageAgent, client, inspectorState, injectedScriptManager));
     }
 
+    static String toErrorString(const ExceptionCode&);
+
     ~InspectorDOMAgent();
 
     virtual void setFrontend(InspectorFrontend*);
@@ -145,6 +147,7 @@ public:
     virtual void moveTo(ErrorString*, int nodeId, int targetNodeId, const int* anchorNodeId, int* newNodeId);
     virtual void setTouchEmulationEnabled(ErrorString*, bool);
     virtual void undo(ErrorString*);
+    virtual void redo(ErrorString*);
     virtual void markUndoableState(ErrorString*);
 
     Node* highlightedNode() const;
@@ -158,6 +161,7 @@ public:
 
     void didInsertDOMNode(Node*);
     void didRemoveDOMNode(Node*);
+    void willModifyDOMAttr(Element*, const AtomicString& oldValue, const AtomicString& newValue);
     void didModifyDOMAttr(Element*, const AtomicString& name, const AtomicString& value);
     void didRemoveDOMAttr(Element*, const AtomicString& name);
     void styleAttributeInvalidated(const Vector<Element*>& elements);
@@ -193,14 +197,6 @@ public:
     Node* assertNode(ErrorString*, int nodeId);
 
 private:
-    class DOMAction;
-    class RemoveChildAction;
-    class InsertBeforeAction;
-    class RemoveAttributeAction;
-    class SetAttributeAction;
-    class SetOuterHTMLAction;
-    class ReplaceWholeTextAction;
-
     InspectorDOMAgent(InstrumentingAgents*, InspectorPageAgent*, InspectorClient*, InspectorState*, InjectedScriptManager*);
 
     void setSearchingForNode(bool enabled, InspectorObject* highlightConfig);
@@ -254,6 +250,8 @@ private:
     RefPtr<Node> m_nodeToFocus;
     bool m_searchingForNode;
     OwnPtr<InspectorHistory> m_history;
+    OwnPtr<DOMEditor> m_domEditor;
+    bool m_suppressAttributeModifiedEvent;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index 742d288df..6609e64ed 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -44,6 +44,10 @@
 #include "ScriptObject.h"
 #include <wtf/text/WTFString.h>
 
+using WebCore::TypeBuilder::Array;
+using WebCore::TypeBuilder::Debugger::FunctionDetails;
+using WebCore::TypeBuilder::Runtime::RemoteObject;
+
 namespace WebCore {
 
 namespace DebuggerAgentState {
@@ -210,8 +214,10 @@ static bool matches(const String& url, const String& pattern, bool isRegex)
     return url == pattern;
 }
 
-void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString* errorString, int lineNumber, const String* const optionalURL, const String* const optionalURLRegex, const int* const optionalColumnNumber, const String* const optionalCondition, String* outBreakpointId, RefPtr<InspectorArray>& locations)
+void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString* errorString, int lineNumber, const String* const optionalURL, const String* const optionalURLRegex, const int* const optionalColumnNumber, const String* const optionalCondition, String* outBreakpointId, RefPtr<InspectorArray>& locationsRaw)
 {
+    RefPtr<Array<TypeBuilder::Debugger::Location> > locations = Array<TypeBuilder::Debugger::Location>::create();
+    locationsRaw = locations;
     if (!optionalURL == !optionalURLRegex) {
         *errorString = "Either url or urlRegex must be specified.";
         return;
@@ -310,7 +316,7 @@ void InspectorDebuggerAgent::continueToLocation(ErrorString* errorString, const
     resume(errorString);
 }
 
-PassRefPtr<InspectorObject> InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint& breakpoint)
+PassRefPtr<TypeBuilder::Debugger::Location> InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint& breakpoint)
 {
     ScriptsMap::iterator scriptIterator = m_scripts.find(scriptId);
     if (scriptIterator == m_scripts.end())
@@ -380,14 +386,16 @@ void InspectorDebuggerAgent::getScriptSource(ErrorString* error, const String& s
         *error = "No script for id: " + scriptId;
 }
 
-void InspectorDebuggerAgent::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<InspectorObject>& details)
+void InspectorDebuggerAgent::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<InspectorObject>& detailsRaw)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(functionId);
     if (injectedScript.hasNoValue()) {
         *errorString = "Inspected frame has gone";
         return;
     }
+    RefPtr<FunctionDetails> details;
     injectedScript.getFunctionDetails(errorString, functionId, &details);
+    detailsRaw = details;
 }
 
 void InspectorDebuggerAgent::schedulePauseOnNextStatement(const String& breakReason, PassRefPtr<InspectorObject> data)
@@ -470,24 +478,26 @@ void InspectorDebuggerAgent::setPauseOnExceptionsImpl(ErrorString* errorString,
         m_state->setLong(DebuggerAgentState::pauseOnExceptionsState, pauseState);
 }
 
-void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const returnByValue, RefPtr<InspectorObject>& result, bool* wasThrown)
+void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const returnByValue, RefPtr<InspectorObject>& resultRaw, bool* wasThrown)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(callFrameId);
     if (injectedScript.hasNoValue()) {
         *errorString = "Inspected frame has gone";
         return;
     }
+    RefPtr<RemoteObject> result;
     injectedScript.evaluateOnCallFrame(errorString, m_currentCallStack, callFrameId, expression, objectGroup ? *objectGroup : "", includeCommandLineAPI ? *includeCommandLineAPI : false, returnByValue ? *returnByValue : false, &result, wasThrown);
+    resultRaw = result;
 }
 
-PassRefPtr<InspectorArray> InspectorDebuggerAgent::currentCallFrames()
+PassRefPtr<Array<TypeBuilder::Debugger::CallFrame> > InspectorDebuggerAgent::currentCallFrames()
 {
     if (!m_pausedScriptState)
-        return InspectorArray::create();
+        return Array<TypeBuilder::Debugger::CallFrame>::create();
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(m_pausedScriptState);
     if (injectedScript.hasNoValue()) {
         ASSERT_NOT_REACHED();
-        return InspectorArray::create();
+        return Array<TypeBuilder::Debugger::CallFrame>::create();
     }
     return injectedScript.wrapCallFrames(m_currentCallStack);
 }
@@ -520,7 +530,8 @@ void InspectorDebuggerAgent::didParseSource(const String& scriptId, const Script
     // Don't send script content to the front end until it's really needed.
     const bool* isContentScript = script.isContentScript ? &script.isContentScript : 0;
     String sourceMapURL = sourceMapURLForScript(script);
-    m_frontend->scriptParsed(scriptId, script.url, script.startLine, script.startColumn, script.endLine, script.endColumn, isContentScript, sourceMapURL);
+    String* sourceMapURLParam = sourceMapURL.isNull() ? 0 : &sourceMapURL;
+    m_frontend->scriptParsed(scriptId, script.url, script.startLine, script.startColumn, script.endLine, script.endColumn, isContentScript, sourceMapURLParam);
 
     m_scripts.set(scriptId, script);
 
@@ -540,7 +551,7 @@ void InspectorDebuggerAgent::didParseSource(const String& scriptId, const Script
         breakpointObject->getNumber("lineNumber", &breakpoint.lineNumber);
         breakpointObject->getNumber("columnNumber", &breakpoint.columnNumber);
         breakpointObject->getString("condition", &breakpoint.condition);
-        RefPtr<InspectorObject> location = resolveBreakpoint(it->first, scriptId, breakpoint);
+        RefPtr<TypeBuilder::Debugger::Location> location = resolveBreakpoint(it->first, scriptId, breakpoint);
         if (location)
             m_frontend->breakpointResolved(it->first, location);
     }
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index b64fedc89..a6abfa435 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -130,7 +130,7 @@ private:
     void disable();
     bool enabled();
 
-    PassRefPtr<InspectorArray> currentCallFrames();
+    PassRefPtr<TypeBuilder::Array<TypeBuilder::Debugger::CallFrame> > currentCallFrames();
 
     virtual void didParseSource(const String& scriptId, const Script&);
     virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
@@ -139,7 +139,7 @@ private:
 
     void setPauseOnExceptionsImpl(ErrorString*, int);
 
-    PassRefPtr<InspectorObject> resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint&);
+    PassRefPtr<TypeBuilder::Debugger::Location> resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint&);
     void clear();
     bool assertPaused(ErrorString*);
     void clearBreakDetails();
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
index 117ae8b38..9841e2002 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -42,6 +42,7 @@
 #include "InspectorBackendDispatcher.h"
 #include "InspectorController.h"
 #include "InspectorFrontendHost.h"
+#include "InspectorPageAgent.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "ScriptFunctionCall.h"
@@ -159,10 +160,12 @@ void InspectorFrontendClientLocal::requestDetachWindow()
 
 bool InspectorFrontendClientLocal::canAttachWindow()
 {
-    unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
-
     // Don't allow the attach if the window would be too small to accommodate the minimum inspector height.
-    return minimumAttachedHeight <= inspectedPageHeight * maximumAttachedHeightRatio;
+    // Also don't allow attaching to another inspector -- two inspectors in one window is too much!
+    bool isInspectorPage = m_inspectorController->inspectedPage()->inspectorController()->hasInspectorFrontendClient();
+    unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
+    unsigned maximumAttachedHeight = inspectedPageHeight * maximumAttachedHeightRatio;
+    return minimumAttachedHeight <= maximumAttachedHeight && !isInspectorPage;
 }
 
 void InspectorFrontendClientLocal::changeAttachedWindowHeight(unsigned height)
@@ -263,6 +266,17 @@ void InspectorFrontendClientLocal::showConsole()
     evaluateOnLoad("[\"showConsole\"]");
 }
 
+void InspectorFrontendClientLocal::showResources()
+{
+    evaluateOnLoad("[\"showResources\"]");
+}
+
+void InspectorFrontendClientLocal::showMainResourceForFrame(Frame* frame)
+{
+    String frameId = m_inspectorController->pageAgent()->frameId(frame);
+    evaluateOnLoad(String::format("[\"showMainResourceForFrame\", \"%s\"]", frameId.ascii().data()));
+}
+
 unsigned InspectorFrontendClientLocal::constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight)
 {
     using namespace std;
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.h b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
index 2b1d187b5..8292d2289 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.h
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
@@ -93,6 +93,10 @@ public:
 
     void showConsole();
 
+    void showMainResourceForFrame(Frame*);
+    
+    void showResources();
+
 protected:
     virtual void setAttachedWindowHeight(unsigned) = 0;
     void setAttachedWindow(bool);
diff --git a/Source/WebCore/inspector/InspectorHistory.cpp b/Source/WebCore/inspector/InspectorHistory.cpp
index bf68c1ff5..1b6eacfa6 100644
--- a/Source/WebCore/inspector/InspectorHistory.cpp
+++ b/Source/WebCore/inspector/InspectorHistory.cpp
@@ -43,9 +43,11 @@ class UndoableStateMark : public InspectorHistory::Action {
 public:
     UndoableStateMark() : InspectorHistory::Action("[UndoableState]") { }
 
-    virtual bool perform(ErrorString*) { return true; }
+    virtual bool perform(ExceptionCode&) { return true; }
 
-    virtual bool undo(ErrorString*) { return true; }
+    virtual bool undo(ExceptionCode&) { return true; }
+
+    virtual bool redo(ExceptionCode&) { return true; }
 
     virtual bool isUndoableStateMark() { return true; }
 };
@@ -79,49 +81,71 @@ void InspectorHistory::Action::merge(PassOwnPtr<Action>)
 {
 }
 
-InspectorHistory::InspectorHistory() { }
+InspectorHistory::InspectorHistory() : m_afterLastActionIndex(0) { }
 
 InspectorHistory::~InspectorHistory() { }
 
-bool InspectorHistory::perform(PassOwnPtr<Action> action, ErrorString* errorString)
+bool InspectorHistory::perform(PassOwnPtr<Action> action, ExceptionCode& ec)
 {
-    if (!action->perform(errorString))
+    if (!action->perform(ec))
         return false;
 
-    if (!m_history.isEmpty() && !action->mergeId().isEmpty() && action->mergeId() == m_history.first()->mergeId())
-        m_history.first()->merge(action);
-    else
-        m_history.prepend(action);
-
+    if (!action->mergeId().isEmpty() && m_afterLastActionIndex > 0 && action->mergeId() == m_history[m_afterLastActionIndex - 1]->mergeId())
+        m_history[m_afterLastActionIndex - 1]->merge(action);
+    else {
+        m_history.resize(m_afterLastActionIndex);
+        m_history.append(action);
+        ++m_afterLastActionIndex;
+    }
     return true;
 }
 
 void InspectorHistory::markUndoableState()
 {
-    m_history.prepend(adoptPtr(new UndoableStateMark()));
+    ExceptionCode ec;
+    perform(adoptPtr(new UndoableStateMark()), ec);
 }
 
-bool InspectorHistory::undo(ErrorString* errorString)
+bool InspectorHistory::undo(ExceptionCode& ec)
 {
-    while (!m_history.isEmpty() && m_history.first()->isUndoableStateMark())
-        m_history.removeFirst();
+    while (m_afterLastActionIndex > 0 && m_history[m_afterLastActionIndex - 1]->isUndoableStateMark())
+        --m_afterLastActionIndex;
 
-    while (!m_history.isEmpty()) {
-        OwnPtr<Action> first = m_history.takeFirst();
-        if (!first->undo(errorString)) {
-            m_history.clear();
+    while (m_afterLastActionIndex > 0) {
+        Action* action = m_history[m_afterLastActionIndex - 1].get();
+        if (!action->undo(ec)) {
+            reset();
             return false;
         }
-
-        if (first->isUndoableStateMark())
+        --m_afterLastActionIndex;
+        if (action->isUndoableStateMark())
             break;
     }
 
     return true;
 }
 
+bool InspectorHistory::redo(ExceptionCode& ec)
+{
+    while (m_afterLastActionIndex < m_history.size() && m_history[m_afterLastActionIndex]->isUndoableStateMark())
+        ++m_afterLastActionIndex;
+
+    while (m_afterLastActionIndex < m_history.size()) {
+        Action* action = m_history[m_afterLastActionIndex].get();
+        if (!action->redo(ec)) {
+            reset();
+            return false;
+        }
+        ++m_afterLastActionIndex;
+        if (action->isUndoableStateMark())
+            break;
+    }
+    return true;
+}
+
 void InspectorHistory::reset()
 {
+    m_afterLastActionIndex = 0;
     m_history.clear();
 }
 
diff --git a/Source/WebCore/inspector/InspectorHistory.h b/Source/WebCore/inspector/InspectorHistory.h
index e506e05b9..037344b60 100644
--- a/Source/WebCore/inspector/InspectorHistory.h
+++ b/Source/WebCore/inspector/InspectorHistory.h
@@ -33,8 +33,8 @@
 
 #include "ExceptionCode.h"
 
-#include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
@@ -43,8 +43,6 @@ class ContainerNode;
 class Element;
 class Node;
 
-typedef String ErrorString;
-
 #if ENABLE(INSPECTOR)
 
 class InspectorHistory {
@@ -56,13 +54,15 @@ public:
         virtual ~Action();
         virtual String toString();
 
-        virtual bool isUndoableStateMark();
-
         virtual String mergeId();
         virtual void merge(PassOwnPtr<Action>);
 
-        virtual bool perform(ErrorString*) = 0;
-        virtual bool undo(ErrorString*) = 0;
+        virtual bool perform(ExceptionCode&) = 0;
+
+        virtual bool undo(ExceptionCode&) = 0;
+        virtual bool redo(ExceptionCode&) = 0;
+
+        virtual bool isUndoableStateMark();
     private:
         String m_name;
     };
@@ -70,15 +70,16 @@ public:
     InspectorHistory();
     virtual ~InspectorHistory();
 
-    bool perform(PassOwnPtr<Action>, ErrorString*);
+    bool perform(PassOwnPtr<Action>, ExceptionCode&);
     void markUndoableState();
 
-    bool undo(ErrorString*);
+    bool undo(ExceptionCode&);
+    bool redo(ExceptionCode&);
     void reset();
 
 private:
-    void dump();
-    Deque<OwnPtr<Action> > m_history;
+    Vector<OwnPtr<Action> > m_history;
+    size_t m_afterLastActionIndex;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
index b00525966..d767ff656 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
@@ -40,12 +40,17 @@
 #include "Frame.h"
 #include "GroupSettings.h"
 #include "IDBCallbacks.h"
+#include "IDBCursor.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBIndexBackendInterface.h"
+#include "IDBKey.h"
+#include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendInterface.h"
+#include "IDBPendingTransactionMonitor.h"
 #include "IDBTransaction.h"
 #include "IDBTransactionBackendInterface.h"
+#include "InjectedScript.h"
 #include "InspectorFrontend.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
@@ -57,8 +62,12 @@
 
 #include <wtf/Vector.h>
 
+using WebCore::TypeBuilder::Array;
 using WebCore::TypeBuilder::IndexedDB::SecurityOriginWithDatabaseNames;
 using WebCore::TypeBuilder::IndexedDB::DatabaseWithObjectStores;
+using WebCore::TypeBuilder::IndexedDB::DataEntry;
+using WebCore::TypeBuilder::IndexedDB::Key;
+using WebCore::TypeBuilder::IndexedDB::KeyRange;
 using WebCore::TypeBuilder::IndexedDB::ObjectStore;
 using WebCore::TypeBuilder::IndexedDB::ObjectStoreIndex;
 
@@ -102,6 +111,21 @@ public:
     virtual void onBlocked() { }
 };
 
+class InspectorIDBTransactionCallback : public IDBTransactionCallbacks {
+public:
+    static PassRefPtr<InspectorIDBTransactionCallback> create()
+    {
+        return adoptRef(new InspectorIDBTransactionCallback());
+    }
+
+    virtual ~InspectorIDBTransactionCallback() { }
+
+    virtual void onAbort() { }
+    virtual void onComplete() { }
+private:
+    InspectorIDBTransactionCallback() { }
+};
+
 class GetDatabaseNamesCallback : public InspectorIDBCallback {
 public:
     static PassRefPtr<GetDatabaseNamesCallback> create(InspectorIndexedDBAgent::FrontendProvider* frontendProvider, int requestId, const String& securityOrigin)
@@ -262,10 +286,281 @@ private:
     int m_requestId;
 };
 
+static PassRefPtr<IDBKey> idbKeyFromInspectorObject(InspectorObject* key)
+{
+    RefPtr<IDBKey> idbKey;
+
+    String type;
+    if (!key->getString("type", &type))
+        return 0;
+
+    DEFINE_STATIC_LOCAL(String, number, ("number"));
+    DEFINE_STATIC_LOCAL(String, string, ("string"));
+    DEFINE_STATIC_LOCAL(String, date, ("date"));
+    DEFINE_STATIC_LOCAL(String, array, ("array"));
+
+    if (type == number) {
+        double number;
+        if (!key->getNumber("number", &number))
+            return 0;
+        idbKey = IDBKey::createNumber(number);
+    } else if (type == string) {
+        String string;
+        if (!key->getString("string", &string))
+            return 0;
+        idbKey = IDBKey::createString(string);
+    } else if (type == date) {
+        double date;
+        if (!key->getNumber("date", &date))
+            return 0;
+        idbKey = IDBKey::createDate(date);
+    } else if (type == array) {
+        IDBKey::KeyArray keyArray;
+        RefPtr<InspectorArray> array = key->getArray("array");
+        for (size_t i = 0; i < array->length(); ++i) {
+            RefPtr<InspectorValue> value = array->get(i);
+            RefPtr<InspectorObject> object;
+            if (!value->asObject(&object))
+                return 0;
+            keyArray.append(idbKeyFromInspectorObject(object.get()));
+        }
+        idbKey = IDBKey::createArray(keyArray);
+    } else
+        return 0;
+
+    return idbKey.release();
+}
+
+static PassRefPtr<IDBKeyRange> idbKeyRangeFromKeyRange(InspectorObject* keyRange)
+{
+    RefPtr<InspectorObject> lower = keyRange->getObject("lower");
+    RefPtr<IDBKey> idbLower = lower ? idbKeyFromInspectorObject(lower.get()) : 0;
+    if (lower && !idbLower)
+        return 0;
+
+    RefPtr<InspectorObject> upper = keyRange->getObject("upper");
+    RefPtr<IDBKey> idbUpper = upper ? idbKeyFromInspectorObject(upper.get()) : 0;
+    if (upper && !idbUpper)
+        return 0;
+
+    bool lowerOpen;
+    if (!keyRange->getBoolean("lowerOpen", &lowerOpen))
+        return 0;
+    IDBKeyRange::LowerBoundType lowerBoundType = lowerOpen ? IDBKeyRange::LowerBoundOpen : IDBKeyRange::LowerBoundClosed;
+
+    bool upperOpen;
+    if (!keyRange->getBoolean("upperOpen", &upperOpen))
+        return 0;
+    IDBKeyRange::UpperBoundType upperBoundType = upperOpen ? IDBKeyRange::UpperBoundOpen : IDBKeyRange::UpperBoundClosed;
+
+    RefPtr<IDBKeyRange> idbKeyRange = IDBKeyRange::create(idbLower, idbUpper, lowerBoundType, upperBoundType);
+    return idbKeyRange.release();
+}
+
+static PassRefPtr<Key> keyFromIDBKey(IDBKey* idbKey)
+{
+    if (!idbKey || !idbKey->valid())
+        return 0;
+
+    RefPtr<Key> key;
+    switch (idbKey->type()) {
+    case IDBKey::InvalidType:
+    case IDBKey::MinType:
+        return 0;
+    case IDBKey::NumberType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::Number);
+        key = tmpKey;
+        key->setNumber(idbKey->number());
+        break;
+    }
+    case IDBKey::StringType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::String);
+        key = tmpKey;
+        key->setString(idbKey->string());
+        break;
+    }
+    case IDBKey::DateType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::Date);
+        key = tmpKey;
+        key->setDate(idbKey->date());
+        break;
+    }
+    case IDBKey::ArrayType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::Array);
+        key = tmpKey;
+        RefPtr<InspectorArray> array = InspectorArray::create();
+        IDBKey::KeyArray keyArray = idbKey->array();
+        for (size_t i = 0; i < keyArray.size(); ++i)
+            array->pushObject(keyFromIDBKey(keyArray[i].get()));
+        key->setArray(array);
+        break;
+    }
+    }
+    return key.release();
+}
+
+class OpenCursorCallback : public InspectorIDBCallback {
+public:
+    enum CursorType {
+        ObjectStoreDataCursor,
+        IndexDataCursor
+    };
+
+    static PassRefPtr<OpenCursorCallback> create(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
+    {
+        return adoptRef(new OpenCursorCallback(frontendProvider, injectedScript, idbTransaction, cursorType, requestId, skipCount, pageSize));
+    }
+
+    virtual ~OpenCursorCallback() { }
+
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>)
+    {
+        end(false);
+    }
+
+    virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface> idbCursor)
+    {
+        m_idbCursor = idbCursor;
+        onSuccessWithContinuation();
+    }
+
+    virtual void onSuccessWithContinuation()
+    {
+        if (m_skipCount) {
+            --m_skipCount;
+            next();
+            return;
+        }
+
+        if (m_result->length() == m_pageSize) {
+            end(true);
+            return;
+        }
+
+        RefPtr<IDBKey> key = m_idbCursor->key();
+        RefPtr<IDBKey> primaryKey = m_idbCursor->primaryKey();
+        RefPtr<SerializedScriptValue> value = m_idbCursor->value();
+        RefPtr<InspectorObject> wrappedValue = m_injectedScript.wrapSerializedObject(value.get(), String());
+        RefPtr<DataEntry> dataEntry = DataEntry::create()
+            .setKey(keyFromIDBKey(key.get()))
+            .setPrimaryKey(keyFromIDBKey(primaryKey.get()))
+            .setValue(wrappedValue);
+        m_result->addItem(dataEntry);
+
+        next();
+    }
+
+    void next()
+    {
+        ExceptionCode ec = 0;
+        m_idbCursor->continueFunction(0, this, ec);
+        m_idbTransaction->didCompleteTaskEvents();
+    }
+
+    void end(bool hasMore)
+    {
+        if (!m_frontendProvider->frontend())
+            return;
+
+        m_idbTransaction->didCompleteTaskEvents();
+
+        switch (m_cursorType) {
+        case ObjectStoreDataCursor:
+            m_frontendProvider->frontend()->objectStoreDataLoaded(m_requestId, m_result.release(), hasMore);
+            break;
+        case IndexDataCursor:
+            m_frontendProvider->frontend()->indexDataLoaded(m_requestId, m_result.release(), hasMore);
+            break;
+        }
+    }
+
+private:
+    OpenCursorCallback(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
+        : m_frontendProvider(frontendProvider)
+        , m_injectedScript(injectedScript)
+        , m_idbTransaction(idbTransaction)
+        , m_cursorType(cursorType)
+        , m_requestId(requestId)
+        , m_skipCount(skipCount)
+        , m_pageSize(pageSize)
+    {
+        m_result = Array<DataEntry>::create();
+        m_idbTransaction->setCallbacks(InspectorIDBTransactionCallback::create().get());
+    }
+    RefPtr<InspectorIndexedDBAgent::FrontendProvider> m_frontendProvider;
+    InjectedScript m_injectedScript;
+    RefPtr<IDBTransactionBackendInterface> m_idbTransaction;
+    CursorType m_cursorType;
+    int m_requestId;
+    int m_skipCount;
+    unsigned m_pageSize;
+    RefPtr<Array<DataEntry> > m_result;
+    RefPtr<IDBCursorBackendInterface> m_idbCursor;
+};
+
+class DataLoaderCallback : public ExecutableWithDatabase {
+public:
+    static PassRefPtr<DataLoaderCallback> create(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, int requestId, const InjectedScript& injectedScript, const String& objectStoreName, const String& indexName, PassRefPtr<IDBKeyRange> idbKeyRange, int skipCount, unsigned pageSize)
+    {
+        return adoptRef(new DataLoaderCallback(frontendProvider, requestId, injectedScript, objectStoreName, indexName, idbKeyRange, skipCount, pageSize));
+    }
+
+    virtual ~DataLoaderCallback() { }
+
+    virtual void execute(PassRefPtr<IDBDatabaseBackendInterface> idbDatabase)
+    {
+        if (!m_frontendProvider->frontend())
+            return;
+
+        RefPtr<IDBTransactionBackendInterface> idbTransaction = transactionForDatabase(idbDatabase.get(), m_objectStoreName);
+        if (!idbTransaction)
+            return;
+        RefPtr<IDBObjectStoreBackendInterface> idbObjectStore = objectStoreForTransaction(idbTransaction.get(), m_objectStoreName);
+        if (!idbObjectStore)
+            return;
+
+        if (!m_indexName.isEmpty()) {
+            RefPtr<IDBIndexBackendInterface> idbIndex = indexForObjectStore(idbObjectStore.get(), m_indexName);
+            if (!idbIndex)
+                return;
+
+            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, idbTransaction.get(), OpenCursorCallback::IndexDataCursor, m_requestId, m_skipCount, m_pageSize);
+
+            ExceptionCode ec = 0;
+            idbIndex->openCursor(m_idbKeyRange, IDBCursor::NEXT, openCursorCallback, idbTransaction.get(), ec);
+        } else {
+            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, idbTransaction.get(), OpenCursorCallback::ObjectStoreDataCursor, m_requestId, m_skipCount, m_pageSize);
+
+            ExceptionCode ec = 0;
+            idbObjectStore->openCursor(m_idbKeyRange, IDBCursor::NEXT, openCursorCallback, idbTransaction.get(), ec);
+        }
+    }
+
+private:
+    DataLoaderCallback(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, int requestId, const InjectedScript& injectedScript, const String& objectStoreName, const String& indexName, PassRefPtr<IDBKeyRange> idbKeyRange, int skipCount, unsigned pageSize)
+        : m_frontendProvider(frontendProvider)
+        , m_requestId(requestId)
+        , m_injectedScript(injectedScript)
+        , m_objectStoreName(objectStoreName)
+        , m_indexName(indexName)
+        , m_idbKeyRange(idbKeyRange)
+        , m_skipCount(skipCount)
+        , m_pageSize(pageSize) { }
+    RefPtr<InspectorIndexedDBAgent::FrontendProvider> m_frontendProvider;
+    int m_requestId;
+    InjectedScript m_injectedScript;
+    String m_objectStoreName;
+    String m_indexName;
+    RefPtr<IDBKeyRange> m_idbKeyRange;
+    int m_skipCount;
+    unsigned m_pageSize;
+};
+
 } // namespace
 
-InspectorIndexedDBAgent::InspectorIndexedDBAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorPageAgent* pageAgent)
+InspectorIndexedDBAgent::InspectorIndexedDBAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorPageAgent* pageAgent)
     : InspectorBaseAgent<InspectorIndexedDBAgent>("IndexedDB", instrumentingAgents, state)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_pageAgent(pageAgent)
 {
 }
@@ -304,34 +599,54 @@ void InspectorIndexedDBAgent::disable(ErrorString*)
     m_state->setBoolean(IndexedDBAgentState::indexedDBAgentEnabled, false);
 }
 
-static Document* assertDocument(const String& frameId, InspectorPageAgent* pageAgent, ErrorString* error)
+static Frame* assertFrame(ErrorString* errorString, const String& frameId, InspectorPageAgent* pageAgent)
 {
     Frame* frame = pageAgent->frameForId(frameId);
+
+    if (!frame)
+        *errorString = "Frame not found";
+
+    return frame;
+}
+
+static Document* assertDocument(ErrorString* errorString, Frame* frame)
+{
     Document* document = frame ? frame->document() : 0;
 
     if (!document)
-        *error = "No document for given frame found";
+        *errorString = "No document for given frame found";
 
     return document;
 }
 
-static IDBFactoryBackendInterface* assertIDBFactory(Document* document, ErrorString* error)
+static Document* assertDocument(ErrorString* errorString, const String& frameId, InspectorPageAgent* pageAgent)
+{
+    Frame* frame = pageAgent->frameForId(frameId);
+    Document* document = frame ? frame->document() : 0;
+
+    if (!document)
+        *errorString = "No document for given frame found";
+
+    return document;
+}
+
+static IDBFactoryBackendInterface* assertIDBFactory(ErrorString* errorString, Document* document)
 {
     Page* page = document ? document->page() : 0;
     IDBFactoryBackendInterface* idbFactory = page ? page->group().idbFactory() : 0;
 
     if (!idbFactory)
-        *error = "No IndexedDB factory for given frame found";
+        *errorString = "No IndexedDB factory for given frame found";
 
     return idbFactory;
 }
 
-void InspectorIndexedDBAgent::requestDatabaseNamesForFrame(ErrorString* error, int requestId, const String& frameId)
+void InspectorIndexedDBAgent::requestDatabaseNamesForFrame(ErrorString* errorString, int requestId, const String& frameId)
 {
-    Document* document = assertDocument(frameId, m_pageAgent, error);
+    Document* document = assertDocument(errorString, frameId, m_pageAgent);
     if (!document)
         return;
-    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(document, error);
+    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(errorString, document);
     if (!idbFactory)
         return;
 
@@ -340,12 +655,12 @@ void InspectorIndexedDBAgent::requestDatabaseNamesForFrame(ErrorString* error, i
     idbFactory->getDatabaseNames(callback.get(), document->securityOrigin(), document->frame(), groupSettings->indexedDBDatabasePath());
 }
 
-void InspectorIndexedDBAgent::requestDatabase(ErrorString* error, int requestId, const String& frameId, const String& databaseName)
+void InspectorIndexedDBAgent::requestDatabase(ErrorString* errorString, int requestId, const String& frameId, const String& databaseName)
 {
-    Document* document = assertDocument(frameId, m_pageAgent, error);
+    Document* document = assertDocument(errorString, frameId, m_pageAgent);
     if (!document)
         return;
-    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(document, error);
+    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(errorString, document);
     if (!idbFactory)
         return;
 
@@ -353,6 +668,30 @@ void InspectorIndexedDBAgent::requestDatabase(ErrorString* error, int requestId,
     databaseLoaderCallback->start(idbFactory, document->securityOrigin(), document->frame(), databaseName);
 }
 
+void InspectorIndexedDBAgent::requestData(ErrorString* errorString, int requestId, const String& frameId, const String& databaseName, const String& objectStoreName, const String& indexName, int skipCount, int pageSize, const RefPtr<InspectorObject>* keyRange)
+{
+    Frame* frame = assertFrame(errorString, frameId, m_pageAgent);
+    if (!frame)
+        return;
+    Document* document = assertDocument(errorString, frame);
+    if (!document)
+        return;
+    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(errorString, document);
+    if (!idbFactory)
+        return;
+
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(mainWorldScriptState(frame));
+
+    RefPtr<IDBKeyRange> idbKeyRange = keyRange ? idbKeyRangeFromKeyRange(keyRange->get()) : 0;
+    if (keyRange && !idbKeyRange) {
+        *errorString = "Can not parse key range.";
+        return;
+    }
+
+    RefPtr<DataLoaderCallback> dataLoaderCallback = DataLoaderCallback::create(m_frontendProvider, requestId, injectedScript, objectStoreName, indexName, idbKeyRange, skipCount, pageSize);
+    dataLoaderCallback->start(idbFactory, document->securityOrigin(), document->frame(), databaseName);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR) && ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.h b/Source/WebCore/inspector/InspectorIndexedDBAgent.h
index 1b46dd143..b19ed6e5f 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.h
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.h
@@ -39,6 +39,7 @@
 
 namespace WebCore {
 
+class InjectedScriptManager;
 class InspectorPageAgent;
 
 typedef String ErrorString;
@@ -47,9 +48,9 @@ class InspectorIndexedDBAgent : public InspectorBaseAgent<InspectorIndexedDBAgen
 public:
     class FrontendProvider;
 
-    static PassOwnPtr<InspectorIndexedDBAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorPageAgent* pageAgent)
+    static PassOwnPtr<InspectorIndexedDBAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorPageAgent* pageAgent)
     {
-        return adoptPtr(new InspectorIndexedDBAgent(instrumentingAgents, state, pageAgent));
+        return adoptPtr(new InspectorIndexedDBAgent(instrumentingAgents, state, injectedScriptManager, pageAgent));
     }
     ~InspectorIndexedDBAgent();
 
@@ -62,9 +63,11 @@ public:
     virtual void disable(ErrorString*);
     virtual void requestDatabaseNamesForFrame(ErrorString*, int requestId, const String& frameId);
     virtual void requestDatabase(ErrorString*, int requestId, const String& frameId, const String& databaseName);
+    virtual void requestData(ErrorString*, int requestId, const String& frameId, const String& databaseName, const String& objectStoreName, const String& indexName, int skipCount, int pageSize, const RefPtr<InspectorObject>* keyRange);
 private:
-    InspectorIndexedDBAgent(InstrumentingAgents*, InspectorState*, InspectorPageAgent*);
+    InspectorIndexedDBAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, InspectorPageAgent*);
 
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorPageAgent* m_pageAgent;
     RefPtr<FrontendProvider> m_frontendProvider;
     bool m_enabled;
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 95d6f30c6..532eb8665 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -71,6 +71,9 @@
 
 namespace WebCore {
 
+static const char* const requestAnimationFrameEventName = "requestAnimationFrame";
+static const char* const cancelAnimationFrameEventName = "cancelAnimationFrame";
+static const char* const animationFrameFiredEventName = "animationFrameFired";
 static const char* const setTimerEventName = "setTimer";
 static const char* const clearTimerEventName = "clearTimer";
 static const char* const timerFiredEventName = "timerFired";
@@ -154,11 +157,13 @@ void InspectorInstrumentation::didRemoveDOMNodeImpl(InstrumentingAgents* instrum
         domAgent->didRemoveDOMNode(node);
 }
 
-void InspectorInstrumentation::willModifyDOMAttrImpl(InstrumentingAgents* instrumentingAgents, Element* element)
+void InspectorInstrumentation::willModifyDOMAttrImpl(InstrumentingAgents* instrumentingAgents, Element* element, const AtomicString& oldValue, const AtomicString& newValue)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     if (InspectorDOMDebuggerAgent* domDebuggerAgent = instrumentingAgents->inspectorDOMDebuggerAgent())
         domDebuggerAgent->willModifyDOMAttr(element);
+    if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
+        domAgent->willModifyDOMAttr(element, oldValue, newValue);
 #endif
 }
 
@@ -397,8 +402,11 @@ void InspectorInstrumentation::didLoadXHRImpl(const InspectorInstrumentationCook
         timelineAgent->didLoadXHR();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InstrumentingAgents* instrumentingAgents, const LayoutRect& rect)
+InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InstrumentingAgents* instrumentingAgents, GraphicsContext* context, const LayoutRect& rect)
 {
+    if (InspectorPageAgent* pageAgent = instrumentingAgents->inspectorPageAgent())
+        pageAgent->willPaint(context, rect);
+
     int timelineAgentId = 0;
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent()) {
         timelineAgent->willPaint(rect);
@@ -411,6 +419,8 @@ void InspectorInstrumentation::didPaintImpl(const InspectorInstrumentationCookie
 {
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
         timelineAgent->didPaint();
+    if (InspectorPageAgent* pageAgent = cookie.first ? cookie.first->inspectorPageAgent() : 0)
+        pageAgent->didPaint();
 }
 
 InspectorInstrumentationCookie InspectorInstrumentation::willRecalculateStyleImpl(InstrumentingAgents* instrumentingAgents)
@@ -983,32 +993,38 @@ void InspectorInstrumentation::cancelPauseOnNativeEvent(InstrumentingAgents* ins
 #endif
 }
 
-void InspectorInstrumentation::didRegisterAnimationFrameCallbackImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
+void InspectorInstrumentation::didRequestAnimationFrameImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
 {
+    pauseOnNativeEventIfNeeded(instrumentingAgents, false, requestAnimationFrameEventName, true);
+
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didRegisterAnimationFrameCallback(callbackId);
+        timelineAgent->didRequestAnimationFrame(callbackId);
 }
 
-void InspectorInstrumentation::didCancelAnimationFrameCallbackImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
+void InspectorInstrumentation::didCancelAnimationFrameImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
 {
+    pauseOnNativeEventIfNeeded(instrumentingAgents, false, cancelAnimationFrameEventName, true);
+
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didCancelAnimationFrameCallback(callbackId);
+        timelineAgent->didCancelAnimationFrame(callbackId);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrameEventImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
+InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrameImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
 {
+    pauseOnNativeEventIfNeeded(instrumentingAgents, false, animationFrameFiredEventName, false);
+
     int timelineAgentId = 0;
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent()) {
-        timelineAgent->willFireAnimationFrameEvent(callbackId);
+        timelineAgent->willFireAnimationFrame(callbackId);
         timelineAgentId = timelineAgent->id();
     }
     return InspectorInstrumentationCookie(instrumentingAgents, timelineAgentId);
 }
 
-void InspectorInstrumentation::didFireAnimationFrameEventImpl(const InspectorInstrumentationCookie& cookie)
+void InspectorInstrumentation::didFireAnimationFrameImpl(const InspectorInstrumentationCookie& cookie)
 {
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
-        timelineAgent->didFireAnimationFrameEvent();
+        timelineAgent->didFireAnimationFrame();
 }
 
 InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index da7dfe019..5d5c2d3d3 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -51,6 +51,7 @@ class Database;
 class Element;
 class EventContext;
 class DocumentLoader;
+class GraphicsContext;
 class HitTestResult;
 class InspectorCSSAgent;
 class InspectorTimelineAgent;
@@ -85,7 +86,7 @@ public:
     static void willInsertDOMNode(Document*, Node*, Node* parent);
     static void didInsertDOMNode(Document*, Node*);
     static void willRemoveDOMNode(Document*, Node*);
-    static void willModifyDOMAttr(Document*, Element*);
+    static void willModifyDOMAttr(Document*, Element*, const AtomicString& oldValue, const AtomicString& newValue);
     static void didModifyDOMAttr(Document*, Element*, const AtomicString& name, const AtomicString& value);
     static void didRemoveDOMAttr(Document*, Element*, const AtomicString& name);
     static void characterDataModified(Document*, CharacterData*);
@@ -120,7 +121,7 @@ public:
     static void didLayout(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHR(ScriptExecutionContext*, XMLHttpRequest*);
     static void didLoadXHR(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willPaint(Frame*, const LayoutRect&);
+    static InspectorInstrumentationCookie willPaint(Frame*, GraphicsContext*, const LayoutRect&);
     static void didPaint(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willRecalculateStyle(Document*);
     static void didRecalculateStyle(const InspectorInstrumentationCookie&);
@@ -173,10 +174,10 @@ public:
     static void stopConsoleTiming(Page*, const String& title, PassRefPtr<ScriptCallStack>);
     static void consoleTimeStamp(Page*, PassRefPtr<ScriptArguments>);
 
-    static void didRegisterAnimationFrameCallback(Document*, int callbackId);
-    static void didCancelAnimationFrameCallback(Document*, int callbackId);
-    static InspectorInstrumentationCookie willFireAnimationFrameEvent(Document*, int callbackId);
-    static void didFireAnimationFrameEvent(const InspectorInstrumentationCookie&);
+    static void didRequestAnimationFrame(Document*, int callbackId);
+    static void didCancelAnimationFrame(Document*, int callbackId);
+    static InspectorInstrumentationCookie willFireAnimationFrame(Document*, int callbackId);
+    static void didFireAnimationFrame(const InspectorInstrumentationCookie&);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     static void addStartProfilingMessageToConsole(Page*, const String& title, unsigned lineNumber, const String& sourceURL);
@@ -235,7 +236,7 @@ private:
     static void didInsertDOMNodeImpl(InstrumentingAgents*, Node*);
     static void willRemoveDOMNodeImpl(InstrumentingAgents*, Node*);
     static void didRemoveDOMNodeImpl(InstrumentingAgents*, Node*);
-    static void willModifyDOMAttrImpl(InstrumentingAgents*, Element*);
+    static void willModifyDOMAttrImpl(InstrumentingAgents*, Element*, const AtomicString& oldValue, const AtomicString& newValue);
     static void didModifyDOMAttrImpl(InstrumentingAgents*, Element*, const AtomicString& name, const AtomicString& value);
     static void didRemoveDOMAttrImpl(InstrumentingAgents*, Element*, const AtomicString& name);
     static void characterDataModifiedImpl(InstrumentingAgents*, CharacterData*);
@@ -270,7 +271,7 @@ private:
     static void didLayoutImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHRImpl(InstrumentingAgents*, XMLHttpRequest*);
     static void didLoadXHRImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willPaintImpl(InstrumentingAgents*, const LayoutRect&);
+    static InspectorInstrumentationCookie willPaintImpl(InstrumentingAgents*, GraphicsContext*, const LayoutRect&);
     static void didPaintImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willRecalculateStyleImpl(InstrumentingAgents*);
     static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
@@ -320,10 +321,10 @@ private:
     static void stopConsoleTimingImpl(InstrumentingAgents*, const String& title, PassRefPtr<ScriptCallStack>);
     static void consoleTimeStampImpl(InstrumentingAgents*, PassRefPtr<ScriptArguments>);
 
-    static void didRegisterAnimationFrameCallbackImpl(InstrumentingAgents*, int callbackId);
-    static void didCancelAnimationFrameCallbackImpl(InstrumentingAgents*, int callbackId);
-    static InspectorInstrumentationCookie willFireAnimationFrameEventImpl(InstrumentingAgents*, int callbackId);
-    static void didFireAnimationFrameEventImpl(const InspectorInstrumentationCookie&);
+    static void didRequestAnimationFrameImpl(InstrumentingAgents*, int callbackId);
+    static void didCancelAnimationFrameImpl(InstrumentingAgents*, int callbackId);
+    static InspectorInstrumentationCookie willFireAnimationFrameImpl(InstrumentingAgents*, int callbackId);
+    static void didFireAnimationFrameImpl(const InspectorInstrumentationCookie&);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     static void addStartProfilingMessageToConsoleImpl(InstrumentingAgents*, const String& title, unsigned lineNumber, const String& sourceURL);
@@ -424,12 +425,12 @@ inline void InspectorInstrumentation::willRemoveDOMNode(Document* document, Node
 #endif
 }
 
-inline void InspectorInstrumentation::willModifyDOMAttr(Document* document, Element* element)
+inline void InspectorInstrumentation::willModifyDOMAttr(Document* document, Element* element, const AtomicString& oldValue, const AtomicString& newValue)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(void());
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        willModifyDOMAttrImpl(instrumentingAgents, element);
+        willModifyDOMAttrImpl(instrumentingAgents, element, oldValue, newValue);
 #endif
 }
 
@@ -722,12 +723,12 @@ inline void InspectorInstrumentation::didLoadXHR(const InspectorInstrumentationC
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame, const LayoutRect& rect)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame, GraphicsContext* context, const LayoutRect& rect)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
-        return willPaintImpl(instrumentingAgents, rect);
+        return willPaintImpl(instrumentingAgents, context, rect);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -1172,37 +1173,37 @@ inline void InspectorInstrumentation::updateApplicationCacheStatus(Frame* frame)
 #endif
 }
 
-inline void InspectorInstrumentation::didRegisterAnimationFrameCallback(Document* document, int callbackId)
+inline void InspectorInstrumentation::didRequestAnimationFrame(Document* document, int callbackId)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        didRegisterAnimationFrameCallbackImpl(instrumentingAgents, callbackId);
+        didRequestAnimationFrameImpl(instrumentingAgents, callbackId);
 #endif
 }
 
-inline void InspectorInstrumentation::didCancelAnimationFrameCallback(Document* document, int callbackId)
+inline void InspectorInstrumentation::didCancelAnimationFrame(Document* document, int callbackId)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        didCancelAnimationFrameCallbackImpl(instrumentingAgents, callbackId);
+        didCancelAnimationFrameImpl(instrumentingAgents, callbackId);
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrameEvent(Document* document, int callbackId)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrame(Document* document, int callbackId)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        return willFireAnimationFrameEventImpl(instrumentingAgents, callbackId);
+        return willFireAnimationFrameImpl(instrumentingAgents, callbackId);
 #endif
     return InspectorInstrumentationCookie();
 }
 
-inline void InspectorInstrumentation::didFireAnimationFrameEvent(const InspectorInstrumentationCookie& cookie)
+inline void InspectorInstrumentation::didFireAnimationFrame(const InspectorInstrumentationCookie& cookie)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(void());
     if (cookie.first)
-        didFireAnimationFrameEventImpl(cookie);
+        didFireAnimationFrameImpl(cookie);
 #endif
 }
 
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 44004bc8c..8e8b25abf 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -36,13 +36,17 @@
 
 #include "Base64.h"
 #include "CachedCSSStyleSheet.h"
+#include "CachedFont.h"
+#include "CachedImage.h"
 #include "CachedResource.h"
 #include "CachedResourceLoader.h"
 #include "CachedScript.h"
 #include "ContentSearchUtils.h"
 #include "Cookie.h"
 #include "CookieJar.h"
-#include "DOMEditor.h"
+#include "DOMImplementation.h"
+#include "DOMNodeHighlighter.h"
+#include "DOMPatchSupport.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
@@ -51,6 +55,7 @@
 #include "HTMLNames.h"
 #include "IdentifiersFactory.h"
 #include "InjectedScriptManager.h"
+#include "InspectorClient.h"
 #include "InspectorFrontend.h"
 #include "InspectorInstrumentation.h"
 #include "InspectorState.h"
@@ -63,6 +68,7 @@
 #include "SecurityOrigin.h"
 #include "SharedBuffer.h"
 #include "TextEncoding.h"
+#include "TextResourceDecoder.h"
 #include "UserGestureIndicator.h"
 
 #include <wtf/CurrentTime.h>
@@ -78,6 +84,7 @@ static const char pageAgentEnabled[] = "pageAgentEnabled";
 static const char pageAgentScriptsToEvaluateOnLoad[] = "pageAgentScriptsToEvaluateOnLoad";
 static const char pageAgentScreenWidthOverride[] = "pageAgentScreenWidthOverride";
 static const char pageAgentScreenHeightOverride[] = "pageAgentScreenHeightOverride";
+static const char showPaintRects[] = "showPaintRects";
 }
 
 static bool decodeSharedBuffer(PassRefPtr<SharedBuffer> buffer, const String& textEncodingName, String* result)
@@ -121,7 +128,24 @@ static bool prepareCachedResourceBuffer(CachedResource* cachedResource, bool* ha
 static bool hasTextContent(CachedResource* cachedResource)
 {
     InspectorPageAgent::ResourceType type = InspectorPageAgent::cachedResourceType(*cachedResource);
-    return type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource;
+    return type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource || type == InspectorPageAgent::XHRResource;
+}
+
+// static
+PassRefPtr<TextResourceDecoder> InspectorPageAgent::createDecoder(const String& mimeType, const String& textEncodingName)
+{
+    RefPtr<TextResourceDecoder> decoder;
+    if (!textEncodingName.isEmpty())
+        decoder = TextResourceDecoder::create("text/plain", textEncodingName);
+    else if (mimeType == "text/plain")
+        decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
+    else if (mimeType == "text/html")
+        decoder = TextResourceDecoder::create("text/html", "UTF-8");
+    else if (DOMImplementation::isXMLMIMEType(mimeType)) {
+        decoder = TextResourceDecoder::create("application/xml");
+        decoder->useLenientXMLDecoding();
+    }
+    return decoder;
 }
 
 bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, String* result, bool* base64Encoded)
@@ -142,6 +166,11 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
         return true;
     }
 
+    if (hasZeroSize) {
+        *result = "";
+        return true;
+    }
+
     if (cachedResource) {
         switch (cachedResource->type()) {
         case CachedResource::CSSStyleSheet:
@@ -150,11 +179,20 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
         case CachedResource::Script:
             *result = static_cast<CachedScript*>(cachedResource)->script();
             return true;
+        case CachedResource::RawResource: {
+            SharedBuffer* buffer = cachedResource->data();
+            if (!buffer)
+                return false;
+            RefPtr<TextResourceDecoder> decoder = InspectorPageAgent::createDecoder(cachedResource->response().mimeType(), cachedResource->response().textEncodingName());
+            // We show content for raw resources only for certain mime types (text, html and xml). Otherwise decoder will be null.
+            if (!decoder)
+                return false;
+            String content = decoder->decode(buffer->data(), buffer->size());
+            content += decoder->flush();
+            *result = content;
+            return true;
+        }
         default:
-            if (hasZeroSize) {
-                *result = "";
-                return true;
-            }
             return decodeSharedBuffer(cachedResource->data(), cachedResource->encoding(), result);
         }
     }
@@ -182,9 +220,9 @@ bool InspectorPageAgent::sharedBufferContent(PassRefPtr<SharedBuffer> buffer, co
     return decodeSharedBuffer(buffer, textEncodingName, result);
 }
 
-PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* state, InjectedScriptManager* injectedScriptManager)
+PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
 {
-    return adoptPtr(new InspectorPageAgent(instrumentingAgents, page, state, injectedScriptManager));
+    return adoptPtr(new InspectorPageAgent(instrumentingAgents, page, state, injectedScriptManager, client));
 }
 
 // static
@@ -254,6 +292,8 @@ InspectorPageAgent::ResourceType InspectorPageAgent::cachedResourceType(const Ca
         return InspectorPageAgent::StylesheetResource;
     case CachedResource::Script:
         return InspectorPageAgent::ScriptResource;
+    case CachedResource::RawResource:
+        return InspectorPageAgent::XHRResource;
     default:
         break;
     }
@@ -265,13 +305,15 @@ String InspectorPageAgent::cachedResourceTypeString(const CachedResource& cached
     return resourceTypeString(cachedResourceType(cachedResource));
 }
 
-InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
+InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
     : InspectorBaseAgent<InspectorPageAgent>("Page", instrumentingAgents, inspectorState)
     , m_page(page)
     , m_injectedScriptManager(injectedScriptManager)
+    , m_client(client)
     , m_frontend(0)
     , m_lastScriptIdentifier(0)
     , m_originalUseFixedLayout(false)
+    , m_lastPaintContext(0)
 {
 }
 
@@ -388,8 +430,27 @@ static Vector<CachedResource*> cachedResourcesForFrame(Frame* frame)
 
     const CachedResourceLoader::DocumentResourceMap& allResources = frame->document()->cachedResourceLoader()->allCachedResources();
     CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
-        result.append(it->second.get());
+    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+        CachedResource* cachedResource = it->second.get();
+
+        switch (cachedResource->type()) {
+        case CachedResource::ImageResource:
+            // Skip images that were not auto loaded (images disabled in the user agent).
+            if (static_cast<CachedImage*>(cachedResource)->stillNeedsLoad())
+                continue;
+            break;
+        case CachedResource::FontResource:
+            // Skip fonts that were referenced in CSS but never used/downloaded.
+            if (static_cast<CachedFont*>(cachedResource)->stillNeedsLoad())
+                continue;
+            break;
+        default:
+            // All other CachedResource types download immediately.
+            break;
+        }
+
+        result.append(cachedResource);
+    }
 
     return result;
 }
@@ -571,8 +632,7 @@ void InspectorPageAgent::setDocumentContent(ErrorString* errorString, const Stri
         *errorString = "No Document instance to set HTML for";
         return;
     }
-    DOMEditor editor(document);
-    editor.patchDocument(html);
+    DOMPatchSupport::patchDocument(document, html);
 }
 
 void InspectorPageAgent::setScreenSizeOverride(ErrorString* errorString, const int width, const int height)
@@ -597,6 +657,13 @@ void InspectorPageAgent::setScreenSizeOverride(ErrorString* errorString, const i
     updateFrameViewFixedLayout(width, height);
 }
 
+void InspectorPageAgent::setShowPaintRects(ErrorString*, bool show)
+{
+    m_state->setBoolean(PageAgentState::showPaintRects, show);
+    if (!show)
+        m_page->mainFrame()->view()->invalidate();
+}
+
 void InspectorPageAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
 {
     if (world != mainThreadNormalWorld())
@@ -726,6 +793,32 @@ void InspectorPageAgent::applyScreenHeightOverride(long* height)
         *height = heightOverride;
 }
 
+void InspectorPageAgent::willPaint(GraphicsContext* context, const LayoutRect& rect)
+{
+    if (m_state->getBoolean(PageAgentState::showPaintRects)) {
+        m_lastPaintContext = context;
+        m_lastPaintRect = rect;
+        m_lastPaintRect.inflate(-1);
+    }
+}
+
+void InspectorPageAgent::didPaint()
+{
+    if (!m_lastPaintContext || !m_state->getBoolean(PageAgentState::showPaintRects))
+        return;
+
+    static int colorSelector = 0;
+    const Color colors[] = {
+        Color(0xFF, 0, 0, 0x3F),
+        Color(0xFF, 0, 0xFF, 0x3F),
+        Color(0, 0, 0xFF, 0x3F),
+    };
+
+    DOMNodeHighlighter::drawOutline(*m_lastPaintContext, m_lastPaintRect, colors[colorSelector++ % WTF_ARRAY_LENGTH(colors)]);
+
+    m_lastPaintContext = 0;
+}
+
 PassRefPtr<InspectorObject> InspectorPageAgent::buildObjectForFrame(Frame* frame)
 {
     RefPtr<InspectorObject> frameObject = InspectorObject::create();
@@ -733,7 +826,7 @@ PassRefPtr<InspectorObject> InspectorPageAgent::buildObjectForFrame(Frame* frame
     if (frame->tree()->parent())
         frameObject->setString("parentId", frameId(frame->tree()->parent()));
     if (frame->ownerElement()) {
-        String name = frame->ownerElement()->getAttribute(HTMLNames::nameAttr);
+        String name = frame->ownerElement()->getNameAttribute();
         if (name.isEmpty())
             name = frame->ownerElement()->getAttribute(HTMLNames::idAttr);
         frameObject->setString("name", name);
@@ -758,10 +851,15 @@ PassRefPtr<InspectorObject> InspectorPageAgent::buildObjectForFrameTree(Frame* f
     Vector<CachedResource*> allResources = cachedResourcesForFrame(frame);
     for (Vector<CachedResource*>::const_iterator it = allResources.begin(); it != allResources.end(); ++it) {
         CachedResource* cachedResource = *it;
+
         RefPtr<InspectorObject> resourceObject = InspectorObject::create();
         resourceObject->setString("url", cachedResource->url());
         resourceObject->setString("type", cachedResourceTypeString(*cachedResource));
         resourceObject->setString("mimeType", cachedResource->response().mimeType());
+        if (cachedResource->status() == CachedResource::LoadError)
+            resourceObject->setBoolean("failed", true);
+        if (cachedResource->status() == CachedResource::Canceled)
+            resourceObject->setBoolean("canceled", true);
         subresources->pushValue(resourceObject);
     }
 
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index 59ed709d7..8fd7b4208 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -50,6 +50,7 @@ class Frame;
 class Frontend;
 class InjectedScriptManager;
 class InspectorArray;
+class InspectorClient;
 class InspectorObject;
 class InspectorState;
 class InstrumentingAgents;
@@ -57,6 +58,7 @@ class KURL;
 class Page;
 class RegularExpression;
 class SharedBuffer;
+class TextResourceDecoder;
 
 typedef String ErrorString;
 
@@ -74,8 +76,9 @@ public:
         OtherResource
     };
 
-    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*);
+    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
 
+    static PassRefPtr<TextResourceDecoder> createDecoder(const String& mimeType, const String& textEncodingName);
     static bool cachedResourceContent(CachedResource*, String* result, bool* base64Encoded);
     static bool sharedBufferContent(PassRefPtr<SharedBuffer>, const String& textEncodingName, bool withBase64Encode, String* result);
     static void resourceContent(ErrorString*, Frame*, const KURL&, String* result, bool* base64Encoded);
@@ -101,6 +104,7 @@ public:
     virtual void searchInResources(ErrorString*, const String&, const bool* caseSensitive, const bool* isRegex, RefPtr<InspectorArray>&);
     virtual void setDocumentContent(ErrorString*, const String& frameId, const String& html);
     virtual void setScreenSizeOverride(ErrorString*, int width, int height);
+    virtual void setShowPaintRects(ErrorString*, bool show);
 
     // InspectorInstrumentation API
     void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
@@ -111,6 +115,8 @@ public:
     void loaderDetachedFromFrame(DocumentLoader*);
     void applyScreenWidthOverride(long*);
     void applyScreenHeightOverride(long*);
+    void willPaint(GraphicsContext*, const LayoutRect&);
+    void didPaint();
 
     // Inspector Controller API
     virtual void setFrontend(InspectorFrontend*);
@@ -127,7 +133,7 @@ public:
     static DocumentLoader* assertDocumentLoader(ErrorString*, Frame*);
 
 private:
-    InspectorPageAgent(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*);
+    InspectorPageAgent(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
     void updateFrameViewFixedLayout(int, int);
     void setFrameViewFixedLayout(int, int);
     void clearFrameViewFixedLayout();
@@ -136,6 +142,7 @@ private:
     PassRefPtr<InspectorObject> buildObjectForFrameTree(Frame*);
     Page* m_page;
     InjectedScriptManager* m_injectedScriptManager;
+    InspectorClient* m_client;
     InspectorFrontend::Page* m_frontend;
     long m_lastScriptIdentifier;
     String m_pendingScriptToEvaluateOnLoadOnce;
@@ -145,6 +152,8 @@ private:
     HashMap<DocumentLoader*, String> m_loaderToIdentifier;
     OwnPtr<IntSize> m_originalFixedLayoutSize;
     bool m_originalUseFixedLayout;
+    GraphicsContext* m_lastPaintContext;
+    LayoutRect m_lastPaintRect;
 };
 
 
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 8774276cb..08e9ea63a 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -34,6 +34,7 @@
 
 #include "Console.h"
 #include "InjectedScript.h"
+#include "InjectedScriptHost.h"
 #include "InspectorConsoleAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorState.h"
@@ -264,6 +265,7 @@ void InspectorProfilerAgent::resetState()
     m_nextUserInitiatedProfileNumber = 1;
     m_nextUserInitiatedHeapSnapshotNumber = 1;
     resetFrontendProfiles();
+    m_injectedScriptManager->injectedScriptHost()->clearInspectedObjects();
 }
 
 void InspectorProfilerAgent::resetFrontendProfiles()
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.cpp b/Source/WebCore/inspector/InspectorResourceAgent.cpp
index ca3b0e925..09cdc036a 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.cpp
+++ b/Source/WebCore/inspector/InspectorResourceAgent.cpp
@@ -253,7 +253,7 @@ void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, Docume
             type = InspectorPageAgent::ScriptResource;
         else if (equalIgnoringFragmentIdentifier(response.url(), loader->frameLoader()->icon()->url()))
             type = InspectorPageAgent::ImageResource;
-        else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == InspectorPageAgent::OtherResource)
+        else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && !loader->isCommitted())
             type = InspectorPageAgent::DocumentResource;
 
         m_resourcesData->responseReceived(requestId, m_pageAgent->frameId(loader->frame()), response);
@@ -328,7 +328,10 @@ void InspectorResourceAgent::didReceiveScriptResponse(unsigned long identifier)
 
 void InspectorResourceAgent::setInitialXHRContent(unsigned long identifier, const String& sourceString)
 {
-    m_resourcesData->setResourceContent(IdentifiersFactory::requestId(identifier), sourceString);
+    // For Asynchronous XHRs, the inspector can grab the data directly off of the CachedResource. For sync XHRs, we need to
+    // provide the data here, since no CachedResource was involved.
+    if (m_loadingXHRSynchronously)
+        m_resourcesData->setResourceContent(IdentifiersFactory::requestId(identifier), sourceString);
 }
 
 void InspectorResourceAgent::didReceiveXHRResponse(unsigned long identifier)
@@ -529,6 +532,8 @@ void InspectorResourceAgent::clearBrowserCookies(ErrorString*)
 void InspectorResourceAgent::setCacheDisabled(ErrorString*, bool cacheDisabled)
 {
     m_state->setBoolean(ResourceAgentState::cacheDisabled, cacheDisabled);
+    if (cacheDisabled)
+        memoryCache()->evictResources();
 }
 
 void InspectorResourceAgent::mainFrameNavigated(DocumentLoader* loader)
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index c7c4edb77..b72461e17 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -280,13 +280,13 @@ PassRefPtr<InspectorArray> InspectorStyle::buildArrayForComputedStyle() const
 //
 // The propertyText (if not empty) is checked to be a valid style declaration (containing at least one property). If not,
 // the method returns false (denoting an error).
-bool InspectorStyle::setPropertyText(ErrorString* errorString, unsigned index, const String& propertyText, bool overwrite, String* oldText)
+bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText, bool overwrite, String* oldText, ExceptionCode& ec)
 {
     ASSERT(m_parentStyleSheet);
     DEFINE_STATIC_LOCAL(String, bogusPropertyName, ("-webkit-boguz-propertee"));
 
     if (!m_parentStyleSheet->ensureParsedDataReady()) {
-        *errorString = "Internal error: no stylesheet parsed data available";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
@@ -303,27 +303,27 @@ bool InspectorStyle::setPropertyText(ErrorString* errorString, unsigned index, c
 
         // At least one property + the bogus property added just above should be present.
         if (propertyCount < 2) {
-            *errorString = "Invalid property value";
+            ec = SYNTAX_ERR;
             return false;
         }
 
         // Check for a proper propertyText termination (the parser could at least restore to the PROPERTY_NAME state).
         if (propertyData.at(propertyCount - 1).name != bogusPropertyName) {
-            *errorString = "Invalid property value";
+            ec = SYNTAX_ERR;
             return false;
         }
     }
 
     RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet->ruleSourceDataFor(m_style.get());
     if (!sourceData) {
-        *errorString = "Internal error: no CSS rule source found";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
     String text;
     bool success = styleText(&text);
     if (!success) {
-        *errorString = "Internal error: could not fetch style text";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
@@ -337,31 +337,31 @@ bool InspectorStyle::setPropertyText(ErrorString* errorString, unsigned index, c
     return applyStyleText(editor.styleText());
 }
 
-bool InspectorStyle::toggleProperty(ErrorString* errorString, unsigned index, bool disable)
+bool InspectorStyle::toggleProperty(unsigned index, bool disable, ExceptionCode& ec)
 {
     ASSERT(m_parentStyleSheet);
     if (!m_parentStyleSheet->ensureParsedDataReady()) {
-        *errorString = "Can toggle only source-based properties";
+        ec = NO_MODIFICATION_ALLOWED_ERR;
         return false;
     }
 
     RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet->ruleSourceDataFor(m_style.get());
     if (!sourceData) {
-        *errorString = "Internal error: No source data for the style found";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
     String text;
     bool success = styleText(&text);
     if (!success) {
-        *errorString = "Internal error: could not fetch style text";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
     Vector<InspectorStyleProperty> allProperties;
     populateAllProperties(&allProperties);
     if (index >= allProperties.size()) {
-        *errorString = "Property index is outside of property range";
+        ec = INDEX_SIZE_ERR;
         return false;
     }
 
@@ -653,9 +653,9 @@ NewLineAndWhitespace& InspectorStyle::newLineAndWhitespaceDelimiters() const
     return m_format;
 }
 
-PassRefPtr<InspectorStyleSheet> InspectorStyleSheet::create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL)
+PassRefPtr<InspectorStyleSheet> InspectorStyleSheet::create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener* listener)
 {
-    return adoptRef(new InspectorStyleSheet(id, pageStyleSheet, origin, documentURL));
+    return adoptRef(new InspectorStyleSheet(id, pageStyleSheet, origin, documentURL, listener));
 }
 
 // static
@@ -666,12 +666,13 @@ String InspectorStyleSheet::styleSheetURL(CSSStyleSheet* pageStyleSheet)
     return emptyString();
 }
 
-InspectorStyleSheet::InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL)
+InspectorStyleSheet::InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener* listener)
     : m_id(id)
     , m_pageStyleSheet(pageStyleSheet)
     , m_origin(origin)
     , m_documentURL(documentURL)
     , m_isRevalidating(false)
+    , m_listener(listener)
 {
     m_parsedStyleSheet = new ParsedStyleSheet();
 }
@@ -694,6 +695,7 @@ void InspectorStyleSheet::reparseStyleSheet(const String& text)
     m_pageStyleSheet->parseString(text, m_pageStyleSheet->useStrictParsing());
     m_pageStyleSheet->styleSheetChanged();
     m_inspectorStyles.clear();
+    fireStyleSheetChanged();
 }
 
 bool InspectorStyleSheet::setText(const String& text)
@@ -707,34 +709,52 @@ bool InspectorStyleSheet::setText(const String& text)
     return true;
 }
 
-bool InspectorStyleSheet::setRuleSelector(const InspectorCSSId& id, const String& selector)
+String InspectorStyleSheet::ruleSelector(const InspectorCSSId& id, ExceptionCode& ec)
 {
     CSSStyleRule* rule = ruleForId(id);
-    if (!rule)
+    if (!rule) {
+        ec = NOT_FOUND_ERR;
+        return "";
+    }
+    return rule->selectorText();
+}
+
+bool InspectorStyleSheet::setRuleSelector(const InspectorCSSId& id, const String& selector, ExceptionCode& ec)
+{
+    CSSStyleRule* rule = ruleForId(id);
+    if (!rule) {
+        ec = NOT_FOUND_ERR;
         return false;
+    }
     CSSStyleSheet* styleSheet = rule->parentStyleSheet();
-    if (!styleSheet || !ensureParsedDataReady())
+    if (!styleSheet || !ensureParsedDataReady()) {
+        ec = NOT_FOUND_ERR;
         return false;
+    }
 
     rule->setSelectorText(selector);
     RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(rule->style());
-    if (!sourceData)
+    if (!sourceData) {
+        ec = NOT_FOUND_ERR;
         return false;
+    }
 
     String sheetText = m_parsedStyleSheet->text();
     sheetText.replace(sourceData->selectorListRange.start, sourceData->selectorListRange.end - sourceData->selectorListRange.start, selector);
     m_parsedStyleSheet->setText(sheetText);
+    fireStyleSheetChanged();
     return true;
 }
 
-CSSStyleRule* InspectorStyleSheet::addRule(const String& selector)
+CSSStyleRule* InspectorStyleSheet::addRule(const String& selector, ExceptionCode& ec)
 {
     String styleSheetText;
     bool success = getText(&styleSheetText);
-    if (!success)
+    if (!success) {
+        ec = NOT_FOUND_ERR;
         return 0;
+    }
 
-    ExceptionCode ec = 0;
     m_pageStyleSheet->addRule(selector, "", ec);
     if (ec)
         return 0;
@@ -751,9 +771,41 @@ CSSStyleRule* InspectorStyleSheet::addRule(const String& selector)
     // Using setText() as this operation changes the style sheet rule set.
     setText(styleSheetText);
 
+    fireStyleSheetChanged();
+
     return rule;
 }
 
+bool InspectorStyleSheet::deleteRule(const InspectorCSSId& id, ExceptionCode& ec)
+{
+    RefPtr<CSSStyleRule> rule = ruleForId(id);
+    if (!rule) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+    CSSStyleSheet* styleSheet = rule->parentStyleSheet();
+    if (!styleSheet || !ensureParsedDataReady()) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
+    styleSheet->deleteRule(id.ordinal(), ec);
+    if (ec)
+        return false;
+
+    RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(rule->style());
+    if (!sourceData) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
+    String sheetText = m_parsedStyleSheet->text();
+    sheetText.remove(sourceData->selectorListRange.start, sourceData->styleSourceData->styleBodyRange.end - sourceData->selectorListRange.start + 1);
+    m_parsedStyleSheet->setText(sheetText);
+    fireStyleSheetChanged();
+    return true;
+}
+
 CSSStyleRule* InspectorStyleSheet::ruleForId(const InspectorCSSId& id) const
 {
     if (!m_pageStyleSheet)
@@ -868,31 +920,35 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyle(CSSStyleDec
     return result.release();
 }
 
-bool InspectorStyleSheet::setPropertyText(ErrorString* errorString, const InspectorCSSId& id, unsigned propertyIndex, const String& text, bool overwrite, String* oldText)
+bool InspectorStyleSheet::setPropertyText(const InspectorCSSId& id, unsigned propertyIndex, const String& text, bool overwrite, String* oldText, ExceptionCode& ec)
 {
     RefPtr<InspectorStyle> inspectorStyle = inspectorStyleForId(id);
     if (!inspectorStyle) {
-        *errorString = "No style found for given id";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
-    return inspectorStyle->setPropertyText(errorString, propertyIndex, text, overwrite, oldText);
+    bool success = inspectorStyle->setPropertyText(propertyIndex, text, overwrite, oldText, ec);
+    if (success)
+        fireStyleSheetChanged();
+    return success;
 }
 
-bool InspectorStyleSheet::toggleProperty(ErrorString* errorString, const InspectorCSSId& id, unsigned propertyIndex, bool disable)
+bool InspectorStyleSheet::toggleProperty(const InspectorCSSId& id, unsigned propertyIndex, bool disable, ExceptionCode& ec)
 {
     RefPtr<InspectorStyle> inspectorStyle = inspectorStyleForId(id);
     if (!inspectorStyle) {
-        *errorString = "No style found for given id";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
-    bool success = inspectorStyle->toggleProperty(errorString, propertyIndex, disable);
+    bool success = inspectorStyle->toggleProperty(propertyIndex, disable, ec);
     if (success) {
         if (disable)
             rememberInspectorStyle(inspectorStyle);
         else if (!inspectorStyle->hasDisabledProperties())
             forgetInspectorStyle(inspectorStyle->cssStyle());
+        fireStyleSheetChanged();
     }
     return success;
 }
@@ -914,6 +970,12 @@ CSSStyleDeclaration* InspectorStyleSheet::styleForId(const InspectorCSSId& id) c
     return rule->style();
 }
 
+void InspectorStyleSheet::fireStyleSheetChanged()
+{
+    if (m_listener)
+        m_listener->styleSheetChanged(this);
+}
+
 PassRefPtr<InspectorStyle> InspectorStyleSheet::inspectorStyleForId(const InspectorCSSId& id)
 {
     CSSStyleDeclaration* style = styleForId(id);
@@ -1218,13 +1280,13 @@ void InspectorStyleSheet::collectFlatRules(PassRefPtr<CSSRuleList> ruleList, Vec
     }
 }
 
-PassRefPtr<InspectorStyleSheetForInlineStyle> InspectorStyleSheetForInlineStyle::create(const String& id, PassRefPtr<Element> element, const String& origin)
+PassRefPtr<InspectorStyleSheetForInlineStyle> InspectorStyleSheetForInlineStyle::create(const String& id, PassRefPtr<Element> element, const String& origin, Listener* listener)
 {
-    return adoptRef(new InspectorStyleSheetForInlineStyle(id, element, origin));
+    return adoptRef(new InspectorStyleSheetForInlineStyle(id, element, origin, listener));
 }
 
-InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element> element, const String& origin)
-    : InspectorStyleSheet(id, 0, origin, "")
+InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element> element, const String& origin, Listener* listener)
+    : InspectorStyleSheet(id, 0, origin, "", listener)
     , m_element(element)
     , m_ruleSourceData(0)
     , m_isStyleTextValid(false)
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.h b/Source/WebCore/inspector/InspectorStyleSheet.h
index d627b1dda..aa293c2cd 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.h
+++ b/Source/WebCore/inspector/InspectorStyleSheet.h
@@ -26,6 +26,8 @@
 #define InspectorStyleSheet_h
 
 #include "CSSPropertySourceData.h"
+#include "CSSStyleDeclaration.h"
+#include "ExceptionCode.h"
 #include "InspectorStyleTextEditor.h"
 #include "InspectorValues.h"
 #include "PlatformString.h"
@@ -131,8 +133,8 @@ public:
     PassRefPtr<InspectorObject> buildObjectForStyle() const;
     PassRefPtr<InspectorArray> buildArrayForComputedStyle() const;
     bool hasDisabledProperties() const { return !m_disabledProperties.isEmpty(); }
-    bool setPropertyText(ErrorString*, unsigned index, const String& text, bool overwrite, String* oldText);
-    bool toggleProperty(ErrorString*, unsigned index, bool disable);
+    bool setPropertyText(unsigned index, const String& text, bool overwrite, String* oldText, ExceptionCode&);
+    bool toggleProperty(unsigned index, bool disable, ExceptionCode&);
 
 private:
     InspectorStyle(const InspectorCSSId& styleId, PassRefPtr<CSSStyleDeclaration> style, InspectorStyleSheet* parentStyleSheet);
@@ -156,8 +158,15 @@ private:
 
 class InspectorStyleSheet : public RefCounted<InspectorStyleSheet> {
 public:
+    class Listener {
+    public:
+        Listener() { }
+        virtual ~Listener() { }
+        virtual void styleSheetChanged(InspectorStyleSheet*) = 0;
+    };
+
     typedef HashMap<CSSStyleDeclaration*, RefPtr<InspectorStyle> > InspectorStyleMap;
-    static PassRefPtr<InspectorStyleSheet> create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL);
+    static PassRefPtr<InspectorStyleSheet> create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener*);
     static String styleSheetURL(CSSStyleSheet* pageStyleSheet);
 
     virtual ~InspectorStyleSheet();
@@ -167,21 +176,27 @@ public:
     CSSStyleSheet* pageStyleSheet() const { return m_pageStyleSheet.get(); }
     void reparseStyleSheet(const String&);
     bool setText(const String&);
-    bool setRuleSelector(const InspectorCSSId&, const String& selector);
-    CSSStyleRule* addRule(const String& selector);
+    String ruleSelector(const InspectorCSSId&, ExceptionCode&);
+    bool setRuleSelector(const InspectorCSSId&, const String& selector, ExceptionCode&);
+    CSSStyleRule* addRule(const String& selector, ExceptionCode&);
+    bool deleteRule(const InspectorCSSId&, ExceptionCode&);
     CSSStyleRule* ruleForId(const InspectorCSSId&) const;
     PassRefPtr<InspectorObject> buildObjectForStyleSheet();
     PassRefPtr<InspectorObject> buildObjectForStyleSheetInfo();
     PassRefPtr<InspectorObject> buildObjectForRule(CSSStyleRule*);
     PassRefPtr<InspectorObject> buildObjectForStyle(CSSStyleDeclaration*);
-    bool setPropertyText(ErrorString*, const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite, String* oldPropertyText);
-    bool toggleProperty(ErrorString*, const InspectorCSSId&, unsigned propertyIndex, bool disable);
+    bool setPropertyText(const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite, String* oldPropertyText, ExceptionCode&);
+    bool toggleProperty(const InspectorCSSId&, unsigned propertyIndex, bool disable, ExceptionCode&);
 
     virtual bool getText(String* result) const;
     virtual CSSStyleDeclaration* styleForId(const InspectorCSSId&) const;
+    void fireStyleSheetChanged();
+
+    InspectorCSSId ruleId(CSSStyleRule*) const;
+    InspectorCSSId styleId(CSSStyleDeclaration* style) const { return ruleOrStyleId(style); }
 
 protected:
-    InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL);
+    InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener*);
 
     bool canBind() const { return m_origin != "userAgent" && m_origin != "user"; }
     InspectorCSSId ruleOrStyleId(CSSStyleDeclaration* style) const;
@@ -197,14 +212,14 @@ protected:
     virtual bool setStyleText(CSSStyleDeclaration*, const String&);
 
 private:
+    friend class InspectorStyle;
+
     static void fixUnparsedPropertyRanges(CSSRuleSourceData* ruleData, const String& styleSheetText);
     static void collectFlatRules(PassRefPtr<CSSRuleList>, Vector<CSSStyleRule*>* result);
     bool ensureText() const;
     bool ensureSourceData();
     void ensureFlatRules() const;
     bool styleSheetTextWithChangedStyle(CSSStyleDeclaration*, const String& newStyleText, String* result);
-    InspectorCSSId ruleId(CSSStyleRule* rule) const;
-    InspectorCSSId styleId(CSSStyleDeclaration* style) const { return ruleOrStyleId(style); }
     void revalidateStyle(CSSStyleDeclaration*);
     bool originalStyleSheetText(String* result) const;
     bool resourceStyleSheetText(String* result) const;
@@ -219,20 +234,19 @@ private:
     ParsedStyleSheet* m_parsedStyleSheet;
     InspectorStyleMap m_inspectorStyles;
     mutable Vector<CSSStyleRule*> m_flatRules;
-
-    friend class InspectorStyle;
+    Listener* m_listener;
 };
 
 class InspectorStyleSheetForInlineStyle : public InspectorStyleSheet {
 public:
-    static PassRefPtr<InspectorStyleSheetForInlineStyle> create(const String& id, PassRefPtr<Element> element, const String& origin);
+    static PassRefPtr<InspectorStyleSheetForInlineStyle> create(const String& id, PassRefPtr<Element>, const String& origin, Listener*);
 
     void didModifyElementAttribute();
     virtual bool getText(String* result) const;
     virtual CSSStyleDeclaration* styleForId(const InspectorCSSId& id) const { ASSERT_UNUSED(id, !id.ordinal()); return inlineStyle(); }
 
 protected:
-    InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element> element, const String& origin);
+    InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element>, const String& origin, Listener*);
 
     virtual Document* ownerDocument() const;
     virtual RefPtr<CSSRuleSourceData> ruleSourceDataFor(CSSStyleDeclaration* style) const { ASSERT_UNUSED(style, style == inlineStyle()); return m_ruleSourceData; }
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index d23c1ea21..ed7d143d5 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -35,8 +35,8 @@
 
 #include "Event.h"
 #include "IdentifiersFactory.h"
+#include "InspectorCounters.h"
 #include "InspectorFrontend.h"
-#include "InspectorMemoryAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
 #include "IntRect.h"
@@ -85,9 +85,9 @@ static const char XHRLoad[] = "XHRLoad";
 static const char FunctionCall[] = "FunctionCall";
 static const char GCEvent[] = "GCEvent";
 
-static const char RegisterAnimationFrameCallback[] = "RegisterAnimationFrameCallback";
-static const char CancelAnimationFrameCallback[] = "CancelAnimationFrameCallback";
-static const char FireAnimationFrameEvent[] = "FireAnimationFrameEvent";
+static const char RequestAnimationFrame[] = "RequestAnimationFrame";
+static const char CancelAnimationFrame[] = "CancelAnimationFrame";
+static const char FireAnimationFrame[] = "FireAnimationFrame";
 }
 
 void InspectorTimelineAgent::pushGCEventRecords()
@@ -177,7 +177,6 @@ void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scri
 
 void InspectorTimelineAgent::didCallFunction()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::FunctionCall);
 }
 
@@ -188,7 +187,6 @@ void InspectorTimelineAgent::willDispatchEvent(const Event& event)
 
 void InspectorTimelineAgent::didDispatchEvent()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::EventDispatch);
 }
 
@@ -232,7 +230,6 @@ void InspectorTimelineAgent::didWriteHTML(unsigned int endLine)
     if (!m_recordStack.isEmpty()) {
         TimelineRecordEntry entry = m_recordStack.last();
         entry.data->setNumber("endLine", endLine);
-        collectDomCounters();
         didCompleteCurrentRecord(TimelineRecordType::ParseHTML);
     }
 }
@@ -254,7 +251,6 @@ void InspectorTimelineAgent::willFireTimer(int timerId)
 
 void InspectorTimelineAgent::didFireTimer()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::TimerFire);
 }
 
@@ -285,7 +281,6 @@ void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumbe
     
 void InspectorTimelineAgent::didEvaluateScript()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::EvaluateScript);
 }
 
@@ -352,24 +347,24 @@ void InspectorTimelineAgent::didCommitLoad()
     clearRecordStack();
 }
 
-void InspectorTimelineAgent::didRegisterAnimationFrameCallback(int callbackId)
+void InspectorTimelineAgent::didRequestAnimationFrame(int callbackId)
 {
-    appendRecord(TimelineRecordFactory::createAnimationFrameCallbackData(callbackId), TimelineRecordType::RegisterAnimationFrameCallback, true);
+    appendRecord(TimelineRecordFactory::createAnimationFrameData(callbackId), TimelineRecordType::RequestAnimationFrame, true);
 }
 
-void InspectorTimelineAgent::didCancelAnimationFrameCallback(int callbackId)
+void InspectorTimelineAgent::didCancelAnimationFrame(int callbackId)
 {
-    appendRecord(TimelineRecordFactory::createAnimationFrameCallbackData(callbackId), TimelineRecordType::CancelAnimationFrameCallback, true);
+    appendRecord(TimelineRecordFactory::createAnimationFrameData(callbackId), TimelineRecordType::CancelAnimationFrame, true);
 }
 
-void InspectorTimelineAgent::willFireAnimationFrameEvent(int callbackId)
+void InspectorTimelineAgent::willFireAnimationFrame(int callbackId)
 {
-    pushCurrentRecord(TimelineRecordFactory::createAnimationFrameCallbackData(callbackId), TimelineRecordType::FireAnimationFrameEvent, false);
+    pushCurrentRecord(TimelineRecordFactory::createAnimationFrameData(callbackId), TimelineRecordType::FireAnimationFrame, false);
 }
 
-void InspectorTimelineAgent::didFireAnimationFrameEvent()
+void InspectorTimelineAgent::didFireAnimationFrame()
 {
-    didCompleteCurrentRecord(TimelineRecordType::FireAnimationFrameEvent);
+    didCompleteCurrentRecord(TimelineRecordType::FireAnimationFrame);
 }
 
 void InspectorTimelineAgent::addRecordToTimeline(PassRefPtr<InspectorObject> prpRecord, const String& type)
@@ -394,22 +389,13 @@ void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
     record->setNumber("usedHeapSize", usedHeapSize);
     record->setNumber("totalHeapSize", totalHeapSize);
 
-}
-
-void InspectorTimelineAgent::collectDomCounters()
-{
-    if (!m_state->getBoolean(TimelineAgentState::includeMemoryDetails))
-        return;
-    if (m_recordStack.isEmpty())
-        return;
-
-    String error;
-    RefPtr<InspectorArray> domGroups;
-    RefPtr<InspectorObject> strings;
-    m_memoryAgent->getDOMNodeCount(&error, domGroups, strings);
-
-    if (domGroups)
-        m_recordStack.last().record->setArray("domGroups", domGroups.release());
+    if (m_state->getBoolean(TimelineAgentState::includeMemoryDetails)) {
+        RefPtr<InspectorObject> counters = InspectorObject::create();
+        counters->setNumber("nodes", InspectorCounters::counterValue(InspectorCounters::NodeCounter));
+        counters->setNumber("documents", InspectorCounters::counterValue(InspectorCounters::DocumentCounter));
+        counters->setNumber("jsEventListeners", InspectorCounters::counterValue(InspectorCounters::JSEventListenerCounter));
+        record->setObject("counters", counters.release());
+    }
 }
 
 void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
@@ -428,12 +414,11 @@ void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
     }
 }
 
-InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorMemoryAgent* memoryAgent)
+InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state)
     : InspectorBaseAgent<InspectorTimelineAgent>("Timeline", instrumentingAgents, state)
     , m_frontend(0)
     , m_id(1)
     , m_maxCallStackDepth(5)
-    , m_memoryAgent(memoryAgent)
 {
 }
 
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index dc0b9e4f6..e8c34869a 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -45,7 +45,6 @@
 namespace WebCore {
 class Event;
 class InspectorFrontend;
-class InspectorMemoryAgent;
 class InspectorState;
 class InstrumentingAgents;
 class IntRect;
@@ -57,9 +56,9 @@ typedef String ErrorString;
 class InspectorTimelineAgent : public InspectorBaseAgent<InspectorTimelineAgent>, ScriptGCEventListener, public InspectorBackendDispatcher::TimelineCommandHandler {
     WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent);
 public:
-    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorMemoryAgent* memoryAgent)
+    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state)
     {
-        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state, memoryAgent));
+        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state));
     }
 
     ~InspectorTimelineAgent();
@@ -122,10 +121,10 @@ public:
     void willReceiveResourceData(unsigned long identifier);
     void didReceiveResourceData();
 
-    void didRegisterAnimationFrameCallback(int callbackId);
-    void didCancelAnimationFrameCallback(int callbackId);
-    void willFireAnimationFrameEvent(int callbackId);
-    void didFireAnimationFrameEvent();
+    void didRequestAnimationFrame(int callbackId);
+    void didCancelAnimationFrame(int callbackId);
+    void willFireAnimationFrame(int callbackId);
+    void didFireAnimationFrame();
 
     virtual void didGC(double, double, size_t);
 
@@ -141,11 +140,10 @@ private:
         String type;
     };
         
-    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*, InspectorMemoryAgent*);
+    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*);
 
     void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type, bool captureCallStack);
     void setHeapSizeStatistic(InspectorObject* record);
-    void collectDomCounters();
         
     void didCompleteCurrentRecord(const String& type);
     void appendRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack);
@@ -172,7 +170,6 @@ private:
     typedef Vector<GCEvent> GCEvents;
     GCEvents m_gcEvents;
     int m_maxCallStackDepth;
-    InspectorMemoryAgent* m_memoryAgent;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/NetworkResourcesData.cpp b/Source/WebCore/inspector/NetworkResourcesData.cpp
index 532dbaacf..bc519e670 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.cpp
+++ b/Source/WebCore/inspector/NetworkResourcesData.cpp
@@ -29,7 +29,6 @@
 #include "config.h"
 #include "NetworkResourcesData.h"
 
-#include "DOMImplementation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 
@@ -80,20 +79,6 @@ unsigned NetworkResourcesData::ResourceData::purgeContent()
     return result;
 }
 
-void NetworkResourcesData::ResourceData::createDecoder(const String& mimeType, const String& textEncodingName)
-{
-    if (!textEncodingName.isEmpty())
-        m_decoder = TextResourceDecoder::create("text/plain", textEncodingName);
-    else if (mimeType == "text/plain")
-        m_decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
-    else if (mimeType == "text/html")
-        m_decoder = TextResourceDecoder::create("text/html", "UTF-8");
-    else if (DOMImplementation::isXMLMIMEType(mimeType)) {
-        m_decoder = TextResourceDecoder::create("application/xml");
-        m_decoder->useLenientXMLDecoding();
-    }
-}
-
 int NetworkResourcesData::ResourceData::dataLength() const
 {
     return m_dataBuffer ? m_dataBuffer->size() : 0;
@@ -113,6 +98,7 @@ int NetworkResourcesData::ResourceData::decodeDataToContent()
     ASSERT(!hasContent());
     int dataLength = m_dataBuffer->size();
     m_content = m_decoder->decode(m_dataBuffer->data(), m_dataBuffer->size());
+    m_content += m_decoder->flush();
     m_dataBuffer = nullptr;
     return 2 * m_content.length() - dataLength;
 }
@@ -143,7 +129,7 @@ void NetworkResourcesData::responseReceived(const String& requestId, const Strin
         return;
     resourceData->setFrameId(frameId);
     resourceData->setUrl(response.url());
-    resourceData->createDecoder(response.mimeType(), response.textEncodingName());
+    resourceData->setDecoder(InspectorPageAgent::createDecoder(response.mimeType(), response.textEncodingName()));
 }
 
 void NetworkResourcesData::setResourceType(const String& requestId, InspectorPageAgent::ResourceType type)
diff --git a/Source/WebCore/inspector/NetworkResourcesData.h b/Source/WebCore/inspector/NetworkResourcesData.h
index 2148685b7..8edd49997 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.h
+++ b/Source/WebCore/inspector/NetworkResourcesData.h
@@ -31,6 +31,7 @@
 
 #include "CachedResourceHandle.h"
 #include "InspectorPageAgent.h"
+#include "TextResourceDecoder.h"
 
 #include <wtf/Deque.h>
 #include <wtf/HashMap.h>
@@ -75,8 +76,8 @@ public:
         String textEncodingName() const { return m_textEncodingName; }
         void setTextEncodingName(const String& textEncodingName) { m_textEncodingName = textEncodingName; }
 
-        TextResourceDecoder* decoder() const { return m_decoder.get(); }
-        void createDecoder(const String& mimeType, const String& textEncodingName);
+        PassRefPtr<TextResourceDecoder> decoder() const { return m_decoder; }
+        void setDecoder(PassRefPtr<TextResourceDecoder> decoder) { m_decoder = decoder; }
 
         PassRefPtr<SharedBuffer> buffer() const { return m_buffer; }
         void setBuffer(PassRefPtr<SharedBuffer> buffer) { m_buffer = buffer; }
diff --git a/Source/WebCore/inspector/PageConsoleAgent.cpp b/Source/WebCore/inspector/PageConsoleAgent.cpp
index eee4bfabf..fcd1f3d0b 100644
--- a/Source/WebCore/inspector/PageConsoleAgent.cpp
+++ b/Source/WebCore/inspector/PageConsoleAgent.cpp
@@ -39,6 +39,8 @@
 #include "InjectedScriptManager.h"
 #include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
+#include "Node.h"
+#include "ScriptObject.h"
 
 namespace WebCore {
 
@@ -61,12 +63,25 @@ void PageConsoleAgent::clearMessages(ErrorString* errorString)
     InspectorConsoleAgent::clearMessages(errorString);
 }
 
-void PageConsoleAgent::addInspectedNode(ErrorString*, int nodeId)
+class InspectableNode : public InjectedScriptHost::InspectableObject {
+public:
+    explicit InspectableNode(Node* node) : m_node(node) { }
+    virtual ScriptValue get(ScriptState* state)
+    {
+        return InjectedScriptHost::nodeAsScriptValue(state, m_node);
+    }
+private:
+    Node* m_node;
+};
+
+void PageConsoleAgent::addInspectedNode(ErrorString* errorString, int nodeId)
 {
     Node* node = m_inspectorDOMAgent->nodeForId(nodeId);
-    if (!node)
+    if (!node) {
+        *errorString = "nodeId is not valid";
         return;
-    m_injectedScriptManager->injectedScriptHost()->addInspectedNode(node);
+    }
+    m_injectedScriptManager->injectedScriptHost()->addInspectedObject(adoptPtr(new InspectableNode(node)));
 }
 
 bool PageConsoleAgent::developerExtrasEnabled()
@@ -74,7 +89,6 @@ bool PageConsoleAgent::developerExtrasEnabled()
     return m_inspectorAgent->developerExtrasEnabled();
 }
 
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/ScriptProfile.idl b/Source/WebCore/inspector/ScriptProfile.idl
index 00b62a313..ebbee2e8e 100644
--- a/Source/WebCore/inspector/ScriptProfile.idl
+++ b/Source/WebCore/inspector/ScriptProfile.idl
@@ -28,7 +28,8 @@ module core {
 
     interface [
         Conditional=JAVASCRIPT_DEBUGGER,
-        OmitConstructor
+        OmitConstructor,
+        V8CustomToJSObject
     ] ScriptProfile {
         readonly attribute DOMString title;
         readonly attribute unsigned long uid;
diff --git a/Source/WebCore/inspector/ScriptProfileNode.idl b/Source/WebCore/inspector/ScriptProfileNode.idl
index 93908b5f6..008d3b3b3 100644
--- a/Source/WebCore/inspector/ScriptProfileNode.idl
+++ b/Source/WebCore/inspector/ScriptProfileNode.idl
@@ -28,7 +28,8 @@ module core {
 
     interface [
         Conditional=JAVASCRIPT_DEBUGGER,
-        OmitConstructor
+        OmitConstructor,
+        V8CustomToJSObject
     ] ScriptProfileNode {
         readonly attribute DOMString functionName;
         readonly attribute DOMString url;
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.cpp b/Source/WebCore/inspector/TimelineRecordFactory.cpp
index 1ac171caf..df54529a0 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/Source/WebCore/inspector/TimelineRecordFactory.cpp
@@ -185,7 +185,7 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createParseHTMLData(unsigned
     return data.release();
 }
 
-PassRefPtr<InspectorObject> TimelineRecordFactory::createAnimationFrameCallbackData(int callbackId)
+PassRefPtr<InspectorObject> TimelineRecordFactory::createAnimationFrameData(int callbackId)
 {
     RefPtr<InspectorObject> data = InspectorObject::create();
     data->setNumber("id", callbackId);
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.h b/Source/WebCore/inspector/TimelineRecordFactory.h
index ed6080b4f..5d3e5aeba 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.h
+++ b/Source/WebCore/inspector/TimelineRecordFactory.h
@@ -79,7 +79,7 @@ namespace WebCore {
 
         static PassRefPtr<InspectorObject> createParseHTMLData(unsigned int length, unsigned int startLine);
 
-        static PassRefPtr<InspectorObject> createAnimationFrameCallbackData(int callbackId);
+        static PassRefPtr<InspectorObject> createAnimationFrameData(int callbackId);
 
     private:
         TimelineRecordFactory() { }
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
index 31fdf49bf..e4fbf016a 100644
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
@@ -34,9 +34,49 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
 #include "ScriptDebugServer.h"
 #include "WorkerContext.h"
+#include "WorkerThread.h"
+#include <wtf/MessageQueue.h>
 
 namespace WebCore {
 
+namespace {
+
+Mutex& workerDebuggerAgentsMutex()
+{
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    return mutex;
+}
+
+typedef HashMap<WorkerThread*, WorkerDebuggerAgent*> WorkerDebuggerAgents;
+
+WorkerDebuggerAgents& workerDebuggerAgents()
+{
+    DEFINE_STATIC_LOCAL(WorkerDebuggerAgents, agents, ());
+    return agents;
+}
+
+
+class RunInspectorCommandsTask : public ScriptDebugServer::Task {
+public:
+    RunInspectorCommandsTask(WorkerThread* thread, WorkerContext* workerContext)
+        : m_thread(thread)
+        , m_workerContext(workerContext) { }
+    virtual ~RunInspectorCommandsTask() { }
+    virtual void run()
+    {
+        // Process all queued debugger commands. It is safe to use m_workerContext here
+        // because it is alive if RunWorkerLoop is not terminated, otherwise it will
+        // just be ignored.
+        while (MessageQueueMessageReceived == m_thread->runLoop().runInMode(m_workerContext, WorkerDebuggerAgent::debuggerTaskMode, WorkerRunLoop::DontWaitForMessage)) { }
+    }
+
+private:
+    RefPtr<WorkerThread> m_thread;
+    WorkerContext* m_workerContext;
+};
+
+} // namespace
+
 const char* WorkerDebuggerAgent::debuggerTaskMode = "debugger";
 
 PassOwnPtr<WorkerDebuggerAgent> WorkerDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
@@ -46,22 +86,36 @@ PassOwnPtr<WorkerDebuggerAgent> WorkerDebuggerAgent::create(InstrumentingAgents*
 
 WorkerDebuggerAgent::WorkerDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
     : InspectorDebuggerAgent(instrumentingAgents, inspectorState, injectedScriptManager)
+    , m_scriptDebugServer(inspectedWorkerContext)
     , m_inspectedWorkerContext(inspectedWorkerContext)
 {
+    MutexLocker lock(workerDebuggerAgentsMutex());
+    workerDebuggerAgents().set(inspectedWorkerContext->thread(), this);
 }
 
 WorkerDebuggerAgent::~WorkerDebuggerAgent()
 {
+    MutexLocker lock(workerDebuggerAgentsMutex());
+    ASSERT(workerDebuggerAgents().contains(m_inspectedWorkerContext->thread()));
+    workerDebuggerAgents().remove(m_inspectedWorkerContext->thread());
+}
+
+void WorkerDebuggerAgent::interruptAndDispatchInspectorCommands(WorkerThread* thread)
+{
+    MutexLocker lock(workerDebuggerAgentsMutex());
+    WorkerDebuggerAgent* agent = workerDebuggerAgents().get(thread);
+    if (agent)
+        agent->m_scriptDebugServer.interruptAndRunTask(adoptPtr(new RunInspectorCommandsTask(thread, agent->m_inspectedWorkerContext)));
 }
 
 void WorkerDebuggerAgent::startListeningScriptDebugServer()
 {
-    scriptDebugServer().addListener(this, m_inspectedWorkerContext);
+    scriptDebugServer().addListener(this);
 }
 
 void WorkerDebuggerAgent::stopListeningScriptDebugServer()
 {
-    scriptDebugServer().removeListener(this, m_inspectedWorkerContext);
+    scriptDebugServer().removeListener(this);
 }
 
 WorkerScriptDebugServer& WorkerDebuggerAgent::scriptDebugServer()
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.h b/Source/WebCore/inspector/WorkerDebuggerAgent.h
index 9e25867e6..8017ac038 100644
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.h
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.h
@@ -38,6 +38,7 @@
 namespace WebCore {
 
 class WorkerContext;
+class WorkerThread;
 
 class WorkerDebuggerAgent : public InspectorDebuggerAgent {
     WTF_MAKE_NONCOPYABLE(WorkerDebuggerAgent);
@@ -47,6 +48,7 @@ public:
     virtual ~WorkerDebuggerAgent();
 
     static const char* debuggerTaskMode;
+    static void interruptAndDispatchInspectorCommands(WorkerThread*);
 
 private:
     WorkerDebuggerAgent(InstrumentingAgents*, InspectorState*, WorkerContext*, InjectedScriptManager*);
diff --git a/Source/WebCore/inspector/compile-front-end.sh b/Source/WebCore/inspector/compile-front-end.sh
index 8d45ff94d..17ed1039d 100755
--- a/Source/WebCore/inspector/compile-front-end.sh
+++ b/Source/WebCore/inspector/compile-front-end.sh
@@ -76,7 +76,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/ResourceUtils.js \
         --js Source/WebCore/inspector/front-end/NetworkManager.js \
         --js Source/WebCore/inspector/front-end/UISourceCode.js \
-    --module jsmodule_ui:34:jsmodule_common \
+    --module jsmodule_ui:36:jsmodule_common \
         --js Source/WebCore/inspector/front-end/AdvancedSearchController.js \
         --js Source/WebCore/inspector/front-end/Checkbox.js \
         --js Source/WebCore/inspector/front-end/ContextMenu.js \
@@ -99,8 +99,10 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/SidebarTreeElement.js \
         --js Source/WebCore/inspector/front-end/ShortcutsScreen.js \
         --js Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js \
+        --js Source/WebCore/inspector/front-end/SidebarOverlay.js \
         --js Source/WebCore/inspector/front-end/SoftContextMenu.js \
         --js Source/WebCore/inspector/front-end/SourceTokenizer.js \
+        --js Source/WebCore/inspector/front-end/Spectrum.js \
         --js Source/WebCore/inspector/front-end/SplitView.js \
         --js Source/WebCore/inspector/front-end/StatusBarButton.js \
         --js Source/WebCore/inspector/front-end/TabbedPane.js \
@@ -145,12 +147,13 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/ResourceTimingView.js \
         --js Source/WebCore/inspector/front-end/ResourceView.js \
         --js Source/WebCore/inspector/front-end/NetworkPanel.js \
-    --module jsmodule_resources:6:jsmodule_components \
+    --module jsmodule_resources:7:jsmodule_components \
         --js Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js \
         --js Source/WebCore/inspector/front-end/CookieItemsView.js \
         --js Source/WebCore/inspector/front-end/DatabaseQueryView.js \
         --js Source/WebCore/inspector/front-end/DatabaseTableView.js \
         --js Source/WebCore/inspector/front-end/DOMStorageItemsView.js \
+        --js Source/WebCore/inspector/front-end/IndexedDBViews.js \
         --js Source/WebCore/inspector/front-end/ResourcesPanel.js \
     --module jsmodule_scripts:10:jsmodule_components \
         --js Source/WebCore/inspector/front-end/CallStackSidebarPane.js \
diff --git a/Source/WebCore/inspector/front-end/AuditCategories.js b/Source/WebCore/inspector/front-end/AuditCategories.js
index ac9e51835..b32b418d0 100644
--- a/Source/WebCore/inspector/front-end/AuditCategories.js
+++ b/Source/WebCore/inspector/front-end/AuditCategories.js
@@ -44,6 +44,7 @@ WebInspector.AuditCategories.PagePerformance.prototype = {
         this.addRule(new WebInspector.AuditRules.UnusedCssRule(), WebInspector.AuditRule.Severity.Warning);
         this.addRule(new WebInspector.AuditRules.CssInHeadRule(), WebInspector.AuditRule.Severity.Severe);
         this.addRule(new WebInspector.AuditRules.StylesScriptsOrderRule(), WebInspector.AuditRule.Severity.Severe);
+        this.addRule(new WebInspector.AuditRules.VendorPrefixedCSSProperties(), WebInspector.AuditRule.Severity.Warning);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index 8430ffa1e..1a0dd9839 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -974,6 +974,167 @@ WebInspector.AuditRules.StylesScriptsOrderRule.prototype.__proto__ = WebInspecto
  * @constructor
  * @extends {WebInspector.AuditRule}
  */
+WebInspector.AuditRules.CSSRuleBase = function(id, name)
+{
+    WebInspector.AuditRule.call(this, id, name);
+}
+
+WebInspector.AuditRules.CSSRuleBase.prototype = {
+    doRun: function(resources, result, callback, progressMonitor)
+    {
+        CSSAgent.getAllStyleSheets(sheetsCallback.bind(this));
+
+        function sheetsCallback(error, headers)
+        {
+            if (error)
+                return callback(null);
+
+            for (var i = 0; i < headers.length; ++i) {
+                var header = headers[i];
+                if (header.disabled)
+                    continue; // Do not check disabled stylesheets.
+
+                this._visitStyleSheet(header.styleSheetId, i === headers.length - 1 ? finishedCallback : null, result, progressMonitor);
+            }
+        }
+
+        function finishedCallback()
+        {
+            callback(result);
+        }
+    },
+
+    _visitStyleSheet: function(styleSheetId, callback, result, progressMonitor)
+    {
+        WebInspector.CSSStyleSheet.createForId(styleSheetId, sheetCallback.bind(this));
+
+        function sheetCallback(styleSheet)
+        {
+            if (progressMonitor.canceled)
+                return;
+
+            if (!styleSheet) {
+                if (callback)
+                    callback();
+                return;
+            }
+
+            this.visitStyleSheet(styleSheet, result);
+
+            for (var i = 0; i < styleSheet.rules.length; ++i)
+                this._visitRule(styleSheet, styleSheet.rules[i], result);
+
+            this.didVisitStyleSheet(styleSheet, result);
+
+            if (callback)
+                callback();
+        }
+    },
+
+    _visitRule: function(styleSheet, rule, result)
+    {
+        this.visitRule(styleSheet, rule, result);
+        var allProperties = rule.style.allProperties;
+        for (var i = 0; i < allProperties.length; ++i)
+            this.visitProperty(styleSheet, allProperties[i], result);
+        this.didVisitRule(styleSheet, rule, result);
+    },
+
+    visitStyleSheet: function(styleSheet, result)
+    {
+        // Subclasses can implement.
+    },
+
+    didVisitStyleSheet: function(styleSheet, result)
+    {
+        // Subclasses can implement.
+    },
+    
+    visitRule: function(styleSheet, rule, result)
+    {
+        // Subclasses can implement.
+    },
+
+    didVisitRule: function(styleSheet, rule, result)
+    {
+        // Subclasses can implement.
+    },
+    
+    visitProperty: function(styleSheet, property, result)
+    {
+        // Subclasses can implement.
+    }
+}
+
+WebInspector.AuditRules.CSSRuleBase.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.AuditRules.CSSRuleBase}
+ */
+WebInspector.AuditRules.VendorPrefixedCSSProperties = function()
+{
+    WebInspector.AuditRules.CSSRuleBase.call(this, "page-vendorprefixedcss", "Use normal CSS property names instead of vendor-prefixed ones");
+    this._webkitPrefix = "-webkit-";
+}
+
+WebInspector.AuditRules.VendorPrefixedCSSProperties.supportedProperties = [
+    "background-clip", "background-origin", "background-size",
+    "border-radius", "border-bottom-left-radius", "border-bottom-right-radius", "border-top-left-radius", "border-top-right-radius",
+    "box-shadow", "box-sizing", "opacity", "text-shadow"
+].keySet();
+
+WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype = {
+    didVisitStyleSheet: function(styleSheet)
+    {
+        delete this._styleSheetResult;
+    },
+
+    visitRule: function(rule)
+    {
+        this._mentionedProperties = {};
+    },
+
+    didVisitRule: function()
+    {
+        delete this._ruleResult;
+        delete this._mentionedProperties;
+    },
+
+    visitProperty: function(styleSheet, property, result)
+    {
+        if (property.name.indexOf(this._webkitPrefix) !== 0)
+            return;
+
+        var normalPropertyName = property.name.substring(this._webkitPrefix.length).toLowerCase(); // Start just after the "-webkit-" prefix.
+        if (WebInspector.AuditRules.VendorPrefixedCSSProperties.supportedProperties[normalPropertyName] && !this._mentionedProperties[normalPropertyName]) {
+            var style = property.ownerStyle;
+            var liveProperty = style.getLiveProperty(normalPropertyName);
+            if (liveProperty && !liveProperty.styleBased)
+                return; // WebCore can provide normal versions of prefixed properties automatically, so be careful to skip only normal source-based properties.
+
+            var rule = style.parentRule;
+            this._mentionedProperties[normalPropertyName] = true;
+            if (!this._styleSheetResult)
+                this._styleSheetResult = result.addChild(rule.sourceURL ? WebInspector.linkifyResourceAsNode(rule.sourceURL) : "<unknown>");
+            if (!this._ruleResult) {
+                var anchor = WebInspector.linkifyURLAsNode(rule.sourceURL, rule.selectorText);
+                anchor.preferredPanel = "resources";
+                anchor.lineNumber = rule.sourceLine;
+                this._ruleResult = this._styleSheetResult.addChild(anchor);
+            }
+            ++result.violationCount;
+            this._ruleResult.addSnippet(String.sprintf("\"" + this._webkitPrefix + "%s\" is used, but \"%s\" is supported.", normalPropertyName, normalPropertyName));
+        }
+    }
+}
+
+WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.__proto__ = WebInspector.AuditRules.CSSRuleBase.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.AuditRule}
+ */
 WebInspector.AuditRules.CookieRuleBase = function(id, name)
 {
     WebInspector.AuditRule.call(this, id, name);
diff --git a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 3bcf8f5cc..af489e64f 100644
--- a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -461,16 +461,17 @@ WebInspector.EventListenerBreakpointsSidebarPane = function()
     this.bodyElement.appendChild(this.categoriesElement);
 
     this._breakpointItems = {};
-    this._createCategory(WebInspector.UIString("Keyboard"), true, ["keydown", "keyup", "keypress", "textInput"]);
-    this._createCategory(WebInspector.UIString("Mouse"), true, ["click", "dblclick", "mousedown", "mouseup", "mouseover", "mousemove", "mouseout", "mousewheel"]);
     // FIXME: uncomment following once inspector stops being drop targer in major ports.
     // Otherwise, inspector page reacts on drop event and tries to load the event data.
     // this._createCategory(WebInspector.UIString("Drag"), true, ["drag", "drop", "dragstart", "dragend", "dragenter", "dragleave", "dragover"]);
+    this._createCategory(WebInspector.UIString("Animation"), false, ["requestAnimationFrame", "cancelAnimationFrame", "animationFrameFired"]);
     this._createCategory(WebInspector.UIString("Control"), true, ["resize", "scroll", "zoom", "focus", "blur", "select", "change", "submit", "reset"]);
     this._createCategory(WebInspector.UIString("Clipboard"), true, ["copy", "cut", "paste", "beforecopy", "beforecut", "beforepaste"]);
-    this._createCategory(WebInspector.UIString("Load"), true, ["load", "unload", "abort", "error"]);
     this._createCategory(WebInspector.UIString("DOM Mutation"), true, ["DOMActivate", "DOMFocusIn", "DOMFocusOut", "DOMAttrModified", "DOMCharacterDataModified", "DOMNodeInserted", "DOMNodeInsertedIntoDocument", "DOMNodeRemoved", "DOMNodeRemovedFromDocument", "DOMSubtreeModified", "DOMContentLoaded"]);
     this._createCategory(WebInspector.UIString("Device"), true, ["deviceorientation", "devicemotion"]);
+    this._createCategory(WebInspector.UIString("Keyboard"), true, ["keydown", "keyup", "keypress", "textInput"]);
+    this._createCategory(WebInspector.UIString("Load"), true, ["load", "unload", "abort", "error"]);
+    this._createCategory(WebInspector.UIString("Mouse"), true, ["click", "dblclick", "mousedown", "mouseup", "mouseover", "mousemove", "mouseout", "mousewheel"]);
     this._createCategory(WebInspector.UIString("Timer"), false, ["setTimer", "clearTimer", "timerFired"]);
     this._createCategory(WebInspector.UIString("Touch"), true, ["touchstart", "touchmove", "touchend", "touchcancel"]);
 
@@ -486,7 +487,10 @@ WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI = function(event
         WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI = {
             "instrumentation:setTimer": WebInspector.UIString("Set Timer"),
             "instrumentation:clearTimer": WebInspector.UIString("Clear Timer"),
-            "instrumentation:timerFired": WebInspector.UIString("Timer Fired")
+            "instrumentation:timerFired": WebInspector.UIString("Timer Fired"),
+            "instrumentation:requestAnimationFrame": WebInspector.UIString("Request Animation Frame"),
+            "instrumentation:cancelAnimationFrame": WebInspector.UIString("Cancel Animation Frame"),
+            "instrumentation:animationFrameFired": WebInspector.UIString("Animation Frame Fired")
         };
     }
     return WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI[eventName] || eventName.substring(eventName.indexOf(":") + 1);
diff --git a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
index 52ab70e87..b2b934d8d 100644
--- a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
+++ b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
@@ -86,9 +86,9 @@ WebInspector.CSSKeywordCompletions._colors = [
 
 WebInspector.CSSKeywordCompletions._colorAwareProperties = [
     "background", "background-color", "background-image", "border", "border-color", "border-top", "border-right", "border-bottom",
-    "border-left", "border-top-color", "border-right-color", "border-bottom-color", "border-left-color", "color",
+    "border-left", "border-top-color", "border-right-color", "border-bottom-color", "border-left-color", "box-shadow", "color",
     "outline", "outline-color", "text-line-through", "text-line-through-color", "text-overline", "text-overline-color",
-    "text-shadow", "text-underline", "text-underline-color", "-webkit-text-emphasis", "-webkit-text-emphasis-color"
+    "text-shadow", "text-underline", "text-underline-color", "-webkit-box-shadow", "-webkit-text-emphasis", "-webkit-text-emphasis-color"
 ].keySet();
 
 WebInspector.CSSKeywordCompletions._propertyKeywordMap = {
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 50686bac4..ecdbfd308 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -34,6 +34,9 @@
  */
 WebInspector.CSSStyleModel = function()
 {
+    this._pendingCommandsMajorState = [];
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.UndoRedoRequested, this._undoRedoRequested, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.UndoRedoCompleted, this._undoRedoCompleted, this);
     new WebInspector.CSSStyleModelResourceBinding(this);
     InspectorBackend.registerCSSDispatcher(new WebInspector.CSSDispatcher(this));
     CSSAgent.enable();
@@ -172,7 +175,6 @@ WebInspector.CSSStyleModel.prototype = {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
-            this._fireStyleSheetChanged(rule.id.styleSheetId, true);
         }
 
         /**
@@ -185,9 +187,11 @@ WebInspector.CSSStyleModel.prototype = {
          */
         function callback(nodeId, successCallback, failureCallback, newSelector, error, rulePayload)
         {
+            this._pendingCommandsMajorState.pop();
             if (error)
                 failureCallback();
             else {
+                WebInspector.domAgent.markUndoableState();
                 var ownerDocumentId = this._ownerDocumentId(nodeId);
                 if (ownerDocumentId)
                     WebInspector.domAgent.querySelectorAll(ownerDocumentId, newSelector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
@@ -196,6 +200,7 @@ WebInspector.CSSStyleModel.prototype = {
             }
         }
 
+        this._pendingCommandsMajorState.push(true);
         CSSAgent.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback, newSelector));
     },
 
@@ -215,7 +220,6 @@ WebInspector.CSSStyleModel.prototype = {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
-            this._fireStyleSheetChanged(rule.id.styleSheetId, true);
         }
 
         /**
@@ -227,10 +231,12 @@ WebInspector.CSSStyleModel.prototype = {
          */
         function callback(successCallback, failureCallback, selector, error, rulePayload)
         {
+            this._pendingCommandsMajorState.pop();
             if (error) {
                 // Invalid syntax for a selector
                 failureCallback();
             } else {
+                WebInspector.domAgent.markUndoableState();
                 var ownerDocumentId = this._ownerDocumentId(nodeId);
                 if (ownerDocumentId)
                     WebInspector.domAgent.querySelectorAll(ownerDocumentId, selector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
@@ -239,6 +245,7 @@ WebInspector.CSSStyleModel.prototype = {
             }
         }
 
+        this._pendingCommandsMajorState.push(true);
         CSSAgent.addRule(nodeId, selector, callback.bind(this, successCallback, failureCallback, selector));
     },
 
@@ -255,36 +262,48 @@ WebInspector.CSSStyleModel.prototype = {
         return node.ownerDocument ? node.ownerDocument.id : null;
     },
 
-    /**
-     * @param {function()=} callback
-     */
-    _fireStyleSheetChanged: function(styleSheetId, majorChange, callback)
+    _fireStyleSheetChanged: function(styleSheetId)
     {
-        callback = callback || function() {};
+        if (!this._pendingCommandsMajorState.length)
+            return;
 
-        if (!majorChange || !styleSheetId || !this.hasEventListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged)) {
-            callback();
+        var majorChange = this._pendingCommandsMajorState[this._pendingCommandsMajorState.length - 1];
+        
+        if (!majorChange || !styleSheetId || !this.hasEventListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged))
             return;
-        }
 
-        function mycallback(error, content)
+        function callback(error, content)
         {
             if (!error)
                 this.dispatchEventToListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged, { styleSheetId: styleSheetId, content: content, majorChange: majorChange });
-            callback();
         }
 
-        CSSAgent.getStyleSheetText(styleSheetId, mycallback.bind(this));
+        CSSAgent.getStyleSheetText(styleSheetId, callback.bind(this));
     },
 
     setStyleSheetText: function(styleSheetId, newText, majorChange, userCallback)
     {
         function callback(error)
         {
-             if (!error)
-                 this._fireStyleSheetChanged(styleSheetId, majorChange, userCallback ? userCallback.bind(this, error) : null);
+            this._pendingCommandsMajorState.pop();
+            if (!error && majorChange)
+                WebInspector.domAgent.markUndoableState();
+            
+            if (!error && userCallback)
+                userCallback(error);
         }
+        this._pendingCommandsMajorState.push(majorChange);
         CSSAgent.setStyleSheetText(styleSheetId, newText, callback.bind(this));
+    },
+
+    _undoRedoRequested: function()
+    {
+        this._pendingCommandsMajorState.push(true);
+    },
+
+    _undoRedoCompleted: function()
+    {
+        this._pendingCommandsMajorState.pop();
     }
 }
 
@@ -468,6 +487,7 @@ WebInspector.CSSStyleDeclaration.prototype = {
     {
         function callback(userCallback, error, payload)
         {
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
             if (!userCallback)
                 return;
 
@@ -476,10 +496,10 @@ WebInspector.CSSStyleDeclaration.prototype = {
                 userCallback(null);
             } else {
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(payload));
-                WebInspector.cssModel._fireStyleSheetChanged(this.id.styleSheetId, true);
             }
         }
 
+        WebInspector.cssModel._pendingCommandsMajorState.push(true);
         CSSAgent.setPropertyText(this.id, index, name + ": " + value + ";", false, callback.bind(this, userCallback));
     },
 
@@ -604,15 +624,16 @@ WebInspector.CSSProperty.prototype = {
     {
         function enabledCallback(style)
         {
-            if (style)
-                WebInspector.cssModel._fireStyleSheetChanged(style.id.styleSheetId, majorChange, userCallback ? userCallback.bind(null, style) : null);
-            else if (userCallback)
+            if (userCallback)
                 userCallback(style);
         }
 
         function callback(error, stylePayload)
         {
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
             if (!error) {
+                if (majorChange)
+                    WebInspector.domAgent.markUndoableState();
                 this.text = propertyText;
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 var newProperty = style.allProperties[this.index];
@@ -622,7 +643,8 @@ WebInspector.CSSProperty.prototype = {
                     return;
                 }
 
-                WebInspector.cssModel._fireStyleSheetChanged(style.id.styleSheetId, majorChange, userCallback ? userCallback.bind(null, style) : null);
+                if (userCallback)
+                    userCallback(style);
             } else {
                 if (userCallback)
                     userCallback(null);
@@ -633,9 +655,8 @@ WebInspector.CSSProperty.prototype = {
             throw "No ownerStyle for property";
 
         // An index past all the properties adds a new property to the style.
+        WebInspector.cssModel._pendingCommandsMajorState.push(majorChange);
         CSSAgent.setPropertyText(this.ownerStyle.id, this.index, propertyText, this.index < this.ownerStyle.pastLastSourcePropertyIndex(), callback.bind(this));
-        if (majorChange)
-            DOMAgent.markUndoableState();
     },
 
     setValue: function(newValue, majorChange, userCallback)
@@ -653,18 +674,20 @@ WebInspector.CSSProperty.prototype = {
 
         function callback(error, stylePayload)
         {
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
             if (error) {
                 if (userCallback)
                     userCallback(null);
                 return;
             }
+            WebInspector.domAgent.markUndoableState();
             if (userCallback) {
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 userCallback(style);
             }
-            WebInspector.cssModel._fireStyleSheetChanged(this.ownerStyle.id.styleSheetId, false);
         }
 
+        WebInspector.cssModel._pendingCommandsMajorState.push(false);
         CSSAgent.toggleProperty(this.ownerStyle.id, this.index, disabled, callback.bind(this));
     }
 }
@@ -741,12 +764,15 @@ WebInspector.CSSStyleSheet.prototype = {
     {
         function callback(error)
         {
-             if (userCallback)
-                 userCallback(error);
-             if (!error)
-                 WebInspector.cssModel._fireStyleSheetChanged(this.id, majorChange);
+            if (!error)
+                WebInspector.domAgent.markUndoableState();
+
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
+            if (userCallback)
+                userCallback(error);
         }
 
+        WebInspector.cssModel._pendingCommandsMajorState.push(majorChange);
         CSSAgent.setStyleSheetText(this.id, newText, callback.bind(this));
     }
 }
@@ -864,6 +890,11 @@ WebInspector.CSSDispatcher.prototype = {
     mediaQueryResultChanged: function()
     {
         this._cssModel.mediaQueryResultChanged();
+    },
+
+    styleSheetChanged: function(styleSheetId)
+    {
+        this._cssModel._fireStyleSheetChanged(styleSheetId);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index 6dd59cc92..b2b388637 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -126,7 +126,7 @@ WebInspector.CallStackSidebarPane.prototype = {
     {
         var text = "";
         for (var i = 0; i < this.placards.length; ++i)
-            text += this.placards[i]._text + "\n";
+            text += this.placards[i].title + " (" + this.placards[i].subtitle + ")\n";
         InspectorFrontendHost.copyText(text);
     },
 
diff --git a/Source/WebCore/inspector/front-end/ConsoleMessage.js b/Source/WebCore/inspector/front-end/ConsoleMessage.js
index 82efcde03..f2a74efa8 100644
--- a/Source/WebCore/inspector/front-end/ConsoleMessage.js
+++ b/Source/WebCore/inspector/front-end/ConsoleMessage.js
@@ -310,22 +310,44 @@ WebInspector.ConsoleMessageImpl.prototype = {
             return;
 
         var elements = [];
+        var length = 0;
         for (var i = 0; i < properties.length; ++i) {
-            var name = properties[i].name;
+            var property = properties[i];
+            var name = property.name;
+            if (name === "length")
+                length = parseInt(property.value.description, 10);
             if (name == parseInt(name, 10))
-                elements[name] = this._formatAsArrayEntry(properties[i].value);
+                elements[name] = this._formatAsArrayEntry(property.value);
         }
 
         elem.appendChild(document.createTextNode("["));
-        for (var i = 0; i < elements.length; ++i) {
+        var lastNonEmptyIndex = -1;
+
+        function appendUndefined(elem, index)
+        {
+            if (index - lastNonEmptyIndex <= 1)
+                return;
+            var span = elem.createChild(span, "console-formatted-undefined");
+            span.textContent = WebInspector.UIString("undefined × %d", index - lastNonEmptyIndex - 1);
+        }
+
+        for (var i = 0; i < length; ++i) {
             var element = elements[i];
-            if (element)
-                elem.appendChild(element);
-            else
-                elem.appendChild(document.createTextNode("undefined"))
-            if (i < elements.length - 1)
+            if (!element)
+                continue;
+
+            if (i - lastNonEmptyIndex > 1) {
+                appendUndefined(elem, i);
                 elem.appendChild(document.createTextNode(", "));
-        }
+            }
+
+            elem.appendChild(element);
+            lastNonEmptyIndex = i;
+            if (i < length - 1)
+                elem.appendChild(document.createTextNode(", "));
+        }       
+        appendUndefined(elem, length);
+
         elem.appendChild(document.createTextNode("]"));
     },
 
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index c17f20394..2ef016943 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -660,9 +660,6 @@ WebInspector.DOMAgent = function() {
     this._document = null;
     this._attributeLoadNodeIds = {};
     InspectorBackend.registerDOMDispatcher(new WebInspector.DOMDispatcher(this));
-    if (WebInspector.experimentsSettings.freeFlowDOMEditing.isEnabled())
-        new WebInspector.DOMModelResourceBinding(this);
-
     if (WebInspector.settings.emulateTouchEvents.get())
         this._emulateTouchEventsChanged();
     WebInspector.settings.emulateTouchEvents.addChangeListener(this._emulateTouchEventsChanged, this);
@@ -677,7 +674,9 @@ WebInspector.DOMAgent.Events = {
     DocumentUpdated: "DocumentUpdated",
     ChildNodeCountUpdated: "ChildNodeCountUpdated",
     InspectElementRequested: "InspectElementRequested",
-    StyleInvalidated: "StyleInvalidated"
+    StyleInvalidated: "StyleInvalidated",
+    UndoRedoRequested: "UndoRedoRequested",
+    UndoRedoCompleted: "UndoRedoCompleted"
 }
 
 WebInspector.DOMAgent.prototype = {
@@ -1115,50 +1114,53 @@ WebInspector.DOMAgent.prototype = {
     {
         function wrapperFunction(error)
         {
+            if (!error)
+                this.markUndoableState();
+
             if (callback)
                 callback.apply(this, arguments);
-            if (error || !WebInspector.experimentsSettings.freeFlowDOMEditing.isEnabled())
-                return;
-            if (this._captureDOMTimer)
-               clearTimeout(this._captureDOMTimer);
-            this._captureDOMTimer = setTimeout(this._captureDOM.bind(this, node), 500);
         }
         return wrapperFunction.bind(this);
     },
 
+    _emulateTouchEventsChanged: function()
+    {
+        DOMAgent.setTouchEmulationEnabled(WebInspector.settings.emulateTouchEvents.get());
+    },
+
+    markUndoableState: function()
+    {
+        DOMAgent.markUndoableState();
+    },
+
     /**
-     * @param {WebInspector.DOMNode} node
+     * @param {function(?Protocol.Error)=} callback
      */
-    _captureDOM: function(node)
+    undo: function(callback)
     {
-        delete this._captureDOMTimer;
-        if (!node.ownerDocument)
-            return;
-
-        function callback(error, text)
+        function mycallback(error)
         {
-            if (error) {
-                console.error(error);
-                return;
-            }
-
-            var url = node.ownerDocument.documentURL;
-            if (!url)
-                return;
-
-            var resource = WebInspector.resourceForURL(url);
-            if (!resource)
-                return;
-
-            resource.addRevision(text);
+            this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoCompleted);
+            callback(error);
         }
-        DOMAgent.getOuterHTML(node.ownerDocument.id, callback);
-        
+
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoRequested);
+        DOMAgent.undo(callback);
     },
 
-    _emulateTouchEventsChanged: function()
+    /**
+     * @param {function(?Protocol.Error)=} callback
+     */
+    redo: function(callback)
     {
-        DOMAgent.setTouchEmulationEnabled(WebInspector.settings.emulateTouchEvents.get());
+        function mycallback(error)
+        {
+            this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoCompleted);
+            callback(error);
+        }
+
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoRequested);
+        DOMAgent.redo(callback);
     }
 }
 
@@ -1258,39 +1260,3 @@ WebInspector.DOMDispatcher.prototype = {
  * @type {?WebInspector.DOMAgent}
  */
 WebInspector.domAgent = null;
-
-/**
- * @constructor
- * @implements {WebInspector.ResourceDomainModelBinding}
- */
-WebInspector.DOMModelResourceBinding = function(domAgent)
-{
-    this._domAgent = domAgent;
-    WebInspector.Resource.registerDomainModelBinding(WebInspector.Resource.Type.Document, this);
-}
-
-WebInspector.DOMModelResourceBinding.prototype = {
-    setContent: function(resource, content, majorChange, userCallback)
-    {
-        var frameId = resource.frameId;
-        if (!frameId)
-            return;
-
-        PageAgent.setDocumentContent(frameId, content, callbackWrapper);
-
-        function callbackWrapper(error)
-        {
-            if (majorChange)
-                resource.addRevision(content);
-            if (userCallback)
-                userCallback(error);
-        }
-    },
-
-    canSetContent: function()
-    {
-        return true;
-    }
-}
-
-WebInspector.DOMModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
diff --git a/Source/WebCore/inspector/front-end/DataGrid.js b/Source/WebCore/inspector/front-end/DataGrid.js
index 036cb4ffb..10379534d 100644
--- a/Source/WebCore/inspector/front-end/DataGrid.js
+++ b/Source/WebCore/inspector/front-end/DataGrid.js
@@ -711,6 +711,8 @@ WebInspector.DataGrid.prototype = {
 
         if (this.expanded)
             child._attach();
+        if (!this.revealed)
+            child.revealed = false;
     },
 
     removeChild: function(child)
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
index 8d83b137a..27b045758 100644
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
@@ -183,6 +183,8 @@ WebInspector.DebuggerPresentationModel.prototype = {
     {
         var result = [];
         for (var i = 0; i < this._rawSourceCodes.length; ++i) {
+            if (!this._rawSourceCodes[i].sourceMapping)
+                continue;
             var uiSourceCodeList = this._rawSourceCodes[i].sourceMapping.uiSourceCodeList();
             for (var j = 0; j < uiSourceCodeList.length; ++j)
                 result.push(uiSourceCodeList[j]);
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
index 66213163d..6e7efaca0 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
@@ -62,25 +62,27 @@ WebInspector.HeapSnapshotGridNode.prototype = {
 
     _toPercentString: function(num)
     {
-        return num.toFixed(2) + "%";
+        return num.toFixed(0) + "\u2009%"; // \u2009 is a thin space.
     },
 
     _createValueCell: function(columnIdentifier)
     {
         var cell = document.createElement("td");
         cell.className = columnIdentifier + "-column";
-        var div = document.createElement("div");
-        var valueSpan = document.createElement("span");
-        valueSpan.textContent = this.data[columnIdentifier];
-        var percentColumn = columnIdentifier + "-percent";
-        if (percentColumn in this.data) {
-            var percentSpan = document.createElement("span");
-            percentSpan.className = "percent-column";
-            percentSpan.textContent = this.data[percentColumn];
-            div.appendChild(percentSpan);
+        if (this.dataGrid.snapshot.totalSize !== 0) {
+            var div = document.createElement("div");
+            var valueSpan = document.createElement("span");
+            valueSpan.textContent = this.data[columnIdentifier];
+            div.appendChild(valueSpan);
+            var percentColumn = columnIdentifier + "-percent";
+            if (percentColumn in this.data) {
+                var percentSpan = document.createElement("span");
+                percentSpan.className = "percent-column";
+                percentSpan.textContent = this.data[percentColumn];
+                div.appendChild(percentSpan);
+            }
+            cell.appendChild(div);
         }
-        div.appendChild(valueSpan);
-        cell.appendChild(div);
         return cell;
     },
 
@@ -207,7 +209,7 @@ WebInspector.HeapSnapshotGenericObjectNode = function(tree, node)
     this.snapshotNodeIndex = node.nodeIndex;
     if (this._type === "string")
         this.hasHoverMessage = true;
-    else if (this._type === "object" && this.isDOMWindow(this._name)) {
+    else if (this._type === "object" && this.isWindow(this._name)) {
         this._name = this.shortenWindowURL(this._name, false);
         this.hasHoverMessage = true;
     } else if (node.flags & tree.snapshot.nodeFlags.canBeQueried)
@@ -300,10 +302,8 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
         var view = this.dataGrid.snapshotView;
         data["shallowSize"] = Number.withThousandsSeparator(this._shallowSize);
         data["retainedSize"] = Number.withThousandsSeparator(this._retainedSize);
-        if (view._showPercentage) {
-            data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
-            data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
-        }
+        data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
+        data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
 
         return this._enhanceData ? this._enhanceData(data) : data;
     },
@@ -343,9 +343,9 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
         this._provider.isEmpty(isEmptyCallback.bind(this));
     },
 
-    isDOMWindow: function(fullName)
+    isWindow: function(fullName)
     {
-        return fullName.substr(0, 9) === "DOMWindow";
+        return fullName.substr(0, 9) === "Window";
     },
 
     shortenWindowURL: function(fullName, hasObjectId)
@@ -381,16 +381,14 @@ WebInspector.HeapSnapshotObjectNode = function(tree, isFromBaseSnapshot, edge, p
 WebInspector.HeapSnapshotObjectNode.prototype = {
     updateHasChildren: function(parentGridNode)
     {
-        if (this.showRetainingEdges) {
-            this._parentGridNode = parentGridNode;
-            var ancestor = parentGridNode;
-            while (ancestor) {
-                if (ancestor.snapshotNodeId === this.snapshotNodeId) {
-                    this._cycledWithAncestorGridNode = ancestor;
-                    return;
-                }
-                ancestor = ancestor._parentGridNode;
+        this._parentGridNode = parentGridNode;
+        var ancestor = parentGridNode;
+        while (ancestor) {
+            if (ancestor.snapshotNodeId === this.snapshotNodeId) {
+                this._cycledWithAncestorGridNode = ancestor;
+                return;
             }
+            ancestor = ancestor._parentGridNode;
         }
         WebInspector.HeapSnapshotGenericObjectNode.prototype.updateHasChildren.call(this);
     },
@@ -470,7 +468,7 @@ WebInspector.HeapSnapshotObjectNode.prototype = {
 
     _prefixObjectCell: function(div, data)
     {
-        if (this.showRetainingEdges && this._cycledWithAncestorGridNode)
+        if (this._cycledWithAncestorGridNode)
             div.className += " cycled-ancessor-node";
 
         var nameSpan = document.createElement("span");
@@ -625,10 +623,9 @@ WebInspector.HeapSnapshotConstructorNode.prototype = {
         data["count"] =  Number.withThousandsSeparator(this._count);
         data["shallowSize"] = Number.withThousandsSeparator(this._shallowSize);
         data["retainedSize"] = Number.withThousandsSeparator(this._retainedSize);
-        if (view._showPercentage) {
-            data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
-            data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
-        }
+        data["count-percent"] =  this._toPercentString(this._countPercent);
+        data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
+        data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
         return data;
     },
 
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
index 7db87f962..d35b20350 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -84,7 +84,9 @@ WebInspector.HeapSnapshotSortableDataGrid.prototype = {
         children.sort(sortFunction);
         for (var i = 0, l = children.length; i < l; ++i) {
             var child = children[i];
+            var revealed = child.revealed;
             this.appendChild(child);
+            child.revealed = revealed;
             if (child.expanded)
                 child.sort();
         }
@@ -296,6 +298,16 @@ WebInspector.HeapSnapshotConstructorsDataGrid.prototype = {
 
         loader(profileIndex, firstSnapshotLoaded.bind(this));
     },
+
+    _nameFilterChanged: function(filterString)
+    {
+        var filter = filterString.toLowerCase();
+        for (var i = 0, l = this.children.length; i < l; ++i) {
+            var node = this.children[i];
+            if (node.depth === 0)
+                node.revealed = node._name.toLowerCase().indexOf(filter) !== -1;
+        }
+    }
 };
 
 WebInspector.HeapSnapshotConstructorsDataGrid.prototype.__proto__ = WebInspector.HeapSnapshotSortableDataGrid.prototype;
@@ -430,8 +442,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.parent.addEventListener("profile added", this._updateBaseOptions, this);
     this.parent.addEventListener("profile added", this._updateFilterOptions, this);
 
-    this._showPercentage = false;
-
     this.viewsContainer = document.createElement("div");
     this.viewsContainer.addStyleClass("views-container");
     this.element.appendChild(this.viewsContainer);
@@ -445,7 +455,18 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
 
     this.constructorsView = new WebInspector.View();
     this.constructorsView.element.addStyleClass("view");
+
+    this.constructorsViewToolbar = document.createElement("div");
+    this.constructorsViewToolbar.addStyleClass("constructors-view-toolbar");
+    this.constructorsViewFilter = document.createElement("input");
+    this.constructorsViewFilter.addStyleClass("constructors-view-filter");
+    this.constructorsViewFilter.setAttribute("placeholder", WebInspector.UIString("Class filter"));
+    this.constructorsViewFilter.addEventListener("keyup", this._changeNameFilter.bind(this), false);
+    this.constructorsViewToolbar.appendChild(this.constructorsViewFilter);
+    this.constructorsView.element.appendChild(this.constructorsViewToolbar);
+
     this.constructorsDataGrid = new WebInspector.HeapSnapshotConstructorsDataGrid();
+    this.constructorsDataGrid.element.addStyleClass("constructors-view-grid");
     this.constructorsDataGrid.element.addEventListener("mousedown", this._mouseDownInContentsGrid.bind(this), true);
     this.constructorsDataGrid.show(this.constructorsView.element);
     this.constructorsDataGrid.addEventListener(WebInspector.DataGrid.Events.SelectedNode, this._selectionChanged, this);
@@ -480,6 +501,7 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.retainmentDataGrid = new WebInspector.HeapSnapshotRetainmentDataGrid();
     this.retainmentDataGrid.element.addEventListener("click", this._mouseClickInRetainmentGrid.bind(this), true);
     this.retainmentDataGrid.show(this.retainmentView.element);
+    this.retainmentDataGrid.addEventListener(WebInspector.DataGrid.Events.SelectedNode, this._inspectedObjectChanged, this);
     this.retainmentView.show(this.element);
     this.retainmentDataGrid.reset();
 
@@ -514,8 +536,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.filterSelectElement.addEventListener("change", this._changeFilter.bind(this), false);
     this._updateFilterOptions();
 
-    this.percentButton = new WebInspector.StatusBarButton("", "percent-time-status-bar-item status-bar-item");
-    this.percentButton.addEventListener("click", this._percentClicked.bind(this), false);
     this.helpButton = new WebInspector.StatusBarButton("", "heapshot-help-status-bar-item status-bar-item");
     this.helpButton.addEventListener("click", this._helpClicked.bind(this), false);
 
@@ -539,7 +559,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
         else
             this.baseSelectElement.selectedIndex = profileIndex;
         this.dataGrid.setDataSource(this, this.profileWrapper);
-        this._updatePercentButton();
     }
 }
 
@@ -558,7 +577,7 @@ WebInspector.DetailedHeapshotView.prototype = {
 
     get statusBarItems()
     {
-        return [this.viewSelectElement, this.baseSelectElement, this.filterSelectElement, this.percentButton.element, this.helpButton.element];
+        return [this.viewSelectElement, this.baseSelectElement, this.filterSelectElement, this.helpButton.element];
     },
 
     get profile()
@@ -612,12 +631,6 @@ WebInspector.DetailedHeapshotView.prototype = {
         this._updateRetainmentViewHeight(height);
     },
 
-    refreshShowPercents: function()
-    {
-        this._updatePercentButton();
-        this.refreshVisibleData();
-    },
-
     searchCanceled: function()
     {
         if (this._searchResults) {
@@ -787,6 +800,11 @@ WebInspector.DetailedHeapshotView.prototype = {
         this.performSearch(this.currentQuery, this._searchFinishedCallback);
     },
 
+    _changeNameFilter: function()
+    {
+        this.dataGrid._nameFilterChanged(this.constructorsViewFilter.value);
+    },
+
     _profiles: function()
     {
         return WebInspector.panels.profiles.getProfiles(WebInspector.DetailedHeapshotProfileType.TypeId);
@@ -824,6 +842,14 @@ WebInspector.DetailedHeapshotView.prototype = {
     {
         var selectedNode = event.target.selectedNode;
         this._setRetainmentDataGridSource(selectedNode);
+        this._inspectedObjectChanged(event);
+    },
+
+    _inspectedObjectChanged: function(event)
+    {
+        var selectedNode = event.target.selectedNode;
+        if (selectedNode instanceof WebInspector.HeapSnapshotGenericObjectNode)
+            ConsoleAgent.addInspectedHeapObject(selectedNode.snapshotNodeId);
     },
 
     _setRetainmentDataGridSource: function(nodeItem)
@@ -843,8 +869,6 @@ WebInspector.DetailedHeapshotView.prototype = {
         if (!cell || (!cell.hasStyleClass("count-column") && !cell.hasStyleClass("shallowSize-column") && !cell.hasStyleClass("retainedSize-column")))
             return;
 
-        this.refreshShowPercents();
-
         event.preventDefault();
         event.stopPropagation();
     },
@@ -946,12 +970,6 @@ WebInspector.DetailedHeapshotView.prototype = {
         return span;
     },
 
-    _percentClicked: function(event)
-    {
-        this._showPercentage = !this._showPercentage;
-        this.refreshShowPercents();
-    },
-
     _resolveObjectForPopover: function(element, showCallback, objectGroupName)
     {
         element.node.queryObjectContent(showCallback, objectGroupName);
@@ -1095,17 +1113,6 @@ WebInspector.DetailedHeapshotView.prototype = {
             filterOption.label = title;
             this.filterSelectElement.appendChild(filterOption);
         }
-    },
-
-    _updatePercentButton: function()
-    {
-        if (this._showPercentage) {
-            this.percentButton.title = WebInspector.UIString("Hide percentages of counts and sizes.");
-            this.percentButton.toggled = true;
-        } else {
-            this.percentButton.title = WebInspector.UIString("Show percentages of counts and sizes.");
-            this.percentButton.toggled = false;
-        }
     }
 };
 
diff --git a/Source/WebCore/inspector/front-end/Dialog.js b/Source/WebCore/inspector/front-end/Dialog.js
index 76d3fdaf9..853aa6fa9 100644
--- a/Source/WebCore/inspector/front-end/Dialog.js
+++ b/Source/WebCore/inspector/front-end/Dialog.js
@@ -45,7 +45,6 @@ WebInspector.Dialog = function(relativeToElement, delegate)
     this._glassPaneElement.addEventListener("focus", this._onGlassPaneFocus.bind(this), false);
 
     this._element = this._glassPaneElement.createChild("div");
-    this._element.className = "dialog";
     this._element.tabIndex = 0;
     this._element.addEventListener("focus", this._onFocus.bind(this), false);
     this._element.addEventListener("keydown", this._onKeyDown.bind(this), false);
@@ -54,8 +53,7 @@ WebInspector.Dialog = function(relativeToElement, delegate)
         WebInspector.KeyboardShortcut.Keys.Esc.code,
     ];
 
-    delegate.element.addStyleClass("dialog-contents");
-    this._element.appendChild(delegate.element);
+    delegate.show(this._element);
 
     this._position();
     this._windowResizeHandler = this._position.bind(this);
@@ -142,6 +140,7 @@ WebInspector.Dialog.prototype = {
 
 /**
  * @constructor
+ * @extends {WebInspector.Object}
  */
 WebInspector.DialogDelegate = function()
 {
@@ -150,6 +149,16 @@ WebInspector.DialogDelegate = function()
 WebInspector.DialogDelegate.prototype = {
     /**
      * @param {Element} element
+     */
+    show: function(element)
+    {
+        element.appendChild(this.element);
+        this.element.addStyleClass("dialog-contents");
+        element.addStyleClass("dialog");    
+    },
+
+    /**
+     * @param {Element} element
      * @param {Element} relativeToElement
      */
     position: function(element, relativeToElement)
@@ -172,3 +181,5 @@ WebInspector.DialogDelegate.prototype = {
 
     willHide: function() { }
 };
+
+WebInspector.DialogDelegate.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 3585e32ae..535e70579 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -96,6 +96,9 @@ WebInspector.ElementsPanel = function()
 
     this._registerShortcuts();
 
+    this._popoverHelper = new WebInspector.PopoverHelper(document.body, this._getPopoverAnchor.bind(this), this._showPopover.bind(this));
+    this._popoverHelper.setTimeout(0);
+
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.NodeRemoved, this._nodeRemoved, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.DocumentUpdated, this._documentUpdated, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.InspectElementRequested, this._inspectElementRequested, this);
@@ -146,10 +149,16 @@ WebInspector.ElementsPanel.prototype = {
         WebInspector.domAgent.hideDOMNodeHighlight();
         this.setSearchingForNode(false);
         this.treeOutline.setVisible(false);
+        this._popoverHelper.hidePopover();
 
         // Detach heavy component on hide
         this.contentElement.removeChild(this.treeOutline.element);
 
+        for (var pane in this.sidebarPanes) {
+            if (this.sidebarPanes[pane].willHide)
+                this.sidebarPanes[pane].willHide();
+        }
+
         WebInspector.Panel.prototype.willHide.call(this);
     },
 
@@ -332,6 +341,124 @@ WebInspector.ElementsPanel.prototype = {
         }
     },
 
+    _getPopoverAnchor: function(element)
+    {
+        var anchor = element.enclosingNodeOrSelfWithClass("webkit-html-resource-link");
+        if (anchor) {
+            if (!anchor.href)
+                return null;
+
+            var resource = WebInspector.resourceTreeModel.resourceForURL(anchor.href);
+            if (!resource || resource.type !== WebInspector.Resource.Type.Image)
+                return null;
+
+            anchor.removeAttribute("title");
+        }
+        return anchor;
+    },
+    
+    _loadDimensionsForNode: function(treeElement, callback)
+    {
+        // We get here for CSS properties, too, so bail out early for non-DOM treeElements.
+        if (treeElement.treeOutline !== this.treeOutline) {
+            callback();
+            return;
+        }
+        
+        var node = /** @type {WebInspector.DOMNode} */ treeElement.representedObject;
+
+        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img") {
+            callback();
+            return;
+        }
+
+        WebInspector.RemoteObject.resolveNode(node, "", resolvedNode);
+
+        function resolvedNode(object)
+        {
+            if (!object) {
+                callback();
+                return;
+            }
+
+            object.callFunctionJSON(dimensions, callback);
+            object.release();
+
+            function dimensions()
+            {
+                return { offsetWidth: this.offsetWidth, offsetHeight: this.offsetHeight, naturalWidth: this.naturalWidth, naturalHeight: this.naturalHeight };
+            }
+        }
+    },
+
+    _showPopover: function(anchor, popover)
+    {
+        var listItem = anchor.enclosingNodeOrSelfWithNodeNameInArray(["li"]);
+        if (listItem && listItem.treeElement)
+            this._loadDimensionsForNode(listItem.treeElement, dimensionsCallback);
+        else
+            dimensionsCallback();
+
+        /**
+         * @param {Object=} dimensions
+         */
+        function dimensionsCallback(dimensions)
+        {
+            var imageElement = document.createElement("img");
+            imageElement.addEventListener("load", showPopover.bind(null, imageElement, dimensions), false);
+            var resource = WebInspector.resourceTreeModel.resourceForURL(anchor.href);
+            if (!resource)
+                return;
+    
+            resource.populateImageSource(imageElement);
+        }
+
+        /**
+         * @param {Object=} dimensions
+         */
+        function showPopover(imageElement, dimensions)
+        {
+            var contents = buildPopoverContents(imageElement, dimensions);
+            popover.setCanShrink(false);
+            popover.show(contents, anchor);
+        }
+
+        /**
+         * @param {Object=} nodeDimensions
+         */
+        function buildPopoverContents(imageElement, nodeDimensions)
+        {
+            const maxImageWidth = 100;
+            const maxImageHeight = 100;
+            var container = document.createElement("table");
+            container.className = "image-preview-container";
+            var naturalWidth = nodeDimensions ? nodeDimensions.naturalWidth : imageElement.naturalWidth;
+            var naturalHeight = nodeDimensions ? nodeDimensions.naturalHeight : imageElement.naturalHeight;
+            var offsetWidth = nodeDimensions ? nodeDimensions.offsetWidth : naturalWidth;
+            var offsetHeight = nodeDimensions ? nodeDimensions.offsetHeight : naturalHeight;
+            var description;
+            if (offsetHeight === naturalHeight && offsetWidth === naturalWidth)
+                description = WebInspector.UIString("%d \xd7 %d pixels", offsetWidth, offsetHeight);
+            else
+                description = WebInspector.UIString("%d \xd7 %d pixels (Natural: %d \xd7 %d pixels)", offsetWidth, offsetHeight, naturalWidth, naturalHeight);
+
+            if (naturalWidth > naturalHeight) {
+                if (naturalWidth > maxImageWidth) {
+                    imageElement.style.width = maxImageWidth + "px";
+                    imageElement.style.height = (naturalHeight * maxImageWidth / naturalWidth) + "px";
+                }
+            } else {
+                if (naturalHeight > maxImageHeight) {
+                    imageElement.style.width = (naturalWidth * maxImageHeight / naturalHeight) + "px";
+                    imageElement.style.height = maxImageHeight + "px";
+                }
+            }
+            container.createChild("tr").createChild("td", "image-container").appendChild(imageElement);
+            container.createChild("tr").createChild("td").createChild("span", "description").textContent = description;
+            return container;
+        }
+    },
+
     jumpToNextSearchResult: function()
     {
         if (!this._searchResults)
@@ -927,8 +1054,17 @@ WebInspector.ElementsPanel.prototype = {
             return;
         }
 
-        if (WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(event) && event.keyIdentifier === "U+005A") { // Z key
-            DOMAgent.undo(this._updateSidebars.bind(this));
+        if (WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(event) && !event.shiftKey && event.keyIdentifier === "U+005A") { // Z key
+            WebInspector.domAgent.undo(this._updateSidebars.bind(this));
+            event.handled = true;
+            return;
+        }
+
+        var isRedoKey = WebInspector.isMac() ? event.metaKey && event.shiftKey && event.keyIdentifier === "U+005A" : // Z key
+                                               event.ctrlKey && event.keyIdentifier === "U+0059"; // Y key
+        if (isRedoKey) {
+            DOMAgent.redo(this._updateSidebars.bind(this));
+            event.handled = true;
             return;
         }
 
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 7fc53b669..1367fdef6 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -292,10 +292,6 @@ WebInspector.ElementsTreeOutline.prototype = {
         if (element) {
             element.hovered = true;
             this._previousHoveredElement = element;
-
-            // Lazily compute tag-specific tooltips.
-            if (element.representedObject && !element.tooltip)
-                element._createTooltipForNode();
         }
 
         WebInspector.domAgent.highlightDOMNode(element ? element.representedObject.id : 0);
@@ -705,48 +701,6 @@ WebInspector.ElementsTreeElement.prototype = {
         return this.expandedChildCount > index;
     },
 
-    _createTooltipForNode: function()
-    {
-        var node = /** @type {WebInspector.DOMNode} */ this.representedObject;
-        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img")
-            return;
-
-        function setTooltip(result)
-        {
-            if (!result || result.type !== "string")
-                return;
-
-            try {
-                var properties = JSON.parse(result.description);
-                var offsetWidth = properties[0];
-                var offsetHeight = properties[1];
-                var naturalWidth = properties[2];
-                var naturalHeight = properties[3];
-                if (offsetHeight === naturalHeight && offsetWidth === naturalWidth)
-                    this.tooltip = WebInspector.UIString("%d \xd7 %d pixels", offsetWidth, offsetHeight);
-                else
-                    this.tooltip = WebInspector.UIString("%d \xd7 %d pixels (Natural: %d \xd7 %d pixels)", offsetWidth, offsetHeight, naturalWidth, naturalHeight);
-            } catch (e) {
-                console.error(e);
-            }
-        }
-
-        function resolvedNode(object)
-        {
-            if (!object)
-                return;
-
-            function dimensions()
-            {
-                return "[" + this.offsetWidth + "," + this.offsetHeight + "," + this.naturalWidth + "," + this.naturalHeight + "]";
-            }
-
-            object.callFunction(dimensions, setTooltip.bind(this));
-            object.release();
-        }
-        WebInspector.RemoteObject.resolveNode(node, "", resolvedNode.bind(this));
-    },
-
     updateSelection: function()
     {
         var listItemElement = this.listItemElement;
@@ -778,8 +732,6 @@ WebInspector.ElementsTreeElement.prototype = {
         this.updateTitle();
         this._preventFollowingLinksOnDoubleClick();
         this.listItemElement.draggable = true;
-        this.listItemElement.addEventListener("click", this._mouseClick.bind(this));
-        this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
     },
 
     _preventFollowingLinksOnDoubleClick: function()
@@ -1054,20 +1006,6 @@ WebInspector.ElementsTreeElement.prototype = {
             this.expand();
     },
 
-    _mouseClick: function(event)
-    {
-        if (this._isSingleClickCandidate)
-            this._startEditingTarget(event.target);
-        this._isSingleClickCandidate = false;
-    },
-
-    _mouseDown: function(event)
-    {
-        if (event.handled || event.which !== 1 || this._editing || this._elementCloseTag || !this.selected)
-            return;
-        this._isSingleClickCandidate = true;
-    },
-
     _insertInLastAttributePosition: function(tag, node)
     {
         if (tag.getElementsByClassName("webkit-html-attribute").length > 0)
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshot.js b/Source/WebCore/inspector/front-end/HeapSnapshot.js
index 084ad0e28..437cd9a6f 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshot.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshot.js
@@ -591,9 +591,9 @@ WebInspector.HeapSnapshotNode.prototype = {
         return this._type() === this._snapshot._nodeSyntheticType;
     },
 
-    get isDOMWindow()
+    get isWindow()
     {
-        return this.name.substr(0, 9) === "DOMWindow";
+        return this.name.substr(0, 9) === "Window";
     },
 
     get isDetachedDOMTreesRoot()
@@ -945,10 +945,10 @@ WebInspector.HeapSnapshot.prototype = {
     {
         this._distancesToWindow = new Array(this.nodeCount);
 
-        // bfs for DOMWindow roots
+        // bfs for Window roots
         var list = [];
         for (var iter = this.rootNode.edges; iter.hasNext(); iter.next()) {
-            if (iter.edge.node.isDOMWindow) {
+            if (iter.edge.node.isWindow) {
                 list.push(iter.edge.node);
                 this._distancesToWindow[iter.edge.node.nodeIndex] = 0;
             }
@@ -1174,14 +1174,14 @@ WebInspector.HeapSnapshot.prototype = {
 
     _markQueriableHeapObjects: function()
     {
-        // Allow runtime properties query for objects accessible from DOMWindow objects
+        // Allow runtime properties query for objects accessible from Window objects
         // via regular properties, and for DOM wrappers. Trying to access random objects
         // can cause a crash due to insonsistent state of internal properties of wrappers.
         var flag = this._nodeFlags.canBeQueried;
 
         var list = [];
         for (var iter = this.rootNode.edges; iter.hasNext(); iter.next()) {
-            if (iter.edge.node.isDOMWindow)
+            if (iter.edge.node.isWindow)
                 list.push(iter.edge.node);
         }
 
diff --git a/Source/WebCore/inspector/front-end/Images/indexedDB.png b/Source/WebCore/inspector/front-end/Images/indexedDB.png
new file mode 100644
index 000000000..155533946
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/indexedDB.png
diff --git a/Source/WebCore/inspector/front-end/Images/indexedDBIndex.png b/Source/WebCore/inspector/front-end/Images/indexedDBIndex.png
new file mode 100644
index 000000000..eaecc0e57
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/indexedDBIndex.png
diff --git a/Source/WebCore/inspector/front-end/Images/indexedDBObjectStore.png b/Source/WebCore/inspector/front-end/Images/indexedDBObjectStore.png
new file mode 100644
index 000000000..10fa04c92
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/indexedDBObjectStore.png
diff --git a/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png b/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png
new file mode 100644
index 000000000..577d416fc
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png
diff --git a/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png b/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png
new file mode 100644
index 000000000..499e4e018
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
index 553124b1c..a46d72888 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
index 5af319589..14486c647 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
index 4e11aa420..6e18b14ad 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
index ec1955caa..819cf9aaf 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
index 435b0f1fb..31e7e499d 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
index 02649cde7..db49089b5 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
index 9c47280c8..e55b7a474 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
index 39716ea29..221cd6fdc 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
index 92f7f720f..dc7242baf 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
index fd8afe110..991a4f594 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
index af34c3053..7045c49cb 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
index b46eddeb7..67485f628 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
index 6ce6640a3..8df8a56c0 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
index 67cccfd22..020719e27 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
index 9e71a9a14..9fdb533e5 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
index aef365242..adf967f0a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
index 82ea80aea..bb48eb20b 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
index 6973fdbf7..8cde46266 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
index 09cfa4a27..a24de5a58 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
index 6fb5b356e..73c8ec086 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
index 64234f716..6e8b3c0ab 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
index a2deee671..a3d60413e 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
diff --git a/Source/WebCore/inspector/front-end/IndexedDBModel.js b/Source/WebCore/inspector/front-end/IndexedDBModel.js
index 75716d2d1..a73fc7ed3 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBModel.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBModel.js
@@ -35,29 +35,119 @@
 WebInspector.IndexedDBModel = function()
 {
     this._indexedDBRequestManager = new WebInspector.IndexedDBRequestManager();
-    
+
+    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameAdded, this._frameNavigated, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, this._frameNavigated, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, this._frameDetached, this);
-    
+
     this._frames = {};
+    this._databases = new Map();
     this._frameIdsBySecurityOrigin = {};
     this._databaseNamesBySecurityOrigin = {};
 
     this.refreshDatabaseNames();
 }
 
+WebInspector.IndexedDBModel.KeyTypes = {
+    NumberType:  "number",
+    StringType:  "string",
+    DateType:    "date",
+    ArrayType:   "array"
+};
+
+/**
+ * @param {IndexedDBAgent.Key} key
+ */
+WebInspector.IndexedDBModel.idbKeyFromKey = function(key)
+{
+    var idbKey;
+    switch (key.type) {
+    case WebInspector.IndexedDBModel.KeyTypes.NumberType:
+        idbKey = key.number;
+        break;
+    case WebInspector.IndexedDBModel.KeyTypes.StringType:
+        idbKey = key.string;
+        break;
+    case WebInspector.IndexedDBModel.KeyTypes.DateType:
+        idbKey = new Date(key.date);
+        break;
+    case WebInspector.IndexedDBModel.KeyTypes.ArrayType:
+        idbKey = [];
+        for (var i = 0; i < key.length; ++i)
+            idbKey.push(WebInspector.IndexedDBModel.idbKeyFromKey(key.array[i]));
+        break;
+    }
+    return idbKey;
+}
+
+WebInspector.IndexedDBModel.keyFromIDBKey = function(idbKey)
+{
+    if (typeof(idbKey) === "undefined" || idbKey === null)
+        return null;
+
+    var key = {};
+    switch (typeof(idbKey)) {
+    case "number":
+        key.number = idbKey;
+        key.type = WebInspector.IndexedDBModel.KeyTypes.NumberType;
+        break;
+    case "string":
+        key.string = idbKey;
+        key.type = WebInspector.IndexedDBModel.KeyTypes.StringType;
+        break;
+    case "object":
+        if (idbKey instanceof Date) {
+            key.date = idbKey.getTime();
+            key.type = WebInspector.IndexedDBModel.KeyTypes.DateType;
+        } else if (idbKey instanceof Array) {
+            key.array = [];
+            for (var i = 0; i < idbKey.length; ++i)
+                key.array.push(WebInspector.IndexedDBModel.keyFromIDBKey(idbKey[i]));
+            key.type = WebInspector.IndexedDBModel.KeyTypes.ArrayType;
+        }
+        break;
+    default:
+        return null;
+    }
+    return key;
+}
+
+WebInspector.IndexedDBModel.keyRangeFromIDBKeyRange = function(idbKeyRange)
+{
+    var IDBKeyRange = window.IDBKeyRange || window.webkitIDBKeyRange;
+    if (typeof(idbKeyRange) === "undefined" || idbKeyRange === null)
+        return null;
+
+    var keyRange = {};
+    keyRange.lower = WebInspector.IndexedDBModel.keyFromIDBKey(idbKeyRange.lower);
+    keyRange.upper = WebInspector.IndexedDBModel.keyFromIDBKey(idbKeyRange.upper);
+    keyRange.lowerOpen = idbKeyRange.lowerOpen;
+    keyRange.upperOpen = idbKeyRange.upperOpen;
+    return keyRange;
+}
+
+WebInspector.IndexedDBModel.EventTypes = {
+    DatabaseAdded: "DatabaseAdded",
+    DatabaseRemoved: "DatabaseRemoved",
+    DatabaseLoaded: "DatabaseLoaded"
+}
+
 WebInspector.IndexedDBModel.prototype = {
     refreshDatabaseNames: function()
     {
         this._reset();
-        this._framesNavigatedRecursively(WebInspector.resourceTreeModel.mainFrame);
+        if (WebInspector.resourceTreeModel.mainFrame)
+            this._framesNavigatedRecursively(WebInspector.resourceTreeModel.mainFrame);
     },
-    
-    refreshDatabase: function(frameId, databaseName)
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     */
+    refreshDatabase: function(databaseId)
     {
-        this._loadDatabase(frameId, databaseName);
+        this._loadDatabase(databaseId);
     },
-    
+
     /**
      * @param {WebInspector.ResourceTreeFrame} resourceTreeFrame
      */
@@ -65,9 +155,9 @@ WebInspector.IndexedDBModel.prototype = {
     {
         this._processFrameNavigated(resourceTreeFrame);
         for (var i = 0; i < resourceTreeFrame.childFrames.length; ++i)
-            this._framesNavigatedRecursively(resourceTreeFrame.childFrames[i]);            
+            this._framesNavigatedRecursively(resourceTreeFrame.childFrames[i]);
     },
-    
+
     /**
      * @param {WebInspector.Event} event
      */
@@ -76,7 +166,7 @@ WebInspector.IndexedDBModel.prototype = {
         var resourceTreeFrame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
         this._processFrameNavigated(resourceTreeFrame);
     },
-    
+
     /**
      * @param {WebInspector.Event} event
      */
@@ -89,11 +179,10 @@ WebInspector.IndexedDBModel.prototype = {
 
     _reset: function()
     {
-        this._frames = {};
-        this._frameIdsBySecurityOrigin = {};
-        this._databaseNamesBySecurityOrigin = {};
+        for (var frameId in this._frames)
+            this._originRemovedFromFrame(frameId);
+
         this._indexedDBRequestManager._reset();
-        // FIXME: dispatch events?
     },
 
     /**
@@ -119,7 +208,6 @@ WebInspector.IndexedDBModel.prototype = {
             this._frameIdsBySecurityOrigin[securityOrigin] = [];
             this._frameIdsBySecurityOrigin[securityOrigin].push(frameId);
             this._databaseNamesBySecurityOrigin[securityOrigin] = [];
-            // FIXME: dispatch origin added event.
         }
         this._frames[frameId] = new WebInspector.IndexedDBModel.Frame(frameId, securityOrigin);
     },
@@ -155,10 +243,9 @@ WebInspector.IndexedDBModel.prototype = {
         for (var i = 0; i < frameIdsForOrigin; ++i)
             delete this._frames[frameIdsForOrigin[i]];
         delete this._frameIdsBySecurityOrigin[securityOrigin];
-        for (var i = 0; i < this._databaseNamesBySecurityOrigin[securityOrigin]; ++i)
+        for (var i = 0; i < this._databaseNamesBySecurityOrigin[securityOrigin].length; ++i)
             this._databaseRemoved(securityOrigin, this._databaseNamesBySecurityOrigin[securityOrigin][i]);
         delete this._databaseNamesBySecurityOrigin[securityOrigin];
-        // FIXME: dispatch origin removed event.
     },
 
     /**
@@ -195,7 +282,8 @@ WebInspector.IndexedDBModel.prototype = {
      */
     _databaseAdded: function(securityOrigin, databaseName)
     {
-        // FIXME: dispatch database added event.
+        var databaseId = new WebInspector.IndexedDBModel.DatabaseId(securityOrigin, databaseName);
+        this.dispatchEventToListeners(WebInspector.IndexedDBModel.EventTypes.DatabaseAdded, databaseId);
     },
 
     /**
@@ -205,7 +293,9 @@ WebInspector.IndexedDBModel.prototype = {
     _databaseRemoved: function(securityOrigin, databaseName)
     {
         this._indexedDBRequestManager._databaseRemoved(this._frameIdsBySecurityOrigin[securityOrigin], databaseName);
-        // FIXME: dispatch database removed event.
+
+        var databaseId = new WebInspector.IndexedDBModel.DatabaseId(securityOrigin, databaseName);
+        this.dispatchEventToListeners(WebInspector.IndexedDBModel.EventTypes.DatabaseRemoved, databaseId);
     },
 
     /**
@@ -220,24 +310,38 @@ WebInspector.IndexedDBModel.prototype = {
         {
             var databaseNames = securityOriginWithDatabaseNames.databaseNames;
             var oldSecurityOrigin = this._frames[frameId] ? this._frames[frameId].securityOrigin : null;
-            if (oldSecurityOrigin && oldSecurityOrigin === securityOriginWithDatabaseNames.securityOrigin)
-                this._updateOriginDatabaseNames(securityOriginWithDatabaseNames.securityOrigin, securityOriginWithDatabaseNames.databaseNames);
-            else {
+            if (!oldSecurityOrigin || oldSecurityOrigin !== securityOriginWithDatabaseNames.securityOrigin) {
                 this._originRemovedFromFrame(frameId);
                 this._originAddedToFrame(frameId, securityOriginWithDatabaseNames.securityOrigin);
-                this._updateOriginDatabaseNames(securityOriginWithDatabaseNames.securityOrigin, securityOriginWithDatabaseNames.databaseNames);
             }
+            this._updateOriginDatabaseNames(securityOriginWithDatabaseNames.securityOrigin, securityOriginWithDatabaseNames.databaseNames);
         }
 
         this._indexedDBRequestManager.requestDatabaseNamesForFrame(frameId, callback.bind(this));
     },
 
     /**
-     * @param {string} frameId
-     * @param {string} databaseName
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @return {string|null}
+     */
+    _assertFrameId: function(databaseId)
+    {
+        var frameIds = this._frameIdsBySecurityOrigin[databaseId.securityOrigin];
+        if (!frameIds || !frameIds.length)
+            return null;
+
+        return frameIds[0];
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
      */
-    _loadDatabase: function(frameId, databaseName)
+    _loadDatabase: function(databaseId)
     {
+        var frameId = this._assertFrameId(databaseId);
+        if (!frameId)
+            return;
+
         /**
          * @param {IndexedDBAgent.DatabaseWithObjectStores} databaseWithObjectStores
          */
@@ -246,23 +350,90 @@ WebInspector.IndexedDBModel.prototype = {
             if (!this._frames[frameId])
                 return;
 
-            var databaseModel = new WebInspector.IndexedDBModel.Database(databaseName, databaseWithObjectStores.version);
-            this._frames[frameId].databases[databaseName] = databaseModel;
+            var databaseModel = new WebInspector.IndexedDBModel.Database(databaseId, databaseWithObjectStores.version);
+            this._databases.put(databaseId, databaseModel); 
             for (var i = 0; i < databaseWithObjectStores.objectStores.length; ++i) {
                 var objectStore = databaseWithObjectStores.objectStores[i];
                 var objectStoreModel = new WebInspector.IndexedDBModel.ObjectStore(objectStore.name, objectStore.keyPath);
                 for (var j = 0; j < objectStore.indexes.length; ++j) {
-                     var objectStoreIndex = objectStore.indexes[j];
-                     var objectStoreIndexModel = new WebInspector.IndexedDBModel.ObjectStoreIndex(objectStoreIndex.name, objectStoreIndex.keyPath, objectStoreIndex.unique, objectStoreIndex.multiEntry);
-                     objectStoreModel.indexes[objectStoreIndexModel.name] = objectStoreIndexModel;
+                     var index = objectStore.indexes[j];
+                     var indexModel = new WebInspector.IndexedDBModel.Index(index.name, index.keyPath, index.unique, index.multiEntry);
+                     objectStoreModel.indexes[indexModel.name] = indexModel;
                 }
                 databaseModel.objectStores[objectStoreModel.name] = objectStoreModel;
             }
 
-            // FIXME: dispatch database loaded event.
+            this.dispatchEventToListeners(WebInspector.IndexedDBModel.EventTypes.DatabaseLoaded, databaseModel);
+        }
+
+        this._indexedDBRequestManager.requestDatabase(frameId, databaseId.name, callback.bind(this));
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @param {string} objectStoreName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<WebInspector.IndexedDBModel.Entry>, boolean)} callback
+     */
+    loadObjectStoreData: function(databaseId, objectStoreName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        var frameId = this._assertFrameId(databaseId);
+        if (!frameId)
+            return;
+
+        /**
+         * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+         * @param {boolean} hasMore
+         */
+        function innerCallback(dataEntries, hasMore)
+        {
+            var entries = [];
+            for (var i = 0; i < dataEntries.length; ++i) {
+                var key = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].key);
+                var primaryKey = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].primaryKey);
+                var value = WebInspector.RemoteObject.fromPayload(dataEntries[i].value);
+                entries.push(new WebInspector.IndexedDBModel.Entry(key, primaryKey, value));
+            }
+            callback(entries, hasMore);
+        }
+
+        this._indexedDBRequestManager.requestObjectStoreData(frameId, databaseId.name, objectStoreName, idbKeyRange, skipCount, pageSize, innerCallback);
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @param {string} objectStoreName
+     * @param {string} indexName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<WebInspector.IndexedDBModel.Entry>, boolean)} callback
+     */
+    loadIndexData: function(databaseId, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        var frameId = this._assertFrameId(databaseId);
+        if (!frameId)
+            return;
+
+        /**
+         * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+         * @param {boolean} hasMore
+         */
+        function innerCallback(dataEntries, hasMore)
+        {
+            var entries = [];
+            for (var i = 0; i < dataEntries.length; ++i) {
+                var key = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].key);
+                var primaryKey = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].primaryKey);
+                var value = WebInspector.RemoteObject.fromPayload(dataEntries[i].value);
+                entries.push(new WebInspector.IndexedDBModel.Entry(key, primaryKey, value));
+            }
+            callback(entries, hasMore);
         }
 
-        this._indexedDBRequestManager.requestDatabase(frameId, databaseName, callback.bind(this));
+        this._indexedDBRequestManager.requestIndexData(frameId, databaseId.name, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, innerCallback.bind(this));
     }
 }
 
@@ -270,6 +441,19 @@ WebInspector.IndexedDBModel.prototype.__proto__ = WebInspector.Object.prototype;
 
 /**
  * @constructor
+ * @param {*} key
+ * @param {*} primaryKey
+ * @param {WebInspector.RemoteObject} value
+ */
+WebInspector.IndexedDBModel.Entry = function(key, primaryKey, value)
+{
+    this.key = key;
+    this.primaryKey = primaryKey;
+    this.value = value;
+}
+
+/**
+ * @constructor
  * @param {string} frameId
  * @param {string} securityOrigin
  */
@@ -277,16 +461,37 @@ WebInspector.IndexedDBModel.Frame = function(frameId, securityOrigin)
 {
     this.frameId = frameId;
     this.securityOrigin = securityOrigin;
-    this.databases = {};
+    this.databaseNames = {};
 }
 
 /**
  * @constructor
+ * @param {string} securityOrigin
  * @param {string} name
  */
-WebInspector.IndexedDBModel.Database = function(name, version)
+WebInspector.IndexedDBModel.DatabaseId = function(securityOrigin, name)
 {
+    this.securityOrigin = securityOrigin;
     this.name = name;
+}
+
+WebInspector.IndexedDBModel.DatabaseId.prototype = {
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     */
+    equals: function(databaseId)
+    {
+        return this.name === databaseId.name && this.securityOrigin === databaseId.securityOrigin;
+    },
+}
+/**
+ * @constructor
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {string} version
+ */
+WebInspector.IndexedDBModel.Database = function(databaseId, version)
+{
+    this.databaseId = databaseId;
     this.version = version;
     this.objectStores = {};
 }
@@ -308,7 +513,7 @@ WebInspector.IndexedDBModel.ObjectStore = function(name, keyPath)
  * @param {string} name
  * @param {string} keyPath
  */
-WebInspector.IndexedDBModel.ObjectStoreIndex = function(name, keyPath, unique, multiEntry)
+WebInspector.IndexedDBModel.Index = function(name, keyPath, unique, multiEntry)
 {
     this.name = name;
     this.keyPath = keyPath;
@@ -323,6 +528,8 @@ WebInspector.IndexedDBRequestManager = function()
 {
     this._lastRequestId = 0;
     this._requestDatabaseNamesForFrameCallbacks = {};
+    this._requestDatabaseCallbacks = {};
+    this._requestDataCallbacks = {};
 
     IndexedDBAgent.enable();
     InspectorBackend.registerIndexedDBDispatcher(new WebInspector.IndexedDBDispatcher(this));
@@ -384,7 +591,7 @@ WebInspector.IndexedDBRequestManager.prototype = {
 
         IndexedDBAgent.requestDatabase(requestId, frameId, databaseName, innerCallback);
     },
-    
+
     /**
      * @param {number} requestId
      * @param {IndexedDBAgent.DatabaseWithObjectStores} databaseWithObjectStores
@@ -399,6 +606,91 @@ WebInspector.IndexedDBRequestManager.prototype = {
     },
 
     /**
+     * @param {string} frameId
+     * @param {string} databaseName
+     * @param {string} objectStoreName
+     * @param {string} indexName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+     */
+    _requestData: function(frameId, databaseName, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        var requestId = this._requestId();
+        var request = new WebInspector.IndexedDBRequestManager.DataRequest(frameId, databaseName, objectStoreName, indexName, callback);
+        this._requestDataCallbacks[requestId] = request;
+
+        function innerCallback(error)
+        {
+            if (error) {
+                console.error("IndexedDBAgent error: " + error);
+                return;
+            }
+        }
+
+        var keyRange = WebInspector.IndexedDBModel.keyRangeFromIDBKeyRange(idbKeyRange);
+        IndexedDBAgent.requestData(requestId, frameId, databaseName, objectStoreName, indexName, skipCount, pageSize, keyRange ? keyRange : undefined, innerCallback);
+    },
+
+    /**
+     * @param {string} frameId
+     * @param {string} databaseName
+     * @param {string} objectStoreName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+     */
+    requestObjectStoreData: function(frameId, databaseName, objectStoreName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        this._requestData(frameId, databaseName, objectStoreName, "", idbKeyRange, skipCount, pageSize, callback);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    _objectStoreDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        var request = this._requestDataCallbacks[requestId];
+        if (!request.callback)
+            return;
+
+        request.callback(dataEntries, hasMore);
+    },
+
+    /**
+     * @param {string} frameId
+     * @param {string} databaseName
+     * @param {string} objectStoreName
+     * @param {string} indexName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+     */
+    requestIndexData: function(frameId, databaseName, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        this._requestData(frameId, databaseName, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    _indexDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        var request = this._requestDataCallbacks[requestId];
+        if (!request.callback)
+            return;
+
+        request.callback(dataEntries, hasMore);
+    },
+
+    /**
      * @return {number}
      */
     _requestId: function()
@@ -415,11 +707,16 @@ WebInspector.IndexedDBRequestManager.prototype = {
             if (this._requestDatabaseNamesForFrameCallbacks[requestId].frameId === frameId)
                 delete this._requestDatabaseNamesForFrameCallbacks[requestId];
         }
-        
+
         for (var requestId in this._requestDatabaseCallbacks) {
             if (this._requestDatabaseCallbacks[requestId].frameId === frameId)
                 delete this._requestDatabaseCallbacks[requestId];
         }
+
+        for (var requestId in this._requestDataCallbacks) {
+            if (this._requestDataCallbacks[requestId].frameId === frameId)
+                delete this._requestDataCallbacks[requestId];
+        }
     },
 
     /**
@@ -431,19 +728,26 @@ WebInspector.IndexedDBRequestManager.prototype = {
             if (this._requestDatabaseCallbacks[requestId].frameId === frameId && this._requestDatabaseCallbacks[requestId].databaseName === databaseName)
                 delete this._requestDatabaseCallbacks[requestId];
         }
+
+        for (var requestId in this._requestDataCallbacks) {
+            if (this._requestDataCallbacks[requestId].frameId === frameId && this._requestDataCallbacks[requestId].databaseName === databaseName)
+                delete this._requestDataCallbacks[requestId];
+        }
     },
 
     _reset: function()
     {
         this._requestDatabaseNamesForFrameCallbacks = {};
         this._requestDatabaseCallbacks = {};
-
+        this._requestDataCallbacks = {};
     }
 }
 
 /**
  * @constructor
- */
+ * @param {string} frameId
+ * @param {function(IndexedDBAgent.SecurityOriginWithDatabaseNames)} callback
+*/
 WebInspector.IndexedDBRequestManager.DatabasesForFrameRequest = function(frameId, callback)
 {
     this.frameId = frameId;
@@ -452,6 +756,9 @@ WebInspector.IndexedDBRequestManager.DatabasesForFrameRequest = function(frameId
 
 /**
  * @constructor
+ * @param {string} frameId
+ * @param {string} databaseName
+ * @param {function(IndexedDBAgent.DatabaseWithObjectStores)} callback
  */
 WebInspector.IndexedDBRequestManager.DatabaseRequest = function(frameId, databaseName, callback)
 {
@@ -462,6 +769,23 @@ WebInspector.IndexedDBRequestManager.DatabaseRequest = function(frameId, databas
 
 /**
  * @constructor
+ * @param {string} frameId
+ * @param {string} databaseName
+ * @param {string} objectStoreName
+ * @param {string} indexName
+ * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+ */
+WebInspector.IndexedDBRequestManager.DataRequest = function(frameId, databaseName, objectStoreName, indexName, callback)
+{
+    this.frameId = frameId;
+    this.databaseName = databaseName;
+    this.objectStoreName = objectStoreName;
+    this.indexName = indexName;
+    this.callback = callback;
+}
+
+/**
+ * @constructor
  * @implements {IndexedDBAgent.Dispatcher}
  * @param {WebInspector.IndexedDBRequestManager} indexedDBRequestManager
  */
@@ -487,5 +811,26 @@ WebInspector.IndexedDBDispatcher.prototype = {
     databaseLoaded: function(requestId, databaseWithObjectStores)
     {
         this._agentWrapper._databaseLoaded(requestId, databaseWithObjectStores);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    objectStoreDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        this._agentWrapper._objectStoreDataLoaded(requestId, dataEntries, hasMore);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    indexDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        this._agentWrapper._indexDataLoaded(requestId, dataEntries, hasMore);
     }
 }
+
diff --git a/Source/WebCore/inspector/front-end/IndexedDBViews.js b/Source/WebCore/inspector/front-end/IndexedDBViews.js
new file mode 100644
index 000000000..a14b791b9
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/IndexedDBViews.js
@@ -0,0 +1,334 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ * @param {WebInspector.IndexedDBModel.Database} database
+ */
+WebInspector.IDBDatabaseView = function(database)
+{
+    WebInspector.View.call(this);
+    this.registerRequiredCSS("indexedDBViews.css");
+    
+    this.element.addStyleClass("fill");
+    this.element.addStyleClass("indexed-db-database-view");
+    
+    this._headersListElement = this.element.createChild("ol", "outline-disclosure");
+    this._headersTreeOutline = new TreeOutline(this._headersListElement);
+    this._headersTreeOutline.expandTreeElementsWhenArrowing = true;
+    
+    this._securityOriginTreeElement = new TreeElement("", null, false);
+    this._securityOriginTreeElement.selectable = false;
+    this._headersTreeOutline.appendChild(this._securityOriginTreeElement);
+
+    this._nameTreeElement = new TreeElement("", null, false);
+    this._nameTreeElement.selectable = false;
+    this._headersTreeOutline.appendChild(this._nameTreeElement);
+
+    this._versionTreeElement = new TreeElement("", null, false);
+    this._versionTreeElement.selectable = false;
+    this._headersTreeOutline.appendChild(this._versionTreeElement);
+
+    this.update(database);
+}
+
+WebInspector.IDBDatabaseView.prototype = {
+    /**
+     * @param {string} name
+     * @param {string} value
+     */
+    _formatHeader: function(name, value)
+    {
+        var fragment = document.createDocumentFragment();
+        fragment.createChild("div", "attribute-name").textContent = name + ":";
+        fragment.createChild("div", "attribute-value source-code").textContent = value;
+
+        return fragment;
+    },
+
+    _refreshDatabase: function()
+    {
+        this._securityOriginTreeElement.title = this._formatHeader(WebInspector.UIString("Security origin"), this._database.databaseId.securityOrigin);
+        this._nameTreeElement.title = this._formatHeader(WebInspector.UIString("Name"), this._database.databaseId.name);
+        this._versionTreeElement.title = this._formatHeader(WebInspector.UIString("Version"), this._database.version);
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.Database} database
+     */
+    update: function(database)
+    {
+        this._database = database;
+        this._refreshDatabase();
+    },
+}
+
+WebInspector.IDBDatabaseView.prototype.__proto__ = WebInspector.View.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+ * @param {WebInspector.IndexedDBModel.Index} index
+ */
+WebInspector.IDBDataView = function(model, databaseId, objectStore, index)
+{
+    WebInspector.View.call(this);
+    this.registerRequiredCSS("indexedDBViews.css");
+    
+    this._model = model; 
+    this._databaseId = databaseId;
+    this._isIndex = !!index;
+
+    this.element.addStyleClass("indexed-db-data-view");
+
+    var editorToolbar = this._createEditorToolbar();
+    this.element.appendChild(editorToolbar);
+    
+    this._dataGridContainer = this.element.createChild("div", "fill");
+    this._dataGridContainer.addStyleClass("data-grid-container");
+
+    this._pageSize = 50;
+    this._skipCount = 0;
+
+    this.update(objectStore, index);
+}
+
+WebInspector.IDBDataView.prototype = {
+    /**
+     * @return {WebInspector.DataGrid}
+     */
+    _createDataGrid: function()
+    {
+        var columns = {};
+        columns["number"] = {};
+        columns["number"].title = WebInspector.UIString("#");
+        columns["number"].width = "50px";
+        
+        var keyPath = this._isIndex ? this._index.keyPath : this._objectStore.keyPath;
+        columns["key"] = {};
+        var keyColumnTitle = WebInspector.UIString("Key") + (keyPath ? " (" + keyPath + ")" : "");
+        columns["key"].title = keyColumnTitle;
+        
+        if (this._isIndex) {
+            columns["primaryKey"] = {};
+            var primaryKeyColumnTitle = WebInspector.UIString("Primary key") + (this._objectStore.keyPath ? " (" + this._objectStore.keyPath + ")" : "");
+            columns["primaryKey"].title = primaryKeyColumnTitle;
+        }
+        
+        columns["value"] = {};
+        columns["value"].title = WebInspector.UIString("Value");
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        return dataGrid;
+    },
+
+    /**
+     * @return {Element}
+     */
+    _createEditorToolbar: function()
+    {
+        var editorToolbar = document.createElement("div");
+        editorToolbar.addStyleClass("status-bar");
+        editorToolbar.addStyleClass("data-view-toolbar");
+
+        this._pageBackButton = editorToolbar.createChild("button", "back-button");
+        this._pageBackButton.addStyleClass("status-bar-item");
+        this._pageBackButton.title = WebInspector.UIString("Show previous page.");
+        this._pageBackButton.disabled = true;
+        this._pageBackButton.appendChild(document.createElement("img"));
+        this._pageBackButton.addEventListener("click", this._pageBackButtonClicked.bind(this), false);
+        editorToolbar.appendChild(this._pageBackButton);
+        
+        this._pageForwardButton = editorToolbar.createChild("button", "forward-button");
+        this._pageForwardButton.addStyleClass("status-bar-item");
+        this._pageForwardButton.title = WebInspector.UIString("Show next page.");
+        this._pageForwardButton.disabled = true;
+        this._pageForwardButton.appendChild(document.createElement("img"));
+        this._pageForwardButton.addEventListener("click", this._pageForwardButtonClicked.bind(this), false);
+        editorToolbar.appendChild(this._pageForwardButton);
+        
+        this._keyInputElement = editorToolbar.createChild("input", "key-input");
+        this._keyInputElement.placeholder = WebInspector.UIString("Start from key");
+        this._keyInputElement.addEventListener("paste", this._keyInputChanged.bind(this));
+        this._keyInputElement.addEventListener("cut", this._keyInputChanged.bind(this));
+        this._keyInputElement.addEventListener("keypress", this._keyInputChanged.bind(this));
+        this._keyInputElement.addEventListener("keydown", this._keyInputChanged.bind(this));
+
+        return editorToolbar;
+    },
+
+    _pageBackButtonClicked: function()
+    {
+        this._skipCount = Math.max(0, this._skipCount - this._pageSize);
+        this._updateData(false);
+    },
+    
+    _pageForwardButtonClicked: function()
+    {
+        this._skipCount = this._skipCount + this._pageSize;
+        this._updateData(false);
+    },
+    
+    _keyInputChanged: function()
+    {
+        window.setTimeout(this._updateData.bind(this, false), 0);        
+    },
+    
+    /**
+     * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+     * @param {WebInspector.IndexedDBModel.Index} index
+     */
+    update: function(objectStore, index)
+    {
+        this._objectStore = objectStore;
+        this._index = index;
+
+        if (this._dataGrid)
+            this._dataGrid.detach();
+        this._dataGrid = this._createDataGrid();
+        this._dataGrid.show(this._dataGridContainer);
+
+        this._skipCount = 0;
+        this._updateData(true); 
+    },
+    
+    /**
+     * @param {string} keyString
+     */
+    _parseKey: function(keyString)
+    {
+        var result;
+        try {
+            result = JSON.parse(keyString);
+        } catch (e) {
+            result = keyString;
+        }
+        return result;
+    },
+    
+    /**
+     * @return {string}
+     */
+    _stringifyKey: function(key)
+    {
+        if (typeof(key) === "string")
+            return key;
+        return JSON.stringify(key);
+    },
+
+    /**
+     * @param {boolean} force
+     */
+    _updateData: function(force)
+    {
+        var key = this._parseKey(this._keyInputElement.value);
+        var pageSize = this._pageSize;
+        var skipCount = this._skipCount;
+        
+        if (!force && this._lastKey === key && this._lastPageSize === pageSize && this._lastSkipCount === skipCount)
+            return;
+
+        if (this._lastKey !== key || this._lastPageSize !== pageSize) {
+            skipCount = 0;
+            this._skipCount = 0;
+        }
+        this._lastKey = key;
+        this._lastPageSize = pageSize;
+        this._lastSkipCount = skipCount;
+
+        /**
+         * @param {Array.<WebInspector.IndexedDBModel.Entry>} entries
+         * @param {boolean} hasMore
+         */
+        function callback(entries, hasMore)
+        {
+            this._dataGrid.removeChildren();
+            for (var i = 0; i < entries.length; ++i) {
+                var data = {};
+                data["number"] = i + skipCount;
+                data["key"] = this._stringifyKey(entries[i].key);
+                data["primaryKey"] = this._stringifyKey(entries[i].primaryKey);
+                data["value"] = entries[i].value;
+
+                var primaryKey = JSON.stringify(this._isIndex ? entries[i].primaryKey : entries[i].key);
+                var valueTitle = this._objectStore.name + "[" + primaryKey + "]";
+                var node = new WebInspector.IDBDataGridNode(valueTitle, data);
+                this._dataGrid.appendChild(node);
+            }
+            
+            this._pageBackButton.disabled = skipCount === 0;
+            this._pageForwardButton.disabled = !hasMore;
+        }
+        
+        var idbKeyRange = key ? window.webkitIDBKeyRange.lowerBound(key) : null;
+        if (this._isIndex)
+            this._model.loadIndexData(this._databaseId, this._objectStore.name, this._index.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
+        else
+            this._model.loadObjectStoreData(this._databaseId, this._objectStore.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
+    },
+}
+
+WebInspector.IDBDataView.prototype.__proto__ = WebInspector.View.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.DataGridNode}
+ * @param {string} valueTitle
+ * @param {*} data
+ */
+WebInspector.IDBDataGridNode = function(valueTitle, data)
+{
+    WebInspector.DataGridNode.call(this, data, false);
+    
+    this._valueTitle = valueTitle;
+    this.selectable = false;
+}
+
+WebInspector.IDBDataGridNode.prototype = {
+    /**
+     * @return {Element}
+     */
+    createCell: function(columnIdentifier)
+    {
+        if (columnIdentifier !== "value")
+            return WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+        
+        var section = new WebInspector.ObjectPropertiesSection(this.data["value"], this._valueTitle)
+        section.editable = false;
+        section.skipProto = true;
+        return section.element;
+    }
+};
+
+WebInspector.IDBDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
index ec80b98bc..828c54032 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
@@ -85,6 +85,16 @@ InspectorFrontendAPI = {
         WebInspector.inspectorView.setCurrentPanel(WebInspector.panels.console);
     },
 
+    showMainResourceForFrame: function(frameId)
+    {
+        // FIXME: Implement this to show the source code for the main resource of a given frame.
+    },
+
+    showResources: function()
+    {
+        WebInspector.inspectorView.setCurrentPanel(WebInspector.panels.resources);
+    },
+
     dispatch: function(signature)
     {
         if (WebInspector.panels) {
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index 32d7afff1..c8b9528ce 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -254,28 +254,51 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         delete this._javaScriptSourceFrameState;
     },
 
-    // Popover callbacks
-    _shouldShowPopover: function(element)
+    _getPopoverAnchor: function(element, event)
     {
         if (!this._model.paused)
-            return false;
-        if (!element.enclosingNodeOrSelfWithClass("webkit-line-content"))
-            return false;
+            return null;
         if (window.getSelection().type === "Range")
-            return false;
+            return null;
+        var lineElement = element.enclosingNodeOrSelfWithClass("webkit-line-content");
+        if (!lineElement)
+            return null;
 
-        // We are interested in identifiers and "this" keyword.
-        if (element.hasStyleClass("webkit-javascript-keyword"))
-            return element.textContent === "this";
+        if (element.hasStyleClass("webkit-javascript-ident"))
+            return element;
 
-        return element.hasStyleClass("webkit-javascript-ident");
-    },
+        if (element.hasStyleClass("source-frame-token"))
+            return element;
 
-    _getPopoverAnchor: function(element)
-    {
-        if (!this._shouldShowPopover(element))
-            return;
-        return element;
+        // We are interested in identifiers and "this" keyword.
+        if (element.hasStyleClass("webkit-javascript-keyword"))
+            return element.textContent === "this" ? element : null;
+
+        if (element !== lineElement || lineElement.childElementCount)
+            return null;
+
+        // Handle non-highlighted case
+        // 1. Collect ranges of identifier suspects
+        var lineContent = lineElement.textContent;
+        var ranges = [];
+        var regex = new RegExp("[a-zA-Z_\$0-9]+", "g");
+        var match;
+        while (regex.lastIndex < lineContent.length && (match = regex.exec(lineContent)))
+            ranges.push({offset: match.index, length: regex.lastIndex - match.index});
+
+        // 2. 'highlight' them with artificial style to detect word boundaries
+        var changes = [];
+        highlightRangesWithStyleClass(lineElement, ranges, "source-frame-token", changes);
+        var lineOffsetLeft = lineElement.totalOffsetLeft();
+        for (var child = lineElement.firstChild; child; child = child.nextSibling) {
+            if (child.nodeType !== Node.ELEMENT_NODE || !child.hasStyleClass("source-frame-token"))
+                continue;
+            if (event.x > lineOffsetLeft + child.offsetLeft && event.x < lineOffsetLeft + child.offsetLeft + child.offsetWidth) {
+                var text = child.textContent;
+                return (text === "this" || !WebInspector.SourceJavaScriptTokenizer.Keywords[text]) ? child : null;
+            }
+        }
+        return null;
     },
 
     _resolveObjectForPopover: function(element, showCallback, objectGroupName)
@@ -328,7 +351,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         // Collect tokens belonging to evaluated expression.
         var tokens = [ element ];
         var token = element.previousSibling;
-        while (token && (token.className === "webkit-javascript-ident" || token.className === "webkit-javascript-keyword" || token.textContent.trim() === ".")) {
+        while (token && (token.className === "webkit-javascript-ident" || token.className === "source-frame-token" || token.className === "webkit-javascript-keyword" || token.textContent.trim() === ".")) {
             tokens.push(token);
             token = token.previousSibling;
         }
diff --git a/Source/WebCore/inspector/front-end/MemoryStatistics.js b/Source/WebCore/inspector/front-end/MemoryStatistics.js
index 49bf9d451..d9d2fbcff 100644
--- a/Source/WebCore/inspector/front-end/MemoryStatistics.js
+++ b/Source/WebCore/inspector/front-end/MemoryStatistics.js
@@ -48,16 +48,20 @@ WebInspector.MemoryStatistics = function(timelinePanel, sidebarWidth)
     this._canvasContainer = this._memorySplitView.mainElement;
     this._canvas = this._canvasContainer.createChild("canvas", "fill");
     this._canvas.id = "memory-counters-graph";
-    this._memoryMarker = this._canvasContainer.createChild("div", "timeline-marker");
+    this._lastMarkerXPosition = 0;
 
     this._canvasContainer.addEventListener("mouseover", this._onMouseOver.bind(this), true);
-    this._canvasContainer.addEventListener("mousemove", this._onMouseOver.bind(this), true);
+    this._canvasContainer.addEventListener("mousemove", this._onMouseMove.bind(this), true);
+    this._canvasContainer.addEventListener("mouseout", this._onMouseOut.bind(this), true);
 
     // Populate sidebar
     this._counterSidebarElements = [];
-    this._domGroups = this._createCounterSidebarElement(WebInspector.UIString("DOM group count:"), true);
-    this._domNodes = this._createCounterSidebarElement(WebInspector.UIString("DOM node count:"), true);
-    this._listeners = this._createCounterSidebarElement(WebInspector.UIString("Event listener count:"), false);
+    this._documents = this._createCounterSidebarElement(WebInspector.UIString("Document count"), true);
+    this._domNodes = this._createCounterSidebarElement(WebInspector.UIString("DOM node count"), true);
+    this._listeners = this._createCounterSidebarElement(WebInspector.UIString("Event listener count"), false);
+
+    this._savedImageData = [];
+    this._graphColors = ["rgba(100,0,0,0.8)", "rgba(0,100,0,0.8)", "rgba(0,0,100,0.8)"];
 
     TimelineAgent.setIncludeMemoryDetails(true);
 }
@@ -111,9 +115,20 @@ WebInspector.MemoryStatistics.prototype = {
     _createCounterSidebarElement: function(title, showBottomBorder)
     {
         var container = this._memorySplitView.sidebarElement.createChild("div", "memory-counter-sidebar-info");
-        var value = container.createChild("p");
-        value.textContent = title;
-        container._value = value.createChild("span");
+        container.createChild("div", "title").textContent = title;
+
+        var currentValue = container.createChild("div", "counter-value");
+        currentValue.createChild("span").textContent = WebInspector.UIString("Current: ");
+        container._value = currentValue.createChild("span");
+
+        var minValue = container.createChild("div", "counter-value");
+        minValue.createChild("span").textContent = WebInspector.UIString("Min: ");
+        container._minValue = minValue.createChild("span");
+
+        var maxValue = container.createChild("div", "counter-value");
+        maxValue.createChild("span").textContent = WebInspector.UIString("Max: ");
+        container._maxValue = maxValue.createChild("span");
+
         if (showBottomBorder)
             container.addStyleClass("bottom-border-visible");
         this._counterSidebarElements.push(container);
@@ -122,28 +137,12 @@ WebInspector.MemoryStatistics.prototype = {
 
     addTimlineEvent: function(event)
     {
-        var time = event.data.endTime;
-        var domGroups = event.data["domGroups"];
-
-        var nodeCount = 0;
-        for (var i = 0; i < domGroups.length; i++) {
-            var counters = domGroups[i].nodeCount;
-            for (var j = 0; j < counters.length; j++)
-                nodeCount += counters[j].count;
-        }
-
-        var listenerCount = 0;
-        for (var i = 0; i < domGroups.length; i++) {
-            var counters = domGroups[i].listenerCount;
-            for (var j = 0; j < counters.length; j++)
-                listenerCount += counters[j].count;
-        }
-
+        var counters = event.data["counters"];
         this._counters.push({
-            time: time,
-            domGroupCount: domGroups.length,
-            nodeCount: nodeCount,
-            listenerCount: listenerCount
+            time: event.data.endTime || event.data.startTime,
+            documentCount: counters["documents"],
+            nodeCount: counters["nodes"],
+            listenerCount: counters["jsEventListeners"]
         });
     },
 
@@ -154,21 +153,20 @@ WebInspector.MemoryStatistics.prototype = {
         this._clear();
         var graphHeight = Math.round(this._canvas.height / 3);
 
-        function getGroupCount(entry)
+        function getDocumentCount(entry)
         {
-            return entry.domGroupCount;
+            return entry.documentCount;
         }
         this._setVerticalClip(0 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getGroupCount, "rgba(100,0,0,0.8)");
+        this._drawPolyline(getDocumentCount, this._graphColors[0], this._documents);
         this._drawBottomBound("rgba(20,20,20,0.8)");
 
-
         function getNodeCount(entry)
         {
             return entry.nodeCount;
         }
         this._setVerticalClip(1 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getNodeCount, "rgba(0,100,0,0.8)");
+        this._drawPolyline(getNodeCount, this._graphColors[1], this._domNodes);
         this._drawBottomBound("rgba(20,20,20,0.8)");
 
         function getListenerCount(entry)
@@ -176,7 +174,7 @@ WebInspector.MemoryStatistics.prototype = {
             return entry.listenerCount;
         }
         this._setVerticalClip(2 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getListenerCount, "rgba(0,0,100,0.8)");
+        this._drawPolyline(getListenerCount, this._graphColors[2], this._listeners);
     },
 
     _calculateVisibleIndexes: function()
@@ -184,31 +182,68 @@ WebInspector.MemoryStatistics.prototype = {
         var calculator = this._timelinePanel.calculator;
         var start = calculator.minimumBoundary * 1000;
         var end = calculator.maximumBoundary * 1000;
-        var firstIndex;
-        var lastIndex;
+        var firstIndex = 0;
+        var lastIndex = this._counters.length - 1;
         for (var i = 0; i < this._counters.length; i++) {
             var time = this._counters[i].time;
-            if (start <= time && time <= end) {
-                if (firstIndex === undefined)
-                    firstIndex = i;
+            if (time <= start) {
+                firstIndex = i;
+            } else {
+                if (end < time)
+                    break;
                 lastIndex = i;
             }
         }
+        // Maximum index of element whose time <= start.
         this._minimumIndex = firstIndex;
+
+        // Maximum index of element whose time <= end.
         this._maximumIndex = lastIndex;
+
+        // Current window bounds.
+        this._minTime = start;
+        this._maxTime = end;
+    },
+
+    _onMouseOut: function(event)
+    {
+        this._clearMarkers();
+        delete this._markerXPosition;
+
+        this._documents._value.textContent = "";
+        this._domNodes._value.textContent = "";
+        this._listeners._value.textContent = "";
     },
 
     _onMouseOver: function(event)
     {
+        this._onMouseMove(event);
+    },
+
+    _onMouseMove: function(event)
+    {
         var x = event.x - event.target.offsetParent.offsetLeft
-        this._memoryMarker.style.left = x + "px";
-        this._refreshCurrentValues(x);
+        this._markerXPosition = x;
+        this._refreshCurrentValues();
     },
 
-    _refreshCurrentValues: function(x)
+    _refreshCurrentValues: function()
     {
         if (!this._counters.length)
             return;
+        if (this._markerXPosition === undefined)
+            return;
+        var i = this._recordIndexAt(this._markerXPosition);
+
+        this._documents._value.textContent = this._counters[i].documentCount;
+        this._domNodes._value.textContent = this._counters[i].nodeCount;
+        this._listeners._value.textContent = this._counters[i].listenerCount;
+
+        this._highlightCurrentPositionOnGraphs(this._markerXPosition, i);
+    },
+
+    _recordIndexAt: function(x)
+    {
         var i;
         for (i = this._minimumIndex + 1; i <= this._maximumIndex; i++) {
             var statX = this._counters[i].x;
@@ -216,9 +251,47 @@ WebInspector.MemoryStatistics.prototype = {
                 break;
         }
         i--;
-        this._domGroups._value.textContent = this._counters[i].domGroupCount;
-        this._domNodes._value.textContent = this._counters[i].nodeCount;
-        this._listeners._value.textContent = this._counters[i].listenerCount;
+        return i;
+    },
+
+    _highlightCurrentPositionOnGraphs: function(x, index)
+    {
+        var ctx = this._canvas.getContext("2d");
+        this._clearMarkers();
+        var yValues = this._counters[index].yValues;
+        for (var i = 0; i < yValues.length; i++) {
+            var y = yValues[i];
+            ctx.beginPath();
+            const radius = 2;
+            this._saveImageUnderMarker(ctx, x, y, radius);
+            ctx.arc(x, y, radius, 0, Math.PI*2, true);
+            ctx.lineWidth = 1;
+            ctx.fillStyle = this._graphColors[i];
+            ctx.strokeStyle = this._graphColors[i];
+            ctx.fill();
+            ctx.stroke();
+            ctx.closePath();
+        }
+    },
+
+    _clearMarkers: function()
+    {
+        var ctx = this._canvas.getContext("2d");
+        for (var i = 0; i < this._savedImageData.length; i++) {
+            var entry = this._savedImageData[i];
+            ctx.putImageData(entry.imageData, entry.x, entry.y);
+        }
+        this._savedImageData = [];
+    },
+
+    _saveImageUnderMarker: function(ctx, x, y, radius)
+    {
+        const w = radius + 1;
+        var imageData = ctx.getImageData(x - w, y - w, 2 * w, 2 * w);
+        this._savedImageData.push({
+            x: x - w,
+            y: y - w,
+            imageData: imageData });
     },
 
     visible: function()
@@ -238,7 +311,7 @@ WebInspector.MemoryStatistics.prototype = {
     {
         this._updateSize();
         this._draw();
-        this._refreshCurrentValues(this._memoryMarker.offsetLeft);
+        this._refreshCurrentValues();
     },
 
     hide: function()
@@ -257,19 +330,16 @@ WebInspector.MemoryStatistics.prototype = {
         if (!this._counters.length)
             return;
 
-        var minTime = this._counters[this._minimumIndex].time;
-        var maxTime = this._counters[this._maximumIndex].time;
-
         var width = this._canvas.width;
-        var xFactor = width / (maxTime - minTime);
+        var xFactor = width / (this._maxTime - this._minTime);
 
         this._counters[this._minimumIndex].x = 0;
         for (var i = this._minimumIndex + 1; i < this._maximumIndex; i++)
-             this._counters[i].x = xFactor * (this._counters[i].time - minTime);
+             this._counters[i].x = xFactor * (this._counters[i].time - this._minTime);
         this._counters[this._maximumIndex].x = width;
     },
 
-    _drawPolyline: function(valueGetter, color)
+    _drawPolyline: function(valueGetter, color, section)
     {
         var canvas = this._canvas;
         var ctx = canvas.getContext("2d");
@@ -299,18 +369,26 @@ WebInspector.MemoryStatistics.prototype = {
                 maxValue = value;
         }
 
+        section._minValue.textContent = minValue;
+        section._maxValue.textContent = maxValue;
+
         var originalValue = valueGetter(this._counters[this._minimumIndex]);
 
-        var yFactor = height / (2 * Math.max(maxValue - originalValue, originalValue - minValue));
+        var maxYRange = Math.max(maxValue - originalValue, originalValue - minValue);
+        var yFactor = maxYRange ? height / (2 * maxYRange) : 0.5;
 
         ctx.beginPath();
-        ctx.moveTo(0, originY + height / 2);
+        var currentY = originY + height / 2;
+        ctx.moveTo(0, currentY);
         for (var i = this._minimumIndex; i <= this._maximumIndex; i++) {
              var x = this._counters[i].x;
-             var y = originY + (height / 2 - (valueGetter(this._counters[i])- originalValue) * yFactor);
-             ctx.lineTo(x, y);
+             ctx.lineTo(x, currentY);
+             currentY = originY + (height / 2 - (valueGetter(this._counters[i])- originalValue) * yFactor);
+             ctx.lineTo(x, currentY);
+
+             this._counters[i].yValues.push(currentY);
         }
-        ctx.lineTo(width, originY + (height / 2 - (valueGetter(this._counters[this._maximumIndex]) - originalValue) * yFactor));
+        ctx.lineTo(width, currentY);
         ctx.lineWidth = 1;
         ctx.strokeStyle = color;
         ctx.stroke();
@@ -335,9 +413,10 @@ WebInspector.MemoryStatistics.prototype = {
 
     _clear: function() {
         var ctx = this._canvas.getContext("2d");
-        ctx.fillStyle = "rgb(255,255,255)";
-        ctx.fillRect(0, 0, ctx.canvas.width, ctx.canvas.height);
-        ctx.fill();
+        ctx.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);
+        for (var i = this._minimumIndex; i <= this._maximumIndex; i++)
+             this._counters[i].yValues = [];
+        this._savedImageData = [];
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index a4eeee16d..20acf9133 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -43,6 +43,7 @@ WebInspector.ObjectPropertiesSection = function(object, title, subtitle, emptyPl
     this.extraProperties = extraProperties;
     this.treeElementConstructor = treeElementConstructor || WebInspector.ObjectPropertyTreeElement;
     this.editable = true;
+    this.skipProto = false;
 
     WebInspector.PropertiesSection.call(this, title, subtitle);
 }
@@ -85,6 +86,9 @@ WebInspector.ObjectPropertiesSection.prototype = {
         this.propertiesTreeOutline.removeChildren();
 
         for (var i = 0; i < properties.length; ++i) {
+            if (this.skipProto && properties[i].name === "__proto__")
+                continue;
+
             properties[i].parentObject = this.object;
             this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
         }
diff --git a/Source/WebCore/inspector/front-end/Popover.js b/Source/WebCore/inspector/front-end/Popover.js
index fbb54f921..1a84c3033 100644
--- a/Source/WebCore/inspector/front-end/Popover.js
+++ b/Source/WebCore/inspector/front-end/Popover.js
@@ -48,6 +48,10 @@ WebInspector.Popover = function(popoverHelper)
 }
 
 WebInspector.Popover.prototype = {
+    /**
+     * @param {number=} preferredWidth
+     * @param {number=} preferredHeight
+     */
     show: function(contentElement, anchor, preferredWidth, preferredHeight)
     {
         if (this._disposed)
@@ -100,10 +104,16 @@ WebInspector.Popover.prototype = {
         this._disposed = true;
     },
 
+    setCanShrink: function(canShrink)
+    {
+        this._hasFixedHeight = !canShrink;
+        this._contentDiv.addStyleClass("fixed-height");
+    },
+
     _positionElement: function(anchorElement, preferredWidth, preferredHeight)
     {
         const borderWidth = 25;
-        const scrollerWidth = 11;
+        const scrollerWidth = this._hasFixedHeight ? 0 : 11;
         const arrowHeight = 15;
         const arrowOffset = 10;
         const borderRadius = 10;
@@ -125,15 +135,24 @@ WebInspector.Popover.prototype = {
             if (anchorBox.y > newElementPosition.height + arrowHeight + borderRadius)
                 newElementPosition.y = anchorBox.y - newElementPosition.height - arrowHeight;
             else {
-                newElementPosition.y = borderRadius * 2;
+                newElementPosition.y = borderRadius;
                 newElementPosition.height = anchorBox.y - borderRadius * 2 - arrowHeight;
+                if (this._hasFixedHeight && newElementPosition.height < preferredHeight) {
+                    newElementPosition.y = borderRadius;
+                    newElementPosition.height = preferredHeight;
+                }
             }
             verticalAlignment = "bottom";
         } else {
             // Positioning below the anchor.
             newElementPosition.y = anchorBox.y + anchorBox.height + arrowHeight;
-            if (newElementPosition.y + newElementPosition.height + arrowHeight - borderWidth >= totalHeight)
+            if (newElementPosition.y + newElementPosition.height + arrowHeight - borderWidth >= totalHeight) {
                 newElementPosition.height = totalHeight - anchorBox.y - anchorBox.height - borderRadius * 2 - arrowHeight;
+                if (this._hasFixedHeight && newElementPosition.height < preferredHeight) {
+                    newElementPosition.y = totalHeight - preferredHeight - borderRadius;
+                    newElementPosition.height = preferredHeight;
+                }
+            }
             // Align arrow.
             verticalAlignment = "top";
         }
@@ -148,6 +167,7 @@ WebInspector.Popover.prototype = {
             // Position arrow accurately.
             var arrowRightPosition = Math.max(0, totalWidth - anchorBox.x - anchorBox.width - borderRadius - arrowOffset);
             arrowRightPosition += anchorBox.width / 2;
+            arrowRightPosition = Math.min(arrowRightPosition, newElementPosition.width - borderRadius - arrowOffset);
             this._popupArrowElement.style.right = arrowRightPosition + "px";
         } else {
             newElementPosition.x = borderRadius;
@@ -226,7 +246,7 @@ WebInspector.PopoverHelper.prototype = {
         this._resetHoverTimer();
         if (event.which && this._disableOnClick)
             return;
-        this._hoverElement = this._getAnchor(event.target);
+        this._hoverElement = this._getAnchor(event.target, event);
         if (!this._hoverElement)
             return;
         const toolTipDelay = isMouseDown ? 0 : (this._popup ? this._timeout * 0.6 : this._timeout);
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index ca754d57e..040c83a16 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -49,6 +49,7 @@ WebInspector.MIMETypes = {
     "image/x-xbitmap":             {2: true},
     "font/ttf":                    {3: true},
     "font/opentype":               {3: true},
+    "font/woff":                   {3: true},
     "application/x-font-type1":    {3: true},
     "application/x-font-ttf":      {3: true},
     "application/x-font-woff":     {3: true},
diff --git a/Source/WebCore/inspector/front-end/ResourceUtils.js b/Source/WebCore/inspector/front-end/ResourceUtils.js
index c0a31bf52..501df10ea 100644
--- a/Source/WebCore/inspector/front-end/ResourceUtils.js
+++ b/Source/WebCore/inspector/front-end/ResourceUtils.js
@@ -190,7 +190,7 @@ WebInspector.formatLinkText = function(url, lineNumber)
 
 /**
  * @param {string} url
- * @param {number} lineNumber
+ * @param {number=} lineNumber
  * @param {string=} classes
  * @param {string=} tooltipText
  * @return {Element}
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 7c6e6b167..219b01b75 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -52,6 +52,11 @@ WebInspector.ResourcesPanel = function(database)
     this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Databases"), "Databases", ["database-storage-tree-item"]);
     this.sidebarTree.appendChild(this.databasesListTreeElement);
 
+    if (WebInspector.experimentsSettings.showIndexedDB.isEnabled()) {
+        this.indexedDBListTreeElement = new WebInspector.IndexedDBTreeElement(this);
+        this.sidebarTree.appendChild(this.indexedDBListTreeElement);
+    }
+
     this.localStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Local Storage"), "LocalStorage", ["domstorage-storage-tree-item", "local-storage"]);
     this.sidebarTree.appendChild(this.localStorageListTreeElement);
 
@@ -456,6 +461,14 @@ WebInspector.ResourcesPanel.prototype = {
         this._innerShowView(view);
     },
 
+    /**
+     * @param {WebInspector.View} view
+     */
+    showIndexedDB: function(view)
+    {
+        this._innerShowView(view);
+    },
+
     showDOMStorage: function(domStorage)
     {
         if (!domStorage)
@@ -565,11 +578,11 @@ WebInspector.ResourcesPanel.prototype = {
     _populateApplicationCacheTree: function()
     {
         this._applicationCacheModel = new WebInspector.ApplicationCacheModel();
-        
+
         this._applicationCacheViews = {};
         this._applicationCacheFrameElements = {};
         this._applicationCacheManifestElements = {};
-        
+
         this._applicationCacheModel.addEventListener(WebInspector.ApplicationCacheModel.EventTypes.FrameManifestAdded, this._applicationCacheFrameManifestAdded, this);
         this._applicationCacheModel.addEventListener(WebInspector.ApplicationCacheModel.EventTypes.FrameManifestRemoved, this._applicationCacheFrameManifestRemoved, this);
 
@@ -934,7 +947,7 @@ WebInspector.BaseStorageTreeElement.prototype = {
     _updateTitle: function()
     {
         this._updateDisplayName();
-        
+
         if (!this.titleElement)
             return;
 
@@ -944,7 +957,7 @@ WebInspector.BaseStorageTreeElement.prototype = {
     _updateSubtitle: function()
     {
         this._updateDisplayName();
-        
+
         if (!this.titleElement)
             return;
 
@@ -1484,6 +1497,288 @@ WebInspector.DatabaseTableTreeElement.prototype.__proto__ = WebInspector.BaseSto
 
 /**
  * @constructor
+ * @extends {WebInspector.StorageCategoryTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ */
+WebInspector.IndexedDBTreeElement = function(storagePanel)
+{
+    WebInspector.StorageCategoryTreeElement.call(this, storagePanel, WebInspector.UIString("IndexedDB"), "IndexedDB", ["indexed-db-storage-tree-item"]);
+}
+
+WebInspector.IndexedDBTreeElement.prototype = {
+    onexpand: function()
+    {
+        WebInspector.StorageCategoryTreeElement.prototype.onexpand.call(this);
+        if (!this._indexedDBModel)
+            this._createIndexedDBModel();
+    },
+
+    _createIndexedDBModel: function()
+    {
+        this._indexedDBModel = new WebInspector.IndexedDBModel();
+        this._idbDatabaseTreeElements = [];
+        this._indexedDBModel.addEventListener(WebInspector.IndexedDBModel.EventTypes.DatabaseAdded, this._indexedDBAdded, this);
+        this._indexedDBModel.addEventListener(WebInspector.IndexedDBModel.EventTypes.DatabaseRemoved, this._indexedDBRemoved, this);
+        this._indexedDBModel.addEventListener(WebInspector.IndexedDBModel.EventTypes.DatabaseLoaded, this._indexedDBLoaded, this);
+    },
+
+    refreshIndexedDB: function()
+    {
+        if (!this._indexedDBModel) {
+            this._createIndexedDBModel();
+            return;
+        }
+
+        this._indexedDBModel.refreshDatabaseNames();
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _indexedDBAdded: function(event)
+    {
+        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ event.data;
+
+        var idbDatabaseTreeElement = new WebInspector.IDBDatabaseTreeElement(this._storagePanel, this._indexedDBModel, databaseId);
+        this._idbDatabaseTreeElements.push(idbDatabaseTreeElement);
+        this.appendChild(idbDatabaseTreeElement);
+
+        this._indexedDBModel.refreshDatabase(databaseId);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _indexedDBRemoved: function(event)
+    {
+        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ event.data;
+
+        var idbDatabaseTreeElement = this._idbDatabaseTreeElement(databaseId)
+        if (!idbDatabaseTreeElement)
+            return;
+
+        this.removeChild(idbDatabaseTreeElement);
+        this._idbDatabaseTreeElements.remove(idbDatabaseTreeElement);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _indexedDBLoaded: function(event)
+    {
+        var database = /** @type {WebInspector.IndexedDBModel.Database} */ event.data;
+
+        var idbDatabaseTreeElement = this._idbDatabaseTreeElement(database.databaseId)
+        if (!idbDatabaseTreeElement)
+            return;
+
+        idbDatabaseTreeElement.update(database);
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @return {WebInspector.IDBDatabaseTreeElement}
+     */
+    _idbDatabaseTreeElement: function(databaseId)
+    {
+        var index = -1;
+        for (var i = 0; i < this._idbDatabaseTreeElements.length; ++i) {
+            if (this._idbDatabaseTreeElements[i]._databaseId.equals(databaseId)) {
+                index = i;
+                break;
+            }
+        }
+        if (index !== -1)
+            return this._idbDatabaseTreeElements[i];
+        return null;
+    }
+}
+
+WebInspector.IndexedDBTreeElement.prototype.__proto__ = WebInspector.StorageCategoryTreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.BaseStorageTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ */
+WebInspector.IDBDatabaseTreeElement = function(storagePanel, model, databaseId)
+{
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, databaseId.name + " - " + databaseId.securityOrigin, ["indexed-db-storage-tree-item"]);
+    this._model = model;
+    this._databaseId = databaseId;
+    this._idbObjectStoreTreeElements = {};
+}
+
+WebInspector.IDBDatabaseTreeElement.prototype = {
+    get itemURL()
+    {
+        return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name;
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.Database} database
+     */
+    update: function(database)
+    {
+        this._database = database;
+        var objectStoreNames = {};
+        for (var objectStoreName in this._database.objectStores) {
+            var objectStore = this._database.objectStores[objectStoreName];
+            objectStoreNames[objectStore.name] = true;
+            if (!this._idbObjectStoreTreeElements[objectStore.name]) {
+                var idbObjectStoreTreeElement = new WebInspector.IDBObjectStoreTreeElement(this._storagePanel, this._model, this._databaseId, objectStore);
+                this._idbObjectStoreTreeElements[objectStore.name] = idbObjectStoreTreeElement;
+                this.appendChild(idbObjectStoreTreeElement);
+            }
+            this._idbObjectStoreTreeElements[objectStore.name].update(objectStore);
+        }
+        for (var objectStoreName in this._idbObjectStoreTreeElements) {
+            if (!objectStoreNames[objectStoreName]) {
+                this.removeChild(this._idbObjectStoreTreeElements[objectStoreName]);
+                delete this._idbObjectStoreTreeElements[objectStoreName];
+            }
+        }
+        
+        if (this.children.length) {
+            this.hasChildren = true;
+            this.expand();
+        }
+
+        if (this._view)
+            this._view.update(database);
+    },
+
+    onselect: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
+        if (!this._view)
+            this._view = new WebInspector.IDBDatabaseView(this._database);
+
+        this._storagePanel.showIndexedDB(this._view);        
+    }
+}
+
+WebInspector.IDBDatabaseTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.BaseStorageTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+ */
+WebInspector.IDBObjectStoreTreeElement = function(storagePanel, model, databaseId, objectStore)
+{
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, objectStore.name, ["indexed-db-object-store-storage-tree-item"]);
+    this._model = model;
+    this._databaseId = databaseId;
+    this._idbIndexTreeElements = {};
+}
+
+WebInspector.IDBObjectStoreTreeElement.prototype = {
+    get itemURL()
+    {
+        return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name + "/" + this._objectStore.name;
+    },
+
+   /**
+     * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+     */
+    update: function(objectStore)
+    {
+        this._objectStore = objectStore;
+
+        var indexNames = {};
+        for (var indexName in this._objectStore.indexes) {
+            var index = this._objectStore.indexes[indexName];
+            indexNames[index.name] = true;
+            if (!this._idbIndexTreeElements[index.name]) {
+                var idbIndexTreeElement = new WebInspector.IDBIndexTreeElement(this._storagePanel, this._model, this._databaseId, this._objectStore, index);
+                this._idbIndexTreeElements[index.name] = idbIndexTreeElement;
+                this.appendChild(idbIndexTreeElement);
+            }
+            this._idbIndexTreeElements[index.name].update(index);
+        }
+        for (var indexName in this._idbIndexTreeElements) {
+            if (!indexNames[indexName]) {
+                this.removeChild(this._idbIndexTreeElements[indexName]);
+                delete this._idbIndexTreeElements[indexName];
+            }
+        }
+        
+        if (this.children.length) {
+            this.hasChildren = true;
+            this.expand();
+        }
+
+        if (this._view)
+            this._view.update(this._objectStore);
+    },
+
+    onselect: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
+        if (!this._view)
+            this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, null);
+
+        this._storagePanel.showIndexedDB(this._view);        
+    }
+}
+
+WebInspector.IDBObjectStoreTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.BaseStorageTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+ * @param {WebInspector.IndexedDBModel.Index} index
+ */
+WebInspector.IDBIndexTreeElement = function(storagePanel, model, databaseId, objectStore, index)
+{
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, index.name, ["indexed-db-index-storage-tree-item"]);
+    this._model = model;
+    this._databaseId = databaseId;
+    this._objectStore = objectStore;
+    this._index = index;
+}
+
+WebInspector.IDBIndexTreeElement.prototype = {
+    get itemURL()
+    {
+        return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name + "/" + this._objectStore.name + "/" + this._index.name;
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.Index} index
+     */
+    update: function(index)
+    {
+        this._index = index;
+        
+        if (this._view)
+            this._view.update(this._index);
+    },
+
+    onselect: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
+        if (!this._view)
+            this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, this._index);
+
+        this._storagePanel.showIndexedDB(this._view);        
+    }
+}
+
+WebInspector.IDBIndexTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
+
+/**
+ * @constructor
  * @extends {WebInspector.BaseStorageTreeElement}
  */
 WebInspector.DOMStorageTreeElement = function(storagePanel, domStorage, className)
diff --git a/Source/WebCore/inspector/front-end/ScriptsNavigator.js b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
index dad448ad7..0046517f5 100644
--- a/Source/WebCore/inspector/front-end/ScriptsNavigator.js
+++ b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
@@ -31,19 +31,21 @@
  * @extends {WebInspector.Object}
  * @constructor
  */
-WebInspector.ScriptsNavigator = function(presentationModel)
+WebInspector.ScriptsNavigator = function()
 {
     WebInspector.Object.call(this);
     
     this._tabbedPane = new WebInspector.TabbedPane();
     this._tabbedPane.shrinkableTabs = true;
 
-    this._presentationModel = presentationModel;
-
     this._tabbedPane.element.id = "scripts-navigator-tabbed-pane";
+    
+    this._tabbedPane.element.tabIndex = 0;
+    this._tabbedPane.element.addEventListener("focus", this.focus.bind(this), false);
   
     this._treeSearchBox = document.createElement("div");
     this._treeSearchBox.id = "scripts-navigator-tree-search-box";
+    this._tabbedPane.element.appendChild(this._treeSearchBox);
 
     this._navigatorScriptsTreeElement = document.createElement("ol");
     var scriptsView = new WebInspector.View();
@@ -67,9 +69,6 @@ WebInspector.ScriptsNavigator = function(presentationModel)
     this._scriptTreeElementsByUISourceCode = new Map();
     
     WebInspector.settings.showScriptFolders.addChangeListener(this._showScriptFoldersSettingChanged.bind(this));
-    
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasDisabled, this._reset, this);
-    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerReset, this._reset, this);
 }
 
 WebInspector.ScriptsNavigator.ScriptsTab = "scripts";
@@ -85,12 +84,35 @@ WebInspector.ScriptsNavigator.prototype = {
     },
 
     /**
+     * @type {WebInspector.View}
+     */
+    get view()
+    {
+        return this._tabbedPane;
+    },
+
+    /**
+     * @type {Element}
+     */
+    get element()
+    {
+        return this._tabbedPane.element;
+    },
+
+    /**
      * @param {Element} element
      */
     show: function(element)
     {
         this._tabbedPane.show(element);
-        element.appendChild(this._treeSearchBox);
+    },
+
+    focus: function()
+    {
+        if (this._tabbedPane.selectedTabId === WebInspector.ScriptsNavigator.ScriptsTab)
+            WebInspector.setCurrentFocusElement(this._navigatorScriptsTreeElement);
+        else
+            WebInspector.setCurrentFocusElement(this._navigatorContentScriptsTreeElement);
     },
 
     /**
@@ -195,20 +217,22 @@ WebInspector.ScriptsNavigator.prototype = {
             }
             treeElement = parent;
         }
+        this._scriptTreeElementsByUISourceCode.remove(uiSourceCode);
     },
     
     _showScriptFoldersSettingChanged: function()
     {
         var uiSourceCodes = this._navigatorScriptsTree.scriptTreeElements();
         uiSourceCodes = uiSourceCodes.concat(this._navigatorContentScriptsTree.scriptTreeElements());
-        this._reset();
+        this.reset();
         for (var i = 0; i < uiSourceCodes.length; ++i)
             this.addUISourceCode(uiSourceCodes[i]);
         
-        this.revealUISourceCode(this._lastSelectedUISourceCode);
+        if (this._lastSelectedUISourceCode)
+            this.revealUISourceCode(this._lastSelectedUISourceCode);
     },
     
-    _reset: function()
+    reset: function()
     {
         this._navigatorScriptsTree.stopSearch();
         this._navigatorScriptsTree.removeChildren();
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index 43325c00b..cd93e9ead 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -60,29 +60,33 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this.debugSidebarResizeWidgetElement.id = "scripts-debug-sidebar-resizer-widget";
     this.splitView.installResizer(this.debugSidebarResizeWidgetElement);
 
-    if (WebInspector.experimentsSettings.useScriptsNavigator.isEnabled()) {
+    WebInspector.settings.useScriptsNavigator = WebInspector.settings.createSetting("useScriptsNavigator", true);
+    if (WebInspector.settings.useScriptsNavigator.get()) {
         const initialNavigatorWidth = 225;
         const minimalViewsContainerWidthPercent = 50;
         this.editorView = new WebInspector.SplitView(WebInspector.SplitView.SidebarPosition.Left, "scriptsPanelNavigatorSidebarWidth", initialNavigatorWidth);
+        this.editorView.element.id = "scripts-editor-view";
 
         this.editorView.minimalSidebarWidth = Preferences.minScriptsSidebarWidth;
         this.editorView.minimalMainWidthPercent = minimalViewsContainerWidthPercent;
         this.editorView.show(this.splitView.mainElement);
 
-        this._fileSelector = new WebInspector.ScriptsNavigator(this._presentationModel);
-
+        this._navigator = new WebInspector.ScriptsNavigator();
+        this._navigatorView = this._navigator.view;
+        this._fileSelector = this._navigator;
         this._fileSelector.show(this.editorView.sidebarElement);
 
-        this._navigatorResizeWidgetElement = document.createElement("div");
-        this._navigatorResizeWidgetElement.id = "scripts-navigator-resizer-widget";
-        this.editorView.installResizer(this._navigatorResizeWidgetElement);
-        this.editorView.sidebarElement.appendChild(this._navigatorResizeWidgetElement);
-
-        this._editorContainer = new WebInspector.TabbedEditorContainer(this);
+        this._tabbedEditorContainer = new WebInspector.TabbedEditorContainer(this);
+        this._editorContainer = this._tabbedEditorContainer;
         this._editorContainer.show(this.editorView.mainElement);
         WebInspector.OpenResourceDialog.install(this, this._presentationModel, this.editorView.mainElement);
+
+        this._createNavigatorControls();
+        WebInspector.settings.navigatorHidden = WebInspector.settings.createSetting("navigatorHidden", true);
+        if (WebInspector.settings.navigatorHidden.get())
+            this._toggleNavigator();
     } else {
-        this._fileSelector = new WebInspector.ScriptsPanel.ComboBoxFileSelector(this._presentationModel);
+        this._fileSelector = new WebInspector.ScriptsPanel.ComboBoxFileSelector();
         this._fileSelector.show(this.splitView.mainElement);
 
         this._editorContainer = new WebInspector.ScriptsPanel.SingleFileEditorContainer(this);
@@ -115,7 +119,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
 
     this._debugSidebarContentsElement = document.createElement("div");
     this._debugSidebarContentsElement.id = "scripts-debug-sidebar-contents";
-    this.sidebarElement.appendChild(this._debugSidebarContentsElement);    
+    this.sidebarElement.appendChild(this._debugSidebarContentsElement);
 
     for (var pane in this.sidebarPanes)
         this._debugSidebarContentsElement.appendChild(this.sidebarPanes[pane].element);
@@ -179,13 +183,13 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.ConsoleCommandEvaluatedInSelectedCallFrame, this._consoleCommandEvaluatedInSelectedCallFrame, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.ExecutionLineChanged, this._executionLineChanged, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerReset, this._reset.bind(this, false));
-    
+
     var enableDebugger = !Capabilities.debuggerCausesRecompilation || WebInspector.settings.debuggerEnabled.get();
     if (enableDebugger)
         WebInspector.debuggerModel.enableDebugger();
 
     WebInspector.advancedSearchController.registerSearchScope(new WebInspector.ScriptsSearchScope());
-    
+
     this._sourceFramesByUISourceCode = new Map();
 }
 
@@ -223,6 +227,8 @@ WebInspector.ScriptsPanel.prototype = {
         if (Capabilities.nativeInstrumentationEnabled)
             this._debugSidebarContentsElement.insertBefore(this.sidebarPanes.domBreakpoints.element, this.sidebarPanes.xhrBreakpoints.element);
         this.sidebarPanes.watchExpressions.show();
+
+        window.setTimeout(this._maybeShowNavigatorOverlay.bind(this), 0);
     },
 
     breakpointsActivated: function()
@@ -255,6 +261,15 @@ WebInspector.ScriptsPanel.prototype = {
             // Anonymous sources are shown only when stepping.
             return;
         }
+
+        this._addUISourceCode(uiSourceCode);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    _addUISourceCode: function(uiSourceCode)
+    {
         this._fileSelector.addUISourceCode(uiSourceCode);
         this._editorContainer.uiSourceCodeAdded(uiSourceCode);
     },
@@ -405,6 +420,7 @@ WebInspector.ScriptsPanel.prototype = {
         this._debuggerResumed();
 
         delete this._currentUISourceCode;
+        this._fileSelector.reset();
         this._editorContainer.reset();
         this._updateScriptViewStatusBarItems();
 
@@ -422,7 +438,7 @@ WebInspector.ScriptsPanel.prototype = {
     _updateScriptViewStatusBarItems: function()
     {
         this._scriptViewStatusBarItemsContainer.removeChildren();
-        
+
         var sourceFrame = this.visibleView;
         if (sourceFrame) {
             var statusBarItems = sourceFrame.statusBarItems || [];
@@ -600,7 +616,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         // Anonymous scripts are not added to files select by default.
-        this._fileSelector.addUISourceCode(uiLocation.uiSourceCode);
+        this._addUISourceCode(uiLocation.uiSourceCode);
 
         var sourceFrame = this._showFile(uiLocation.uiSourceCode);
         sourceFrame.setExecutionLine(uiLocation.lineNumber);
@@ -631,9 +647,9 @@ WebInspector.ScriptsPanel.prototype = {
 
         if (this._currentUISourceCode === uiSourceCode)
             delete this._currentUISourceCode;
-        
+
         // We don't need to update file selector here regardless of whether useScriptsNavigator is set or not:
-        // SingleFileEditorContainer never dispatches EditorClosed, so no need to update ComboBoxFileSelector; 
+        // SingleFileEditorContainer never dispatches EditorClosed, so no need to update ComboBoxFileSelector;
         // ScriptsNavigator does not need to update on EditorClosed.
 
         this._updateScriptViewStatusBarItems();
@@ -647,6 +663,8 @@ WebInspector.ScriptsPanel.prototype = {
 
     _fileSelected: function(event)
     {
+        if (this._navigatorOverlayShown)
+            this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
         this._showFile(uiSourceCode);
     },
@@ -897,7 +915,7 @@ WebInspector.ScriptsPanel.prototype = {
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift | platformSpecificModifier));
         this.stepOutButton = this._createButtonAndRegisterShortcuts("scripts-step-out", title, handler, shortcuts, WebInspector.UIString("Step out"));
         debugToolbar.appendChild(this.stepOutButton);
-        
+
         this.toggleBreakpointsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Deactivate all breakpoints."), "toggle-breakpoints");
         this.toggleBreakpointsButton.toggled = true;
         this.toggleBreakpointsButton.addEventListener("click", this._toggleBreakpointsClicked, this);
@@ -906,10 +924,129 @@ WebInspector.ScriptsPanel.prototype = {
         this.debuggerStatusElement = document.createElement("div");
         this.debuggerStatusElement.id = "scripts-debugger-status";
         debugToolbar.appendChild(this.debuggerStatusElement);
-        
+
         return debugToolbar;
     },
 
+    _createNavigatorControls: function()
+    {
+        this._navigatorSidebarResizeWidgetElement = document.createElement("div");
+        this._navigatorSidebarResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
+        this.editorView.installResizer(this._navigatorSidebarResizeWidgetElement);
+        this._navigatorView.element.appendChild(this._navigatorSidebarResizeWidgetElement);
+
+        this._navigatorShowHideButton = this._createNavigatorControlButton(WebInspector.UIString("Show scripts navigator"), "scripts-navigator-show-hide-button", this._toggleNavigator.bind(this));
+        this._navigatorShowHideButton.addStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
+        this.editorView.element.appendChild(this._navigatorShowHideButton);
+
+        this._navigatorPinButton = this._createNavigatorControlButton(WebInspector.UIString("Pin scripts navigator"), "scripts-navigator-pin-button", this._pinNavigator.bind(this));
+        this._navigatorPinButton.addStyleClass("hidden");
+        this._navigatorView.element.appendChild(this._navigatorPinButton);
+    },
+
+    _createNavigatorControlButton: function(title, id, listener)
+    {
+        var button = document.createElement("button");
+        button.title = title;
+        button.id = id;
+        button.addStyleClass("scripts-navigator-control-button");
+        button.addEventListener("click", listener, false);
+        button.createChild("div", "glyph");
+        return button;
+    },
+
+    _maybeShowNavigatorOverlay: function()
+    {
+        if (this._navigator && WebInspector.settings.navigatorHidden.get() && !this._navigatorWasOnceHidden)
+            this._showNavigatorOverlay();
+    },
+
+    _toggleNavigator: function()
+    {
+        if (this._navigatorOverlayShown)
+            this._hideNavigatorOverlay();
+        else if (this._navigatorHidden)
+            this._showNavigatorOverlay();
+        else
+            this._hidePinnedNavigator();
+    },
+
+    _hidePinnedNavigator: function()
+    {
+        this._navigatorHidden = true;
+        this._navigatorShowHideButton.removeStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Show scripts navigator");
+        this._tabbedEditorContainer.element.addStyleClass("navigator-hidden");
+        this._navigatorSidebarResizeWidgetElement.addStyleClass("hidden");
+
+        this._navigatorPinButton.removeStyleClass("hidden");
+
+        this.editorView.hideSidebarElement();
+        this._navigatorView.detach();
+        WebInspector.settings.navigatorHidden.set(true);
+    },
+
+    _pinNavigator: function()
+    {
+        delete this._navigatorHidden;
+        this._hideNavigatorOverlay();
+
+        this._navigatorPinButton.addStyleClass("hidden");
+        this._navigatorShowHideButton.addStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
+
+        this._tabbedEditorContainer.element.removeStyleClass("navigator-hidden");
+        this._navigatorSidebarResizeWidgetElement.removeStyleClass("hidden");
+
+        this.editorView.showSidebarElement();
+        this._navigator.show(this.editorView.sidebarElement);
+        this._navigator.focus();
+        WebInspector.settings.navigatorHidden.set(false);
+    },
+
+    _showNavigatorOverlay: function()
+    {
+        if (this._navigatorOverlayShown)
+            return;
+
+        this._navigatorOverlayShown = true;
+        var sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
+        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WasShown, this._navigatorOverlayWasShown, this);
+        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WillHide, this._navigatorOverlayWillHide, this);
+
+        var navigatorOverlayResizeWidgetElement = document.createElement("div");
+        navigatorOverlayResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
+        sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
+
+        sidebarOverlay.start(this.editorView.element);
+    },
+
+    _hideNavigatorOverlay: function()
+    {
+        if (!this._navigatorOverlayShown)
+            return;
+
+        WebInspector.Dialog.hide();
+    },
+
+    _navigatorOverlayWasShown: function(event)
+    {
+        this._navigatorView.element.appendChild(this._navigatorShowHideButton);
+        this._navigatorShowHideButton.addStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
+        this._navigator.focus();
+    },
+
+    _navigatorOverlayWillHide: function(event)
+    {
+        delete this._navigatorOverlayShown;
+        this._navigatorWasOnceHidden = true;
+        this.editorView.element.appendChild(this._navigatorShowHideButton);
+        this._navigatorShowHideButton.removeStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Show scripts navigator");
+    },
+
     _createButtonAndRegisterShortcuts: function(buttonId, buttonTitle, handler, shortcuts, shortcutDescription)
     {
         var button = document.createElement("button");
@@ -1047,7 +1184,7 @@ WebInspector.ScriptsPanel.FileSelector.prototype = {
      * @return {boolean}
      */
     isScriptSourceAdded: function(uiSourceCode) { },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
@@ -1063,7 +1200,9 @@ WebInspector.ScriptsPanel.FileSelector.prototype = {
      * @param {Array.<WebInspector.UISourceCode>} oldUISourceCodeList
      * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
      */
-    replaceUISourceCodes: function(oldUISourceCodeList, uiSourceCodeList) { }
+    replaceUISourceCodes: function(oldUISourceCodeList, uiSourceCodeList) { },
+
+    reset: function() { }
 }
 
 /**
@@ -1108,7 +1247,7 @@ WebInspector.EditorContainer.prototype = {
      * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
      */
     replaceFiles: function(oldUISourceCodeList, uiSourceCodeList) { },
-    
+
     reset: function() { }
 }
 
@@ -1130,16 +1269,13 @@ WebInspector.EditorContainerDelegate.prototype = {
  * @extends {WebInspector.Object}
  * @constructor
  */
-WebInspector.ScriptsPanel.ComboBoxFileSelector = function(presentationModel)
+WebInspector.ScriptsPanel.ComboBoxFileSelector = function()
 {
     WebInspector.Object.call(this);
     this.editorToolbar = this._createEditorToolbar();
-    
-    this._presentationModel = presentationModel;
+
     WebInspector.settings.showScriptFolders.addChangeListener(this._showScriptFoldersSettingChanged.bind(this));
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasDisabled, this._reset, this);
-    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerReset, this._reset, this);
-    
+
     this._backForwardList = [];
 }
 
@@ -1156,7 +1292,7 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
     {
         element.appendChild(this.editorToolbar);
     },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
@@ -1164,7 +1300,7 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
     {
         if (uiSourceCode._option)
             return;
-        
+
         this._addOptionToFilesSelect(uiSourceCode);
     },
 
@@ -1186,7 +1322,7 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
             return;
         this._innerRevealUISourceCode(uiSourceCode, true);
     },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      * @param {boolean} addToHistory
@@ -1198,12 +1334,12 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
 
         if (addToHistory)
             this._addToHistory(uiSourceCode);
-        
+
         this._updateBackAndForwardButtons();
         this._filesSelectElement.selectedIndex = uiSourceCode._option.index;
         this.dispatchEventToListeners(WebInspector.ScriptsPanel.FileSelector.Events.FileSelected, uiSourceCode);
     },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
@@ -1238,25 +1374,25 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
             if (!option)
                 continue;
             added = true;
-            
+
             // FIXME: find out why we are getting here with option detached.
             if (this._filesSelectElement === option.parentElement)
                 this._filesSelectElement.removeChild(option);
-            
+
             if (selectedUISourceCode === oldUISourceCodeList[i])
                 selected = true;
         }
-            
+
         if (!added)
             return;
-        
+
         for (var i = 0; i < uiSourceCodeList.length; ++i)
             this._addOptionToFilesSelect(uiSourceCodeList[i]);
 
         if (selected)
             this._filesSelectElement.selectedIndex = uiSourceCodeList[0]._option.index;
     },
-    
+
     _showScriptFoldersSettingChanged: function()
     {
         var selectedOption = this._filesSelectElement[this._filesSelectElement.selectedIndex];
@@ -1275,8 +1411,8 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
                 this._filesSelectElement.selectedIndex = index;
         }
     },
-    
-    _reset: function()
+
+    reset: function()
     {
         this._backForwardList = [];
         this._currentBackForwardIndex = -1;
@@ -1534,11 +1670,11 @@ WebInspector.ScriptsPanel.SingleFileEditorContainer.prototype = {
             this._currentSourceFrame.detach();
 
         this._initialViewSelectionProcessed = true;
-        
+
         var sourceFrame = this._delegate.viewForFile(uiSourceCode);
         this._currentSourceFrame = sourceFrame;
         this._currentFile = uiSourceCode;
-        
+
         if (userGesture) {
             this._userSelectedFiles = true;
             WebInspector.settings.lastViewedScriptFile.set(uiSourceCode.url);
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index 68bc38b3a..fba3c0f25 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -89,6 +89,7 @@ WebInspector.Settings = function()
     this.showScriptFolders = this.createSetting("showScriptFolders", true);
     this.dockToRight = this.createSetting("dockToRight", false);
     this.emulateTouchEvents = this.createSetting("emulateTouchEvents", false);
+    this.showPaintRects = this.createSetting("showPaintRects", false);
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
@@ -134,19 +135,23 @@ WebInspector.Setting.prototype = {
 
     get: function()
     {
-        var value = this._defaultValue;
+        if (typeof this._value !== "undefined")
+            return this._value;
+
+        this._value = this._defaultValue;
         if (window.localStorage != null && this._name in window.localStorage) {
             try {
-                value = JSON.parse(window.localStorage[this._name]);
+                this._value = JSON.parse(window.localStorage[this._name]);
             } catch(e) {
                 window.localStorage.removeItem(this._name);
             }
         }
-        return value;
+        return this._value;
     },
 
     set: function(value)
     {
+        this._value = value;
         if (window.localStorage != null) {
             try {
                 window.localStorage[this._name] = JSON.stringify(value);
@@ -168,12 +173,12 @@ WebInspector.ExperimentsSettings = function()
     this._enabledForTest = {};
     
     // Add currently running experiments here.
-    // FIXME: Move out from experiments once navigator is production-ready.
-    this.useScriptsNavigator = this._createExperiment("useScriptsNavigator", "Use file navigator and tabbed editor container in scripts panel");
     this.sourceFrameAlwaysEditable = this._createExperiment("sourceFrameAlwaysEditable", "Make resources always editable");
-    this.freeFlowDOMEditing = this._createExperiment("freeFlowDOMEditing", "Enable free flow DOM editing");
     this.showMemoryCounters = this._createExperiment("showMemoryCounters", "Show memory counters in Timeline panel");
-    this.singleClickEditing = this._createExperiment("singleClickEditing", "Single click CSS editing");
+    this.timelineStartAtZero = this._createExperiment("timelineStartAtZero", "Enable start at zero mode in Timeline panel");
+    // FIXME: Enable http/tests/inspector/indexeddb/resources-panel.html when removed from experiments.
+    this.showIndexedDB = this._createExperiment("showIndexedDB", "Show IndexedDB in Resources panel");
+    this.debugCSS = this._createExperiment("debugCSS", "Load CSS via link tags for debugging");
 
     this._cleanUpSetting();
 }
diff --git a/Source/WebCore/inspector/front-end/SettingsScreen.js b/Source/WebCore/inspector/front-end/SettingsScreen.js
index 8d8eac08a..f92fb1e9b 100644
--- a/Source/WebCore/inspector/front-end/SettingsScreen.js
+++ b/Source/WebCore/inspector/front-end/SettingsScreen.js
@@ -47,6 +47,10 @@ WebInspector.SettingsScreen = function()
         if (Preferences.exposeDisableCache)
             p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Disable cache"), WebInspector.settings.cacheDisabled));
     }
+    
+    p = this._appendSection(WebInspector.UIString("Rendering"));
+    p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show paint rectangles"), WebInspector.settings.showPaintRects));
+    WebInspector.settings.showPaintRects.addChangeListener(this._showPaintRectsChanged, this);
 
     p = this._appendSection(WebInspector.UIString("Elements"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Word wrap"), WebInspector.settings.domWordWrap));
@@ -72,6 +76,7 @@ WebInspector.SettingsScreen = function()
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Emulate touch events"), WebInspector.settings.emulateTouchEvents));
 
     p = this._appendSection(WebInspector.UIString("Scripts"), true);
+    p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Use file navigator and tabbed editor container in scripts panel"), WebInspector.settings.useScriptsNavigator));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show script folders"), WebInspector.settings.showScriptFolders));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Search in content scripts"), WebInspector.settings.searchInContentScripts));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Enable source maps"), WebInspector.settings.sourceMapsEnabled));
@@ -372,6 +377,11 @@ WebInspector.SettingsScreen.prototype = {
 
         selectionChanged.call(this);
         return fieldsetElement;
+    },
+
+    _showPaintRectsChanged: function()
+    {
+        PageAgent.setShowPaintRects(WebInspector.settings.showPaintRects.get());
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/SidebarOverlay.js b/Source/WebCore/inspector/front-end/SidebarOverlay.js
new file mode 100644
index 000000000..17c93e5c8
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/SidebarOverlay.js
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.DialogDelegate}
+ * @param {WebInspector.View} view
+ * @param {string} widthSettingName
+ * @param {number} minimalWidth
+ */
+WebInspector.SidebarOverlay = function(view, widthSettingName, minimalWidth)
+{
+    WebInspector.DialogDelegate.call(this);
+    
+    this._view = view;
+    this._widthSettingName = widthSettingName;
+    this._minimalWidth = minimalWidth;
+    this._savedWidth = minimalWidth || 300;
+    
+    if (this._widthSettingName)
+        WebInspector.settings[this._widthSettingName] = WebInspector.settings.createSetting(this._widthSettingName, undefined);
+    
+    this._resizerElement = document.createElement("div");
+    this._resizerElement.className = "sidebar-overlay-resizer";
+    this._installResizer(this._resizerElement);
+}
+
+WebInspector.SidebarOverlay.EventTypes = {
+    WasShown: "WasShown",
+    WillHide: "WillHide"
+}
+
+WebInspector.SidebarOverlay.prototype = {
+    /**
+     * @param {Element} element
+     */
+    show: function(element)
+    {
+        this._element = element;
+        element.addStyleClass("sidebar-overlay-dialog");
+        this._view.markAsRoot();
+        this._view.show(element);
+        this._element.appendChild(this._resizerElement);
+        if (this._resizerWidgetElement)
+            this._element.appendChild(this._resizerWidgetElement);
+
+        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WasShown, null);
+    },
+
+    /**
+     * @param {Element} element
+     * @param {Element} relativeToElement
+     */
+    position: function(element, relativeToElement)
+    {
+        this._totalWidth = relativeToElement.offsetWidth;
+        
+        var offset = relativeToElement.offsetRelativeToWindow(window);
+        element.style.left = offset.x + "px";
+        element.style.top = offset.y + "px";
+        this._setWidth(this._preferredWidth());
+        element.style.height = relativeToElement.offsetHeight + "px";
+    },
+
+    focus: function()
+    {
+        WebInspector.setCurrentFocusElement(this._view.element);
+    },
+
+    willHide: function() {
+        this._view.detach();
+        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WillHide, null);
+    },
+    
+    /**
+     * @param {Element} relativeToElement
+     */
+    start: function(relativeToElement)
+    {
+        WebInspector.Dialog.show(relativeToElement, this);
+    },
+    
+    /**
+     * @param {number} newWidth
+     */
+    _setWidth: function(newWidth)
+    {
+        var width = Number.constrain(newWidth, this._minimalWidth, this._totalWidth);
+        
+        if (this._width === width)
+            return;
+
+        this._element.style.width = width + "px";
+        this._resizerElement.style.left = (width - 3) + "px";
+        this._width = width;
+        this._view.doResize();
+        this._saveWidth();
+    },
+
+    /**
+     * @return {number}
+     */
+    _preferredWidth: function()
+    {
+        if (!this._widthSettingName)
+            return this._savedWidth;
+
+        return WebInspector.settings[this._widthSettingName].get() || this._savedWidth;
+    },
+    
+    _saveWidth: function()
+    {
+        this._savedWidth = this._width;
+        if (!this._widthSettingName)
+            return;
+
+        WebInspector.settings[this._widthSettingName].set(this._width);
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _startResizerDragging: function(event)
+    {
+        var width = this._width;
+        this._dragOffset = width - event.pageX;
+        WebInspector.elementDragStart(this._resizerElement, this._resizerDragging.bind(this), this._endResizerDragging.bind(this), event, "ew-resize");
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _resizerDragging: function(event)
+    {
+        var width = event.pageX + this._dragOffset;
+        this._setWidth(width);
+        event.preventDefault();
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _endResizerDragging: function(event)
+    {
+        delete this._dragOffset;
+        WebInspector.elementDragEnd(event);
+    },
+
+    /**
+     * @param {Element} resizerElement
+     */
+    _installResizer: function(resizerElement)
+    {
+        resizerElement.addEventListener("mousedown", this._startResizerDragging.bind(this), false);
+    },
+
+    /**
+     * @type {Element}
+     */
+    set resizerWidgetElement(resizerWidgetElement)
+    {
+        this._resizerWidgetElement = resizerWidgetElement;
+        this._installResizer(resizerWidgetElement);
+    }
+}
+
+WebInspector.SidebarOverlay.prototype.__proto__ = WebInspector.DialogDelegate.prototype;
diff --git a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
index ca22c47d1..903e19d2a 100644
--- a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
+++ b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
@@ -50,13 +50,6 @@ WebInspector.SourceJavaScriptTokenizer = function()
 {
     WebInspector.SourceTokenizer.call(this);
 
-    this._keywords = [
-        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
-        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
-        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
-        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
-    ].keySet();
-
     this._lexConditions = {
         DIV: 0,
         NODIV: 1,
@@ -76,6 +69,13 @@ WebInspector.SourceJavaScriptTokenizer = function()
     this.condition = this.createInitialCondition();
 }
 
+WebInspector.SourceJavaScriptTokenizer.Keywords = [
+        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
+        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
+        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
+        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
+    ].keySet();
+
 WebInspector.SourceJavaScriptTokenizer.prototype = {
     createInitialCondition: function()
     {
@@ -257,7 +257,7 @@ case 20:
 case 21:
             {
                     var token = this._line.substring(cursorOnEnter, cursor);
-                    if (this._keywords[token] === true && token !== "__proto__")
+                    if (WebInspector.SourceJavaScriptTokenizer.Keywords[token] === true && token !== "__proto__")
                         this.tokenType = "javascript-keyword";
                     else
                         this.tokenType = "javascript-ident";
@@ -1189,7 +1189,7 @@ case 142:
             this.setLexCondition(this._lexConditions.DIV);
             {
                     var token = this._line.substring(cursorOnEnter, cursor);
-                    if (this._keywords[token] === true && token !== "__proto__")
+                    if (WebInspector.SourceJavaScriptTokenizer.Keywords[token] === true && token !== "__proto__")
                         this.tokenType = "javascript-keyword";
                     else
                         this.tokenType = "javascript-ident";
diff --git a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
index 17d6158cd..969c4db24 100644
--- a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
+++ b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
@@ -49,13 +49,6 @@ WebInspector.SourceJavaScriptTokenizer = function()
 {
     WebInspector.SourceTokenizer.call(this);
 
-    this._keywords = [
-        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
-        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
-        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
-        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
-    ].keySet();
-
     this._lexConditions = {
         DIV: 0,
         NODIV: 1,
@@ -75,6 +68,13 @@ WebInspector.SourceJavaScriptTokenizer = function()
     this.condition = this.createInitialCondition();
 }
 
+WebInspector.SourceJavaScriptTokenizer.Keywords = [
+        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
+        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
+        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
+        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
+    ].keySet();
+
 WebInspector.SourceJavaScriptTokenizer.prototype = {
     createInitialCondition: function()
     {
@@ -170,7 +170,7 @@ WebInspector.SourceJavaScriptTokenizer.prototype = {
                 <DIV,NODIV> Identifier => DIV
                 {
                     var token = this._line.substring(cursorOnEnter, cursor);
-                    if (this._keywords[token] === true && token !== "__proto__")
+                    if (WebInspector.SourceJavaScriptTokenizer.Keywords[token] === true && token !== "__proto__")
                         this.tokenType = "javascript-keyword";
                     else
                         this.tokenType = "javascript-ident";
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
new file mode 100644
index 000000000..3f9a58e44
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -0,0 +1,424 @@
+/*
+ * Copyright (C) 2011 Brian Grinstead All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.Spectrum = function()
+{
+    this._popover = new WebInspector.Popover();
+    this._popover.setCanShrink(false);
+    this._popover.element.addEventListener("mousedown", stopPropagation, false);
+
+    this._containerElement = document.createElement('div');
+    this._containerElement.className = "spectrum-container";
+
+    var topElement = this._containerElement.createChild("div", "spectrum-top");
+    topElement.createChild("div", "spectrum-fill");
+
+    var topInnerElement = topElement.createChild("div", "spectrum-top-inner fill");
+    this._draggerElement = topInnerElement.createChild("div", "spectrum-color");
+    this._dragHelperElement = this._draggerElement.createChild("div", "spectrum-sat fill").createChild("div", "spectrum-val fill").createChild("div", "spectrum-dragger");
+
+    this._sliderElement = topInnerElement.createChild("div", "spectrum-hue");
+    this.slideHelper = this._sliderElement.createChild("div", "spectrum-slider");
+
+    var rangeContainer = this._containerElement.createChild("div", "spectrum-range-container");
+    var alphaLabel = rangeContainer.createChild("label");
+    alphaLabel.textContent = WebInspector.UIString("\u03B1:");
+
+    this._alphaElement = rangeContainer.createChild("input", "spectrum-range");
+    this._alphaElement.setAttribute("type", "range");
+    this._alphaElement.setAttribute("min", "0");
+    this._alphaElement.setAttribute("max", "100");
+    this._alphaElement.addEventListener("change", alphaDrag.bind(this), false);
+
+    var swatchElement = document.createElement("span");
+    swatchElement.className = "swatch";
+    this._swatchInnerElement = swatchElement.createChild("span", "swatch-inner");
+
+    var displayContainer = this._containerElement.createChild("div");
+    displayContainer.appendChild(swatchElement);
+    this._displayElement = displayContainer.createChild("span", "source-code spectrum-display-value");
+
+    WebInspector.Spectrum.draggable(this._sliderElement, hueDrag.bind(this));
+    WebInspector.Spectrum.draggable(this._draggerElement, colorDrag.bind(this));
+
+    function hueDrag(element, dragX, dragY)
+    {
+        this.hsv[0] = (dragY / this.slideHeight);
+
+        this._onchange();
+    }
+
+    function colorDrag(element, dragX, dragY)
+    {
+        this.hsv[1] = dragX / this.dragWidth;
+        this.hsv[2] = (this.dragHeight - dragY) / this.dragHeight;
+
+        this._onchange();
+    }
+
+    function alphaDrag()
+    {
+        this.hsv[3] = this._alphaElement.value / 100;
+
+        this._onchange();
+    }
+
+    this._hideProxy = this.hide.bind(this);
+};
+
+WebInspector.Spectrum.Events = {
+    ColorChanged: "ColorChanged",
+    Hidden: "Hidden"
+};
+
+WebInspector.Spectrum.hsvaToRGBA = function(h, s, v, a)
+{
+    var r, g, b;
+
+    var i = Math.floor(h * 6);
+    var f = h * 6 - i;
+    var p = v * (1 - s);
+    var q = v * (1 - f * s);
+    var t = v * (1 - (1 - f) * s);
+
+    switch(i % 6) {
+    case 0:
+        r = v, g = t, b = p;
+        break;
+    case 1:
+        r = q, g = v, b = p;
+        break;
+    case 2:
+        r = p, g = v, b = t;
+        break;
+    case 3:
+        r = p, g = q, b = v;
+        break;
+    case 4:
+        r = t, g = p, b = v;
+        break;
+    case 5:
+        r = v, g = p, b = q;
+        break;
+    }
+
+    return [Math.round(r * 255), Math.round(g * 255), Math.round(b * 255), a];
+};
+
+WebInspector.Spectrum.rgbaToHSVA = function(r, g, b, a)
+{
+    r = r / 255;
+    g = g / 255;
+    b = b / 255;
+
+    var max = Math.max(r, g, b);
+    var min = Math.min(r, g, b);
+    var h;
+    var s;
+    var v = max;
+
+    var d = max - min;
+    s = max ? d / max : 0;
+
+    if(max === min) {
+        // Achromatic.
+        h = 0;
+    } else {
+        switch(max) {
+        case r:
+            h = (g - b) / d + (g < b ? 6 : 0);
+            break;
+        case g:
+            h = (b - r) / d + 2;
+            break;
+        case b:
+            h = (r - g) / d + 4;
+            break;
+        }
+        h /= 6;
+    }
+    return [h, s, v, a];
+};
+
+//FIXME: migrate to WebInspector.elementDragStart
+/**
+ * @param {Function=} onmove
+ * @param {Function=} onstart
+ * @param {Function=} onstop
+ */
+WebInspector.Spectrum.draggable = function(element, onmove, onstart, onstop) {
+
+    var doc = document;
+    var dragging;
+    var offset;
+    var scrollOffset;
+    var maxHeight;
+    var maxWidth;
+
+    function prevent(e)
+    {
+        if (e.stopPropagation)
+            e.stopPropagation();
+
+        if (e.preventDefault)
+            e.preventDefault();
+    }
+
+    function move(e)
+    {
+        if (dragging) {
+            var dragX = Math.max(0, Math.min(e.pageX - offset.left + scrollOffset.left, maxWidth));
+            var dragY = Math.max(0, Math.min(e.pageY - offset.top + scrollOffset.top, maxHeight));
+
+            if (onmove)
+                onmove(element, dragX, dragY);
+        }
+    }
+
+    function start(e)
+    {
+        var rightClick = e.which ? (e.which === 3) : (e.button === 2);
+
+        if (!rightClick && !dragging) {
+
+            if (onstart)
+                onstart(element, e)
+
+            dragging = true;
+            maxHeight = element.clientHeight;
+            maxWidth = element.clientWidth;
+
+            scrollOffset = element.scrollOffset();
+            offset = element.totalOffset();
+
+            doc.addEventListener("selectstart", prevent, false);
+            doc.addEventListener("dragstart", prevent, false);
+            doc.addEventListener("mousemove", move, false);
+            doc.addEventListener("mouseup", stop, false);
+
+            move(e);
+            prevent(e);
+        }
+    }
+
+    function stop(e)
+    {
+        if (dragging) {
+            doc.removeEventListener("selectstart", prevent, false);
+            doc.removeEventListener("dragstart", prevent, false);
+            doc.removeEventListener("mousemove", move, false);
+            doc.removeEventListener("mouseup", stop, false);
+
+            if (onstop)
+                onstop(element, e);
+        }
+
+        dragging = false;
+    }
+
+    element.addEventListener("mousedown", start, false);
+};
+
+WebInspector.Spectrum.prototype = {
+    set color(color)
+    {
+        var rgba = (color.rgba || color.rgb).slice(0);
+
+        if (rgba.length === 3)
+            rgba[3] = 1;
+
+        this.hsv = WebInspector.Spectrum.rgbaToHSVA(rgba[0], rgba[1], rgba[2], rgba[3]);
+    },
+
+    get color()
+    {
+        var rgba = WebInspector.Spectrum.hsvaToRGBA(this.hsv[0], this.hsv[1], this.hsv[2], this.hsv[3]);
+        var color;
+
+        if (rgba[3] === 1)
+            color = WebInspector.Color.fromRGB(rgba[0], rgba[1], rgba[2]);
+        else
+            color = WebInspector.Color.fromRGBA(rgba[0], rgba[1], rgba[2], rgba[3]);
+
+        var colorValue = color.toString(this.outputColorFormat);
+        if (!colorValue)
+            colorValue = color.toString(); // this.outputColorFormat can be invalid for current color (e.g. "nickname").
+        return new WebInspector.Color(colorValue);
+    },
+
+    get outputColorFormat()
+    {
+        var cf = WebInspector.StylesSidebarPane.ColorFormat;
+        var format = this._originalFormat;
+
+        if (this.hsv[3] === 1) {
+            // Simplify transparent formats.
+            if (format === cf.RGBA)
+                format = cf.RGB;
+            else if (format === cf.HSLA)
+                format = cf.HSL;
+        } else {
+            // Everything except HSL(A) should be returned as RGBA if transparency is involved.
+            if (format === cf.HSL || format === cf.HSLA)
+                format = cf.HSLA;
+            else
+                format = cf.RGBA;
+        }
+
+        return format;
+    },
+
+    get colorHueOnly()
+    {
+        var rgba = WebInspector.Spectrum.hsvaToRGBA(this.hsv[0], 1, 1, 1);
+        return WebInspector.Color.fromRGBA(rgba[0], rgba[1], rgba[2], rgba[3]);
+    },
+
+    set displayText(text)
+    {
+        this._displayElement.textContent = text;
+    },
+
+    get visible()
+    {
+        return this._popover.visible;
+    },
+
+    _onchange: function()
+    {
+        this._updateUI();
+        this.dispatchEventToListeners(WebInspector.Spectrum.Events.ColorChanged, this.color);
+    },
+
+    _updateHelperLocations: function()
+    {
+        var h = this.hsv[0];
+        var s = this.hsv[1];
+        var v = this.hsv[2];
+
+        // Where to show the little circle that displays your current selected color.
+        var dragX = s * this.dragWidth;
+        var dragY = this.dragHeight - (v * this.dragHeight);
+
+        dragX = Math.max(-this._dragHelperElementHeight,
+                        Math.min(this.dragWidth - this._dragHelperElementHeight, dragX - this._dragHelperElementHeight));
+        dragY = Math.max(-this._dragHelperElementHeight,
+                        Math.min(this.dragHeight - this._dragHelperElementHeight, dragY - this._dragHelperElementHeight));
+
+        this._dragHelperElement.positionAt(dragX, dragY);
+
+        // Where to show the bar that displays your current selected hue.
+        var slideY = (h * this.slideHeight) - this.slideHelperHeight;
+        this.slideHelper.style.top = slideY + "px";
+
+        this._alphaElement.value = this.hsv[3] * 100;
+    },
+
+    _updateUI: function()
+    {
+        this._updateHelperLocations();
+
+        var rgb = (this.color.rgba || this.color.rgb).slice(0);
+
+        if (rgb.length === 3)
+            rgb[3] = 1;
+
+        var rgbHueOnly = this.colorHueOnly.rgb;
+
+        var flatColor = "rgb(" + rgbHueOnly[0] + ", " + rgbHueOnly[1] + ", " + rgbHueOnly[2] + ")";
+        var fullColor = "rgba(" + rgb[0] + ", " + rgb[1] + ", " + rgb[2] + ", " + rgb[3] + ")";
+
+        this._draggerElement.style.backgroundColor = flatColor;
+        this._swatchInnerElement.style.backgroundColor = fullColor;
+
+        this._alphaElement.value = this.hsv[3] * 100;
+    },
+
+    toggle: function(element, color, format)
+    {
+        if (this.visible)
+            this.hide();
+        else
+            this.show(element, color, format);
+
+        return this.visible;
+    },
+
+    show: function(element, color, format)
+    {
+        if (this.visible) {
+            if (this.anchorElement === element)
+                return false;
+
+            // Reopen the picker for another anchor element.
+            this.hide();
+        }
+
+        this.reposition(element);
+        this.anchorElement = element;
+
+        document.addEventListener("mousedown", this._hideProxy, false);
+        window.addEventListener("blur", this._hideProxy, false);
+
+        this.slideHeight = this._sliderElement.offsetHeight;
+        this.dragWidth = this._draggerElement.offsetWidth;
+        this.dragHeight = this._draggerElement.offsetHeight;
+        this._dragHelperElementHeight = this._dragHelperElement.offsetHeight / 2;
+        this.slideHelperHeight = this.slideHelper.offsetHeight / 2;
+
+        this.color = color;
+        this._originalFormat = format || color.format;
+
+        this._updateUI();
+
+        return true;
+    },
+
+    reposition: function(element)
+    {
+        this._popover.show(this._containerElement, element);
+    },
+
+    hide: function()
+    {
+        this._popover.hide();
+
+        document.removeEventListener("mousedown", this._hideProxy, false);
+        window.removeEventListener("blur", this._hideProxy, false);
+
+        this.dispatchEventToListeners(WebInspector.Spectrum.Events.Hidden);
+
+        delete this.anchorElement;
+    }
+};
+
+WebInspector.Spectrum.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/SplitView.js b/Source/WebCore/inspector/front-end/SplitView.js
index 71c12d8c5..5c5cf1783 100644
--- a/Source/WebCore/inspector/front-end/SplitView.js
+++ b/Source/WebCore/inspector/front-end/SplitView.js
@@ -73,7 +73,7 @@ WebInspector.SplitView = function(sidebarPosition, sidebarWidthSettingName, defa
 }
 
 WebInspector.SplitView.EventTypes = {
-    Resized: "Resized",
+    Resized: "Resized"
 }
 
 /**
@@ -114,7 +114,7 @@ WebInspector.SplitView.prototype = {
      */
     get resizable()
     {
-        return this._resizable && !this._mainElementHidden && !this._sidebarElementHidden
+        return this._resizable && !this._mainElementHidden && !this._sidebarElementHidden;
     },
 
     /**
@@ -288,6 +288,7 @@ WebInspector.SplitView.prototype = {
         this._mainElementHidden = true;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     showMainElement: function()
@@ -306,6 +307,7 @@ WebInspector.SplitView.prototype = {
         this._mainElementHidden = false;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     hideSidebarElement: function()
@@ -320,6 +322,7 @@ WebInspector.SplitView.prototype = {
         this._sidebarElementHidden = true;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     showSidebarElement: function()
@@ -331,6 +334,7 @@ WebInspector.SplitView.prototype = {
         this._sidebarElementHidden = false;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     wasShown: function()
@@ -366,7 +370,7 @@ WebInspector.SplitView.prototype = {
      */
     _resizerDragging: function(event)
     {
-        var leftWidth = event.pageX + this._dragOffset
+        var leftWidth = event.pageX + this._dragOffset;
         var rightWidth = this._totalWidth - leftWidth;
         var sidebarWidth = this.hasLeftSidebar ? leftWidth : rightWidth;
 
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index 4791b547b..dd273ae99 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -90,6 +90,8 @@ WebInspector.StylesSidebarPane = function(computedStylePane)
     this._sectionsContainer = document.createElement("div");
     this.bodyElement.appendChild(this._sectionsContainer);
 
+    this._spectrum = new WebInspector.Spectrum();
+
     WebInspector.cssModel.addEventListener(WebInspector.CSSStyleModel.Events.StyleSheetChanged, this._styleSheetOrMediaQueryResultChanged, this);
     WebInspector.cssModel.addEventListener(WebInspector.CSSStyleModel.Events.MediaQueryResultChanged, this._styleSheetOrMediaQueryResultChanged, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.AttrModified, this._attributesModified, this);
@@ -204,6 +206,9 @@ WebInspector.StylesSidebarPane.prototype = {
 
     update: function(node, forceUpdate)
     {
+        if (this._spectrum.visible)
+            this._spectrum.hide();
+
         var refresh = false;
 
         if (forceUpdate)
@@ -223,20 +228,80 @@ WebInspector.StylesSidebarPane.prototype = {
         else
             node = this.node;
 
-        this._innerUpdate(refresh);
+        if (refresh)
+            this._refreshUpdate();
+        else
+            this._rebuildUpdate();
+    },
+
+    /**
+     * @param {WebInspector.StylePropertiesSection=} editedSection
+     * @param {boolean=} forceFetchComputedStyle
+     * @param {function()=} userCallback
+     */
+    _refreshUpdate: function(editedSection, forceFetchComputedStyle, userCallback)
+    {
+        if (this._refreshUpdateInProgress) {
+            this._lastNodeForInnerRefresh = this.node;
+            return;
+        }
+
+        var node = this._validateNode(userCallback);
+        if (!node)
+            return;
+
+        function computedStyleCallback(computedStyle)
+        {
+            delete this._refreshUpdateInProgress;
+
+            if (this._lastNodeForInnerRefresh) {
+                delete this._lastNodeForInnerRefresh;
+                this._refreshUpdate(editedSection, forceFetchComputedStyle, userCallback);
+                return;
+            }
+
+            if (this.node === node && computedStyle)
+                this._innerRefreshUpdate(node, computedStyle, editedSection);
+
+            if (userCallback)
+                userCallback();
+        }
+
+        if (this._computedStylePane.expanded || forceFetchComputedStyle) {
+            this._refreshUpdateInProgress = true;
+            WebInspector.cssModel.getComputedStyleAsync(node.id, this._forcedPseudoClasses, computedStyleCallback.bind(this));
+        } else {
+            this._innerRefreshUpdate(node, null, editedSection);
+            if (userCallback)
+                userCallback();
+        }
     },
 
-    _executeRebuildUpdate: function(node, callback)
+    /**
+     * @param {function()=} userCallback
+     */
+    _rebuildUpdate: function(userCallback)
     {
+        if (this._rebuildUpdateInProgress) {
+            this._lastNodeForInnerRebuild = this.node;
+            return;
+        }
+
+        var node = this._validateNode(userCallback);
+        if (!node)
+            return;
+
+        this._rebuildUpdateInProgress = true;
+
         var resultStyles = {};
 
         function stylesCallback(matchedResult)
         {
-            delete this._innerUpdateInProgress;
+            delete this._rebuildUpdateInProgress;
 
-            if (this._lastNodeForInnerUpdate) {
-                delete this._lastNodeForInnerUpdate;
-                this._innerUpdate(false, null, callback);
+            if (this._lastNodeForInnerRebuild) {
+                delete this._lastNodeForInnerRebuild;
+                this._rebuildUpdate(userCallback);
                 return;
             }
 
@@ -244,10 +309,10 @@ WebInspector.StylesSidebarPane.prototype = {
                 resultStyles.matchedCSSRules = matchedResult.matchedCSSRules;
                 resultStyles.pseudoElements = matchedResult.pseudoElements;
                 resultStyles.inherited = matchedResult.inherited;
-                this._rebuildUpdate(node, resultStyles);
+                this._innerRebuildUpdate(node, resultStyles);
             }
-            if (callback)
-                callback();
+            if (userCallback)
+                userCallback();
         }
 
         function inlineCallback(inlineStyle, attributesStyle)
@@ -267,55 +332,17 @@ WebInspector.StylesSidebarPane.prototype = {
         WebInspector.cssModel.getMatchedStylesAsync(node.id, this._forcedPseudoClasses, true, true, stylesCallback.bind(this));
     },
 
-    _refreshComputedStyleSection: function(callback)
+    _validateNode: function(userCallback)
     {
-        this._innerUpdate(true, null, callback);
-    },
-
-    /**
-     * @param {WebInspector.StylePropertiesSection=} editedSection
-     * @param {function()=} userCallback
-     */
-    _innerUpdate: function(refresh, editedSection, userCallback)
-    {
-        if (this._innerUpdateInProgress) {
-            this._lastNodeForInnerUpdate = this.node;
-            return;
-        }
-
-        var node = this.node;
-        if (!node) {
+        if (!this.node) {
             this._sectionsContainer.removeChildren();
             this._computedStylePane.bodyElement.removeChildren();
             this.sections = {};
             if (userCallback)
                 userCallback();
-            return;
-        }
-
-        function computedStyleCallback(computedStyle)
-        {
-            delete this._innerUpdateInProgress;
-
-            if (this._lastNodeForInnerUpdate) {
-                delete this._lastNodeForInnerUpdate;
-                this._innerUpdate(refresh, editedSection, userCallback);
-                return;
-            }
-
-            if (this.node === node && computedStyle)
-                this._refreshUpdate(node, computedStyle, editedSection);
-
-            if (userCallback)
-                userCallback();
+            return null;
         }
-
-        this._innerUpdateInProgress = true;
-
-        if (refresh)
-            WebInspector.cssModel.getComputedStyleAsync(node.id, this._forcedPseudoClasses, computedStyleCallback.bind(this));
-        else
-            this._executeRebuildUpdate(node, userCallback);
+        return this.node;
     },
 
     _styleSheetOrMediaQueryResultChanged: function()
@@ -323,7 +350,7 @@ WebInspector.StylesSidebarPane.prototype = {
         if (this._userOperation || this._isEditingStyle)
             return;
 
-        this._innerUpdate(false);
+        this._rebuildUpdate();
     },
 
     _attributesModified: function(event)
@@ -337,7 +364,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
         // "class" (or any other) attribute might have changed. Update styles unless they are being edited.
         if (!this._isEditingStyle && !this._userOperation)
-            this._innerUpdate(false);
+            this._rebuildUpdate();
     },
 
     _attributesRemoved: function(event)
@@ -347,7 +374,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
         // "style" attribute might have been removed.
         if (!this._isEditingStyle && !this._userOperation)
-            this._innerUpdate(false);
+            this._rebuildUpdate();
     },
 
     _styleInvalidated: function(event)
@@ -356,10 +383,10 @@ WebInspector.StylesSidebarPane.prototype = {
             return;
 
         if (!this._isEditingStyle && !this._userOperation)
-            this._innerUpdate(false);
+            this._rebuildUpdate();
     },
 
-    _refreshUpdate: function(node, computedStyle, editedSection)
+    _innerRefreshUpdate: function(node, computedStyle, editedSection)
     {
         for (var pseudoId in this.sections) {
             var styleRules = this._refreshStyleRules(this.sections[pseudoId], computedStyle);
@@ -367,13 +394,13 @@ WebInspector.StylesSidebarPane.prototype = {
             this._markUsedProperties(styleRules, usedProperties);
             this._refreshSectionsForStyleRules(styleRules, usedProperties, editedSection);
         }
-        // Trace the computed style.
-        this.sections[0][0].rebuildComputedTrace(this.sections[0]);
+        if (computedStyle)
+            this.sections[0][0].rebuildComputedTrace(this.sections[0]);
 
-        this._nodeStylesUpdatedForTest(node, true);
+        this._nodeStylesUpdatedForTest(node, false);
     },
 
-    _rebuildUpdate: function(node, styles)
+    _innerRebuildUpdate: function(node, styles)
     {
         this._sectionsContainer.removeChildren();
         this._computedStylePane.bodyElement.removeChildren();
@@ -383,8 +410,9 @@ WebInspector.StylesSidebarPane.prototype = {
         this._markUsedProperties(styleRules, usedProperties);
         this.sections[0] = this._rebuildSectionsForStyleRules(styleRules, usedProperties, 0, null);
         var anchorElement = this.sections[0].inheritedPropertiesSeparatorElement;
-        // Trace the computed style.
-        this.sections[0][0].rebuildComputedTrace(this.sections[0]);
+
+        if (styles.computedStyle)        
+            this.sections[0][0].rebuildComputedTrace(this.sections[0]);
 
         for (var i = 0; i < styles.pseudoElements.length; ++i) {
             var pseudoElementCSSRules = styles.pseudoElements[i];
@@ -405,10 +433,10 @@ WebInspector.StylesSidebarPane.prototype = {
             this.sections[pseudoId] = this._rebuildSectionsForStyleRules(styleRules, usedProperties, pseudoId, anchorElement);
         }
 
-        this._nodeStylesUpdatedForTest(node, false);
+        this._nodeStylesUpdatedForTest(node, true);
     },
 
-    _nodeStylesUpdatedForTest: function(node, refresh)
+    _nodeStylesUpdatedForTest: function(node, rebuild)
     {
         // Tests override this method.
     },
@@ -780,7 +808,7 @@ WebInspector.StylesSidebarPane.prototype = {
                 for (var i = 0; i < this._elementStatePane.inputs.length; ++i)
                     this._elementStatePane.inputs[i].checked = false;
                 delete this._forcedPseudoClasses;
-                this._innerUpdate(false);
+                this._rebuildUpdate();
             }
         }
     },
@@ -802,7 +830,7 @@ WebInspector.StylesSidebarPane.prototype = {
                     pseudoClasses.push(inputs[i].state);
             }
             this._forcedPseudoClasses = pseudoClasses.length ? pseudoClasses : undefined;
-            this._innerUpdate(false);
+            this._rebuildUpdate();
         }
 
         function createCheckbox(state)
@@ -835,7 +863,13 @@ WebInspector.StylesSidebarPane.prototype = {
 
     _showUserAgentStylesSettingChanged: function()
     {
-        this._innerUpdate(false);
+        this._rebuildUpdate();
+    },
+
+    willHide: function()
+    {
+        if (this._spectrum.visible)
+            this._spectrum.hide();
     }
 }
 
@@ -878,7 +912,7 @@ WebInspector.ComputedStyleSidebarPane.prototype = {
             WebInspector.SidebarPane.prototype.expand.call(this);
         }
 
-        this._stylesSidebarPane._refreshComputedStyleSection(callback.bind(this));
+        this._stylesSidebarPane._refreshUpdate(null, true, callback.bind(this));
     }
 }
 
@@ -891,7 +925,7 @@ WebInspector.ComputedStyleSidebarPane.prototype.__proto__ = WebInspector.Sidebar
 WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable, isInherited, isFirstSection)
 {
     WebInspector.PropertiesSection.call(this, "");
-    this.element.className = "styles-section monospace" + (isFirstSection ? " first-styles-section" : "");
+    this.element.className = "styles-section matched-styles monospace" + (isFirstSection ? " first-styles-section" : "");
 
     if (styleRule.media) {
         for (var i = styleRule.media.length - 1; i >= 0; --i) {
@@ -913,7 +947,8 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
 
             if (media.sourceURL) {
                 var refElement = mediaDataElement.createChild("div", "subtitle");
-                var anchor = WebInspector.linkifyResourceAsNode(media.sourceURL, media.sourceLine < 0 ? undefined : media.sourceLine, "subtitle");
+                var lineNumber = media.sourceLine < 0 ? undefined : media.sourceLine;
+                var anchor = WebInspector.linkifyResourceAsNode(media.sourceURL, lineNumber, "subtitle", media.sourceURL + (isNaN(lineNumber) ? "" : (":" + (lineNumber + 1))));
                 anchor.style.float = "right";
                 refElement.appendChild(anchor);
             }
@@ -937,9 +972,9 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
     closeBrace.textContent = "}";
     this.element.appendChild(closeBrace);
 
-    var eventName = WebInspector.experimentsSettings.singleClickEditing.isEnabled() ? "click" : "dblclick";
-    this._selectorElement.addEventListener(eventName, this._handleSelectorDoubleClick.bind(this), false);
-    this.element.addEventListener(eventName, this._handleEmptySpaceDoubleClick.bind(this), false);
+    this._selectorElement.addEventListener("click", this._handleSelectorClick.bind(this), false);
+    this.element.addEventListener("mousedown", this._handleEmptySpaceMouseDown.bind(this), false);
+    this.element.addEventListener("click", this._handleEmptySpaceClick.bind(this), false);
 
     this._parentPane = parentPane;
     this.styleRule = styleRule;
@@ -1146,7 +1181,7 @@ WebInspector.StylePropertiesSection.prototype = {
     {
         function linkifyUncopyable(url, line)
         {
-            var link = WebInspector.linkifyResourceAsNode(url, line);
+            var link = WebInspector.linkifyResourceAsNode(url, line, "", url + ":" + (line + 1));
             link.classList.add("webkit-html-resource-link");
             link.setAttribute("data-uncopyable", link.textContent);
             link.textContent = "";
@@ -1168,8 +1203,18 @@ WebInspector.StylePropertiesSection.prototype = {
         return document.createTextNode(origin);
     },
 
-    _handleEmptySpaceDoubleClick: function(event)
+    _handleEmptySpaceMouseDown: function(event)
+    {
+        this._willCauseCancelEditing = this._parentPane._isEditingStyle;
+    },
+
+    _handleEmptySpaceClick: function(event)
     {
+        var willCauseCancelEditing = this._willCauseCancelEditing;
+        delete this._willCauseCancelEditing;
+        if (willCauseCancelEditing)
+            return;
+
         if (event.target.hasStyleClass("header") || this.element.hasStyleClass("read-only") || event.target.enclosingNodeOrSelfWithClass("media")) {
             event.stopPropagation();
             return;
@@ -1180,13 +1225,9 @@ WebInspector.StylePropertiesSection.prototype = {
 
     _handleSelectorClick: function(event)
     {
-        event.stopPropagation();
-    },
-
-    _handleSelectorDoubleClick: function(event)
-    {
         this._startEditingOnMouseEvent();
         event.stopPropagation();
+        event.preventDefault();
     },
 
     _startEditingOnMouseEvent: function()
@@ -1436,8 +1477,11 @@ WebInspector.BlankStylePropertiesSection.prototype = {
             this.expand();
             if (this.element.parentElement) // Might have been detached already.
                 this._moveEditorFromSelector(moveDirection);
+
+            delete this._parentPane._userOperation;
         }
 
+        this._parentPane._userOperation = true;
         WebInspector.cssModel.addRule(this.pane.node.id, newContent, successCallback.bind(this), this.editingSelectorCancelled.bind(this));
     },
 
@@ -1482,6 +1526,8 @@ WebInspector.StylePropertyTreeElement = function(section, parentPane, styleRule,
 
     // Pass an empty title, the title gets made later in onattach.
     TreeElement.call(this, "", null, shorthand);
+
+    this.selectable = false;
 }
 
 WebInspector.StylePropertyTreeElement.prototype = {
@@ -1561,14 +1607,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
     onattach: function()
     {
         this.updateTitle();
-        var eventName;
-        if (WebInspector.experimentsSettings.singleClickEditing.isEnabled()) {
-            this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
-            this.listItemElement.addEventListener("mouseup", this._resetMouseDownElement.bind(this));
-            eventName = "click";
-        } else
-            eventName = "dblclick";
-        this.listItemElement.addEventListener(eventName, this._startEditing.bind(this));
+        this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
+        this.listItemElement.addEventListener("mouseup", this._resetMouseDownElement.bind(this));
+        this.listItemElement.addEventListener("click", this._startEditing.bind(this));
     },
 
     _mouseDown: function(event)
@@ -1580,9 +1621,11 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     _resetMouseDownElement: function()
     {
-        delete this._parentPane._mouseDownTreeElement;
-        delete this._parentPane._mouseDownTreeElementIsName;
-        delete this._parentPane._mouseDownTreeElementIsValue;
+        if (this._parentPane) {
+            delete this._parentPane._mouseDownTreeElement;
+            delete this._parentPane._mouseDownTreeElementIsName;
+            delete this._parentPane._mouseDownTreeElementIsValue;
+        }
     },
 
     updateTitle: function()
@@ -1603,8 +1646,12 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var nameElement = document.createElement("span");
         nameElement.className = "webkit-css-property";
         nameElement.textContent = this.name;
+        nameElement.title = this.property.propertyText;
         this.nameElement = nameElement;
 
+        this._expandElement = document.createElement("span");
+        this._expandElement.className = "expand-element";
+
         var valueElement = document.createElement("span");
         valueElement.className = "value";
         this.valueElement = valueElement;
@@ -1662,28 +1709,93 @@ WebInspector.StylePropertyTreeElement.prototype = {
                     return document.createTextNode(text);
                 }
 
+                var format = getFormat();
+                var hasSpectrum = self._parentPane;
+                var spectrum = hasSpectrum ? self._parentPane._spectrum : null;
+
                 var swatchElement = document.createElement("span");
-                swatchElement.title = WebInspector.UIString("Click to change color format");
+                var swatchInnerElement = swatchElement.createChild("span", "swatch-inner");
+                swatchElement.title = WebInspector.UIString("Click to open a colorpicker. Shift-click to change color format");
+
                 swatchElement.className = "swatch";
-                swatchElement.style.setProperty("background-color", text);
-
-                swatchElement.addEventListener("click", changeColorDisplay, false);
-                swatchElement.addEventListener("dblclick", function(event) { event.stopPropagation() }, false);
-
-                var format;
-                var formatSetting = WebInspector.settings.colorFormat.get();
-                if (formatSetting === cf.Original)
-                    format = cf.Original;
-                else if (color.nickname)
-                    format = cf.Nickname;
-                else if (formatSetting === cf.RGB)
-                    format = (color.simple ? cf.RGB : cf.RGBA);
-                else if (formatSetting === cf.HSL)
-                    format = (color.simple ? cf.HSL : cf.HSLA);
-                else if (color.simple)
-                    format = (color.hasShortHex() ? cf.ShortHEX : cf.HEX);
-                else
-                    format = cf.RGBA;
+
+                swatchElement.addEventListener("mousedown", stopPropagation, false);
+                swatchElement.addEventListener("click", swatchClick, false);
+                swatchElement.addEventListener("dblclick", stopPropagation, false);
+
+                swatchInnerElement.style.backgroundColor = text;
+
+                var scrollerElement = hasSpectrum ? self._parentPane._computedStylePane.element.parentElement : null;
+
+                function spectrumChanged(e)
+                {
+                    color = e.data;
+
+                    var colorString = color.toString();
+
+                    colorValueElement.textContent = colorString;
+                    spectrum.displayText = colorString;
+                    swatchInnerElement.style.backgroundColor = colorString;
+
+                    self.applyStyleText(nameElement.textContent + ": " + valueElement.textContent, false, false, false);
+                }
+
+                function spectrumHidden()
+                {
+                    scrollerElement.removeEventListener("scroll", repositionSpectrum, false);
+                    self.applyStyleText(nameElement.textContent + ": " + valueElement.textContent, true, true, false);
+                    spectrum.removeEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
+                    spectrum.removeEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
+
+                    delete self._parentPane._isEditingStyle;
+                }
+
+                function repositionSpectrum()
+                {
+                    spectrum.reposition(swatchElement);
+                }
+
+                function swatchClick(e)
+                {
+                    // Shift + click toggles color formats.
+                    // Click opens colorpicker, only if the element is not in computed styles section.
+                    if (!spectrum || e.shiftKey)
+                        changeColorDisplay(e);
+                    else {
+                        var visible = spectrum.toggle(swatchElement, color, format);
+
+                        if (visible) {
+                            spectrum.displayText = color.toString(format);
+                            self._parentPane._isEditingStyle = true;
+                            spectrum.addEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
+                            spectrum.addEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
+
+                            scrollerElement.addEventListener("scroll", repositionSpectrum, false);
+                        }
+                    }
+                    e.stopPropagation();
+                    e.preventDefault();
+                }
+
+                function getFormat()
+                {
+                    var format;
+                    var formatSetting = WebInspector.settings.colorFormat.get();
+                    if (formatSetting === cf.Original)
+                        format = cf.Original;
+                    else if (color.nickname)
+                        format = cf.Nickname;
+                    else if (formatSetting === cf.RGB)
+                        format = (color.simple ? cf.RGB : cf.RGBA);
+                    else if (formatSetting === cf.HSL)
+                        format = (color.simple ? cf.HSL : cf.HSLA);
+                    else if (color.simple)
+                        format = (color.hasShortHex() ? cf.ShortHEX : cf.HEX);
+                    else
+                        format = cf.RGBA;
+
+                    return format;
+                }
 
                 var colorValueElement = document.createElement("span");
                 colorValueElement.textContent = color.toString(format);
@@ -1763,10 +1875,11 @@ WebInspector.StylePropertyTreeElement.prototype = {
             return;
 
         // Append the checkbox for root elements of an editable section.
-        if (enabledCheckboxElement && this.treeOutline.section && this.treeOutline.section.editable && this.parent.root)
+        if (enabledCheckboxElement && this.treeOutline.section && this.parent.root && !this.section.computedStyle)
             this.listItemElement.appendChild(enabledCheckboxElement);
         this.listItemElement.appendChild(nameElement);
         this.listItemElement.appendChild(document.createTextNode(": "));
+        this.listItemElement.appendChild(this._expandElement);
         this.listItemElement.appendChild(valueElement);
         this.listItemElement.appendChild(document.createTextNode(";"));
 
@@ -1783,14 +1896,12 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
         if (this.property.inactive)
             this.listItemElement.addStyleClass("inactive");
-
-        this.tooltip = this.property.propertyText;
     },
 
     _updatePane: function(userCallback)
     {
         if (this.treeOutline && this.treeOutline.section && this.treeOutline.section.pane)
-            this.treeOutline.section.pane._innerUpdate(true, this.treeOutline.section, userCallback);
+            this.treeOutline.section.pane._refreshUpdate(this.treeOutline.section, false, userCallback);
         else  {
             if (userCallback)
                 userCallback();
@@ -1831,7 +1942,6 @@ WebInspector.StylePropertyTreeElement.prototype = {
         else
             this.listItemElement.removeStyleClass("implicit");
 
-        this.selectable = !this.inherited;
         if (this.inherited)
             this.listItemElement.addStyleClass("inherited");
         else
@@ -1886,6 +1996,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
     {
         this.startEditing(event.target);
         event.stopPropagation();
+        event.preventDefault();
     },
 
     _isNameElement: function(element)
@@ -1904,6 +2015,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (this.parent.shorthand)
             return;
 
+        if (selectElement === this._expandElement)
+            return;
+
         if (this.treeOutline.section && !this.treeOutline.section.editable)
             return;
 
@@ -2133,7 +2247,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (moveDirection === "forward" && !isEditingName || moveDirection === "backward" && isEditingName) {
             do {
                 moveTo = (moveDirection === "forward" ? moveTo.nextSibling : moveTo.previousSibling);
-            } while(moveTo && !moveTo.selectable);
+            } while(moveTo && moveTo.inherited);
 
             if (moveTo)
                 moveToPropertyName = moveTo.name;
@@ -2307,6 +2421,18 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (styleText.length && !/;\s*$/.test(styleText))
             styleText += ";";
         this.property.setText(styleText, majorChange, callback.bind(this, userOperationFinishedCallback.bind(null, this._parentPane, updateInterface), this.originalPropertyText));
+    },
+
+    ondblclick: function()
+    {
+        return true; // handled
+    },
+
+    isEventWithinDisclosureTriangle: function(event)
+    {
+        if (!this.section.computedStyle)
+            return event.target === this._expandElement;
+        return TreeElement.prototype.isEventWithinDisclosureTriangle.call(this, event);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
index e5caa2cfd..82f7447d3 100644
--- a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
+++ b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
@@ -65,6 +65,14 @@ WebInspector.TabbedEditorContainer.prototype = {
     },
 
     /**
+     * @type {Element}
+     */
+    get element()
+    {
+        return this._tabbedPane.element;
+    },
+
+    /**
      * @param {Element} parentElement
      */
     show: function(parentElement)
diff --git a/Source/WebCore/inspector/front-end/TextPrompt.js b/Source/WebCore/inspector/front-end/TextPrompt.js
index 2c479d81f..3c43f690d 100644
--- a/Source/WebCore/inspector/front-end/TextPrompt.js
+++ b/Source/WebCore/inspector/front-end/TextPrompt.js
@@ -400,6 +400,26 @@ WebInspector.TextPrompt.prototype = {
     },
 
     /**
+     * @param {Array.<string>} completions
+     * @param {number} wordPrefixLength
+     */
+    _buildCommonPrefix: function(completions, wordPrefixLength)
+    {
+        var commonPrefix = completions[0];
+        for (var i = 0; i < completions.length; ++i) {
+            var completion = completions[i];
+            var lastIndex = Math.min(commonPrefix.length, completion.length);
+            for (var j = wordPrefixLength; j < lastIndex; ++j) {
+                if (commonPrefix[j] !== completion[j]) {
+                    commonPrefix = commonPrefix.substr(0, j);
+                    break;
+                }
+            }
+        }
+        return commonPrefix;
+    },
+
+    /**
      * @param {Selection} selection
      * @param {boolean} auto
      * @param {Range} originalWordPrefixRange
@@ -430,24 +450,17 @@ WebInspector.TextPrompt.prototype = {
 
         var wordPrefixLength = originalWordPrefixRange.toString().length;
 
-        if (auto)
+        if (auto) {
             var completionText = completions[0];
-        else {
+            var commonPrefix = this._buildCommonPrefix(completions, wordPrefixLength);
+
+            this._commonPrefix = commonPrefix;
+        } else {
             if (completions.length === 1) {
                 var completionText = completions[0];
                 wordPrefixLength = completionText.length;
             } else {
-                var commonPrefix = completions[0];
-                for (var i = 0; i < completions.length; ++i) {
-                    var completion = completions[i];
-                    var lastIndex = Math.min(commonPrefix.length, completion.length);
-                    for (var j = wordPrefixLength; j < lastIndex; ++j) {
-                        if (commonPrefix[j] !== completion[j]) {
-                            commonPrefix = commonPrefix.substr(0, j);
-                            break;
-                        }
-                    }
-                }
+                var commonPrefix = this._buildCommonPrefix(completions, wordPrefixLength);
                 wordPrefixLength = commonPrefix.length;
 
                 if (selection.isCollapsed)
@@ -498,6 +511,20 @@ WebInspector.TextPrompt.prototype = {
             this.applySuggestion(completionText, completions.length > 1, originalWordPrefixRange);
     },
 
+    _completeCommonPrefix: function()
+    {
+        if (!this.autoCompleteElement || !this._commonPrefix || !this._userEnteredText || this._commonPrefix.indexOf(this._userEnteredText) !== 0)
+            return;
+
+        if (!this.isSuggestBoxVisible()) {
+            this.acceptAutoComplete();
+            return;
+        }
+
+        this.autoCompleteElement.textContent = this._commonPrefix.substring(this._userEnteredText.length);
+        this.acceptSuggestion(true)
+    },
+
     /**
      * @param {Range=} originalPrefixRange
      */
@@ -533,7 +560,10 @@ WebInspector.TextPrompt.prototype = {
             this.dispatchEventToListeners(WebInspector.TextPrompt.Events.ItemApplied, { itemText: completionText });
     },
 
-    acceptSuggestion: function()
+    /**
+     * @param {boolean=} prefixAccepted
+     */
+    acceptSuggestion: function(prefixAccepted)
     {
         if (this._isAcceptingSuggestion)
             return false;
@@ -554,8 +584,11 @@ WebInspector.TextPrompt.prototype = {
         selection.removeAllRanges();
         selection.addRange(finalSelectionRange);
 
-        this.hideSuggestBox();
-        this.dispatchEventToListeners(WebInspector.TextPrompt.Events.ItemAccepted);
+        if (!prefixAccepted) {
+            this.hideSuggestBox();
+            this.dispatchEventToListeners(WebInspector.TextPrompt.Events.ItemAccepted);
+        } else
+            this.autoCompleteSoon(true);
 
         return true;
     },
@@ -663,7 +696,9 @@ WebInspector.TextPrompt.prototype = {
 
     tabKeyPressed: function(event)
     {
-        // Just consume the key.
+        this._completeCommonPrefix();
+
+        // Consume the key.
         return true;
     },
 
@@ -892,8 +927,9 @@ WebInspector.TextPrompt.SuggestBox = function(textPrompt, inputElement, classNam
     window.addEventListener("scroll", this._boundOnScroll, true);
     window.addEventListener("resize", this._boundOnResize, true);
 
-    var bodyElement = inputElement.ownerDocument.body;
-    this._element = bodyElement.createChild("div", "suggest-box " + (className || ""));
+    this._bodyElement = inputElement.ownerDocument.body;
+    this._element = inputElement.ownerDocument.createElement("div");
+    this._element.className = "suggest-box " + (className || "");
     this._element.addEventListener("mousedown", this._onboxmousedown.bind(this), true);
     this.containerElement = this._element.createChild("div", "container");
     this.contentElement = this.containerElement.createChild("div", "content");
@@ -902,7 +938,7 @@ WebInspector.TextPrompt.SuggestBox = function(textPrompt, inputElement, classNam
 WebInspector.TextPrompt.SuggestBox.prototype = {
     get visible()
     {
-        return this._element.hasStyleClass("visible");
+        return !!this._element.parentElement;
     },
 
     get hasSelection()
@@ -985,7 +1021,7 @@ WebInspector.TextPrompt.SuggestBox.prototype = {
         if (!this.visible)
             return;
 
-        this._element.removeStyleClass("visible");
+        this._element.parentElement.removeChild(this._element);
         delete this._selectedElement;
     },
 
@@ -993,7 +1029,7 @@ WebInspector.TextPrompt.SuggestBox.prototype = {
     {
         window.removeEventListener("scroll", this._boundOnScroll, true);
         window.removeEventListener("resize", this._boundOnResize, true);
-        this._element.parentElement.removeChild(this._element);
+        this.hide();
     },
 
     /**
@@ -1190,7 +1226,8 @@ WebInspector.TextPrompt.SuggestBox.prototype = {
         if (this._canShowBox(completions, canShowForSingleItem)) {
             this._updateItems(completions, canShowForSingleItem);
             this._updateBoxPosition(anchorBox);
-            this._element.addStyleClass("visible");
+            if (!this.visible)
+                this._bodyElement.appendChild(this._element);
             this._rememberRowCountPerViewport();
         } else
             this.hide();
diff --git a/Source/WebCore/inspector/front-end/TimelineAgent.js b/Source/WebCore/inspector/front-end/TimelineAgent.js
index 979d6dfe8..46ad7eae0 100644
--- a/Source/WebCore/inspector/front-end/TimelineAgent.js
+++ b/Source/WebCore/inspector/front-end/TimelineAgent.js
@@ -66,7 +66,7 @@ WebInspector.TimelineAgent.RecordType = {
     FunctionCall: "FunctionCall",
     GCEvent: "GCEvent",
 
-    RegisterAnimationFrameCallback: "RegisterAnimationFrameCallback",
-    CancelAnimationFrameCallback: "CancelAnimationFrameCallback",
-    FireAnimationFrameEvent: "FireAnimationFrameEvent"
+    RequestAnimationFrame: "RequestAnimationFrame",
+    CancelAnimationFrame: "CancelAnimationFrame",
+    FireAnimationFrame: "FireAnimationFrame"
 }
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index 8718f19e0..858742c6c 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -32,65 +32,66 @@
  * @constructor
  * @extends {WebInspector.Object}
  */
-WebInspector.TimelineOverviewPane = function(categories)
+WebInspector.TimelineOverviewPane = function(presentationModel)
 {
-    this._categories = categories;
+    this.element = document.createElement("div");
+    this.element.className = "fill";
 
-    this.statusBarFilters = document.createElement("div");
-    this.statusBarFilters.className = "status-bar-items";
-    for (var categoryName in this._categories) {
-        var category = this._categories[categoryName];
-        this.statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCheckboxClicked.bind(this, category)));
-    }
+    this._startAtZero = false;
+
+    this._presentationModel = presentationModel;
+
+    this.element = document.createElement("div");
+    this.element.id = "timeline-overview-panel";
+
+    this._topPaneSidebarElement = document.createElement("div");
+    this._topPaneSidebarElement.id = "timeline-overview-sidebar";
+
+    var overviewTreeElement = document.createElement("ol");
+    overviewTreeElement.className = "sidebar-tree";
+    this._topPaneSidebarElement.appendChild(overviewTreeElement);
+    this.element.appendChild(this._topPaneSidebarElement);
+
+    var topPaneSidebarTree = new TreeOutline(overviewTreeElement);
+    this._timelinesOverviewItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Timelines"));
+    topPaneSidebarTree.appendChild(this._timelinesOverviewItem);
+    this._timelinesOverviewItem.revealAndSelect(false);
+    this._timelinesOverviewItem.onselect = this._showTimelines.bind(this);
+
+    this._memoryOverviewItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Memory"));
+    topPaneSidebarTree.appendChild(this._memoryOverviewItem);
+    this._memoryOverviewItem.onselect = this._showMemoryGraph.bind(this);
 
     this._overviewGrid = new WebInspector.TimelineGrid();
     this._overviewGrid.element.id = "timeline-overview-grid";
     this._overviewGrid.itemsGraphsElement.id = "timeline-overview-timelines";
-    this._overviewGrid.element.addEventListener("mousedown", this._dragWindow.bind(this), true);
-    this._overviewGrid.element.addEventListener("mousewheel", this.scrollWindow.bind(this), true);
-    this._overviewGrid.element.addEventListener("dblclick", this._resizeWindowMaximum.bind(this), true);
 
     this._heapGraph = new WebInspector.HeapGraph();
     this._heapGraph.element.id = "timeline-overview-memory";
     this._overviewGrid.element.insertBefore(this._heapGraph.element, this._overviewGrid.itemsGraphsElement);
 
-    this.element = this._overviewGrid.element;
+    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewGrid.element);
+    this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
 
+    this.element.appendChild(this._overviewGrid.element);
+
+    var separatorElement = document.createElement("div");
+    separatorElement.id = "timeline-overview-separator";
+    this.element.appendChild(separatorElement);
+ 
     this._categoryGraphs = {};
     var i = 0;
-    for (var category in this._categories) {
-        var categoryGraph = new WebInspector.TimelineCategoryGraph(this._categories[category], i++ % 2);
+    var categories = this._presentationModel.categories;
+    for (var category in categories) {
+        var categoryGraph = new WebInspector.TimelineCategoryGraph(categories[category], i++ % 2);
         this._categoryGraphs[category] = categoryGraph;
         this._overviewGrid.itemsGraphsElement.appendChild(categoryGraph.graphElement);
     }
-    this._overviewGrid.setScrollAndDividerTop(0, 0);
-
-    this._overviewWindowElement = document.createElement("div");
-    this._overviewWindowElement.id = "timeline-overview-window";
-    this._overviewGrid.element.appendChild(this._overviewWindowElement);
-
-    this._overviewWindowBordersElement = document.createElement("div");
-    this._overviewWindowBordersElement.className = "timeline-overview-window-rulers";
-    this._overviewGrid.element.appendChild(this._overviewWindowBordersElement);
-
-    var overviewDividersBackground = document.createElement("div");
-    overviewDividersBackground.className = "timeline-overview-dividers-background";
-    this._overviewGrid.element.appendChild(overviewDividersBackground);
+    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._onCategoryVisibilityChanged, this);
 
-    this._leftResizeElement = document.createElement("div");
-    this._leftResizeElement.className = "timeline-window-resizer";
-    this._leftResizeElement.style.left = 0;
-    this._overviewGrid.element.appendChild(this._leftResizeElement);
-
-    this._rightResizeElement = document.createElement("div");
-    this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
-    this._rightResizeElement.style.right = 0;
-    this._overviewGrid.element.appendChild(this._rightResizeElement);
+    this._overviewGrid.setScrollAndDividerTop(0, 0);
 
     this._overviewCalculator = new WebInspector.TimelineOverviewCalculator();
-
-    this.windowLeft = 0.0;
-    this.windowRight = 1.0;
 }
 
 WebInspector.TimelineOverviewPane.MinSelectableSize = 12;
@@ -99,43 +100,93 @@ WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor = .3;
 
 WebInspector.TimelineOverviewPane.ResizerOffset = 3.5; // half pixel because offset values are not rounded but ceiled
 
+WebInspector.TimelineOverviewPane.Mode = {
+    Events: "Events",
+    Memory: "Memory"
+};
+
+WebInspector.TimelineOverviewPane.Events = {
+    ModeChanged: "ModeChanged"
+};
+
 WebInspector.TimelineOverviewPane.prototype = {
-    showTimelines: function(event) {
+    _showTimelines: function()
+    {
+        this._timelinesOverviewItem.revealAndSelect(false);
         this._heapGraph.hide();
         this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Events);
     },
 
-    showMemoryGraph: function(records) {
+    _showMemoryGraph: function()
+    {
+        this._memoryOverviewItem.revealAndSelect(false);
         this._heapGraph.show();
-        this._heapGraph.update(records);
+        this._heapGraph.update(this._records);
         this._overviewGrid.itemsGraphsElement.addStyleClass("hidden");
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Memory);
     },
 
-    _onCheckboxClicked: function (category, event) {
-        if (event.target.checked)
-            category.hidden = false;
-        else
-            category.hidden = true;
-        this._categoryGraphs[category.name].dimmed = !event.target.checked;
-        this.dispatchEventToListeners("filter changed");
+    /**
+     * @param {boolean} enabled
+     */
+    setStartAtZero: function(enabled)
+    {
+        if (this._startAtZero === enabled)
+            return;
+        this._startAtZero = enabled;
+        if (enabled) {
+            if (this._heapGraph.visible)
+                this._showTimelines();
+            this.element.addStyleClass("timeline-start-at-zero");
+            this._startAtZeroOverview = new WebInspector.TimelineStartAtZeroOverview(this._presentationModel);
+            this._startAtZeroOverview.show(this.element);
+            this._startAtZeroOverview.update(this._records);
+        } else {
+            this.element.removeStyleClass("timeline-start-at-zero");
+            this._startAtZeroOverview.detach();
+            this._startAtZeroOverview = null;
+            this._showTimelines();
+        }
+    },
+
+    _onWindowChanged: function()
+    {
+        this._presentationModel.setWindowPosition(this._overviewWindow.windowLeft, this._overviewWindow.windowRight);
+    },
+
+    _onCategoryVisibilityChanged: function(event)
+    {
+        var category = event.data;
+        this._categoryGraphs[category.name].dimmed = category.hidden;
     },
 
     _forAllRecords: function(recordsArray, callback)
     {
         if (!recordsArray)
             return;
-        for (var i = 0; i < recordsArray.length; ++i) {
-            callback(recordsArray[i]);
-            this._forAllRecords(recordsArray[i].children, callback);
+        var stack = [{array: recordsArray, index: 0}];
+        while (stack.length) {
+            var entry = stack[stack.length - 1];
+            var records = entry.array;
+            if (entry.index < records.length) {
+                 var record = records[entry.index];
+                 callback(record);
+                 if (record.children)
+                     stack.push({array: record.children, index: 0});
+                 ++entry.index;
+            } else
+                stack.pop();
         }
     },
 
     update: function(records, showShortEvents)
     {
+        this._records = records;
         this._showShortEvents = showShortEvents;
         // Clear summary bars.
         var timelines = {};
-        for (var category in this._categories) {
+        for (var category in this._presentationModel.categories) {
             timelines[category] = [];
             this._categoryGraphs[category].clearChunks();
         }
@@ -158,7 +209,7 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._forAllRecords(records, markPercentagesForRecord.bind(this));
 
         // Convert sparse arrays to continuous segments, render graphs for each.
-        for (var category in this._categories) {
+        for (var category in this._presentationModel.categories) {
             var timeline = timelines[category];
             window.timelineSaved = timeline;
             var chunkStart = -1;
@@ -182,7 +233,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._heapGraph.setSize(this._overviewGrid.element.offsetWidth, 60);
         if (this._heapGraph.visible)
             this._heapGraph.update(records);
-
+        if (this._startAtZeroOverview)
+            this._startAtZeroOverview.update(records);
         this._overviewGrid.updateDividers(true, this._overviewCalculator);
     },
 
@@ -206,22 +258,81 @@ WebInspector.TimelineOverviewPane.prototype = {
     sidebarResized: function(width)
     {
         this._overviewGrid.element.style.left = width + "px";
-        // Min width = <number of buttons on the left> * 31
-        this.statusBarFilters.style.left = Math.max(7 * 31, width) + "px";
+        this._topPaneSidebarElement.style.width = width + "px";
+    },
+
+    reset: function()
+    {
+        this._overviewWindow.reset();
+        this._overviewCalculator.reset();
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+        if (this._startAtZeroOverview)
+            this._startAtZeroOverview.reset();
     },
 
+    scrollWindow: function(event)
+    {
+        this._overviewWindow.scrollWindow(event);
+    }
+}
+
+WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ * @param {Element} parentElement
+ */
+WebInspector.TimelineOverviewWindow = function(parentElement)
+{
+    this._parentElement = parentElement;
+
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+
+    this._parentElement.addEventListener("mousedown", this._dragWindow.bind(this), true);
+    this._parentElement.addEventListener("mousewheel", this.scrollWindow.bind(this), true);
+    this._parentElement.addEventListener("dblclick", this._resizeWindowMaximum.bind(this), true);
+
+    this._overviewWindowElement = document.createElement("div");
+    this._overviewWindowElement.className = "timeline-overview-window";
+    parentElement.appendChild(this._overviewWindowElement);
+
+    this._overviewWindowBordersElement = document.createElement("div");
+    this._overviewWindowBordersElement.className = "timeline-overview-window-rulers";
+    parentElement.appendChild(this._overviewWindowBordersElement);
+
+    var overviewDividersBackground = document.createElement("div");
+    overviewDividersBackground.className = "timeline-overview-dividers-background";
+    parentElement.appendChild(overviewDividersBackground);
+
+    this._leftResizeElement = document.createElement("div");
+    this._leftResizeElement.className = "timeline-window-resizer";
+    this._leftResizeElement.style.left = 0;
+    parentElement.appendChild(this._leftResizeElement);
+
+    this._rightResizeElement = document.createElement("div");
+    this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
+    this._rightResizeElement.style.right = 0;
+    parentElement.appendChild(this._rightResizeElement);
+}
+
+WebInspector.TimelineOverviewWindow.Events = {
+    WindowChanged: "WindowChanged"
+}
+
+WebInspector.TimelineOverviewWindow.prototype = {
     reset: function()
     {
         this.windowLeft = 0.0;
         this.windowRight = 1.0;
+
         this._overviewWindowElement.style.left = "0%";
         this._overviewWindowElement.style.width = "100%";
         this._overviewWindowBordersElement.style.left = "0%";
         this._overviewWindowBordersElement.style.right = "0%";
         this._leftResizeElement.style.left = "0%";
         this._rightResizeElement.style.left = "100%";
-        this._overviewCalculator.reset();
-        this._overviewGrid.updateDividers(true, this._overviewCalculator);
     },
 
     _resizeWindow: function(resizeElement, event)
@@ -232,9 +343,9 @@ WebInspector.TimelineOverviewPane.prototype = {
     _windowResizeDragging: function(resizeElement, event)
     {
         if (resizeElement === this._leftResizeElement)
-            this._resizeWindowLeft(event.pageX - this._overviewGrid.element.offsetLeft);
+            this._resizeWindowLeft(event.pageX - this._parentElement.offsetLeft);
         else
-            this._resizeWindowRight(event.pageX - this._overviewGrid.element.offsetLeft);
+            this._resizeWindowRight(event.pageX - this._parentElement.offsetLeft);
         event.preventDefault();
     },
 
@@ -242,13 +353,13 @@ WebInspector.TimelineOverviewPane.prototype = {
     {
         var node = event.target;
         while (node) {
-            if (node === this._overviewGrid._dividersLabelBarElement) {
+            if (node.hasStyleClass("resources-dividers-label-bar")) {
                 WebInspector.elementDragStart(this._overviewWindowElement, this._windowDragging.bind(this, event.pageX,
                     this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset, this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset), this._endWindowDragging.bind(this), event, "ew-resize");
                 break;
-            } else if (node === this._overviewGrid.element) {
-                var position = event.pageX - this._overviewGrid.element.offsetLeft;
-                this._overviewWindowSelector = new WebInspector.TimelinePanel.WindowSelector(this._overviewGrid.element, position, event);
+            } else if (node === this._parentElement) {
+                var position = event.pageX - this._parentElement.offsetLeft;
+                this._overviewWindowSelector = new WebInspector.TimelinePanel.WindowSelector(this._parentElement, position);
                 WebInspector.elementDragStart(null, this._windowSelectorDragging.bind(this), this._endWindowSelectorDragging.bind(this), event, "ew-resize");
                 break;
             } else if (node === this._leftResizeElement || node === this._rightResizeElement) {
@@ -261,20 +372,21 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     _windowSelectorDragging: function(event)
     {
-        this._overviewWindowSelector._updatePosition(event.pageX - this._overviewGrid.element.offsetLeft);
+        this._overviewWindowSelector._updatePosition(event.pageX - this._parentElement.offsetLeft);
         event.preventDefault();
     },
 
     _endWindowSelectorDragging: function(event)
     {
         WebInspector.elementDragEnd(event);
-        var window = this._overviewWindowSelector._close(event.pageX - this._overviewGrid.element.offsetLeft);
+        var window = this._overviewWindowSelector._close(event.pageX - this._parentElement.offsetLeft);
         delete this._overviewWindowSelector;
-        if (window.end - window.start < WebInspector.TimelineOverviewPane.MinSelectableSize)
-            if (this._overviewGrid.itemsGraphsElement.offsetWidth - window.end > WebInspector.TimelineOverviewPane.MinSelectableSize)
+        if (window.end - window.start < WebInspector.TimelineOverviewPane.MinSelectableSize) {
+            if (this._parentElement.clientWidth - window.end > WebInspector.TimelineOverviewPane.MinSelectableSize)
                 window.end = window.start + WebInspector.TimelineOverviewPane.MinSelectableSize;
             else
                 window.start = window.end - WebInspector.TimelineOverviewPane.MinSelectableSize;
+        }
         this._setWindowPosition(window.start, window.end);
     },
 
@@ -290,8 +402,8 @@ WebInspector.TimelineOverviewPane.prototype = {
             end = windowSize;
         }
 
-        if (end > this._overviewGrid.element.clientWidth) {
-            end = this._overviewGrid.element.clientWidth;
+        if (end > this._parentElement.clientWidth) {
+            end = this._parentElement.clientWidth;
             start = end - windowSize;
         }
         this._setWindowPosition(start, end);
@@ -312,8 +424,8 @@ WebInspector.TimelineOverviewPane.prototype = {
     _resizeWindowRight: function(end)
     {
         // Glue to edge.
-        if (end > this._overviewGrid.element.clientWidth - 10)
-            end = this._overviewGrid.element.clientWidth;
+        if (end > this._parentElement.clientWidth - 10)
+            end = this._parentElement.clientWidth;
         else if (end < this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.MinSelectableSize)
             end = this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.MinSelectableSize;
         this._setWindowPosition(null, end);
@@ -321,25 +433,26 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     _resizeWindowMaximum: function()
     {
-        this._setWindowPosition(0, this._overviewGrid.element.clientWidth);
+        this._setWindowPosition(0, this._parentElement.clientWidth);
     },
 
     _setWindowPosition: function(start, end)
     {
-        const rulerAdjustment = 1 / this._overviewGrid.element.clientWidth;
+        var clientWidth = this._parentElement.clientWidth;
+        const rulerAdjustment = 1 / clientWidth;
         if (typeof start === "number") {
-            this.windowLeft = start / this._overviewGrid.element.clientWidth;
+            this.windowLeft = start / clientWidth;
             this._leftResizeElement.style.left = this.windowLeft * 100 + "%";
             this._overviewWindowElement.style.left = this.windowLeft * 100 + "%";
             this._overviewWindowBordersElement.style.left = (this.windowLeft - rulerAdjustment) * 100 + "%";
         }
         if (typeof end === "number") {
-            this.windowRight = end / this._overviewGrid.element.clientWidth;
+            this.windowRight = end / clientWidth;
             this._rightResizeElement.style.left = this.windowRight * 100 + "%";
         }
         this._overviewWindowElement.style.width = (this.windowRight - this.windowLeft) * 100 + "%";
         this._overviewWindowBordersElement.style.right = (1 - this.windowRight + 2 * rulerAdjustment) * 100 + "%";
-        this.dispatchEventToListeners("window changed");
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewWindow.Events.WindowChanged);
     },
 
     _endWindowDragging: function(event)
@@ -349,37 +462,16 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     scrollWindow: function(event)
     {
-        if (typeof event.wheelDeltaX === "number" && event.wheelDeltaX !== 0)
-            this._windowDragging(event.pageX + Math.round(event.wheelDeltaX * WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor), this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset, this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset, event);
-    },
-
-    _createTimelineCategoryStatusBarCheckbox: function(category, onCheckboxClicked)
-    {
-        var labelContainer = document.createElement("div");
-        labelContainer.addStyleClass("timeline-category-statusbar-item");
-        labelContainer.addStyleClass("timeline-category-" + category.name);
-        labelContainer.addStyleClass("status-bar-item");
-
-        var label = document.createElement("label");
-        var checkElement = document.createElement("input");
-        checkElement.type = "checkbox";
-        checkElement.className = "timeline-category-checkbox";
-        checkElement.checked = true;
-        checkElement.addEventListener("click", onCheckboxClicked, false);
-        label.appendChild(checkElement);
-
-        var typeElement = document.createElement("span");
-        typeElement.className = "type";
-        typeElement.textContent = category.title;
-        label.appendChild(typeElement);
-
-        labelContainer.appendChild(label);
-        return labelContainer;
+        if (typeof event.wheelDeltaX === "number" && event.wheelDeltaX !== 0) {
+            this._windowDragging(event.pageX + Math.round(event.wheelDeltaX * WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor),
+                this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset,
+                this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset,
+                event);
+        }
     }
-
 }
 
-WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.Object.prototype;
+WebInspector.TimelineOverviewWindow.prototype.__proto__ = WebInspector.Object.prototype;
 
 /**
  * @constructor
@@ -473,7 +565,7 @@ WebInspector.TimelineCategoryGraph.prototype = {
 /**
  * @constructor
  */
-WebInspector.TimelinePanel.WindowSelector = function(parent, position, event)
+WebInspector.TimelinePanel.WindowSelector = function(parent, position)
 {
     this._startPosition = position;
     this._width = parent.offsetWidth;
@@ -639,3 +731,100 @@ WebInspector.HeapGraph.prototype = {
 
     _forAllRecords: WebInspector.TimelineOverviewPane.prototype._forAllRecords
 }
+
+/**
+ * @constructor
+ * @param {WebInspector.TimelinePresentationModel} model
+ * @extends {WebInspector.View}
+ */
+WebInspector.TimelineStartAtZeroOverview = function(model) {
+    WebInspector.View.call(this);
+    this._presentationModel = model;
+    this.element.className = "timeline-overview-start-at-zero fill";
+    this._overviewElement = this.element.createChild("div", "timeline-overview-start-at-zero-bars fill");
+    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this.element);
+    this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
+    this._recordsPerBar = 1;
+    this._calculator = new WebInspector.TimelineStartAtZeroCalculator();
+}
+
+WebInspector.TimelineStartAtZeroOverview.prototype = {
+    reset: function()
+    {
+        this._recordsPerBar = 1;
+        this._overviewWindow.reset();
+    },
+
+    update: function(records)
+    {
+        this._calculator.reset();
+        records = this._filterRecords(records);
+        records.forEach(this._calculator.updateBoundaries, this._calculator);
+        this._calculator.calculateWindow();
+
+        var scale = (this._overviewElement.clientHeight - 4) / this._calculator.boundarySpan;
+        this._recordsPerBar = Math.max(1, records.length * 4 / this.element.clientWidth);
+        var numberOfBars = Math.ceil(records.length / this._recordsPerBar);
+
+        this._overviewElement.removeChildren();
+        var padding = this._overviewElement.createChild("div", "padding");
+
+        for (var i = 0; i < numberOfBars; ++i) {
+            var index = Math.floor(i * this._recordsPerBar);
+            var longestRecord = records[index];
+            var stopIndex = Math.min(Math.floor((i + 1) * this._recordsPerBar), records.length);
+            for (++index; index < stopIndex; ++index) {
+                var record = records[index];
+                if (longestRecord.endTime - longestRecord.startTime < record.endTime - record.startTime)
+                    longestRecord = record;
+            }
+            this._overviewElement.insertBefore(this._buildBar(longestRecord, scale), padding);
+        }
+    },
+
+    _filterRecords: function(records)
+    {
+        function filter(record)
+        {
+            return !record.category.hidden;
+        }
+        return records.filter(filter);
+    },
+
+    _buildBar: function(record, scale)
+    {
+        var outer = document.createElement("div");
+        outer.className = "timeline-bar-vertical";
+        var stats = record.aggregatedStats;
+        var categories = Object.keys(stats);
+        for (var i = 0; i < categories.length; ++i) {
+            var category = categories[i];
+            var duration = stats[category];
+            if (!duration)
+                continue;
+            var bar = outer.createChild("div", "timeline-" + category);
+            bar.style.height = (stats[category] * scale) + "px";
+        }
+        return outer;
+    },
+
+    _onWindowChanged: function()
+    {
+        var leftOffset = this._overviewWindow.windowLeft * this.element.clientWidth;
+        var rightOffset = this._overviewWindow.windowRight * this.element.clientWidth;
+        var bars = this._overviewElement.children;
+        var offset0 = bars[0] ? bars[0].offsetLeft : 4;
+        var barWidth = 9;
+        if (bars.length > 2) {
+            var offset1 = bars[bars.length - 2].offsetLeft;
+            barWidth = (offset1 - offset0) / (bars.length - 2);
+        }
+
+        var leftIndex = Math.floor((leftOffset - offset0) / barWidth * this._recordsPerBar);
+        var rightIndex = rightOffset + barWidth >= this.element.clientWidth ? null : Math.ceil((rightOffset - offset0 - 2) / barWidth * this._recordsPerBar);
+
+        this._presentationModel.setWindowIndices(leftIndex, rightIndex);
+    }
+}
+
+WebInspector.TimelineStartAtZeroOverview.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index 28db4ed05..bf580cd21 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -37,7 +37,16 @@ WebInspector.TimelinePanel = function()
     WebInspector.Panel.call(this, "timeline");
     this.registerRequiredCSS("timelinePanel.css");
 
-    this.element.appendChild(this._createTopPane());
+    this._presentationModel = new WebInspector.TimelinePresentationModel();
+    this._presentationModel.addCategory(new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"));
+    this._presentationModel.addCategory(new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"));
+    this._presentationModel.addCategory(new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"));
+    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.WindowChanged, this._scheduleRefresh.bind(this, false));
+    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._scheduleRefresh.bind(this, true));
+
+    this._overviewPane = new WebInspector.TimelineOverviewPane(this._presentationModel);
+
+    this.element.appendChild(this._overviewPane.element);
     this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
     this.element.tabIndex = 0;
 
@@ -56,6 +65,7 @@ WebInspector.TimelinePanel = function()
         this._timelineMemorySplitter.addEventListener("mousedown", this._startSplitterDragging.bind(this), false);
         this._timelineMemorySplitter.addStyleClass("hidden");
         this._memoryStatistics = new WebInspector.MemoryStatistics(this, this.splitView.preferredSidebarWidth());
+        this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._timelinesOverviewModeChanged, this);
     }
 
     var itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
@@ -92,10 +102,9 @@ WebInspector.TimelinePanel = function()
     this._sendRequestRecords = {};
     this._scheduledResourceRequests = {};
     this._timerRecords = {};
-    this._registeredAnimationCallbackRecords = {};
+    this._requestAnimationFrameRecords = {};
 
     this._calculator = new WebInspector.TimelineCalculator();
-    this._calculator._showShortEvents = false;
     var shortRecordThresholdTitle = Number.secondsToString(WebInspector.TimelinePanel.shortRecordThreshold);
     this._showShortRecordsTitleText = WebInspector.UIString("Show the records that are shorter than %s", shortRecordThresholdTitle);
     this._hideShortRecordsTitleText = WebInspector.UIString("Hide the records that are shorter than %s", shortRecordThresholdTitle);
@@ -110,15 +119,16 @@ WebInspector.TimelinePanel = function()
 
     // Disable short events filter by default.
     this.toggleFilterButton.toggled = true;
-    this._calculator._showShortEvents = this.toggleFilterButton.toggled;
+    this._showShortEvents = this.toggleFilterButton.toggled;
     this._timeStampRecords = [];
     this._expandOffset = 15;
 
     this._createFileSelector();
-    this._model = new WebInspector.TimelineModel(this);
+    this._model = new WebInspector.TimelineModel();
+    this._model.addEventListener(WebInspector.TimelineModel.Events.RecordAdded, this._onTimelineEventRecorded, this);
+    this._model.addEventListener(WebInspector.TimelineModel.Events.RecordsCleared, this._onRecordsCleared, this);
 
     this._registerShortcuts();
-    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onTimelineEventRecorded, this);
     this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
 }
 
@@ -181,39 +191,6 @@ WebInspector.TimelinePanel.prototype = {
         return this._linkifyLocation(callFrame.url, callFrame.lineNumber, callFrame.columnNumber);
     },
 
-    _createTopPane: function() {
-        var topPaneElement = document.createElement("div");
-        topPaneElement.id = "timeline-overview-panel";
-
-        this._topPaneSidebarElement = document.createElement("div");
-        this._topPaneSidebarElement.id = "timeline-overview-sidebar";
-
-        var overviewTreeElement = document.createElement("ol");
-        overviewTreeElement.className = "sidebar-tree";
-        this._topPaneSidebarElement.appendChild(overviewTreeElement);
-        topPaneElement.appendChild(this._topPaneSidebarElement);
-
-        var topPaneSidebarTree = new TreeOutline(overviewTreeElement);
-        var timelinesOverviewItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Timelines"));
-        topPaneSidebarTree.appendChild(timelinesOverviewItem);
-        timelinesOverviewItem.revealAndSelect(false);
-        timelinesOverviewItem.onselect = this._timelinesOverviewItemSelected.bind(this);
-
-        var memoryOverviewItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Memory"));
-        topPaneSidebarTree.appendChild(memoryOverviewItem);
-        memoryOverviewItem.onselect = this._memoryOverviewItemSelected.bind(this);
-
-        this._overviewPane = new WebInspector.TimelineOverviewPane(this.categories);
-        this._overviewPane.addEventListener("window changed", this._windowChanged, this);
-        this._overviewPane.addEventListener("filter changed", this._refresh, this);
-        topPaneElement.appendChild(this._overviewPane.element);
-
-        var separatorElement = document.createElement("div");
-        separatorElement.id = "timeline-overview-separator";
-        topPaneElement.appendChild(separatorElement);
-        return topPaneElement;
-    },
-
     get calculator()
     {
         return this._calculator;
@@ -226,23 +203,13 @@ WebInspector.TimelinePanel.prototype = {
 
     get statusBarItems()
     {
-        var result = [this.toggleFilterButton.element, this.toggleTimelineButton.element, this.garbageCollectButton.element, this.clearButton.element];
-        if (this._memoryStatisticsButton)
-            result.push(this._memoryStatisticsButton.element);
-        result.push(this._overviewPane.statusBarFilters);
-        return result;
-    },
+        var statusBarItems = [ this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this.garbageCollectButton.element, this._glueParentButton.element ];
 
-    get categories()
-    {
-        if (!this._categories) {
-            this._categories = {
-                loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"),
-                scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"),
-                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)")
-            };
-        }
-        return this._categories;
+        if (WebInspector.experimentsSettings.timelineStartAtZero.isEnabled())
+            statusBarItems.push(this.toggleStartAtZeroButton.element);
+
+        statusBarItems.push(this.statusBarFilters);
+        return statusBarItems;
     },
 
     get defaultFocusedElement()
@@ -254,31 +221,33 @@ WebInspector.TimelinePanel.prototype = {
     {
         if (!this._recordStylesArray) {
             var recordTypes = WebInspector.TimelineAgent.RecordType;
+            var categories = this._presentationModel.categories;
+
             var recordStyles = {};
-            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: this.categories.scripting };
-            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
-            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
-            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
-            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: this.categories.loading };
-            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: this.categories.scripting };
-            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: this.categories.scripting };
-            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
-            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
-            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
-            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
-            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: this.categories.scripting };
-            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: this.categories.loading };
-            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: this.categories.loading };
-            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: this.categories.loading };
-            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: this.categories.scripting };
-            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: this.categories.loading };
-            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: this.categories.scripting };
-            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: this.categories.loading };
-            recordStyles[recordTypes.RegisterAnimationFrameCallback] = { title: WebInspector.UIString("Register Animation Callback"), category: this.categories.scripting };
-            recordStyles[recordTypes.CancelAnimationFrameCallback] = { title: WebInspector.UIString("Cancel Animation Callback"), category: this.categories.scripting };
-            recordStyles[recordTypes.FireAnimationFrameEvent] = { title: WebInspector.UIString("Animation Frame Event"), category: this.categories.scripting };
+            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: categories["rendering"] };
+            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: categories["rendering"] };
+            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: categories["rendering"] };
+            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: categories["loading"] };
+            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: categories["scripting"] };
+            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: categories["loading"] };
+            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: categories["loading"] };
+            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: categories["scripting"] };
+            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: categories["loading"] };
+            recordStyles[recordTypes.RequestAnimationFrame] = { title: WebInspector.UIString("Request Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.CancelAnimationFrame] = { title: WebInspector.UIString("Cancel Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.FireAnimationFrame] = { title: WebInspector.UIString("Animation Frame Fired"), category: categories["scripting"] };
             this._recordStylesArray = recordStyles;
         }
         return this._recordStylesArray;
@@ -298,13 +267,52 @@ WebInspector.TimelinePanel.prototype = {
         this.garbageCollectButton = new WebInspector.StatusBarButton(WebInspector.UIString("Collect Garbage"), "garbage-collect-status-bar-item");
         this.garbageCollectButton.addEventListener("click", this._garbageCollectButtonClicked, this);
 
-        if (WebInspector.experimentsSettings.showMemoryCounters.isEnabled()) {
-            this._memoryStatisticsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Toggle DOM counters graphs"), "dom-counters-status-bar-item");
-            this._memoryStatisticsButton.addEventListener("click", this._toggleMemoryStatistics, this);
-        }
+        this.toggleStartAtZeroButton = new WebInspector.StatusBarButton(WebInspector.UIString("Display all top level events starting at zero"), "timeline-start-at-zero-status-bar-item");
+        this.toggleStartAtZeroButton.addEventListener("click", this._toggleStartAtZeroButtonClicked, this);
 
         this.recordsCounter = document.createElement("span");
         this.recordsCounter.className = "timeline-records-counter";
+
+        this._glueParentButton = new WebInspector.StatusBarButton(WebInspector.UIString("Glue asynchronous events to causes"), "glue-async-status-bar-item");
+        this._glueParentButton.toggled = true;
+        this._glueParentButton.addEventListener("click", this._glueParentButtonClicked, this);
+
+        this.statusBarFilters = document.createElement("div");
+        this.statusBarFilters.className = "status-bar-items";
+        var categories = this._presentationModel.categories;
+        for (var categoryName in categories) {
+            var category = categories[categoryName];
+            this.statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCategoryCheckboxClicked.bind(this, category)));
+        }
+    },
+
+    _createTimelineCategoryStatusBarCheckbox: function(category, onCheckboxClicked)
+    {
+        var labelContainer = document.createElement("div");
+        labelContainer.addStyleClass("timeline-category-statusbar-item");
+        labelContainer.addStyleClass("timeline-category-" + category.name);
+        labelContainer.addStyleClass("status-bar-item");
+
+        var label = document.createElement("label");
+        var checkElement = document.createElement("input");
+        checkElement.type = "checkbox";
+        checkElement.className = "timeline-category-checkbox";
+        checkElement.checked = true;
+        checkElement.addEventListener("click", onCheckboxClicked, false);
+        label.appendChild(checkElement);
+
+        var typeElement = document.createElement("span");
+        typeElement.className = "type";
+        typeElement.textContent = category.title;
+        label.appendChild(typeElement);
+
+        labelContainer.appendChild(label);
+        return labelContainer;
+    },
+
+    _onCategoryCheckboxClicked: function(category, event)
+    {
+        this._presentationModel.setCategoryVisibility(category, event.target.checked);
     },
 
     _registerShortcuts: function()
@@ -355,11 +363,10 @@ WebInspector.TimelinePanel.prototype = {
 
     _loadFromFile: function()
     {
-        if (this.toggleTimelineButton.toggled)
-            WebInspector.timelineManager.stop();
-
-        this._clearPanel();
-
+        if (this.toggleTimelineButton.toggled) {
+            this.toggleTimelineButton.toggled = false;
+            this._model.stopRecord();
+        }
         this._model._loadFromFile(this._fileSelectorElement.files[0]);
         this._createFileSelector();
     },
@@ -410,23 +417,33 @@ WebInspector.TimelinePanel.prototype = {
         return eventDividerPadding;
     },
 
-    _timelinesOverviewItemSelected: function(event)
-    {
-        this._overviewPane.showTimelines();
-    },
-
-    _memoryOverviewItemSelected: function(event)
+    _timelinesOverviewModeChanged: function(event)
     {
-        this._overviewPane.showMemoryGraph(this._rootRecord.children);
+        if (!this._memoryStatistics)
+            return;
+        var shouldShowMemory = event.data === WebInspector.TimelineOverviewPane.Mode.Memory;
+        if (shouldShowMemory === this._memoryStatistics.visible())
+            return;
+        if (!shouldShowMemory) {
+            this._timelineMemorySplitter.addStyleClass("hidden");
+            this._memoryStatistics.hide();
+            this.splitView.element.style.height = "auto";
+            this.splitView.element.style.bottom = "0";
+            this.onResize();
+        } else {
+            this._timelineMemorySplitter.removeStyleClass("hidden");
+            this._memoryStatistics.show();
+            this.splitView.element.style.bottom = "auto";
+            this._setSplitterPosition(600);
+        }
     },
 
     _toggleTimelineButtonClicked: function()
     {
         if (this.toggleTimelineButton.toggled)
-            WebInspector.timelineManager.stop();
+            this._model.stopRecord();
         else {
-            this._clearPanel();
-            WebInspector.timelineManager.start(30);
+            this._model.startRecord();
             WebInspector.userMetrics.TimelineStarted.record();
         }
         this.toggleTimelineButton.toggled = !this.toggleTimelineButton.toggled;
@@ -435,8 +452,8 @@ WebInspector.TimelinePanel.prototype = {
     _toggleFilterButtonClicked: function()
     {
         this.toggleFilterButton.toggled = !this.toggleFilterButton.toggled;
-        this._calculator._showShortEvents = this.toggleFilterButton.toggled;
-        this.toggleFilterButton.element.title = this._calculator._showShortEvents ? this._hideShortRecordsTitleText : this._showShortRecordsTitleText;
+        this._showShortEvents = this.toggleFilterButton.toggled;
+        this.toggleFilterButton.element.title = this._showShortEvents ? this._hideShortRecordsTitleText : this._showShortRecordsTitleText;
         this._scheduleRefresh(true);
     },
 
@@ -445,41 +462,50 @@ WebInspector.TimelinePanel.prototype = {
         ProfilerAgent.collectGarbage();
     },
 
-    _toggleMemoryStatistics: function()
+    _glueParentButtonClicked: function()
     {
-        if (this._memoryStatistics.visible()) {
-            this._timelineMemorySplitter.addStyleClass("hidden");
-            this._memoryStatistics.hide();
-            this.splitView.element.style.height = "auto";
-            this.splitView.element.style.bottom = "0";
-            this.onResize();
-        } else {
-            this._timelineMemorySplitter.removeStyleClass("hidden");
-            this._memoryStatistics.show();
-            this.splitView.element.style.bottom = "auto";
-            this._setSplitterPosition(600);
-        }
+        this._glueParentButton.toggled = !this._glueParentButton.toggled;
+        this._repopulateRecords();
     },
 
-    _onTimelineEventRecorded: function(event)
+    _toggleStartAtZeroButtonClicked: function()
     {
-        if (this.toggleTimelineButton.toggled) {
-            this._addRecordToTimeline(event.data);
+        var toggled = !this.toggleStartAtZeroButton.toggled
+        this._glueParentButton.disabled = toggled;
+        this.toggleStartAtZeroButton.toggled = toggled;
+        this._calculator = toggled ? new WebInspector.TimelineStartAtZeroCalculator() : new WebInspector.TimelineCalculator();
+        this._repopulateRecords();
+        this._overviewPane.setStartAtZero(toggled);
+    },
 
-            if (this._memoryStatistics && event.data["domGroups"])
-                this._memoryStatistics.addTimlineEvent(event);
-        }
+    _repopulateRecords: function()
+    {
+        this._resetPanel();
+        var records = this._model.records;
+        for (var i = 0; i < records.length; ++i)
+            this._innerAddRecordToTimeline(records[i], this._rootRecord);
+        this._scheduleRefresh(false);
     },
 
-    _addRecordToTimeline: function(record)
+    get _startAtZero()
     {
-        this._model._addRecord(record);
-        this._innerAddRecordToTimeline(record, this._rootRecord);
+        return this.toggleStartAtZeroButton.toggled;
+    },
+
+    _onTimelineEventRecorded: function(event)
+    {
+        this._innerAddRecordToTimeline(event.data, this._rootRecord);
         this._scheduleRefresh(false);
+
+        if (this._memoryStatistics && event.data["counters"])
+            this._memoryStatistics.addTimlineEvent(event);
     },
 
     _findParentRecord: function(record)
     {
+        if (!this._glueParentButton.toggled)
+            return null;
+
         var recordTypes = WebInspector.TimelineAgent.RecordType;
         var parentRecord;
         if (record.type === recordTypes.ResourceReceiveResponse ||
@@ -490,6 +516,8 @@ WebInspector.TimelinePanel.prototype = {
             parentRecord = this._timerRecords[record.data["timerId"]];
         else if (record.type === recordTypes.ResourceSendRequest)
             parentRecord = this._scheduledResourceRequests[record.data["url"]];
+        else if (record.type === recordTypes.FireAnimationFrame)
+            parentRecord = this._requestAnimationFrameRecords[record.data["id"]];
         return parentRecord;
     },
 
@@ -498,17 +526,13 @@ WebInspector.TimelinePanel.prototype = {
         var connectedToOldRecord = false;
         var recordTypes = WebInspector.TimelineAgent.RecordType;
 
-        if (record.type === recordTypes.RegisterAnimationFrameCallback) {
-            this._registeredAnimationCallbackRecords[record.data["id"]] = record;
-            return;
-        }
-
         if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
             parentRecord = null; // No bar entry for load events.
-        else if (parentRecord === this._rootRecord ||
-                 record.type === recordTypes.ResourceReceiveResponse ||
-                 record.type === recordTypes.ResourceFinish ||
-                 record.type === recordTypes.ResourceReceivedData) {
+        else if (!this._startAtZero &&
+                    (parentRecord === this._rootRecord ||
+                    record.type === recordTypes.ResourceReceiveResponse ||
+                    record.type === recordTypes.ResourceFinish ||
+                    record.type === recordTypes.ResourceReceivedData)) {
             var newParentRecord = this._findParentRecord(record);
             if (newParentRecord) {
                 parentRecord = newParentRecord;
@@ -525,7 +549,7 @@ WebInspector.TimelinePanel.prototype = {
             }
         };
 
-        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrameEvent) && children && children.length) {
+        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrame) && children && children.length) {
             var childRecord = children[0];
             if (childRecord.type === recordTypes.FunctionCall) {
                 scriptDetails = {
@@ -550,23 +574,22 @@ WebInspector.TimelinePanel.prototype = {
         for (var i = 0; i < childrenCount; ++i)
             this._innerAddRecordToTimeline(children[i], formattedRecord);
 
-        formattedRecord._calculateAggregatedStats(this.categories);
+        formattedRecord._calculateAggregatedStats(this._presentationModel.categories);
 
         if (connectedToOldRecord) {
             record = formattedRecord;
             do {
                 var parent = record.parent;
-                parent._cpuTime += formattedRecord._cpuTime;
                 if (parent._lastChildEndTime < record._lastChildEndTime)
                     parent._lastChildEndTime = record._lastChildEndTime;
                 for (var category in formattedRecord._aggregatedStats)
                     parent._aggregatedStats[category] += formattedRecord._aggregatedStats[category];
                 record = parent;
             } while (record.parent);
-        } else
+        } else {
             if (parentRecord !== this._rootRecord)
                 parentRecord._selfTime -= formattedRecord.endTime - formattedRecord.startTime;
-
+        }
         // Keep bar entry for mark timeline since nesting might be interesting to the user.
         if (record.type === recordTypes.TimeStamp)
             this._timeStampRecords.push(formattedRecord);
@@ -576,9 +599,11 @@ WebInspector.TimelinePanel.prototype = {
     {
         var width = event.data;
         this._sidebarBackgroundElement.style.width = width + "px";
-        this._topPaneSidebarElement.style.width = width + "px";
         this._scheduleRefresh(false);
         this._overviewPane.sidebarResized(width);
+        // Min width = <number of buttons on the left> * 31
+        this.statusBarFilters.style.left = Math.max((this.statusBarItems.length + 2) * 31, width) + "px";
+
         if (this._memoryStatistics)
             this._memoryStatistics.setSidebarWidth(width);
     },
@@ -601,18 +626,28 @@ WebInspector.TimelinePanel.prototype = {
 
     _clearPanel: function()
     {
+        this._model._reset();
+    },
+
+    _onRecordsCleared: function()
+    {
+        this._resetPanel();
+        this._refresh();
+    },
+
+    _resetPanel: function()
+    {
+        this._presentationModel.reset();
         this._timeStampRecords = [];
         this._sendRequestRecords = {};
         this._scheduledResourceRequests = {};
         this._timerRecords = {};
-        this._registeredAnimationCallbackRecords = {};
+        this._requestAnimationFrameRecords = {};
         this._rootRecord = this._createRootRecord();
         this._boundariesAreValid = false;
         this._overviewPane.reset();
         this._adjustScrollPosition(0);
-        this._refresh();
         this._closeRecordDetails();
-        this._model._reset();
         this._linkifier.reset();
     },
 
@@ -644,12 +679,6 @@ WebInspector.TimelinePanel.prototype = {
         this._scheduleRefresh(true);
     },
 
-    _windowChanged: function()
-    {
-        this._closeRecordDetails();
-        this._scheduleRefresh(false);
-    },
-
     _scheduleRefresh: function(preserveBoundaries)
     {
         this._closeRecordDetails();
@@ -660,9 +689,10 @@ WebInspector.TimelinePanel.prototype = {
 
         if (preserveBoundaries)
             this._refresh();
-        else
+        else {
             if (!this._refreshTimeout)
                 this._refreshTimeout = setTimeout(this._refresh.bind(this), 100);
+        }
     },
 
     _refresh: function()
@@ -672,8 +702,10 @@ WebInspector.TimelinePanel.prototype = {
             delete this._refreshTimeout;
         }
 
-        this._overviewPane.update(this._rootRecord.children, this._calculator._showShortEvents);
+        this._overviewPane.update(this._rootRecord.children, this._showShortEvents);
 
+        if (!this._boundariesAreValid)
+            this._updateBoundaries();
         this._refreshRecords(!this._boundariesAreValid);
         this._updateRecordsCounter();
         if(!this._boundariesAreValid)
@@ -686,8 +718,8 @@ WebInspector.TimelinePanel.prototype = {
     _updateBoundaries: function()
     {
         this._calculator.reset();
-        this._calculator.windowLeft = this._overviewPane.windowLeft;
-        this._calculator.windowRight = this._overviewPane.windowRight;
+        this._calculator.windowLeft = this._presentationModel.windowLeft;
+        this._calculator.windowRight = this._presentationModel.windowRight;
 
         for (var i = 0; i < this._rootRecord.children.length; ++i)
             this._calculator.updateBoundaries(this._rootRecord.children[i]);
@@ -695,42 +727,47 @@ WebInspector.TimelinePanel.prototype = {
         this._calculator.calculateWindow();
     },
 
-    /**
-     * @param {boolean=} parentIsCollapsed
-     */
-    _addToRecordsWindow: function(record, recordsWindow, parentIsCollapsed)
-    {
-        if (!this._calculator._showShortEvents && !record.isLong())
-            return;
-        var percentages = this._calculator.computeBarGraphPercentages(record);
-        if (percentages.start < 100 && percentages.endWithChildren >= 0 && !record.category.hidden) {
-            ++this._rootRecord._visibleRecordsCount;
-            ++record.parent._invisibleChildrenCount;
-            if (!parentIsCollapsed)
-                recordsWindow.push(record);
-        }
-
-        var index = recordsWindow.length;
-        record._invisibleChildrenCount = 0;
-        for (var i = 0; i < record.children.length; ++i)
-            this._addToRecordsWindow(record.children[i], recordsWindow, parentIsCollapsed || record.collapsed);
-        record._visibleChildrenCount = recordsWindow.length - index;
-    },
-
     _filterRecords: function()
     {
         var recordsInWindow = [];
+        var filter = this._startAtZero ? new WebInspector.TimelineStartAtZeroRecordFilter(this._presentationModel, this._rootRecord, this._showShortEvents)
+            : new WebInspector.TimelineRecordFilter(this._calculator, this._showShortEvents);
         this._rootRecord._visibleRecordsCount = 0;
-        for (var i = 0; i < this._rootRecord.children.length; ++i)
-            this._addToRecordsWindow(this._rootRecord.children[i], recordsInWindow);
+
+        var stack = [{children: this._rootRecord.children, index: 0, parentIsCollapsed: false}];
+        while (stack.length) {
+            var entry = stack[stack.length - 1];
+            var records = entry.children;
+            if (records && entry.index < records.length) {
+                 var record = records[entry.index];
+                 ++entry.index;
+
+                 if (filter.accept(record)) {
+                     ++this._rootRecord._visibleRecordsCount;
+                     ++record.parent._invisibleChildrenCount;
+                     if (!entry.parentIsCollapsed)
+                         recordsInWindow.push(record);
+                 }
+
+                 record._invisibleChildrenCount = 0;
+
+                 stack.push({children: record.children,
+                             index: 0,
+                             parentIsCollapsed: (entry.parentIsCollapsed || record.collapsed),
+                             parentRecord: record,
+                             windowLengthBeforeChildrenTraversal: recordsInWindow.length});
+            } else {
+                stack.pop();
+                if (entry.parentRecord)
+                    entry.parentRecord._visibleChildrenCount = recordsInWindow.length - entry.windowLengthBeforeChildrenTraversal;
+            }
+        }
+
         return recordsInWindow;
     },
 
     _refreshRecords: function(updateBoundaries)
     {
-        if (updateBoundaries)
-            this._updateBoundaries();
-
         var recordsInWindow = this._filterRecords();
 
         // Calculate the visible area.
@@ -856,7 +893,7 @@ WebInspector.TimelinePanel.prototype = {
     _showPopover: function(anchor, popover)
     {
         var record = anchor.row._record;
-        popover.show(record._generatePopupContent(this._calculator, this.categories), anchor);
+        popover.show(record._generatePopupContent(this._calculator, this._presentationModel.categories), anchor);
     },
 
     _closeRecordDetails: function()
@@ -893,8 +930,7 @@ WebInspector.TimelineCalculator.prototype = {
         var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
         var end = (record.startTime + record._selfTime - this.minimumBoundary) / this.boundarySpan * 100;
         var endWithChildren = (record._lastChildEndTime - this.minimumBoundary) / this.boundarySpan * 100;
-        var cpuWidth = record._cpuTime / this.boundarySpan * 100;
-        return {start: start, end: end, endWithChildren: endWithChildren, cpuWidth: cpuWidth};
+        return {start: start, end: end, endWithChildren: endWithChildren};
     },
 
     computeBarGraphWindowPosition: function(record, clientWidth)
@@ -903,13 +939,13 @@ WebInspector.TimelineCalculator.prototype = {
         const borderWidth = 4;
         var workingArea = clientWidth - minWidth - borderWidth;
         var percentages = this.computeBarGraphPercentages(record);
+
         var left = percentages.start / 100 * workingArea;
         var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
         var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
-        var cpuWidth = percentages.cpuWidth / 100 * workingArea + minWidth;
         if (percentages.endWithChildren > percentages.end)
             widthWithChildren += borderWidth + minWidth;
-        return {left: left, width: width, widthWithChildren: widthWithChildren, cpuWidth: cpuWidth};
+        return {left: left, width: width, widthWithChildren: widthWithChildren};
     },
 
     calculateWindow: function()
@@ -946,6 +982,74 @@ WebInspector.TimelineCalculator.prototype = {
 
 /**
  * @constructor
+ * @extends WebInspector.TimelineCalculator
+ */
+WebInspector.TimelineStartAtZeroCalculator = function()
+{
+    this.reset();
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+}
+
+WebInspector.TimelineStartAtZeroCalculator.prototype = {
+    computeBarGraphPercentages: function(record)
+    {
+        var scale = 100 / this.maximumBoundary;
+        return {
+            start: record._initiatorOffset * scale,
+            end: (record._initiatorOffset + record.endTime - record.startTime) * scale,
+            endWithChildren: (record._initiatorOffset + record._lastChildEndTime - record.startTime) * scale
+        };
+    },
+
+    computeBarGraphWindowPosition: function(record, clientWidth)
+    {
+        const minWidth = 5;
+        const borderWidth = 4;
+        var workingArea = clientWidth - minWidth - borderWidth;
+        var percentages = this.computeBarGraphPercentages(record);
+        var left = percentages.start / 100 * workingArea;
+        var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
+        var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
+        if (percentages.endWithChildren > percentages.end)
+            widthWithChildren += borderWidth + minWidth;
+
+        return {left: left, width: width, widthWithChildren: widthWithChildren};
+    },
+
+    calculateWindow: function()
+    {
+        this.minimumBoundary = this._absoluteMinimumBoundary;
+        this.maximumBoundary = this._absoluteMaximumBoundary * 1.05;
+        this.boundarySpan = this.maximumBoundary >= 0 ? this.maximumBoundary : 0;
+    },
+
+    reset: function()
+    {
+        this._absoluteMinimumBoundary = -1;
+        this._absoluteMaximumBoundary = -1;
+    },
+
+    updateBoundaries: function(record)
+    {
+        var lowerBound = record.startTime;
+        if (this._absoluteMinimumBoundary === -1 || lowerBound < this._absoluteMinimumBoundary)
+            this._absoluteMinimumBoundary = lowerBound;
+
+        const minimumTimeFrame = 0.001;
+        var upperBound = Math.max(record.endTime - record.startTime, minimumTimeFrame);
+        if (this._absoluteMaximumBoundary === -1 || upperBound > this._absoluteMaximumBoundary)
+            this._absoluteMaximumBoundary = upperBound;
+    },
+
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value, true);
+    }
+};
+
+/**
+ * @constructor
  */
 WebInspector.TimelineRecordListRow = function()
 {
@@ -1018,11 +1122,6 @@ WebInspector.TimelineRecordGraphRow = function(graphContainer, scheduleRefresh)
     this._barWithChildrenElement.row = this;
     this._barAreaElement.appendChild(this._barWithChildrenElement);
 
-    this._barCpuElement = document.createElement("div");
-    this._barCpuElement.className = "timeline-graph-bar cpu"
-    this._barCpuElement.row = this;
-    this._barAreaElement.appendChild(this._barCpuElement);
-
     this._barElement = document.createElement("div");
     this._barElement.className = "timeline-graph-bar";
     this._barElement.row = this;
@@ -1044,8 +1143,6 @@ WebInspector.TimelineRecordGraphRow.prototype = {
         this._barWithChildrenElement.style.width = barPosition.widthWithChildren + "px";
         this._barElement.style.left = barPosition.left + expandOffset + "px";
         this._barElement.style.width =  barPosition.width + "px";
-        this._barCpuElement.style.left = barPosition.left + expandOffset + "px";
-        this._barCpuElement.style.width = barPosition.cpuWidth + "px";
         this._expandElement._update(record, index, barPosition);
     },
 
@@ -1081,6 +1178,9 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
     this.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : this.startTime;
     this._selfTime = this.endTime - this.startTime;
     this._lastChildEndTime = this.endTime;
+    this._initiatorOffset = (parentRecord && parentRecord !== panel._rootRecord) ?
+        parentRecord._initiatorOffset + this.startTime - parentRecord.startTime : 0;
+
     if (record.stackTrace && record.stackTrace.length)
         this.stackTrace = record.stackTrace;
     this.totalHeapSize = record.totalHeapSize;
@@ -1120,10 +1220,12 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
             this.timeout = timerInstalledRecord.timeout;
             this.singleShot = timerInstalledRecord.singleShot;
         }
-    } else if (record.type === recordTypes.FireAnimationFrameEvent) {
-        var registerCallbackRecord = panel._registeredAnimationCallbackRecords[record.data["id"]];
-        if (registerCallbackRecord)
-            this.callSiteStackTrace = registerCallbackRecord.stackTrace;
+    } else if (record.type === recordTypes.RequestAnimationFrame) {
+        panel._requestAnimationFrameRecords[record.data["id"]] = this;
+    } else if (record.type === recordTypes.FireAnimationFrame) {
+        var requestAnimationRecord = panel._requestAnimationFrameRecords[record.data["id"]];
+        if (requestAnimationRecord)
+            this.callSiteStackTrace = requestAnimationRecord.stackTrace;
     }
     this._refreshDetails();
 }
@@ -1150,7 +1252,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             label.className = "timeline-aggregated-category timeline-" + index;
             cell.appendChild(label);
             var text = document.createElement("span");
-            text.textContent = Number.secondsToString(this._aggregatedStats[index] + 0.0001);
+            text.textContent = Number.secondsToString(this._aggregatedStats[index], true);
             cell.appendChild(text);
         }
         return cell;
@@ -1161,10 +1263,10 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
         var contentHelper = new WebInspector.TimelinePanel.PopupContentHelper(this.title, this._panel);
 
         if (this._children && this._children.length) {
-            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime + 0.0001));
+            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime, true));
             contentHelper._appendElementRow(WebInspector.UIString("Aggregated Time"), this._generateAggregatedInfo());
         }
-        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime),
+        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
             calculator.formatValue(this.startTime - calculator.minimumBoundary));
         contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
 
@@ -1183,7 +1285,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
                     contentHelper._appendTextRow(WebInspector.UIString("Repeats"), !this.singleShot);
                 }
                 break;
-            case recordTypes.FireAnimationFrameEvent:
+            case recordTypes.FireAnimationFrame:
                 contentHelper._appendTextRow(WebInspector.UIString("Callback ID"), this.data["id"]);
                 break;
             case recordTypes.FunctionCall:
@@ -1246,7 +1348,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
                 return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["timerId"];
             case WebInspector.TimelineAgent.RecordType.FunctionCall:
                 return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : null;
-            case WebInspector.TimelineAgent.RecordType.FireAnimationFrameEvent:
+            case WebInspector.TimelineAgent.RecordType.FireAnimationFrame:
                 return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["id"];
             case WebInspector.TimelineAgent.RecordType.EventDispatch:
                 return this.data ? this.data["type"] : null;
@@ -1255,8 +1357,8 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             case WebInspector.TimelineAgent.RecordType.TimerInstall:
             case WebInspector.TimelineAgent.RecordType.TimerRemove:
                 return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["timerId"];
-            case WebInspector.TimelineAgent.RecordType.RegisterAnimationFrameCallback:
-            case WebInspector.TimelineAgent.RecordType.CancelAnimationFrameCallback:
+            case WebInspector.TimelineAgent.RecordType.RequestAnimationFrame:
+            case WebInspector.TimelineAgent.RecordType.CancelAnimationFrame:
                 return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["id"];
             case WebInspector.TimelineAgent.RecordType.ParseHTML:
             case WebInspector.TimelineAgent.RecordType.RecalculateStyles:
@@ -1283,18 +1385,20 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
         this._aggregatedStats = {};
         for (var category in categories)
             this._aggregatedStats[category] = 0;
-        this._cpuTime = this._selfTime;
 
         if (this._children) {
             for (var index = this._children.length; index; --index) {
                 var child = this._children[index - 1];
-                this._aggregatedStats[child.category.name] += child._selfTime;
                 for (var category in categories)
                     this._aggregatedStats[category] += child._aggregatedStats[category];
             }
-            for (var category in this._aggregatedStats)
-                this._cpuTime += this._aggregatedStats[category];
         }
+        this._aggregatedStats[this.category.name] += this._selfTime;
+    },
+
+    get aggregatedStats()
+    {
+        return this._aggregatedStats;
     }
 }
 
@@ -1427,23 +1531,60 @@ WebInspector.TimelineExpandableElement.prototype = {
 
 /**
  * @constructor
+ * @extends {WebInspector.Object}
  */
-WebInspector.TimelineModel = function(timelinePanel)
+WebInspector.TimelineModel = function()
 {
-    this._panel = timelinePanel;
     this._records = [];
+    this._collectionEnabled = false;
+
+    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onRecordAdded, this);
+}
+
+WebInspector.TimelineModel.Events = {
+    RecordAdded: "RecordAdded",
+    RecordsCleared: "RecordsCleared"
 }
 
 WebInspector.TimelineModel.prototype = {
+    startRecord: function()
+    {
+        if (this._collectionEnabled)
+            return;
+        this._reset();
+        WebInspector.timelineManager.start(30);
+        this._collectionEnabled = true;
+    },
+
+    stopRecord: function()
+    {
+        if (!this._collectionEnabled)
+            return;
+        WebInspector.timelineManager.stop();
+        this._collectionEnabled = false;
+    },
+
+    get records()
+    {
+        return this._records;
+    },
+
+    _onRecordAdded: function(event)
+    {
+        if (this._collectionEnabled)
+            this._addRecord(event.data);
+    },
+
     _addRecord: function(record)
     {
         this._records.push(record);
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordAdded, record);
     },
 
     _loadNextChunk: function(data, index)
     {
         for (var i = 0; i < 20 && index < data.length; ++i, ++index)
-            this._panel._addRecordToTimeline(data[index]);
+            this._addRecord(data[index]);
 
         if (index !== data.length)
             setTimeout(this._loadNextChunk.bind(this, data, index), 0);
@@ -1454,7 +1595,7 @@ WebInspector.TimelineModel.prototype = {
         function onLoad(e)
         {
             var data = JSON.parse(e.target.result);
-            var version = data[0];
+            this._reset();
             this._loadNextChunk(data, 1);
         }
 
@@ -1495,6 +1636,140 @@ WebInspector.TimelineModel.prototype = {
 
     _reset: function()
     {
+        this.stopRecord();
         this._records = [];
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordsCleared);
     }
 }
+
+WebInspector.TimelineModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelinePresentationModel = function()
+{
+    this._categories = {};
+    this.reset();
+}
+
+WebInspector.TimelinePresentationModel.Events = {
+    WindowChanged: "WindowChanged",
+    CategoryVisibilityChanged: "CategoryVisibilityChanged"
+}
+
+WebInspector.TimelinePresentationModel.prototype = {
+    reset: function()
+    {
+        this.windowLeft = 0.0;
+        this.windowRight = 1.0;
+        this.windowIndexLeft = 0;
+        this.windowIndexRight = null;
+    },
+
+    get categories()
+    {
+        return this._categories;
+    },
+
+    /**
+     * @param {WebInspector.TimelineCategory} category
+     */
+    addCategory: function(category)
+    {
+        this._categories[category.name] = category;
+    },
+
+    /**
+     * @param {number} left
+     * @param {number} right
+     */
+    setWindowPosition: function(left, right)
+    {
+        this.windowLeft = left;
+        this.windowRight = right;
+        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
+    },
+
+    /**
+     * @param {number} left
+     * @param {?number} right
+     */
+    setWindowIndices: function(left, right)
+    {
+        this.windowIndexLeft = left;
+        this.windowIndexRight = right;
+        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
+    },
+
+    /**
+     * @param {WebInspector.TimelineCategory} category
+     * @param {boolean} visible
+     */
+    setCategoryVisibility: function(category, visible)
+    {
+        category.hidden = !visible;
+        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, category);
+    }
+}
+
+/**
+ * @constructor
+ * @param {WebInspector.TimelineCalculator} calculator
+ * @param {boolean} showShortEvents
+ */
+WebInspector.TimelineRecordFilter = function(calculator, showShortEvents)
+{
+    this._calculator = calculator;
+    this._showShortEvents = showShortEvents;
+}
+
+WebInspector.TimelineRecordFilter.prototype = {
+    /**
+     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     */
+    accept: function(record)
+    {
+        if (record.category.hidden)
+            return false;
+        if (!this._showShortEvents && !record.isLong())
+            return false;
+        var percentages = this._calculator.computeBarGraphPercentages(record);
+        return percentages.start <= 100 && percentages.endWithChildren >= 0;
+    }
+}
+
+/**
+ * @constructor
+ * @param {WebInspector.TimelinePresentationModel} model
+ * @param {Object} rootRecord
+ * @param {boolean} showShortEvents
+ */
+WebInspector.TimelineStartAtZeroRecordFilter = function(model, rootRecord, showShortEvents)
+{
+    this._windowIndexLeft = model.windowIndexLeft;
+    this._windowIndexRight = model.windowIndexRight;
+    this._rootRecord = rootRecord;
+    this._topLevelRecordIndex = 0;
+    this._showShortEvents = showShortEvents;
+}
+
+WebInspector.TimelineStartAtZeroRecordFilter.prototype = {
+    /**
+     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     */
+    accept: function(record)
+    {
+        if (record.category.hidden)
+            return false;
+        if (record.parent === this._rootRecord)
+            ++this._topLevelRecordIndex;
+        if (!this._showShortEvents && !record.isLong())
+            return false;
+        return this._topLevelRecordIndex > this._windowIndexLeft &&
+            (typeof this._windowIndexRight !== "number" || this._topLevelRecordIndex <= this._windowIndexRight);
+    }
+}
+
+WebInspector.TimelinePresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/UIUtils.js b/Source/WebCore/inspector/front-end/UIUtils.js
index 0e268634e..49ddec50b 100644
--- a/Source/WebCore/inspector/front-end/UIUtils.js
+++ b/Source/WebCore/inspector/front-end/UIUtils.js
@@ -447,7 +447,7 @@ Number.withThousandsSeparator = function(num)
     var str = num + "";
     var re = /(\d+)(\d{3})/;
     while (str.match(re))
-        str = str.replace(re, "$1,$2");
+        str = str.replace(re, "$1\u2009$2"); // \u2009 is a thin space.
     return str;
 }
 
diff --git a/Source/WebCore/inspector/front-end/View.js b/Source/WebCore/inspector/front-end/View.js
index b39dad5cd..f5a6dc847 100644
--- a/Source/WebCore/inspector/front-end/View.js
+++ b/Source/WebCore/inspector/front-end/View.js
@@ -278,13 +278,20 @@ WebInspector.View.prototype = {
             return;
         }
 
-        var xhr = new XMLHttpRequest();
-        xhr.open("GET", cssFile, false);
-        xhr.send(null);
-
-        styleElement = document.createElement("style");
-        styleElement.type = "text/css";
-        styleElement.textContent = xhr.responseText;
+        if (WebInspector.experimentsSettings.debugCSS.isEnabled()) {
+            styleElement = document.createElement("link");
+            styleElement.rel = "stylesheet";
+            styleElement.type = "text/css";
+            styleElement.href = cssFile;
+        } else {
+            var xhr = new XMLHttpRequest();
+            xhr.open("GET", cssFile, false);
+            xhr.send(null);
+
+            styleElement = document.createElement("style");
+            styleElement.type = "text/css";
+            styleElement.textContent = xhr.responseText;
+        }
         document.head.insertBefore(styleElement, document.head.firstChild);
 
         WebInspector.View._cssFileToStyleElement[cssFile] = styleElement;
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index e6d3db341..2887b1d62 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -270,8 +270,10 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     _mouseOut: function()
     {
-        if (this._hoveredElement)
+        if (this._hoveredElement) {
             this._hoveredElement.removeStyleClass("hovered");
+            delete this._hoveredElement;
+        }
         delete this._lastMouseMovePageY;
     },
 
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 869240c93..d1031e288 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -68,6 +68,7 @@
     <file>HelpScreen.js</file>
     <file>ImageView.js</file>
     <file>IndexedDBModel.js</file>
+    <file>IndexedDBViews.js</file>
     <file>InjectedFakeWorker.js</file>
     <file>inspector.js</file>
     <file>InspectorBackend.js</file>
@@ -126,6 +127,7 @@
     <file>SettingsScreen.js</file>
     <file>ShortcutsScreen.js</file>
     <file>ShowMoreDataGridNode.js</file>
+    <file>SidebarOverlay.js</file>
     <file>SidebarPane.js</file>
     <file>SidebarTreeElement.js</file>
     <file>SoftContextMenu.js</file>
@@ -134,6 +136,7 @@
     <file>SourceHTMLTokenizer.js</file>
     <file>SourceJavaScriptTokenizer.js</file>
     <file>SourceTokenizer.js</file>
+    <file>Spectrum.js</file>
     <file>SplitView.js</file>
     <file>StatusBarButton.js</file>
     <file>StylesSidebarPane.js</file>
@@ -168,6 +171,7 @@
     <file>filteredItemSelectionDialog.css</file>
     <file>heapProfiler.css</file>
     <file>helpScreen.css</file>
+    <file>indexedDBViews.css</file>
     <file>inspector.css</file>
     <file>inspectorCommon.css</file>
     <file>inspectorSyntaxHighlight.css</file>
@@ -223,7 +227,12 @@
     <file>Images/goArrow.png</file>
     <file>Images/graphLabelCalloutLeft.png</file>
     <file>Images/graphLabelCalloutRight.png</file>
+    <file>Images/indexedDB.png</file>
+    <file>Images/indexedDBObjectStore.png</file>
+    <file>Images/indexedDBIndex.png</file>
     <file>Images/localStorage.png</file>
+    <file>Images/navigatorShowHideButton.png</file>
+    <file>Images/navigatorPinButton.png</file>
     <file>Images/paneAddButtons.png</file>
     <file>Images/paneBottomGrow.png</file>
     <file>Images/paneBottomGrowActive.png</file>
diff --git a/Source/WebCore/inspector/front-end/dialog.css b/Source/WebCore/inspector/front-end/dialog.css
index ccfb3a443..20f3ee1ad 100644
--- a/Source/WebCore/inspector/front-end/dialog.css
+++ b/Source/WebCore/inspector/front-end/dialog.css
@@ -53,3 +53,24 @@
     background-color: rgb(215, 215, 215);
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
 }
+
+.sidebar-overlay-dialog {
+    position: absolute;
+    display: -webkit-box;
+    height: 0;
+    width: 0;
+    -webkit-box-orient: vertical;
+    z-index: -1;
+    background-color: white;
+    border-right: 1px solid gray;
+    -webkit-box-shadow: rgb(90,90,90) 20px 0px 50px -25px;
+}
+
+.sidebar-overlay-resizer {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    width: 5px;
+    z-index: 500;
+    cursor: ew-resize;
+}
diff --git a/Source/WebCore/inspector/front-end/elementsPanel.css b/Source/WebCore/inspector/front-end/elementsPanel.css
index a61197496..8f9224a69 100644
--- a/Source/WebCore/inspector/front-end/elementsPanel.css
+++ b/Source/WebCore/inspector/front-end/elementsPanel.css
@@ -248,8 +248,8 @@
     opacity: 0.75;
     width: 12px;
     height: 10px;
-    margin: 0;
-    padding-right: 2px;
+    margin: 0 6px 0 0;
+    padding: 0 1px;
     vertical-align: baseline;
     -webkit-user-select: none;
     cursor: default;
@@ -297,11 +297,15 @@
 .styles-section .properties {
     display: none;
     margin: 0;
-    padding: 2px 4px 0 8px;
+    padding: 2px 4px 0 6px;
     list-style: none;
     clear: both;
 }
 
+.styles-section.matched-styles .properties {
+    padding-left: 0;
+}
+
 .styles-section.no-affect .properties li {
     opacity: 0.5;
 }
@@ -321,9 +325,8 @@
     overflow: hidden;
     cursor: auto;
 }
-
-.styles-section .properties li.parent {
-    margin-left: 1px;
+.styles-section.matched-styles .properties li {
+    margin-left: 0 !important;
 }
 
 .styles-section .properties li.child-editing {
@@ -343,6 +346,25 @@
 }
 
 .styles-section .properties li.parent::before {
+    content: none;
+}
+
+.styles-section .properties li.parent.expanded::before {
+    content: none;
+}
+
+.styles-section.matched-styles .properties li.parent .expand-element {
+    content: url(Images/treeRightTriangleBlack.png);
+    margin-right: 1px;
+    margin-left: -5px;
+    opacity: 0.6;
+}
+
+.styles-section.matched-styles .properties li.parent.expanded .expand-element {
+    content: url(Images/treeDownTriangleBlack.png);
+}
+
+.styles-section.computed-style .properties li.parent::before {
     content: url(Images/treeRightTriangleBlack.png);
     opacity: 0.75;
     float: left;
@@ -354,7 +376,7 @@
     cursor: default;
 }
 
-.styles-section .properties li.parent.expanded::before {
+.styles-section.computed-style .properties li.parent.expanded::before {
     content: url(Images/treeDownTriangleBlack.png);
     margin-top: 1px;
 }
@@ -364,22 +386,28 @@
     padding-bottom: 3px;
 }
 
-.styles-section:hover .properties .enabled-button {
-    display: block;
+.styles-section.matched-styles:not(.read-only):hover .properties .enabled-button {
+    visibility: visible;
 }
 
-.styles-section .properties li.disabled .enabled-button {
-    display: block;
+.styles-section.matched-styles:not(.read-only) .properties li.disabled .enabled-button {
+    visibility: visible;
 }
 
 .styles-section .properties .enabled-button {
-    display: none;
-    float: right;
+    visibility: hidden;
+    float: left;
     font-size: 10px;
-    margin: 0 0 0 4px;
+    margin: 0;
     vertical-align: top;
     position: relative;
     z-index: 1;
+    width: 18px;
+    left: -2px;
+}
+
+.styles-section.matched-styles .properties ol.expanded {
+    margin-left: 16px;
 }
 
 .styles-section .properties .overloaded, .styles-section .properties .inactive, .styles-section .properties .disabled {
@@ -479,9 +507,137 @@
     width: 8px;
     height: 8px;
     opacity: 0.75;
-    content: url(Images/treeRightTriangleBlack.png);
+    content: url(Images/treeRightTriangleBlack.png) !important;
 }
 
 .event-bars .event-bar.expanded .header::before {
-    content: url(Images/treeDownTriangleBlack.png);
+    content: url(Images/treeDownTriangleBlack.png) !important;
+}
+
+.image-preview-container {
+    background: transparent;
+    text-align: center;
+    padding-left: 11px;
+}
+
+.image-preview-container img {
+    margin: 2px auto;
+    background-image: url(Images/checker.png);
+    -webkit-user-select: text;
+    -webkit-user-drag: auto;
+}
+
+/* https://github.com/bgrins/spectrum */
+.spectrum-container {
+    position: absolute;
+    top: 0;
+    left: 0;
+    display: inline-block;
+    background: rgba(230, 230, 230, 1) !important;
+    border: 1px solid #646464;
+    padding: 10px;
+    width: 220px;
+    z-index: 10;
+    -webkit-user-select: none;
+}
+
+.spectrum-top {
+    position: relative;
+    width: 100%;
+    display: inline-block;
+}
+
+.spectrum-color {
+    position: absolute;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    right: 40px;
+}
+
+.spectrum-display-value {
+    -webkit-user-select: text;
+    position: relative;
+    left: 2px;
+    top: -6px;
+}
+
+.spectrum-hue {
+    position: absolute;
+    top: 0;
+    right: 0;
+    bottom: 0;
+    left: 170px;
+    -webkit-box-reflect: right -28px;
+}
+
+.spectrum-fill {
+    /* Same as spectrum-color width to force aspect ratio. */
+    margin-top: 150px;
+}
+
+.spectrum-range-container {
+    position: relative;
+    padding-bottom: 5px;
+}
+
+.spectrum-range-container * {
+    font-size: 11px;
+    vertical-align: middle;
+}
+
+.spectrum-range-container label {
+    display: inline-block;
+    padding-right: 4px;
+}
+
+.spectrum-range-container input {
+    position: absolute;
+    left: 15px;
+    right: 40px;
+    margin: 3px 0 0 0;
+}
+
+.swatch, .spectrum-dragger, .spectrum-slider {
+    -webkit-user-select: none;
+}
+
+.spectrum-sat {
+    background-image: -webkit-linear-gradient(left, white, rgba(204, 154, 129, 0));
+}
+
+.spectrum-val {
+    background-image: -webkit-linear-gradient(bottom, black, rgba(204, 154, 129, 0));
+}
+
+.spectrum-hue {
+    background: -webkit-linear-gradient(top, #ff0000 0%, #ffff00 17%, #00ff00 33%, #00ffff 50%, #0000ff 67%, #ff00ff 83%, #ff0000 100%);
+}
+
+.spectrum-dragger {
+    border-radius: 5px;
+    height: 5px;
+    width: 5px;
+    border: 1px solid white;
+    cursor: pointer;
+    position: absolute;
+    top: 0;
+    left: 0;
+    background: black;
+}
+
+.spectrum-slider {
+    position: absolute;
+    top: 0;
+    cursor: pointer;
+    border: 1px solid black;
+    height: 4px;
+    left: -1px;
+    right: -1px;
+}
+
+.spectrum-container .swatch {
+    width: 20px;
+    height:20px;
+    margin: 0;
 }
diff --git a/Source/WebCore/inspector/front-end/externs.js b/Source/WebCore/inspector/front-end/externs.js
index a7a4512bc..606cc9a1e 100644
--- a/Source/WebCore/inspector/front-end/externs.js
+++ b/Source/WebCore/inspector/front-end/externs.js
@@ -42,7 +42,7 @@ var JSON = {}
 /** @param {string} str */
 JSON.parse = function(str) {}
 /**
- * @param {Object} obj
+ * @param {*} obj
  * @param {Function=} replacer
  * @param {number=} space
  * @return {string}
@@ -191,3 +191,6 @@ WebInspector.showPanel = function(panel)
 WebInspector.inspectedPageDomain;
 
 WebInspector.isCompactMode = function() { return false; }
+
+WebInspector.SourceJavaScriptTokenizer = {}
+WebInspector.SourceJavaScriptTokenizer.Keywords = {}
diff --git a/Source/WebCore/inspector/front-end/heapProfiler.css b/Source/WebCore/inspector/front-end/heapProfiler.css
index 7f20296c1..d98e3823e 100644
--- a/Source/WebCore/inspector/front-end/heapProfiler.css
+++ b/Source/WebCore/inspector/front-end/heapProfiler.css
@@ -121,8 +121,8 @@ body.inactive .heap-snapshot-sidebar-tree-item.wait.selected .icon {
 
 .detailed-heapshot-view .data-grid span.percent-column {
     color: grey;
-    width: 42px;
-    float: left;
+    width: 32px;
+    float: right;
 }
 
 .detailed-heapshot-view .console-formatted-object, .console-formatted-node {
@@ -187,6 +187,30 @@ body.inactive .heap-snapshot-sidebar-tree-item.wait.selected .icon {
     right: 0;
 }
 
+.detailed-heapshot-view .constructors-view-grid {
+    top: 22px;
+}
+
+.detailed-heapshot-view .constructors-view-toolbar {
+    height: 22px;
+    background-color: #DDD;
+    display: block;
+    position: absolute;
+    left: 0;
+    right: 0;
+    top: 0;
+}
+
+.detailed-heapshot-view .constructors-view-toolbar input.constructors-view-filter {
+    width: 200px;
+    height: 18px;
+    font-size: 11px;
+    padding: 2px;
+    margin: 2px 10px;
+    background-color: white;
+    border: solid 1px #BBB;
+}
+
 .detailed-heapshot-view .retainers-view-header {
     background-image: url(Images/statusbarResizerVertical.png), url(Images/statusbarBackground.png);
     background-repeat: no-repeat, repeat-x;
diff --git a/Source/WebCore/inspector/front-end/indexedDBViews.css b/Source/WebCore/inspector/front-end/indexedDBViews.css
new file mode 100644
index 000000000..b5817d14e
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/indexedDBViews.css
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+.indexed-db-database-view {
+    -webkit-user-select: text;
+    margin-top: 5px;
+}
+
+.indexed-db-database-view .outline-disclosure {
+    padding-left: 0;
+}
+
+.indexed-db-database-view .outline-disclosure li {
+    white-space: nowrap;
+}
+
+.indexed-db-database-view .outline-disclosure .attribute-name {
+    color: rgb(33%, 33%, 33%);
+    display: inline-block;
+    margin-right: 0.5em;
+    font-weight: bold;
+    vertical-align: top;
+}
+
+.indexed-db-database-view .outline-disclosure .attribute-value {
+    display: inline;
+    margin-top: 1px;
+}
+
+.indexed-db-data-view .data-view-toolbar {
+    position: relative;
+    margin-top: -1px;
+    height: 24px;
+}
+
+.indexed-db-data-view .data-view-toolbar .back-button img {
+    content: url(Images/back.png);
+}
+
+.indexed-db-data-view .data-view-toolbar .forward-button img {
+    content: url(Images/forward.png);
+}
+
+.indexed-db-data-view .data-view-toolbar .key-input {
+    font-size: 10px;
+    margin-top: 3px;
+    margin-left: 3px;
+    width: 200px;
+}
+
+.indexed-db-data-view .data-grid-container {
+    top: 23px;
+}
+
+.indexed-db-data-view .data-grid {
+    height: 100%;
+    border: 0;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-child(even) {
+    background-color: white;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-child(odd) {
+    background-color: #EAF3FF;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-last-child(1) {
+    background-color: white;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-last-child(1) td {
+    border: 0;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 70f0e136f..490c1f52b 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -1437,14 +1437,20 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
 }
 
 .swatch {
-    display: inline-block;
-    vertical-align: baseline;
     margin-left: 1px;
     margin-right: 2px;
     margin-bottom: -1px;
     width: 1em;
     height: 1em;
     border: 1px solid rgba(128, 128, 128, 0.6);
+    background-image: url(Images/checker.png);
+    display: inline-block;
+}
+
+.swatch-inner {
+    width: 100%;
+    height: 100%;
+    display: block;
 }
 
 .swatch:hover {
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index 04e4ef1d6..ee56c86b2 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -82,7 +82,9 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ApplicationCacheModel.js"></script>
     <script type="text/javascript" src="ApplicationCacheItemsView.js"></script>
     <script type="text/javascript" src="IndexedDBModel.js"></script>
+    <script type="text/javascript" src="IndexedDBViews.js"></script>
     <script type="text/javascript" src="Script.js"></script>
+    <script type="text/javascript" src="Spectrum.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
     <script type="text/javascript" src="ElementsTreeOutline.js"></script>
     <script type="text/javascript" src="DOMPresentationUtils.js"></script>
@@ -181,6 +183,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Dialog.js"></script>
     <script type="text/javascript" src="GoToLineDialog.js"></script>
     <script type="text/javascript" src="FilteredItemSelectionDialog.js"></script>
+    <script type="text/javascript" src="SidebarOverlay.js"></script>
     <script type="text/javascript" src="SettingsScreen.js"></script>
     <script type="text/javascript" src="ShortcutsScreen.js"></script>
     <script type="text/javascript" src="HAREntry.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 29d05fa70..05fa8e2e2 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -406,7 +406,6 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     this._createPanels();
     this._createGlobalStatusBarItems();
 
-
     this.toolbar = new WebInspector.Toolbar();
     WebInspector._installDockToRight();
 
@@ -440,6 +439,9 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     DatabaseAgent.enable();
     DOMStorageAgent.enable();
 
+    if (WebInspector.settings.showPaintRects.get())
+        PageAgent.setShowPaintRects(true);
+
     WebInspector.CSSCompletions.requestCSSNameCompletions();
     WebInspector.WorkerManager.loadCompleted();
     InspectorFrontendAPI.loadCompleted();
@@ -555,7 +557,7 @@ WebInspector.documentClick = function(event)
 
     function followLink()
     {
-        if (WebInspector._showAnchorLocation(anchor))
+        if (WebInspector.isInEditMode(event) || WebInspector._showAnchorLocation(anchor))
             return;
 
         const profileMatch = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
diff --git a/Source/WebCore/inspector/front-end/inspectorCommon.css b/Source/WebCore/inspector/front-end/inspectorCommon.css
index 82dc5b865..526843140 100644
--- a/Source/WebCore/inspector/front-end/inspectorCommon.css
+++ b/Source/WebCore/inspector/front-end/inspectorCommon.css
@@ -13,7 +13,6 @@ body {
     font-family: Lucida Grande, sans-serif;
     font-size: 10px;
     margin: 0;
-    -webkit-text-size-adjust: none;
     -webkit-user-select: none;
 }
 
diff --git a/Source/WebCore/inspector/front-end/networkLogView.css b/Source/WebCore/inspector/front-end/networkLogView.css
index c525d9ac3..202e8b43d 100644
--- a/Source/WebCore/inspector/front-end/networkLogView.css
+++ b/Source/WebCore/inspector/front-end/networkLogView.css
@@ -311,10 +311,10 @@
     bottom: 0;
     margin: auto -7px;
     border-width: 6px 7px;
-    height: 13px;
+    height: 0;
     min-width: 14px;
     opacity: 0.65;
-    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillGray.png) 7 7 7 7;
 }
 
 .network-graph-bar.waiting, .network-graph-bar.waiting-right {
@@ -325,23 +325,23 @@
 
 
 .resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillGray.png) 7 7 7 7;
 }
 
 .network-category-documents .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillBlue.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillBlue.png) 7 7 7 7;
 }
 
 .network-category-documents.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillBlue.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillBlue.png) 7 7 7 7;
 }
 
 .network-category-stylesheets .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillGreen.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillGreen.png) 7 7 7 7;
 }
 
 .network-category-stylesheets.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillGreen.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillGreen.png) 7 7 7 7;
 }
 
 .network-category-images .network-graph-bar {
@@ -349,39 +349,39 @@
 }
 
 .network-category-images.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillPurple.png) 6 7 6 7;
+    border-image: url(Images/timelineHollowPillPurple.png) 7 7 7 7;
 }
 
 .network-category-fonts .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillRed.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillRed.png) 7 7 7 7;
 }
 
 .network-category-fonts.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillRed.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillRed.png) 7 7 7 7;
 }
 
 .network-category-scripts .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillOrange.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillOrange.png) 7 7 7 7;
 }
 
 .network-category-scripts.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillOrange.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillOrange.png) 7 7 7 7;
 }
 
 .network-category-xhr .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillYellow.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillYellow.png) 7 7 7 7;
 }
 
 .network-category-xhr.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillYellow.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillYellow.png) 7 7 7 7;
 }
 
 .network-category-websockets .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillGray.png) 7 7 7 7;
 }
 
 .network-category-websockets.resource-cached .network-graph-bar {
-   -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;
+   -webkit-border-image: url(Images/timelineHollowPillGray.png) 7 7 7 7;
 }
 
 .network-dim-cell {
diff --git a/Source/WebCore/inspector/front-end/popover.css b/Source/WebCore/inspector/front-end/popover.css
index cf14ed47e..e6e95f59c 100644
--- a/Source/WebCore/inspector/front-end/popover.css
+++ b/Source/WebCore/inspector/front-end/popover.css
@@ -17,6 +17,10 @@
     -webkit-user-select: text;
 }
 
+.popover .content.fixed-height {
+    overflow: hidden;
+} 
+
 .popover .arrow {
     position: absolute;
     background-image: url(Images/popoverArrows.png);
diff --git a/Source/WebCore/inspector/front-end/resourcesPanel.css b/Source/WebCore/inspector/front-end/resourcesPanel.css
index a82f35daf..a2b3ad3b5 100644
--- a/Source/WebCore/inspector/front-end/resourcesPanel.css
+++ b/Source/WebCore/inspector/front-end/resourcesPanel.css
@@ -298,6 +298,18 @@ li.selected .base-storage-tree-element-subtitle {
     content: url(Images/databaseTable.png);
 }
 
+.indexed-db-storage-tree-item .icon {
+    content: url(Images/indexedDB.png);
+}
+
+.indexed-db-object-store-storage-tree-item .icon {
+    content: url(Images/indexedDBObjectStore.png);
+}
+
+.indexed-db-index-storage-tree-item .icon {
+    content: url(Images/indexedDBIndex.png);
+}
+
 .domstorage-storage-tree-item.local-storage .icon {
     content: url(Images/localStorage.png);
 }
diff --git a/Source/WebCore/inspector/front-end/scriptsPanel.css b/Source/WebCore/inspector/front-end/scriptsPanel.css
index 9eac3e09b..b412f0207 100644
--- a/Source/WebCore/inspector/front-end/scriptsPanel.css
+++ b/Source/WebCore/inspector/front-end/scriptsPanel.css
@@ -142,7 +142,7 @@
     z-index: 13;
 }
 
-#scripts-navigator-resizer-widget {
+.scripts-navigator-resizer-widget {
     position: absolute;
     top: 0;
     right: 0;
@@ -154,6 +154,50 @@
     background-position: center;
 }
 
+.scripts-navigator-control-button {
+    position: absolute;
+    padding: 0;
+    margin: 0;
+    border: 0 transparent none;
+    background-color: transparent;
+}
+
+#scripts-navigator-show-hide-button {
+    top: 3px;
+    height: 16px;
+    left: 2px;
+    width: 16px;
+}
+
+#scripts-navigator-show-hide-button .glyph {
+    -webkit-mask-image: url(Images/navigatorShowHideButton.png);
+}
+
+#scripts-navigator-show-hide-button:active .glyph {
+    top: 1px;
+    bottom: -1px;
+}
+
+#scripts-navigator-show-hide-button.toggled-on .glyph {
+    background-color: #4281EB;
+}
+
+#scripts-navigator-pin-button {
+    top: 6px;
+    height: 10px;
+    right: 16px;
+    width: 10px;
+}
+
+#scripts-navigator-pin-button .glyph {
+    -webkit-mask-image: url(Images/navigatorPinButton.png);
+}
+
+#scripts-navigator-pin-button:active .glyph {
+    top: 1px;
+    bottom: -1px;
+}
+
 .scripts-views-container {
     position: absolute;
     top: 23px;
@@ -203,7 +247,7 @@
     content: url(Images/resourceJSIcon.png);
 }
 
-.scripts.panel .navigator {
+#scripts-navigator-tabbed-pane .navigator {
     padding-left: 0;
 }
 
@@ -234,8 +278,8 @@
 }
 
 #scripts-navigator-tabbed-pane .tabbed-pane-header-contents {
-    margin-left: 1px;
-    margin-right: 16px;
+    margin-left: 20px;
+    margin-right: 28px;
 }
 
 #scripts-editor-container-tabbed-pane .tabbed-pane-header {
@@ -247,48 +291,52 @@
     margin-right: 16px;
 }
 
+#scripts-editor-container-tabbed-pane.navigator-hidden .tabbed-pane-header-contents {
+    margin-left: 20px;
+}
+
 #scripts-editor-container-tabbed-pane .tabbed-pane-header-tab {
     border-bottom: 1px solid #BBB;
 }
 
-.scripts.panel .navigator li {
+#scripts-navigator-tabbed-pane .navigator li {
     height: 17px;
     white-space: nowrap;
 }
 
-.scripts.panel .navigator :focus li.selected {
+#scripts-navigator-tabbed-pane .navigator :focus li.selected {
     color: white;
 }
 
-.scripts.panel .navigator li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator li.selected .selection {
     height: 17px;
     background-color: rgb(180, 180, 180);
 }
 
-.scripts.panel .navigator :focus li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator :focus li.selected .selection {
     background-color: rgb(111, 140, 210);
 }
 
-.scripts.panel .navigator .search-match-found li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator .search-match-found li.selected .selection {
     background-color: rgb(111, 140, 210);
 }
 
-.scripts.panel .navigator .search-match-not-found li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator .search-match-not-found li.selected .selection {
     border-color: rgb(111, 140, 210);
     background-color: white;
 }
 
-.scripts.panel .navigator .searching li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator .searching li.selected .selection {
     background-color: rgb(111, 140, 210);
 }
 
-.scripts.panel .navigator .icon {
+#scripts-navigator-tabbed-pane .navigator .icon {
     width: 16px;
     height: 16px;
     float: left;
 }
 
-.scripts.panel .base-navigator-tree-element-title {
+#scripts-navigator-tabbed-pane .navigator .base-navigator-tree-element-title {
     overflow: hidden;
     text-overflow: ellipsis;
     position: relative;
diff --git a/Source/WebCore/inspector/front-end/textPrompt.css b/Source/WebCore/inspector/front-end/textPrompt.css
index 217ae94ca..ca4ba07ce 100644
--- a/Source/WebCore/inspector/front-end/textPrompt.css
+++ b/Source/WebCore/inspector/front-end/textPrompt.css
@@ -31,16 +31,12 @@
 .suggest-box {
     position: absolute;
     background-color: #FFFFFF;
-    display: none;
+    display: block;
     border: 1px solid black;
     padding: 2px;
     z-index: 100;
 }
 
-.suggest-box.visible {
-    display: block;
-}
-
 .suggest-box .container {
     position: absolute;
     top: 0;
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index 3dc8c115f..fd44d59fe 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -72,6 +72,10 @@
     border-right: 1px solid rgb(163, 163, 163);
 }
 
+.timeline-start-at-zero #timeline-overview-sidebar {
+    display: none;
+}
+
 #timeline-overview-grid {
     position: absolute;
     top: 0px;
@@ -81,6 +85,10 @@
     background-color: rgb(255, 255, 255);
 }
 
+.timeline-start-at-zero #timeline-overview-grid {
+    display: none;
+}
+
 .timeline-window-selector {
     position: absolute;
     top: 0;
@@ -89,7 +97,7 @@
     z-index: 250;
 }
 
-#timeline-overview-window {
+.timeline-overview-window {
     background-color: white;
     position: absolute;
     left: 0;
@@ -99,6 +107,10 @@
     z-index: 150;
 }
 
+.timeline-start-at-zero .timeline-overview-window {
+    bottom: 0;
+}
+
 .timeline-overview-dividers-background {
     left: 0%;
     right: 0%;
@@ -108,6 +120,10 @@
     position: absolute;
 }
 
+.timeline-start-at-zero .timeline-overview-dividers-background {
+    bottom: 0;
+}
+
 .timeline-overview-window-rulers {
     top: 0;
     bottom: 0;
@@ -268,6 +284,10 @@
     z-index: 160;
 }
 
+.timeline-start-at-zero #timeline-overview-memory {
+    display: none;
+}
+
 #timeline-overview-memory > canvas {
     position: absolute;
     left: 0;
@@ -333,10 +353,6 @@
     opacity: 0.2;
 }
 
-.timeline-graph-bar.cpu {
-    opacity: 0.6;
-}
-
 .timeline-graph-side.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
@@ -363,15 +379,15 @@
     width: 10px;
 }
 
-.timeline-loading {
+.popover .timeline-loading {
     -webkit-border-image: url(Images/timelineBarBlue.png) 4 4 5 4;
 }
 
-.timeline-scripting {
+.popover .timeline-scripting {
     -webkit-border-image: url(Images/timelineBarOrange.png) 4 4 5 4;
 }
 
-.timeline-rendering {
+.popover .timeline-rendering {
     -webkit-border-image: url(Images/timelineBarPurple.png) 4 4 5 4;
 }
 
@@ -435,6 +451,18 @@
     -webkit-mask-position: -128px -24px;
 }
 
+.glue-async-status-bar-item .glyph {
+    -webkit-mask-position: -128px -48px;
+}
+
+.timeline-start-at-zero-status-bar-item .glyph {
+    -webkit-mask-position: -160px -48px;
+}
+
+.timeline-start-at-zero-status-bar-item.toggled-on .glyph {
+    background-color: rgb(66, 129, 235) !important;
+}
+
 .timeline-records-counter, .storage-application-cache-status, .storage-application-cache-connectivity {
     font-size: 11px;
     text-shadow: white 0 1px 0;
@@ -531,21 +559,70 @@
     overflow: hidden;
 }
 
-.timeline-marker {
-    position: absolute;
-    left: 0;
-    top: 0;
-    bottom: 0;
-    border-left: 1px solid #AAA;
-}
-
 .memory-counter-sidebar-info {
     position: absolute;
     top: 0;
     left: 0;
     right: 0;
+    font-size: 11px;
 }
 
 .memory-counter-sidebar-info.bottom-border-visible {
     border-bottom: 1px solid #AAA;
 }
+
+.memory-counter-sidebar-info .title {
+    margin: 4px;
+    font-weight: bold;
+}
+
+.memory-counter-sidebar-info .counter-value {
+    margin: 4px;
+}
+
+.timeline-overview-start-at-zero {
+    background-color: white;
+}
+
+.timeline-overview-start-at-zero-bars {
+    display: -webkit-box;
+    -webkit-box-align: end;
+    background-color: white;
+    padding-left: 4px;
+    padding-right: 4px;
+    z-index: 200;
+    background-color: rgba(255, 255, 255, 0.8);
+}
+
+.timeline-overview-start-at-zero-bars .padding {
+    -webkit-box-flex: 100000;
+}
+
+.timeline-overview-start-at-zero-bars .timeline-bar-vertical {
+    display: -webkit-box;
+    -webkit-box-orient: vertical;
+    -webkit-box-pack: end;
+    width: 12px;
+    padding-right: 2px;
+    -webkit-box-flex: 1;
+}
+
+.timeline-bar-vertical div:first-child {
+    -webkit-border-top-left-radius: 2px;
+    -webkit-border-top-right-radius: 2px;
+}
+
+.timeline-bar-vertical .timeline-loading {
+    background: -webkit-linear-gradient(left, rgb(201, 220, 245), rgb(109, 157, 222));
+    border: solid 1px rgb(106, 152, 213);
+}
+
+.timeline-bar-vertical .timeline-scripting {
+    background: -webkit-linear-gradient(left, rgb(251, 222, 168), rgb(234, 182, 77));
+    border: solid 1px rgb(223, 175, 77);
+}
+
+.timeline-bar-vertical .timeline-rendering {
+    background: -webkit-linear-gradient(left, rgb(213, 185, 236), rgb(137, 62, 200));
+    border: solid 1px rgb(130, 59, 190);
+}
diff --git a/Source/WebCore/inspector/front-end/treeoutline.js b/Source/WebCore/inspector/front-end/treeoutline.js
index ce36fe82c..528f41b7e 100644
--- a/Source/WebCore/inspector/front-end/treeoutline.js
+++ b/Source/WebCore/inspector/front-end/treeoutline.js
@@ -859,9 +859,11 @@ TreeElement.treeElementDoubleClicked = function(event)
     if (!element || !element.treeElement)
         return;
 
-    if (element.treeElement.ondblclick)
-        element.treeElement.ondblclick.call(element.treeElement, event);
-    else if (element.treeElement.hasChildren && !element.treeElement.expanded)
+    if (element.treeElement.ondblclick) {
+        var handled = element.treeElement.ondblclick.call(element.treeElement, event);
+        if (handled)
+            return;
+    } else if (element.treeElement.hasChildren && !element.treeElement.expanded)
         element.treeElement.expand();
 }
 
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index ebe2ec7b1..663317c2a 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -342,8 +342,8 @@ Element.prototype.boxInWindow = function(targetWindow)
     targetWindow = targetWindow || this.ownerDocument.defaultView;
 
     var anchorBox = this.offsetRelativeToWindow(window);
-    anchorBox.width = this.offsetWidth;
-    anchorBox.height = this.offsetHeight;
+    anchorBox.width = Math.min(this.offsetWidth, window.innerWidth - anchorBox.x);
+    anchorBox.height = Math.min(this.offsetHeight, window.innerHeight - anchorBox.y);
 
     return anchorBox;
 }
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 39f73139e..7b0bf8b20 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -448,6 +448,9 @@ bool DocumentLoader::isLoadingInAPISense() const
     // Once a frame has loaded, we no longer need to consider subresources,
     // but we still need to consider subframes.
     if (frameLoader()->state() != FrameStateComplete) {
+        if (m_frame->settings()->needsIsLoadingInAPISenseQuirk() && !m_subresourceLoaders.isEmpty())
+            return true;
+    
         Document* doc = m_frame->document();
         if ((!m_primaryLoadComplete || !m_frame->document()->loadEventFinished()) && isLoading())
             return true;
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 2eb24a32b..8c4f00a52 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -233,7 +233,8 @@ public:
     virtual void needTouchEvents(bool) { }
 #endif
     
-    virtual void numWheelEventHandlersChanged(unsigned) { }
+    virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE { }
+    virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
     
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return false; }
 };
@@ -431,7 +432,7 @@ public:
 #endif
 
     virtual void getGuessesForWord(const String&, const String&, Vector<String>&) { }
-    virtual void requestCheckingOfString(SpellChecker*, int, TextCheckingTypeMask, const String&) { }
+    virtual void requestCheckingOfString(SpellChecker*, const TextCheckingRequest&) { }
 };
 
 class EmptyEditorClient : public EditorClient {
@@ -460,7 +461,7 @@ public:
     virtual bool shouldInsertText(const String&, Range*, EditorInsertAction) { return false; }
     virtual bool shouldChangeSelectedRange(Range*, Range*, EAffinity, bool) { return false; }
 
-    virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*) { return false; }
+    virtual bool shouldApplyStyle(StylePropertySet*, Range*) { return false; }
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*) { return false; }
 
     virtual void didBeginEditing() { }
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index cd228d4ba..5635539d7 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -2439,8 +2439,8 @@ void FrameLoader::closeAndRemoveChild(Frame* child)
     child->setView(0);
     if (child->ownerElement() && child->page())
         child->page()->decrementFrameCount();
-    // FIXME: The page isn't being destroyed, so it's not right to call a function named pageDestroyed().
-    child->pageDestroyed();
+    child->willDetachPage();
+    child->detachFromPage();
 
     m_frame->tree()->removeChild(child);
 }
@@ -2518,8 +2518,8 @@ void FrameLoader::detachFromParent()
         parent->loader()->scheduleCheckCompleted();
     } else {
         m_frame->setView(0);
-        // FIXME: The page isn't being destroyed, so it's not right to call a function named pageDestroyed().
-        m_frame->pageDestroyed();
+        m_frame->willDetachPage();
+        m_frame->detachFromPage();
     }
 }
 
diff --git a/Source/WebCore/loader/ImageLoader.cpp b/Source/WebCore/loader/ImageLoader.cpp
index 56e675145..842175b5e 100644
--- a/Source/WebCore/loader/ImageLoader.cpp
+++ b/Source/WebCore/loader/ImageLoader.cpp
@@ -28,6 +28,7 @@
 #include "Document.h"
 #include "Element.h"
 #include "Event.h"
+#include "EventSender.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
 #include "HTMLParserIdioms.h"
@@ -62,32 +63,6 @@ template<> struct ValueCheck<WebCore::ImageLoader*> {
 
 namespace WebCore {
 
-class ImageEventSender {
-    WTF_MAKE_NONCOPYABLE(ImageEventSender); WTF_MAKE_FAST_ALLOCATED;
-public:
-    ImageEventSender(const AtomicString& eventType);
-
-    void dispatchEventSoon(ImageLoader*);
-    void cancelEvent(ImageLoader*);
-
-    void dispatchPendingEvents();
-
-#ifndef NDEBUG
-    bool hasPendingEvents(ImageLoader* loader) const
-    {
-        return m_dispatchSoonList.find(loader) != notFound || m_dispatchingList.find(loader) != notFound;
-    }
-#endif
-
-private:
-    void timerFired(Timer<ImageEventSender>*);
-
-    AtomicString m_eventType;
-    Timer<ImageEventSender> m_timer;
-    Vector<ImageLoader*> m_dispatchSoonList;
-    Vector<ImageLoader*> m_dispatchingList;
-};
-
 static ImageEventSender& beforeLoadEventSender()
 {
     DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().beforeloadEvent));
@@ -302,6 +277,16 @@ void ImageLoader::updateRenderer()
         imageResource->setCachedImage(m_image.get());
 }
 
+void ImageLoader::dispatchPendingEvent(ImageEventSender* eventSender)
+{
+    ASSERT(eventSender == &beforeLoadEventSender() || eventSender == &loadEventSender());
+    const AtomicString& eventType = eventSender->eventType();
+    if (eventType == eventNames().beforeloadEvent)
+        dispatchPendingBeforeLoadEvent();
+    if (eventType == eventNames().loadEvent)
+        dispatchPendingLoadEvent();
+}
+
 void ImageLoader::dispatchPendingBeforeLoadEvent()
 {
     if (m_firedBeforeLoad)
@@ -354,66 +339,4 @@ void ImageLoader::elementDidMoveToNewDocument()
     setImage(0);
 }
 
-ImageEventSender::ImageEventSender(const AtomicString& eventType)
-    : m_eventType(eventType)
-    , m_timer(this, &ImageEventSender::timerFired)
-{
-}
-
-void ImageEventSender::dispatchEventSoon(ImageLoader* loader)
-{
-    m_dispatchSoonList.append(loader);
-    if (!m_timer.isActive())
-        m_timer.startOneShot(0);
-}
-
-void ImageEventSender::cancelEvent(ImageLoader* loader)
-{
-    // Remove instances of this loader from both lists.
-    // Use loops because we allow multiple instances to get into the lists.
-    size_t size = m_dispatchSoonList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_dispatchSoonList[i] == loader)
-            m_dispatchSoonList[i] = 0;
-    }
-    size = m_dispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_dispatchingList[i] == loader)
-            m_dispatchingList[i] = 0;
-    }
-    if (m_dispatchSoonList.isEmpty())
-        m_timer.stop();
-}
-
-void ImageEventSender::dispatchPendingEvents()
-{
-    // Need to avoid re-entering this function; if new dispatches are
-    // scheduled before the parent finishes processing the list, they
-    // will set a timer and eventually be processed.
-    if (!m_dispatchingList.isEmpty())
-        return;
-
-    m_timer.stop();
-
-    m_dispatchSoonList.checkConsistency();
-
-    m_dispatchingList.swap(m_dispatchSoonList);
-    size_t size = m_dispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (ImageLoader* loader = m_dispatchingList[i]) {
-            m_dispatchingList[i] = 0;
-            if (m_eventType == eventNames().beforeloadEvent)
-                loader->dispatchPendingBeforeLoadEvent();
-            else
-                loader->dispatchPendingLoadEvent();
-        }
-    }
-    m_dispatchingList.clear();
-}
-
-void ImageEventSender::timerFired(Timer<ImageEventSender>*)
-{
-    dispatchPendingEvents();
-}
-
 }
diff --git a/Source/WebCore/loader/ImageLoader.h b/Source/WebCore/loader/ImageLoader.h
index 5f4818997..0667b3dc4 100644
--- a/Source/WebCore/loader/ImageLoader.h
+++ b/Source/WebCore/loader/ImageLoader.h
@@ -30,9 +30,12 @@
 namespace WebCore {
 
 class Element;
-class ImageLoadEventSender;
+class ImageLoader;
 class RenderImageResource;
 
+template<typename T> class EventSender;
+typedef EventSender<ImageLoader> ImageEventSender;
+
 class ImageLoader : public CachedImageClient {
 public:
     ImageLoader(Element*);
@@ -59,6 +62,8 @@ public:
     bool haveFiredBeforeLoadEvent() const { return m_firedBeforeLoad; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
 
+    void dispatchPendingEvent(ImageEventSender*);
+
     static void dispatchPendingBeforeLoadEvents();
     static void dispatchPendingLoadEvents();
 
@@ -69,7 +74,6 @@ private:
     virtual void dispatchLoadEvent() = 0;
     virtual String sourceURI(const AtomicString&) const = 0;
 
-    friend class ImageEventSender;
     void dispatchPendingBeforeLoadEvent();
     void dispatchPendingLoadEvent();
 
diff --git a/Source/WebCore/loader/NavigationScheduler.cpp b/Source/WebCore/loader/NavigationScheduler.cpp
index d30413304..46267f932 100644
--- a/Source/WebCore/loader/NavigationScheduler.cpp
+++ b/Source/WebCore/loader/NavigationScheduler.cpp
@@ -422,6 +422,8 @@ void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
 {
     ASSERT(m_frame->page());
 
+    RefPtr<Frame> protect(m_frame);
+
     // If a redirect was scheduled during a load, then stop the current load.
     // Otherwise when the current load transitions from a provisional to a 
     // committed state, pending redirects may be cancelled. 
@@ -437,6 +439,9 @@ void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
     if (!m_frame->loader()->isComplete() && m_redirect->isLocationChange())
         m_frame->loader()->completed();
 
+    if (!m_frame->page())
+        return;
+
     startTimer();
 }
 
diff --git a/Source/WebCore/loader/cache/CachedFont.h b/Source/WebCore/loader/cache/CachedFont.h
index f857dade5..e0b5b7dac 100644
--- a/Source/WebCore/loader/cache/CachedFont.h
+++ b/Source/WebCore/loader/cache/CachedFont.h
@@ -60,6 +60,7 @@ public:
     void checkNotify();
 
     void beginLoadIfNeeded(CachedResourceLoader* dl);
+    bool stillNeedsLoad() const { return !m_loadInitiated; }
 
     bool ensureCustomFontData();
     FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
diff --git a/Source/WebCore/loader/cache/CachedRawResource.cpp b/Source/WebCore/loader/cache/CachedRawResource.cpp
index 63f81c9a7..196d7a90d 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.cpp
+++ b/Source/WebCore/loader/cache/CachedRawResource.cpp
@@ -37,7 +37,7 @@ namespace WebCore {
 
 CachedRawResource::CachedRawResource(ResourceRequest& resourceRequest)
     : CachedResource(resourceRequest, RawResource)
-    , m_dataLength(0)
+    , m_identifier(0)
 {
 }
 
@@ -48,7 +48,7 @@ void CachedRawResource::data(PassRefPtr<SharedBuffer> data, bool allDataReceived
         // If we are buffering data, then we are saving the buffer in m_data and need to manually
         // calculate the incremental data. If we are not buffering, then m_data will be null and
         // the buffer contains only the incremental data.
-        size_t previousDataLength = (m_options.shouldBufferData == BufferData) ? m_dataLength : 0;
+        size_t previousDataLength = (m_options.shouldBufferData == BufferData) ? encodedSize() : 0;
         ASSERT(data->size() >= previousDataLength);
         const char* incrementalData = data->data() + previousDataLength;
         size_t incrementalDataLength = data->size() - previousDataLength;
@@ -61,7 +61,8 @@ void CachedRawResource::data(PassRefPtr<SharedBuffer> data, bool allDataReceived
     }
     
     if (m_options.shouldBufferData == BufferData) {
-        m_dataLength = data ? data->size() : 0;
+        if (data)
+            setEncodedSize(data->size());
         m_data = data;
     }
     CachedResource::data(m_data, allDataReceived);
@@ -69,11 +70,16 @@ void CachedRawResource::data(PassRefPtr<SharedBuffer> data, bool allDataReceived
 
 void CachedRawResource::didAddClient(CachedResourceClient* c)
 {
-    if (m_data) {
-        static_cast<CachedRawResourceClient*>(c)->responseReceived(this, m_response);
-        static_cast<CachedRawResourceClient*>(c)->dataReceived(this, m_data->data(), m_data->size());
-    }
-    CachedResource::didAddClient(c);
+    if (m_response.isNull() || !hasClient(c))
+        return;
+    CachedRawResourceClient* client = static_cast<CachedRawResourceClient*>(c);
+    client->responseReceived(this, m_response);
+    if (!hasClient(c) || !m_data)
+        return;
+    client->dataReceived(this, m_data->data(), m_data->size());
+    if (!hasClient(c))
+       return;
+    CachedResource::didAddClient(client);
 }
 
 void CachedRawResource::allClientsRemoved()
@@ -94,6 +100,8 @@ void CachedRawResource::willSendRequest(ResourceRequest& request, const Resource
 
 void CachedRawResource::setResponse(const ResourceResponse& response)
 {
+    if (!m_identifier)
+        m_identifier = m_loader->identifier();
     CachedResource::setResponse(response);
     CachedResourceClientWalker<CachedRawResourceClient> w(m_clients);
     while (CachedRawResourceClient* c = w.next())
@@ -113,9 +121,15 @@ void CachedRawResource::setDefersLoading(bool defers)
         m_loader->setDefersLoading(defers);
 }
 
-unsigned long CachedRawResource::identifier() const
+bool CachedRawResource::canReuse() const
 {
-    return m_loader ? m_loader->identifier() : 0;
+    if (m_options.shouldBufferData == DoNotBufferData)
+        return false;
+
+    if (m_resourceRequest.httpMethod() != "GET")
+        return false;
+
+    return true;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/cache/CachedRawResource.h b/Source/WebCore/loader/cache/CachedRawResource.h
index 9b0cab523..f6eeb839e 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.h
+++ b/Source/WebCore/loader/cache/CachedRawResource.h
@@ -27,6 +27,8 @@
 #include "CachedResourceClient.h"
 
 namespace WebCore {
+class CachedRawResourceCallback;
+class CachedRawResourceClient;
 
 class CachedRawResource : public CachedResource {
 public:
@@ -38,7 +40,9 @@ public:
     virtual void setDefersLoading(bool);
     
     // FIXME: This is exposed for the InpsectorInstrumentation for preflights in DocumentThreadableLoader. It's also really lame.
-    unsigned long identifier() const;
+    unsigned long identifier() const { return m_identifier; }
+
+    bool canReuse() const;
 
 private:
     virtual void didAddClient(CachedResourceClient*);
@@ -54,7 +58,7 @@ private:
     virtual void didDownloadData(int);
 #endif
 
-    size_t m_dataLength;
+    unsigned long m_identifier;
 };
 
 
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 80d373c30..78a71c187 100644..100755
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -61,6 +61,10 @@ static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type
 #endif
             return ResourceLoadPriorityHigh;
         case CachedResource::Script:
+#if ENABLE(SVG)
+        case CachedResource::SVGDocumentResource:
+            return ResourceLoadPriorityLow;
+#endif
         case CachedResource::FontResource:
         case CachedResource::RawResource:
             return ResourceLoadPriorityMedium;
@@ -116,6 +120,10 @@ static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource
     case CachedResource::TextTrackResource:
         return ResourceRequest::TargetIsTextTrack;
 #endif
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+        return ResourceRequest::TargetIsImage;
+#endif
     }
     ASSERT_NOT_REACHED();
     return ResourceRequest::TargetIsSubresource;
@@ -366,17 +374,21 @@ void CachedResource::stopLoading()
 
 void CachedResource::addClient(CachedResourceClient* client)
 {
-    addClientToSet(client);
-    didAddClient(client);
+    if (addClientToSet(client))
+        didAddClient(client);
 }
 
 void CachedResource::didAddClient(CachedResourceClient* c)
 {
+    if (m_clientsAwaitingCallback.contains(c)) {
+        m_clients.add(c);
+        m_clientsAwaitingCallback.remove(c);
+    }
     if (!isLoading())
         c->notifyFinished(this);
 }
 
-void CachedResource::addClientToSet(CachedResourceClient* client)
+bool CachedResource::addClientToSet(CachedResourceClient* client)
 {
     ASSERT(!isPurgeable());
 
@@ -390,13 +402,32 @@ void CachedResource::addClientToSet(CachedResourceClient* client)
     }
     if (!hasClients() && inCache())
         memoryCache()->addToLiveResourcesSize(this);
+
+    if (m_type == RawResource && !m_response.isNull() && !m_proxyResource) {
+        // Certain resources (especially XHRs) do crazy things if an asynchronous load returns
+        // synchronously (e.g., scripts may not have set all the state they need to handle the load).
+        // Therefore, rather than immediately sending callbacks on a cache hit like other CachedResources,
+        // we schedule the callbacks and ensure we never finish synchronously.
+        ASSERT(!m_clientsAwaitingCallback.contains(client));
+        m_clientsAwaitingCallback.add(client, CachedResourceCallback::schedule(this, client));
+        return false;
+    }
+
     m_clients.add(client);
+    return true;
 }
 
 void CachedResource::removeClient(CachedResourceClient* client)
 {
-    ASSERT(m_clients.contains(client));
-    m_clients.remove(client);
+    OwnPtr<CachedResourceCallback> callback = m_clientsAwaitingCallback.take(client);
+    if (callback) {
+        ASSERT(!m_clients.contains(client));
+        callback->cancel();
+        callback.clear();
+    } else {
+        ASSERT(m_clients.contains(client));
+        m_clients.remove(client);
+    }
 
     if (canDelete() && !inCache())
         delete this;
@@ -725,4 +756,24 @@ void CachedResource::setLoadPriority(ResourceLoadPriority loadPriority)
     m_loadPriority = loadPriority;
 }
 
+
+CachedResource::CachedResourceCallback::CachedResourceCallback(CachedResource* resource, CachedResourceClient* client)
+    : m_resource(resource)
+    , m_client(client)
+    , m_callbackTimer(this, &CachedResourceCallback::timerFired)
+{
+    m_callbackTimer.startOneShot(0);
+}
+
+void CachedResource::CachedResourceCallback::cancel()
+{
+    if (m_callbackTimer.isActive())
+        m_callbackTimer.stop();
+}
+
+void CachedResource::CachedResourceCallback::timerFired(Timer<CachedResourceCallback>*)
+{
+    m_resource->didAddClient(m_client);
+}
+
 }
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index b87da71ac..c07b231d4 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -31,6 +31,7 @@
 #include "ResourceLoadPriority.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
+#include "Timer.h"
 #include <wtf/HashCountedSet.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -65,6 +66,9 @@ public:
         Script,
         FontResource,
         RawResource
+#if ENABLE(SVG)
+        , SVGDocumentResource
+#endif
 #if ENABLE(XSLT)
         , XSLStyleSheet
 #endif
@@ -111,7 +115,7 @@ public:
 
     void addClient(CachedResourceClient*);
     void removeClient(CachedResourceClient*);
-    bool hasClients() const { return !m_clients.isEmpty(); }
+    bool hasClients() const { return !m_clients.isEmpty() || !m_clientsAwaitingCallback.isEmpty(); }
     void deleteIfPossible();
 
     enum PreloadResult {
@@ -254,6 +258,22 @@ protected:
     
     HashCountedSet<CachedResourceClient*> m_clients;
 
+    class CachedResourceCallback {
+    public:
+        static PassOwnPtr<CachedResourceCallback> schedule(CachedResource* resource, CachedResourceClient* client) { return adoptPtr(new CachedResourceCallback(resource, client)); }
+        void cancel();
+    private:
+        CachedResourceCallback(CachedResource*, CachedResourceClient*);
+        void timerFired(Timer<CachedResourceCallback>*);
+
+        CachedResource* m_resource;
+        CachedResourceClient* m_client;
+        Timer<CachedResourceCallback> m_callbackTimer;
+    };
+    HashMap<CachedResourceClient*, OwnPtr<CachedResourceCallback> > m_clientsAwaitingCallback;
+
+    bool hasClient(CachedResourceClient* client) { return m_clients.contains(client) || m_clientsAwaitingCallback.contains(client); }
+
     ResourceRequest m_resourceRequest;
     String m_accept;
     RefPtr<SubresourceLoader> m_loader;
@@ -267,7 +287,7 @@ protected:
     OwnPtr<PurgeableBuffer> m_purgeableData;
 
 private:
-    void addClientToSet(CachedResourceClient*);
+    bool addClientToSet(CachedResourceClient*);
 
     virtual PurgePriority purgePriority() const { return PurgeDefault; }
 
diff --git a/Source/WebCore/loader/cache/CachedResourceClient.h b/Source/WebCore/loader/cache/CachedResourceClient.h
index 4aa2dd2a7..df6bdd15f 100644
--- a/Source/WebCore/loader/cache/CachedResourceClient.h
+++ b/Source/WebCore/loader/cache/CachedResourceClient.h
@@ -39,6 +39,9 @@ public:
         ImageType,
         FontType,
         StyleSheetType,
+#if ENABLE(SVG)
+        SVGDocumentType,
+#endif
         RawResourceType
     };
 
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 5df4a0dc3..aaf753eb8 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -28,6 +28,7 @@
 #include "CachedResourceLoader.h"
 
 #include "CachedCSSStyleSheet.h"
+#include "CachedSVGDocument.h"
 #include "CachedFont.h"
 #include "CachedImage.h"
 #include "CachedRawResource.h"
@@ -72,6 +73,10 @@ static CachedResource* createResource(CachedResource::Type type, ResourceRequest
         return new CachedCSSStyleSheet(request, charset);
     case CachedResource::Script:
         return new CachedScript(request, charset);
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+        return new CachedSVGDocument(request);
+#endif
     case CachedResource::FontResource:
         return new CachedFont(request);
     case CachedResource::RawResource:
@@ -246,6 +251,9 @@ bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
 #endif
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+#endif
     case CachedResource::CSSStyleSheet:
         // These resource can inject script into the current document (Script,
         // XSL) or exfiltrate the content of the current document (CSS).
@@ -313,6 +321,9 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         // These types of resources can be loaded from any origin.
         // FIXME: Are we sure about CachedResource::FontResource?
         break;
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+#endif
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
         if (!m_document->securityOrigin()->canRequest(url)) {
@@ -347,6 +358,9 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url))
             return false;
         break;
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+#endif
     case CachedResource::ImageResource:
         if (!m_document->contentSecurityPolicy()->allowImageFromSource(url))
             return false;
@@ -523,8 +537,18 @@ CachedResourceLoader::RevalidationPolicy CachedResourceLoader::determineRevalida
         return Reload;
     }
 
-    // FIXME: Currently, all CachedRawResources are always reloaded. Some of them should be cacheable.
-    if (existingResource->type() == CachedResource::RawResource)
+    if (existingResource->type() == CachedResource::RawResource && !static_cast<CachedRawResource*>(existingResource)->canReuse())
+         return Reload;
+
+    // Certain requests (e.g., XHRs) might have manually set headers that require revalidation.
+    // FIXME: In theory, this should be a Revalidate case. In practice, the MemoryCache revalidation path assumes a whole bunch
+    // of things about how revalidation works that manual headers violate, so punt to Reload instead.
+    if (request.isConditional())
+        return Reload;
+
+    // Re-using resources in the case of a Range header is very simple if the headers are identical and
+    // much tougher if they aren't.
+    if (existingResource->resourceRequest().httpHeaderField("Range") != request.httpHeaderField("Range"))
         return Reload;
     
     // Don't reload resources while pasting.
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.cpp b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
new file mode 100755
index 000000000..f03fadb57
--- /dev/null
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
@@ -0,0 +1,77 @@
+/*
+    Copyright (C) 2010 Rob Buis <rwlbuis@gmail.com>
+    Copyright (C) 2011 Cosmin Truta <ctruta@gmail.com>
+    Copyright (C) 2012 University of Szeged
+    Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "CachedSVGDocument.h"
+
+#include "CachedResourceClient.h"
+#include "CachedResourceHandle.h"
+#include "SharedBuffer.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+CachedSVGDocument::CachedSVGDocument(const ResourceRequest& request)
+    : CachedResource(request, SVGDocumentResource)
+    , m_decoder(TextResourceDecoder::create("application/xml"))
+{
+    setAccept("image/svg+xml");
+}
+
+CachedSVGDocument::~CachedSVGDocument()
+{
+}
+
+void CachedSVGDocument::setEncoding(const String& chs)
+{
+    m_decoder->setEncoding(chs, TextResourceDecoder::EncodingFromHTTPHeader);
+}
+
+String CachedSVGDocument::encoding() const
+{
+    return m_decoder->encoding().name();
+}
+
+void CachedSVGDocument::data(PassRefPtr<SharedBuffer> data, bool allDataReceived)
+{
+    if (!allDataReceived)
+        return;
+
+    if (data) {
+        StringBuilder decodedText;
+        decodedText.append(m_decoder->decode(data->data(), data->size()));
+        decodedText.append(m_decoder->flush());
+        // We don't need to create a new frame because the new document belongs to the parent UseElement.
+        m_document = SVGDocument::create(0, response().url());
+        m_document->setContent(decodedText.toString());
+    }
+
+    setLoading(false);
+    checkNotify();
+}
+
+}
+
+#endif
+
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.h b/Source/WebCore/loader/cache/CachedSVGDocument.h
new file mode 100755
index 000000000..84389ed51
--- /dev/null
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.h
@@ -0,0 +1,62 @@
+/*
+    Copyright (C) 2010 Rob Buis <rwlbuis@gmail.com>
+    Copyright (C) 2011 Cosmin Truta <ctruta@gmail.com>
+    Copyright (C) 2012 University of Szeged
+    Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef CachedSVGDocument_h
+#define CachedSVGDocument_h
+
+#if ENABLE(SVG)
+#include "CachedResource.h"
+#include "CachedResourceClient.h"
+#include "CachedResourceHandle.h"
+#include "SVGDocument.h"
+#include "TextResourceDecoder.h"
+
+namespace WebCore {
+
+class CachedSVGDocument : public CachedResource {
+public:
+    explicit CachedSVGDocument(const ResourceRequest&);
+    virtual ~CachedSVGDocument();
+
+    SVGDocument* document() const { return m_document.get(); }
+
+    virtual void setEncoding(const String&);
+    virtual String encoding() const;
+    virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
+
+protected:
+    RefPtr<SVGDocument> m_document;
+    RefPtr<TextResourceDecoder> m_decoder;
+};
+
+class CachedSVGDocumentClient : public CachedResourceClient {
+public:
+    virtual ~CachedSVGDocumentClient() { }
+    static CachedResourceClientType expectedType() { return SVGDocumentType; }
+    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
+};
+
+}
+
+#endif
+
+#endif // CachedSVGDocument_h
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index a8507a97d..5ae8005c0 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -156,7 +156,7 @@ void IconDatabase::close()
         wakeSyncThread();
         
         // Wait for the sync thread to terminate
-        waitForThreadCompletion(m_syncThread, 0);
+        waitForThreadCompletion(m_syncThread);
     }
 
     m_syncThreadRunning = false;    
@@ -949,14 +949,14 @@ bool IconDatabase::shouldStopThreadActivity() const
     return m_threadTerminationRequested || m_removeIconsRequested;
 }
 
-void* IconDatabase::iconDatabaseSyncThreadStart(void* vIconDatabase)
+void IconDatabase::iconDatabaseSyncThreadStart(void* vIconDatabase)
 {    
     IconDatabase* iconDB = static_cast<IconDatabase*>(vIconDatabase);
     
-    return iconDB->iconDatabaseSyncThread();
+    iconDB->iconDatabaseSyncThread();
 }
 
-void* IconDatabase::iconDatabaseSyncThread()
+void IconDatabase::iconDatabaseSyncThread()
 {
     // The call to create this thread might not complete before the thread actually starts, so we might fail this ASSERT_ICON_SYNC_THREAD() because the pointer 
     // to our thread structure hasn't been filled in yet.
@@ -988,12 +988,14 @@ void* IconDatabase::iconDatabaseSyncThread()
         MutexLocker locker(m_syncLock);
         if (!m_syncDB.open(m_completeDatabasePath)) {
             LOG_ERROR("Unable to open icon database at path %s - %s", m_completeDatabasePath.ascii().data(), m_syncDB.lastErrorMsg());
-            return 0;
+            return;
         }
     }
     
-    if (shouldStopThreadActivity())
-        return syncThreadMainLoop();
+    if (shouldStopThreadActivity()) {
+        syncThreadMainLoop();
+        return;
+    }
         
 #if !LOG_DISABLED
     double timeStamp = currentTime();
@@ -1001,8 +1003,10 @@ void* IconDatabase::iconDatabaseSyncThread()
 #endif    
 
     performOpenInitialization();
-    if (shouldStopThreadActivity())
-        return syncThreadMainLoop();
+    if (shouldStopThreadActivity()) {
+        syncThreadMainLoop();
+        return;
+    }
         
 #if !LOG_DISABLED
     double newStamp = currentTime();
@@ -1024,8 +1028,10 @@ void* IconDatabase::iconDatabaseSyncThread()
             importTransaction.rollback();
         }
         
-        if (shouldStopThreadActivity())
-            return syncThreadMainLoop();
+        if (shouldStopThreadActivity()) {
+            syncThreadMainLoop();
+            return;
+        }
             
 #if !LOG_DISABLED
         newStamp = currentTime();
@@ -1041,8 +1047,10 @@ void* IconDatabase::iconDatabaseSyncThread()
     LOG(IconDatabase, "(THREAD) Starting iconURL import");
     performURLImport();
     
-    if (shouldStopThreadActivity())
-        return syncThreadMainLoop();
+    if (shouldStopThreadActivity()) {
+        syncThreadMainLoop();
+        return;
+    }
 
 #if !LOG_DISABLED
     newStamp = currentTime();
@@ -1050,7 +1058,7 @@ void* IconDatabase::iconDatabaseSyncThread()
 #endif 
 
     LOG(IconDatabase, "(THREAD) Beginning sync");
-    return syncThreadMainLoop();
+    syncThreadMainLoop();
 }
 
 static int databaseVersionNumber(SQLiteDatabase& db)
@@ -1348,7 +1356,7 @@ void IconDatabase::performURLImport()
     callOnMainThread(notifyPendingLoadDecisionsOnMainThread, this);
 }
 
-void* IconDatabase::syncThreadMainLoop()
+void IconDatabase::syncThreadMainLoop()
 {
     ASSERT_ICON_SYNC_THREAD();
 
@@ -1461,8 +1469,6 @@ void* IconDatabase::syncThreadMainLoop()
         MutexLocker locker(m_syncLock);
         m_disabledSuddenTerminationForSyncThread = false;
     }
-
-    return 0;
 }
 
 bool IconDatabase::readFromDatabase()
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index 7ab08416f..f4abb8b13 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -183,15 +183,15 @@ public:
     virtual bool shouldStopThreadActivity() const;
 
 private:    
-    static void* iconDatabaseSyncThreadStart(void *);
-    void* iconDatabaseSyncThread();
+    static void iconDatabaseSyncThreadStart(void *);
+    void iconDatabaseSyncThread();
     
     // The following block of methods are called exclusively by the sync thread to manage i/o to and from the database
     // Each method should periodically monitor m_threadTerminationRequested when it makes sense to return early on shutdown
     void performOpenInitialization();
     bool checkIntegrity();
     void performURLImport();
-    void* syncThreadMainLoop();
+    void syncThreadMainLoop();
     bool readFromDatabase();
     bool writeToDatabase();
     void pruneUnretainedIcons();
diff --git a/Source/WebCore/mathml/MathMLElement.cpp b/Source/WebCore/mathml/MathMLElement.cpp
index 830ad45d0..4c00defa3 100644
--- a/Source/WebCore/mathml/MathMLElement.cpp
+++ b/Source/WebCore/mathml/MathMLElement.cpp
@@ -48,33 +48,42 @@ PassRefPtr<MathMLElement> MathMLElement::create(const QualifiedName& tagName, Do
     return adoptRef(new MathMLElement(tagName, document));
 }
 
-void MathMLElement::parseAttribute(Attribute* attr)
+bool MathMLElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == mathbackgroundAttr || attr->name() == mathsizeAttr || attr->name() == mathcolorAttr || attr->name() == fontsizeAttr || attr->name() == backgroundAttr || attr->name() == colorAttr || attr->name() == fontstyleAttr || attr->name() == fontweightAttr || attr->name() == fontfamilyAttr)
+        return true;
+    return StyledElement::isPresentationAttribute(attr);
+}
+
+void MathMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == mathbackgroundAttr)
-        addCSSProperty(CSSPropertyBackgroundColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attr->value());
     else if (attr->name() == mathsizeAttr) {
         // The following three values of mathsize are handled in WebCore/css/mathml.css
         if (attr->value() != "normal" && attr->value() != "small" && attr->value() != "big")
-            addCSSProperty(CSSPropertyFontSize, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyFontSize, attr->value());
     } else if (attr->name() == mathcolorAttr)
-        addCSSProperty(CSSPropertyColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyColor, attr->value());
     // FIXME: deprecated attributes that should loose in a conflict with a non deprecated attribute
     else if (attr->name() == fontsizeAttr)
-        addCSSProperty(CSSPropertyFontSize, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyFontSize, attr->value());
     else if (attr->name() == backgroundAttr)
-        addCSSProperty(CSSPropertyBackgroundColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attr->value());
     else if (attr->name() == colorAttr)
-        addCSSProperty(CSSPropertyColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyColor, attr->value());
     else if (attr->name() == fontstyleAttr)
-        addCSSProperty(CSSPropertyFontStyle, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyFontStyle, attr->value());
     else if (attr->name() == fontweightAttr)
-        addCSSProperty(CSSPropertyFontWeight, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyFontWeight, attr->value());
     else if (attr->name() == fontfamilyAttr)
-        addCSSProperty(CSSPropertyFontFamily, attr->value());
-    else
-        StyledElement::parseAttribute(attr);
+        addPropertyToAttributeStyle(style, CSSPropertyFontFamily, attr->value());
+    else {
+        ASSERT(!isPresentationAttribute(attr));
+        StyledElement::collectStyleForAttribute(attr, style);
+    }
 }
-    
+
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/mathml/MathMLElement.h b/Source/WebCore/mathml/MathMLElement.h
index 201f0835c..4b092513f 100644
--- a/Source/WebCore/mathml/MathMLElement.h
+++ b/Source/WebCore/mathml/MathMLElement.h
@@ -42,7 +42,8 @@ protected:
 
 private:    
     virtual bool isMathMLElement() const { return true; }
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
     
 }
diff --git a/Source/WebCore/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/mediastream/DOMWindowMediaStream.idl
new file mode 100644
index 000000000..589878abe
--- /dev/null
+++ b/Source/WebCore/mediastream/DOMWindowMediaStream.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Supplemental=DOMWindow
+    ] DOMWindowMediaStream {
+        attribute [V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
+        attribute MediaStreamEventConstructor MediaStreamEvent;
+    };
+
+}
diff --git a/Source/WebCore/mediastream/LocalMediaStream.idl b/Source/WebCore/mediastream/LocalMediaStream.idl
index 29d97215a..49360fff2 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.idl
+++ b/Source/WebCore/mediastream/LocalMediaStream.idl
@@ -28,7 +28,7 @@ module core {
         Conditional=MEDIA_STREAM,
         JSGenerateToNativeObject,
         EventTarget,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] LocalMediaStream : MediaStream {
         void stop();
     };
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.cpp b/Source/WebCore/mediastream/MediaStreamTrack.cpp
index 4fb93acdf..c34efa5f2 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.cpp
+++ b/Source/WebCore/mediastream/MediaStreamTrack.cpp
@@ -81,6 +81,9 @@ void MediaStreamTrack::setEnabled(bool enabled)
 
     m_component->setEnabled(enabled);
 
+    if (m_streamDescriptor->ended())
+        return;    
+
     MediaStreamCenter::instance().didSetMediaStreamTrackEnabled(m_streamDescriptor.get(), m_component.get());
 }
 
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.cpp b/Source/WebCore/mediastream/NavigatorMediaStream.cpp
new file mode 100644
index 000000000..204d6e3b7
--- /dev/null
+++ b/Source/WebCore/mediastream/NavigatorMediaStream.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorMediaStream.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "NavigatorUserMediaErrorCallback.h"
+#include "NavigatorUserMediaSuccessCallback.h"
+#include "Page.h"
+#include "UserMediaController.h"
+#include "UserMediaRequest.h"
+
+namespace WebCore {
+
+NavigatorMediaStream::NavigatorMediaStream()
+{
+}
+
+NavigatorMediaStream::~NavigatorMediaStream()
+{
+}
+
+void NavigatorMediaStream::webkitGetUserMedia(Navigator* navigator, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
+{
+    if (!successCallback)
+        return;
+
+    UserMediaController* userMedia = UserMediaController::from(navigator->frame());
+    if (!userMedia) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    RefPtr<UserMediaRequest> request = UserMediaRequest::create(navigator->frame()->document(), userMedia, options, successCallback, errorCallback);
+    if (!request) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    request->start();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.h b/Source/WebCore/mediastream/NavigatorMediaStream.h
new file mode 100644
index 000000000..b7b01fa52
--- /dev/null
+++ b/Source/WebCore/mediastream/NavigatorMediaStream.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef NavigatorMediaStream_h
+#define NavigatorMediaStream_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Navigator;
+class NavigatorUserMediaErrorCallback;
+class NavigatorUserMediaSuccessCallback;
+
+typedef int ExceptionCode;
+
+class NavigatorMediaStream {
+public:
+    static void webkitGetUserMedia(Navigator*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
+
+private:
+    NavigatorMediaStream();
+    ~NavigatorMediaStream();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // NavigatorMediaStream_h
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.idl b/Source/WebCore/mediastream/NavigatorMediaStream.idl
new file mode 100644
index 000000000..84e062e64
--- /dev/null
+++ b/Source/WebCore/mediastream/NavigatorMediaStream.idl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Supplemental=Navigator
+    ] NavigatorMediaStream {
+        [V8EnabledAtRuntime] void webkitGetUserMedia(in DOMString options,
+                                                     in [Callback] NavigatorUserMediaSuccessCallback successCallback,
+                                                     in [Callback, Optional] NavigatorUserMediaErrorCallback errorCallback)
+            raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl b/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
index 66748cd48..44928f81f 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
+++ b/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
@@ -25,7 +25,7 @@
 module window {
     interface [
         Conditional=MEDIA_STREAM,
-        Callback=FunctionOnly
+        Callback
     ] NavigatorUserMediaErrorCallback {
         boolean handleEvent(in NavigatorUserMediaError error);
     };
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl b/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
index 3938e73c7..0a661807b 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
+++ b/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
@@ -25,7 +25,7 @@
 module window {
     interface [
         Conditional=MEDIA_STREAM,
-        Callback=FunctionOnly
+        Callback
     ] NavigatorUserMediaSuccessCallback {
         boolean handleEvent(in LocalMediaStream stream);
     };
diff --git a/Source/WebCore/mediastream/PeerConnection.cpp b/Source/WebCore/mediastream/PeerConnection.cpp
index 11944823b..4dd3bf0da 100644
--- a/Source/WebCore/mediastream/PeerConnection.cpp
+++ b/Source/WebCore/mediastream/PeerConnection.cpp
@@ -41,6 +41,7 @@ PassRefPtr<PeerConnection> PeerConnection::create(ScriptExecutionContext* contex
     RefPtr<PeerConnection> connection = adoptRef(new PeerConnection(context, serverConfiguration, signalingCallback));
     connection->setPendingActivity(connection.get());
     connection->scheduleInitialNegotiation();
+    connection->suspendIfNeeded();
 
     return connection.release();
 }
@@ -55,7 +56,7 @@ PeerConnection::PeerConnection(ScriptExecutionContext* context, const String& se
     , m_initialNegotiationTimer(this, &PeerConnection::initialNegotiationTimerFired)
     , m_streamChangeTimer(this, &PeerConnection::streamChangeTimerFired)
     , m_readyStateChangeTimer(this, &PeerConnection::readyStateChangeTimerFired)
-    , m_peerHandler(PeerConnectionHandler::create(this, serverConfiguration, context->securityOrigin()))
+    , m_peerHandler(PeerConnectionHandler::create(this, serverConfiguration, context->securityOrigin()->toString()))
 {
 }
 
diff --git a/Source/WebCore/mediastream/PeerConnection.idl b/Source/WebCore/mediastream/PeerConnection.idl
index afaebd705..7760d10ce 100644
--- a/Source/WebCore/mediastream/PeerConnection.idl
+++ b/Source/WebCore/mediastream/PeerConnection.idl
@@ -28,7 +28,7 @@ module p2p {
         Conditional=MEDIA_STREAM,
         ActiveDOMObject,
         ConstructorParameters=2,
-        Constructor(in DOMString serverConfiguration, in [Callback=FunctionOnly] SignalingCallback signalingCallback),
+        Constructor(in DOMString serverConfiguration, in [Callback] SignalingCallback signalingCallback),
         CallWith=ScriptExecutionContext,
         JSCustomConstructor,
         EventTarget
diff --git a/Source/WebCore/mediastream/SignalingCallback.idl b/Source/WebCore/mediastream/SignalingCallback.idl
index 0d32fcf0e..e2e0cebd2 100644
--- a/Source/WebCore/mediastream/SignalingCallback.idl
+++ b/Source/WebCore/mediastream/SignalingCallback.idl
@@ -26,7 +26,7 @@ module p2p {
 
     interface [
         Conditional=MEDIA_STREAM,
-        Callback=FunctionOnly
+        Callback
     ] SignalingCallback {
         boolean handleEvent(in DOMString message, in PeerConnection source);
     };
diff --git a/Source/WebCore/mediastream/UserMediaClient.h b/Source/WebCore/mediastream/UserMediaClient.h
index c8e2952ff..744711e42 100644
--- a/Source/WebCore/mediastream/UserMediaClient.h
+++ b/Source/WebCore/mediastream/UserMediaClient.h
@@ -38,6 +38,8 @@
 
 namespace WebCore {
 
+class Page;
+
 class UserMediaClient {
 public:
     virtual void pageDestroyed() = 0;
@@ -49,6 +51,8 @@ protected:
     virtual ~UserMediaClient() { }
 };
 
+void provideUserMediaTo(Page*, UserMediaClient*);
+
 } // namespace WebCore
 
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp b/Source/WebCore/mediastream/UserMediaController.cpp
index dccb00581..3b4dd14e9 100644
--- a/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp
+++ b/Source/WebCore/mediastream/UserMediaController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,44 +23,36 @@
  */
 
 #include "config.h"
-#include "V8Navigator.h"
+#include "UserMediaController.h"
 
 #if ENABLE(MEDIA_STREAM)
 
-#include "ExceptionCode.h"
-#include "Navigator.h"
-#include "V8Binding.h"
-#include "V8NavigatorUserMediaErrorCallback.h"
-#include "V8NavigatorUserMediaSuccessCallback.h"
-#include "V8Utilities.h"
-
-using namespace WTF;
-
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Navigator::webkitGetUserMediaCallback(const v8::Arguments& args)
+const AtomicString& UserMediaController::supplementName()
 {
-    INC_STATS("DOM.Navigator.webkitGetUserMedia()");
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("UserMediaController"));
+    return name;
+}
 
-    v8::TryCatch exceptionCatcher;
-    v8::Handle<v8::String> options = args[0]->ToString();
-    if (exceptionCatcher.HasCaught())
-        return throwError(exceptionCatcher.Exception());
+UserMediaController::UserMediaController(UserMediaClient* client)
+    : m_client(client)
+{
+}
 
-    bool succeeded = false;
-    RefPtr<NavigatorUserMediaSuccessCallback> successCallback = createFunctionOnlyCallback<V8NavigatorUserMediaSuccessCallback>(args[1], succeeded);
-    if (!succeeded)
-        return v8::Undefined();
+UserMediaController::~UserMediaController()
+{
+    m_client->pageDestroyed();
+}
 
-    // Argument is optional, hence undefined is allowed.
-    RefPtr<NavigatorUserMediaErrorCallback> errorCallback = createFunctionOnlyCallback<V8NavigatorUserMediaErrorCallback>(args[2], succeeded, CallbackAllowUndefined);
-    if (!succeeded)
-        return v8::Undefined();
+PassOwnPtr<UserMediaController> UserMediaController::create(UserMediaClient* client)
+{
+    return adoptPtr(new UserMediaController(client));
+}
 
-    ExceptionCode ec = 0;
-    Navigator* navigator = V8Navigator::toNative(args.Holder());
-    navigator->webkitGetUserMedia(toWebCoreString(options), successCallback.release(), errorCallback.release(), ec);
-    return throwError(ec);
+void provideUserMediaTo(Page* page, UserMediaClient* client)
+{
+    PageSupplement::provideTo(page, UserMediaController::supplementName(), UserMediaController::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/mediastream/UserMediaController.h b/Source/WebCore/mediastream/UserMediaController.h
new file mode 100644
index 000000000..6b0590ecf
--- /dev/null
+++ b/Source/WebCore/mediastream/UserMediaController.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef UserMediaController_h
+#define UserMediaController_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "PageSupplement.h"
+#include "UserMediaClient.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class Page;
+
+class UserMediaController : public PageSupplement {
+public:
+    ~UserMediaController();
+
+    UserMediaClient* client() const { return m_client; }
+    void requestUserMedia(PassRefPtr<UserMediaRequest>, const MediaStreamSourceVector& audioSources,  const MediaStreamSourceVector& videoSources);
+    void cancelUserMediaRequest(UserMediaRequest*);
+
+    static PassOwnPtr<UserMediaController> create(UserMediaClient*);
+    static const AtomicString& supplementName();
+    static UserMediaController* from(Frame* frame) { return static_cast<UserMediaController*>(PageSupplement::from(frame, supplementName())); }
+    static UserMediaController* from(Page* page) { return static_cast<UserMediaController*>(PageSupplement::from(page, supplementName())); }
+
+protected:
+    UserMediaController(UserMediaClient*);
+
+private:
+    UserMediaClient* m_client;
+};
+
+inline void UserMediaController::requestUserMedia(PassRefPtr<UserMediaRequest> request, const MediaStreamSourceVector& audioSources,  const MediaStreamSourceVector& videoSources)
+{
+    m_client->requestUserMedia(request, audioSources, videoSources);
+}
+
+inline void UserMediaController::cancelUserMediaRequest(UserMediaRequest* request)
+{
+    m_client->cancelUserMediaRequest(request);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // UserMediaController_h
diff --git a/Source/WebCore/mediastream/UserMediaRequest.cpp b/Source/WebCore/mediastream/UserMediaRequest.cpp
index faf3d4d4f..3f3c9efe1 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.cpp
+++ b/Source/WebCore/mediastream/UserMediaRequest.cpp
@@ -36,26 +36,26 @@
 
 #include "LocalMediaStream.h"
 #include "SpaceSplitString.h"
-#include "UserMediaClient.h"
+#include "UserMediaController.h"
 
 namespace WebCore {
 
-PassRefPtr<UserMediaRequest> UserMediaRequest::create(ScriptExecutionContext* context, UserMediaClient* client, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
+PassRefPtr<UserMediaRequest> UserMediaRequest::create(ScriptExecutionContext* context, UserMediaController* controller, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
 {
-    RefPtr<UserMediaRequest> request = adoptRef(new UserMediaRequest(context, client, options, successCallback, errorCallback));
+    RefPtr<UserMediaRequest> request = adoptRef(new UserMediaRequest(context, controller, options, successCallback, errorCallback));
     if (!request->audio() && !request->video())
         return 0;
 
     return request.release();
 }
 
-UserMediaRequest::UserMediaRequest(ScriptExecutionContext* context, UserMediaClient* client, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
+UserMediaRequest::UserMediaRequest(ScriptExecutionContext* context, UserMediaController* controller, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
     : ContextDestructionObserver(context)
     , m_audio(false)
     , m_video(false)
     , m_cameraPreferenceUser(false)
     , m_cameraPreferenceEnvironment(false)
-    , m_client(client)
+    , m_controller(controller)
     , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
 {
@@ -73,8 +73,8 @@ void UserMediaRequest::start()
 
 void UserMediaRequest::didCompleteQuery(const MediaStreamSourceVector& audioSources, const MediaStreamSourceVector& videoSources)
 {
-    if (m_client)
-        m_client->requestUserMedia(this, audioSources, videoSources);
+    if (m_controller)
+        m_controller->requestUserMedia(this, audioSources, videoSources);
 }
 
 void UserMediaRequest::succeed(const MediaStreamSourceVector& audioSources, const MediaStreamSourceVector& videoSources)
@@ -99,9 +99,9 @@ void UserMediaRequest::fail()
 
 void UserMediaRequest::contextDestroyed()
 {
-    if (m_client) {
-        m_client->cancelUserMediaRequest(this);
-        m_client = 0;
+    if (m_controller) {
+        m_controller->cancelUserMediaRequest(this);
+        m_controller = 0;
     }
 
     ContextDestructionObserver::contextDestroyed();
diff --git a/Source/WebCore/mediastream/UserMediaRequest.h b/Source/WebCore/mediastream/UserMediaRequest.h
index a71b5e93f..6af31f30b 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.h
+++ b/Source/WebCore/mediastream/UserMediaRequest.h
@@ -44,11 +44,11 @@
 
 namespace WebCore {
 
-class UserMediaClient;
+class UserMediaController;
 
 class UserMediaRequest : public MediaStreamSourcesQueryClient, public ContextDestructionObserver {
 public:
-    static PassRefPtr<UserMediaRequest> create(ScriptExecutionContext*, UserMediaClient*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
+    static PassRefPtr<UserMediaRequest> create(ScriptExecutionContext*, UserMediaController*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
     ~UserMediaRequest();
 
     NavigatorUserMediaSuccessCallback* successCallback() const { return m_successCallback.get(); }
@@ -70,7 +70,7 @@ public:
     virtual void contextDestroyed();
 
 private:
-    UserMediaRequest(ScriptExecutionContext*, UserMediaClient*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
+    UserMediaRequest(ScriptExecutionContext*, UserMediaController*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
 
     void parseOptions(const String& options);
 
@@ -80,7 +80,7 @@ private:
     bool m_cameraPreferenceUser;
     bool m_cameraPreferenceEnvironment;
 
-    UserMediaClient* m_client;
+    UserMediaController* m_controller;
 
     RefPtr<NavigatorUserMediaSuccessCallback> m_successCallback;
     RefPtr<NavigatorUserMediaErrorCallback> m_errorCallback;
diff --git a/Source/WebCore/notifications/Notification.cpp b/Source/WebCore/notifications/Notification.cpp
index d7991f2d9..74964dc77 100644
--- a/Source/WebCore/notifications/Notification.cpp
+++ b/Source/WebCore/notifications/Notification.cpp
@@ -102,12 +102,16 @@ Notification::~Notification()
 
 PassRefPtr<Notification> Notification::create(const KURL& url, ScriptExecutionContext* context, ExceptionCode& ec, PassRefPtr<NotificationCenter> provider) 
 { 
-    return adoptRef(new Notification(url, context, ec, provider));
+    RefPtr<Notification> notification(adoptRef(new Notification(url, context, ec, provider)));
+    notification->suspendIfNeeded();
+    return notification.release();
 }
 
 PassRefPtr<Notification> Notification::create(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, PassRefPtr<NotificationCenter> provider) 
 { 
-    return adoptRef(new Notification(contents, context, ec, provider));
+    RefPtr<Notification> notification(adoptRef(new Notification(contents, context, ec, provider)));
+    notification->suspendIfNeeded();
+    return notification.release();
 }
 
 const AtomicString& Notification::interfaceName() const
diff --git a/Source/WebCore/notifications/NotificationCenter.cpp b/Source/WebCore/notifications/NotificationCenter.cpp
index 37ed5473c..71146af8d 100644
--- a/Source/WebCore/notifications/NotificationCenter.cpp
+++ b/Source/WebCore/notifications/NotificationCenter.cpp
@@ -41,6 +41,13 @@
 
 namespace WebCore {
 
+PassRefPtr<NotificationCenter> NotificationCenter::create(ScriptExecutionContext* context, NotificationPresenter* presenter)
+{
+    RefPtr<NotificationCenter> notificationCenter(adoptRef(new NotificationCenter(context, presenter)));
+    notificationCenter->suspendIfNeeded();
+    return notificationCenter.release();
+}
+
 NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter)
     : ActiveDOMObject(context, this)
     , m_notificationPresenter(presenter) {}
diff --git a/Source/WebCore/notifications/NotificationCenter.h b/Source/WebCore/notifications/NotificationCenter.h
index 23b31e031..402ccba93 100644
--- a/Source/WebCore/notifications/NotificationCenter.h
+++ b/Source/WebCore/notifications/NotificationCenter.h
@@ -50,7 +50,7 @@ class VoidCallback;
 
 class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject {
 public:
-    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
+    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext*, NotificationPresenter*);
 
     PassRefPtr<Notification> createHTMLNotification(const String& URI, ExceptionCode& ec)
     {
diff --git a/Source/WebCore/notifications/NotificationCenter.idl b/Source/WebCore/notifications/NotificationCenter.idl
index ed6d07929..8be1ecc76 100644
--- a/Source/WebCore/notifications/NotificationCenter.idl
+++ b/Source/WebCore/notifications/NotificationCenter.idl
@@ -37,9 +37,9 @@ module threads {
         OmitConstructor
     ] NotificationCenter {
 #if !defined(ENABLE_TEXT_NOTIFICATIONS_ONLY) || !ENABLE_TEXT_NOTIFICATIONS_ONLY
-       [V8Custom] Notification createHTMLNotification(in DOMString url) raises(Exception);
+       [V8Custom] Notification createHTMLNotification(in DOMString url) raises(DOMException);
 #endif
-       [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(Exception);
+       [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(DOMException);
 
        int checkPermission();
        [Custom] void requestPermission(in VoidCallback callback);
diff --git a/Source/WebCore/notifications/NotificationController.cpp b/Source/WebCore/notifications/NotificationController.cpp
index c86aa128c..cbdc3ea45 100644
--- a/Source/WebCore/notifications/NotificationController.cpp
+++ b/Source/WebCore/notifications/NotificationController.cpp
@@ -50,6 +50,24 @@ PassOwnPtr<NotificationController> NotificationController::create(Page* page, No
     return adoptPtr(new NotificationController(page, client));
 }
 
+NotificationPresenter* NotificationController::clientFrom(Page* page)
+{
+    if (NotificationController* controller = NotificationController::from(page))
+        return controller->client();
+    return 0;
+}
+
+const AtomicString& NotificationController::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("NotificationController"));
+    return name;
+}
+
+void provideNotification(Page* page, NotificationPresenter* client)
+{
+    PageSupplement::provideTo(page, NotificationController::supplementName(), NotificationController::create(page, client));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(NOTIFICATIONS)
diff --git a/Source/WebCore/notifications/NotificationController.h b/Source/WebCore/notifications/NotificationController.h
index a958a057a..33a95d516 100644
--- a/Source/WebCore/notifications/NotificationController.h
+++ b/Source/WebCore/notifications/NotificationController.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(NOTIFICATIONS)
 
+#include "PageSupplement.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -36,12 +37,16 @@ namespace WebCore {
 class NotificationPresenter;
 class Page;
 
-class NotificationController {
+class NotificationController : public PageSupplement {
     WTF_MAKE_NONCOPYABLE(NotificationController);
 public:
     ~NotificationController();
 
     static PassOwnPtr<NotificationController> create(Page*, NotificationPresenter*);
+    static const AtomicString& supplementName();
+    static NotificationController* from(Frame* frame) { return static_cast<NotificationController*>(PageSupplement::from(frame, supplementName())); }
+    static NotificationController* from(Page* page) { return static_cast<NotificationController*>(PageSupplement::from(page, supplementName())); }
+    static NotificationPresenter* clientFrom(Page*);
 
     NotificationPresenter* client() { return m_client; }
     
diff --git a/Source/WebCore/notifications/NotificationPresenter.h b/Source/WebCore/notifications/NotificationPresenter.h
index 108f05583..1935384dc 100644
--- a/Source/WebCore/notifications/NotificationPresenter.h
+++ b/Source/WebCore/notifications/NotificationPresenter.h
@@ -40,6 +40,7 @@ namespace WebCore {
 class Document;
 class Notification;
 class KURL;
+class Page;
 class ScriptExecutionContext;
 
 class NotificationPresenter {
@@ -84,6 +85,8 @@ protected:
     virtual ~NotificationPresenter() { }
 };
 
+void provideNotification(Page*, NotificationPresenter*);
+
 } // namespace WebCore
 
 #endif // NotificationPresenter_h
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index 8c3b03264..5e0122ddd 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -445,16 +445,6 @@ void Chrome::print(Frame* frame)
     m_client->print(frame);
 }
 
-void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
-{
-    m_client->requestGeolocationPermissionForFrame(frame, geolocation);
-}
-
-void Chrome::cancelGeolocationPermissionRequestForFrame(Frame* frame, Geolocation* geolocation)
-{
-    m_client->cancelGeolocationPermissionRequestForFrame(frame, geolocation);
-}
-
 #if ENABLE(DIRECTORY_UPLOAD)
 void Chrome::enumerateChosenDirectory(FileChooser* fileChooser)
 {
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index d5b39bfe2..c6704c97a 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -149,11 +149,6 @@ namespace WebCore {
 
         void print(Frame*);
 
-        // FIXME: Remove once all ports are using client-based geolocation. https://bugs.webkit.org/show_bug.cgi?id=40373
-        // For client-based geolocation, these two methods have moved to GeolocationClient. https://bugs.webkit.org/show_bug.cgi?id=50061
-        void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
-        void cancelGeolocationPermissionRequestForFrame(Frame*, Geolocation*);
-
 #if ENABLE(INPUT_COLOR)
         PassOwnPtr<ColorChooser> createColorChooser(ColorChooserClient*, const Color& initialColor);
 #endif
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 486625a98..33b1c4b87 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -325,6 +325,7 @@ namespace WebCore {
         virtual bool shouldRunModalDialogDuringPageDismissal(const DialogType&, const String& dialogMessage, FrameLoader::PageDismissalType) const { UNUSED_PARAM(dialogMessage); return true; }
 
         virtual void numWheelEventHandlersChanged(unsigned) = 0;
+        virtual void numTouchEventHandlersChanged(unsigned) = 0;
         
         virtual bool isSVGImageChromeClient() const { return false; }
 
diff --git a/Source/WebCore/page/Console.cpp b/Source/WebCore/page/Console.cpp
index 24e13a5fd..fe0f0af7c 100644
--- a/Source/WebCore/page/Console.cpp
+++ b/Source/WebCore/page/Console.cpp
@@ -236,7 +236,7 @@ void Console::trace(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCall
     }
 }
 
-void Console::assertCondition(bool condition, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+void Console::assertCondition(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack, bool condition)
 {
     if (condition)
         return;
@@ -299,16 +299,14 @@ void Console::time(const String& title)
 {
     InspectorInstrumentation::startConsoleTiming(page(), title);
 #if PLATFORM(CHROMIUM)
-    if (PlatformSupport::isTraceEventEnabled())
-        PlatformSupport::traceEventBegin(title.utf8().data(), 0, 0);
+    TRACE_EVENT_COPY_BEGIN0("webkit", title.utf8().data());
 #endif
 }
 
-void Console::timeEnd(const String& title, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack> callStack)
+void Console::timeEnd(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack> callStack, const String& title)
 {
 #if PLATFORM(CHROMIUM)
-    if (PlatformSupport::isTraceEventEnabled())
-        PlatformSupport::traceEventEnd(title.utf8().data(), 0, 0);
+    TRACE_EVENT_COPY_END0("webkit", title.utf8().data());
 #endif
     InspectorInstrumentation::stopConsoleTiming(page(), title, callStack);
 }
diff --git a/Source/WebCore/page/Console.h b/Source/WebCore/page/Console.h
index f30d191a8..89e2955d6 100644
--- a/Source/WebCore/page/Console.h
+++ b/Source/WebCore/page/Console.h
@@ -66,7 +66,7 @@ public:
     void dir(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void dirxml(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void trace(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    void assertCondition(bool condition, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
+    void assertCondition(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, bool condition);
     void count(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void markTimeline(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -75,7 +75,7 @@ public:
     void profileEnd(const String&, ScriptState*, PassRefPtr<ScriptCallStack>);
 #endif
     void time(const String&);
-    void timeEnd(const String&, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
+    void timeEnd(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, const String&);
     void timeStamp(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void group(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void groupCollapsed(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
diff --git a/Source/WebCore/page/Console.idl b/Source/WebCore/page/Console.idl
index 42cd187f9..2defe3213 100644
--- a/Source/WebCore/page/Console.idl
+++ b/Source/WebCore/page/Console.idl
@@ -33,17 +33,17 @@ module window {
         OmitConstructor
     ] Console {
 
-        [CustomArgumentHandling] void debug();
-        [CustomArgumentHandling] void error();
-        [CustomArgumentHandling] void info();
-        [CustomArgumentHandling] void log();
-        [CustomArgumentHandling] void warn();
-        [CustomArgumentHandling] void dir();
-        [CustomArgumentHandling] void dirxml();
-        [V8Custom, CustomArgumentHandling] void trace();
-        [V8Custom, CustomArgumentHandling, ImplementedAs=assertCondition] void assert(in boolean condition);
-        [CustomArgumentHandling] void count();
-        [CustomArgumentHandling] void markTimeline();
+        [CallWith=ScriptArguments|CallStack] void debug();
+        [CallWith=ScriptArguments|CallStack] void error();
+        [CallWith=ScriptArguments|CallStack] void info();
+        [CallWith=ScriptArguments|CallStack] void log();
+        [CallWith=ScriptArguments|CallStack] void warn();
+        [CallWith=ScriptArguments|CallStack] void dir();
+        [CallWith=ScriptArguments|CallStack] void dirxml();
+        [V8Custom, CallWith=ScriptArguments|CallStack] void trace();
+        [V8Custom, CallWith=ScriptArguments|CallStack, ImplementedAs=assertCondition] void assert(in boolean condition);
+        [CallWith=ScriptArguments|CallStack] void count();
+        [CallWith=ScriptArguments|CallStack] void markTimeline();
 
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         readonly attribute [CustomGetter] Array profiles;
@@ -51,11 +51,11 @@ module window {
         [Custom] void profileEnd(in DOMString title);
 #endif
 
-        void time(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString title);
-        [CustomArgumentHandling] void timeEnd(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString title);
-        [CustomArgumentHandling] void timeStamp();
-        [CustomArgumentHandling] void group();
-        [CustomArgumentHandling] void groupCollapsed();
+        void time(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString title);
+        [CallWith=ScriptArguments|CallStack] void timeEnd(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString title);
+        [CallWith=ScriptArguments|CallStack] void timeStamp();
+        [CallWith=ScriptArguments|CallStack] void group();
+        [CallWith=ScriptArguments|CallStack] void groupCollapsed();
         void groupEnd();
 
         readonly attribute [V8CustomGetter] MemoryInfo memory;
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index a214352b2..98b29817f 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -983,7 +983,12 @@ void ContextMenuController::addInspectElementItem()
         return;
 
     ContextMenuItem InspectElementItem(ActionType, ContextMenuItemTagInspectElement, contextMenuItemTagInspectElement());
-    appendItem(*separatorItem(), m_contextMenu.get());
+#if USE(CROSS_PLATFORM_CONTEXT_MENUS)
+    if (!m_contextMenu->items().isEmpty())
+#else
+    if (m_contextMenu->itemCount())
+#endif
+        appendItem(*separatorItem(), m_contextMenu.get());
     appendItem(InspectElementItem, m_contextMenu.get());
 }
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/page/DOMSelection.idl b/Source/WebCore/page/DOMSelection.idl
index ccd30e375..cd4b5938a 100644
--- a/Source/WebCore/page/DOMSelection.idl
+++ b/Source/WebCore/page/DOMSelection.idl
@@ -43,8 +43,8 @@ module window {
         readonly attribute boolean isCollapsed;
         readonly attribute long rangeCount;
 
-        void collapse(in [Optional=CallWithDefaultValue] Node node, 
-                      in [Optional=CallWithDefaultValue] long index)
+        void collapse(in [Optional=DefaultIsUndefined] Node node, 
+                      in [Optional=DefaultIsUndefined] long index)
             raises(DOMException);
         void collapseToEnd()
             raises(DOMException);
@@ -52,19 +52,19 @@ module window {
             raises(DOMException);
 
         void deleteFromDocument();
-        boolean containsNode(in [Optional=CallWithDefaultValue] Node node, 
-                             in [Optional=CallWithDefaultValue] boolean allowPartial);
-        void selectAllChildren(in [Optional=CallWithDefaultValue] Node node)
+        boolean containsNode(in [Optional=DefaultIsUndefined] Node node, 
+                             in [Optional=DefaultIsUndefined] boolean allowPartial);
+        void selectAllChildren(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
 
-        void extend(in [Optional=CallWithDefaultValue] Node node, 
-                    in [Optional=CallWithDefaultValue] long offset)
+        void extend(in [Optional=DefaultIsUndefined] Node node, 
+                    in [Optional=DefaultIsUndefined] long offset)
             raises(DOMException);
 
-        Range getRangeAt(in [Optional=CallWithDefaultValue] long index)
+        Range getRangeAt(in [Optional=DefaultIsUndefined] long index)
             raises(DOMException);
         void removeAllRanges();
-        void addRange(in [Optional=CallWithDefaultValue] Range range);
+        void addRange(in [Optional=DefaultIsUndefined] Range range);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [NotEnumerable] DOMString toString();
@@ -80,16 +80,16 @@ module window {
         // IE's type accessor returns "none", "text" and "control"
         readonly attribute DOMString type;
 
-        void modify(in [Optional=CallWithDefaultValue] DOMString alter, 
-                    in [Optional=CallWithDefaultValue] DOMString direction, 
-                    in [Optional=CallWithDefaultValue] DOMString granularity);
-        void setBaseAndExtent(in [Optional=CallWithDefaultValue] Node baseNode, 
-                              in [Optional=CallWithDefaultValue] long baseOffset, 
-                              in [Optional=CallWithDefaultValue] Node extentNode, 
-                              in [Optional=CallWithDefaultValue] long extentOffset)
+        void modify(in [Optional=DefaultIsUndefined] DOMString alter, 
+                    in [Optional=DefaultIsUndefined] DOMString direction, 
+                    in [Optional=DefaultIsUndefined] DOMString granularity);
+        void setBaseAndExtent(in [Optional=DefaultIsUndefined] Node baseNode, 
+                              in [Optional=DefaultIsUndefined] long baseOffset, 
+                              in [Optional=DefaultIsUndefined] Node extentNode, 
+                              in [Optional=DefaultIsUndefined] long extentOffset)
             raises(DOMException);
-        void setPosition(in [Optional=CallWithDefaultValue] Node node, 
-                         in [Optional=CallWithDefaultValue] long offset)
+        void setPosition(in [Optional=DefaultIsUndefined] Node node, 
+                         in [Optional=DefaultIsUndefined] long offset)
             raises(DOMException);
 
         // IE extentions
diff --git a/Source/WebCore/page/DOMTimer.cpp b/Source/WebCore/page/DOMTimer.cpp
index 0a94e7ef8..dad76f58d 100644
--- a/Source/WebCore/page/DOMTimer.cpp
+++ b/Source/WebCore/page/DOMTimer.cpp
@@ -92,6 +92,7 @@ int DOMTimer::install(ScriptExecutionContext* context, PassOwnPtr<ScheduledActio
     // or if it is a one-time timer and it has fired (DOMTimer::fired).
     DOMTimer* timer = new DOMTimer(context, action, timeout, singleShot);
 
+    timer->suspendIfNeeded();
     InspectorInstrumentation::didInstallTimer(context, timer->m_timeoutId, timeout, singleShot);
 
     return timer->m_timeoutId;
@@ -114,7 +115,7 @@ void DOMTimer::fired()
 {
     ScriptExecutionContext* context = scriptExecutionContext();
     timerNestingLevel = m_nestingLevel;
-    
+    ASSERT(!context->activeDOMObjectsAreSuspended());
     UserGestureIndicator gestureIndicator(m_shouldForwardUserGesture ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
     
     // Only the first execution of a multi-shot timer should get an affirmative user gesture indicator.
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 2597f864f..051bbf0db 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -102,17 +102,6 @@
 #include <wtf/MathExtras.h>
 #include <wtf/text/WTFString.h>
 
-#if ENABLE(FILE_SYSTEM)
-#include "AsyncFileSystem.h"
-#include "DOMFileSystem.h"
-#include "EntryCallback.h"
-#include "ErrorCallback.h"
-#include "FileError.h"
-#include "FileSystemCallback.h"
-#include "FileSystemCallbacks.h"
-#include "LocalFileSystem.h"
-#endif
-
 #if ENABLE(REQUEST_ANIMATION_FRAME)
 #include "RequestAnimationFrameCallback.h"
 #endif
@@ -480,6 +469,21 @@ void DOMWindow::frameDestroyed()
     clear();
 }
 
+void DOMWindow::willDetachPage()
+{
+    InspectorInstrumentation::frameWindowDiscarded(m_frame, this);
+
+#if ENABLE(NOTIFICATIONS)
+    // Clearing Notifications requests involves accessing the client so it must be done
+    // before the frame is detached.
+    resetNotifications();
+#endif
+
+    HashSet<DOMWindowProperty*>::iterator stop = m_properties.end();
+    for (HashSet<DOMWindowProperty*>::iterator it = m_properties.begin(); it != stop; ++it)
+        (*it)->willDetachPage();
+}
+
 void DOMWindow::registerProperty(DOMWindowProperty* property)
 {
     m_properties.add(property);
@@ -715,7 +719,7 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
-    NotificationPresenter* provider = page->notificationController()->client();
+    NotificationPresenter* provider = NotificationController::clientFrom(page);
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
       
@@ -731,23 +735,6 @@ void DOMWindow::resetNotifications()
 }
 #endif
 
-void DOMWindow::pageDestroyed()
-{
-    InspectorInstrumentation::frameWindowDiscarded(m_frame, this);
-#if ENABLE(NOTIFICATIONS)
-    // Clearing Notifications requests involves accessing the client so it must be done
-    // before the frame is detached.
-    resetNotifications();
-#endif
-}
-
-void DOMWindow::resetGeolocation()
-{
-    // Geolocation should cancel activities and permission requests when the page is detached.
-    if (m_navigator)
-        m_navigator->resetGeolocation();
-}
-
 #if ENABLE(INDEXED_DATABASE)
 void DOMWindow::setIDBFactory(PassRefPtr<IDBFactory> idbFactory)
 {
@@ -755,61 +742,6 @@ void DOMWindow::setIDBFactory(PassRefPtr<IDBFactory> idbFactory)
 }
 #endif
 
-#if ENABLE(FILE_SYSTEM)
-void DOMWindow::webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!isCurrentlyDisplayedInFrame())
-        return;
-
-    Document* document = this->document();
-    if (!document)
-        return;
-
-    if (!AsyncFileSystem::isAvailable() || !document->securityOrigin()->canAccessFileSystem()) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (!AsyncFileSystem::isValidType(fileSystemType)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
-}
-
-void DOMWindow::webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!isCurrentlyDisplayedInFrame())
-        return;
-
-    Document* document = this->document();
-    if (!document)
-        return;
-
-    SecurityOrigin* securityOrigin = document->securityOrigin();
-    KURL completedURL = document->completeURL(url);
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin->canAccessFileSystem() || !securityOrigin->canRequest(completedURL)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type type;
-    String filePath;
-    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::ENCODING_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().readFileSystem(document, type, ResolveURICallbacks::create(successCallback, errorCallback, document, filePath));
-}
-
-COMPILE_ASSERT(static_cast<int>(DOMWindow::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
-COMPILE_ASSERT(static_cast<int>(DOMWindow::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
-
-#endif
-
 void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     MessagePortArray ports;
@@ -1206,7 +1138,7 @@ unsigned DOMWindow::length() const
     if (!isCurrentlyDisplayedInFrame())
         return 0;
 
-    return m_frame->tree()->childCount();
+    return m_frame->tree()->scopedChildCount();
 }
 
 String DOMWindow::name() const
@@ -1321,7 +1253,7 @@ PassRefPtr<CSSStyleDeclaration> DOMWindow::getComputedStyle(Element* elt, const
     if (!elt)
         return 0;
 
-    return computedStyle(elt, false, pseudoElt);
+    return CSSComputedStyleDeclaration::create(elt, false, pseudoElt);
 }
 
 PassRefPtr<CSSRuleList> DOMWindow::getMatchedCSSRules(Element* element, const String& pseudoElement, bool authorOnly) const
@@ -1561,10 +1493,13 @@ bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<Event
     else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
         addBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
-    else if (eventType == eventNames().devicemotionEvent && frame() && frame()->page() && frame()->page()->deviceMotionController())
-        frame()->page()->deviceMotionController()->addListener(this);
-    else if (eventType == eventNames().deviceorientationEvent && frame() && frame()->page() && frame()->page()->deviceOrientationController())
-        frame()->page()->deviceOrientationController()->addListener(this);
+    else if (eventType == eventNames().devicemotionEvent) {
+        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+            controller->addListener(this);
+    } else if (eventType == eventNames().deviceorientationEvent) {
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+            controller->addListener(this);
+    }
 #endif
 
     return true;
@@ -1585,10 +1520,13 @@ bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener
     else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
         removeBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
-    else if (eventType == eventNames().devicemotionEvent && frame() && frame()->page() && frame()->page()->deviceMotionController())
-        frame()->page()->deviceMotionController()->removeListener(this);
-    else if (eventType == eventNames().deviceorientationEvent && frame() && frame()->page() && frame()->page()->deviceOrientationController())
-        frame()->page()->deviceOrientationController()->removeListener(this);
+    else if (eventType == eventNames().devicemotionEvent) {
+        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+            controller->removeListener(this);
+    } else if (eventType == eventNames().deviceorientationEvent) {
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+            controller->removeListener(this);
+    }
 #endif
 
     return true;
@@ -1641,10 +1579,10 @@ void DOMWindow::removeAllEventListeners()
     EventTarget::removeAllEventListeners();
 
 #if ENABLE(DEVICE_ORIENTATION)
-    if (frame() && frame()->page() && frame()->page()->deviceMotionController())
-        frame()->page()->deviceMotionController()->removeAllListeners(this);
-    if (frame() && frame()->page() && frame()->page()->deviceOrientationController())
-        frame()->page()->deviceOrientationController()->removeAllListeners(this);
+    if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+        controller->removeAllListeners(this);
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+        controller->removeAllListeners(this);
 #endif
 
     removeAllUnloadEventListeners(this);
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index 96a58e583..9fa6a5caf 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -46,10 +46,7 @@ namespace WebCore {
     class DatabaseCallback;
     class Document;
     class Element;
-    class EntryCallback;
-    class ErrorCallback;
     class EventListener;
-    class FileSystemCallback;
     class FloatRect;
     class Frame;
     class History;
@@ -92,8 +89,6 @@ namespace WebCore {
 
         virtual DOMWindow* toDOMWindow();
 
-        virtual void frameDestroyed() OVERRIDE;
-
         void registerProperty(DOMWindowProperty*);
         void unregisterProperty(DOMWindowProperty*);
 
@@ -231,9 +226,6 @@ namespace WebCore {
         void printErrorMessage(const String&);
         String crossDomainAccessErrorMessage(DOMWindow* activeWindow);
 
-        void pageDestroyed();
-        void resetGeolocation();
-
         void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
         void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
@@ -360,17 +352,6 @@ namespace WebCore {
         Storage* sessionStorage(ExceptionCode&) const;
         Storage* localStorage(ExceptionCode&) const;
 
-#if ENABLE(FILE_SYSTEM)
-        // They are placed here and in all capital letters so they can be checked against the constants in the
-        // IDL at compile time.
-        enum FileSystemType {
-            TEMPORARY,
-            PERSISTENT,
-        };
-        void webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
-        void webkitResolveLocalFileSystemURL(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-#endif
-
 #if ENABLE(NOTIFICATIONS)
         NotificationCenter* webkitNotifications() const;
         // Renders webkitNotifications object safely inoperable, disconnects
@@ -419,6 +400,9 @@ namespace WebCore {
     private:
         explicit DOMWindow(Frame*);
 
+        virtual void frameDestroyed() OVERRIDE;
+        virtual void willDetachPage() OVERRIDE;
+
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
         virtual EventTargetData* eventTargetData();
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 41ace04d0..2d8691642 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -27,11 +27,11 @@
 module window {
 
     interface [
-        CheckDomainSecurity,
+        CheckSecurity,
         JSCustomDefineOwnProperty,
         CustomDeleteProperty,
         CustomGetOwnPropertySlot,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         JSCustomMarkFunction,
         JSCustomToNativeObject,
         CustomPutFunction,
@@ -39,11 +39,13 @@ module window {
         ExtendsDOMGlobalObject,
         JSGenerateToNativeObject,
         ReplaceableConstructor,
-        JSLegacyParent=JSDOMWindowBase
+        JSLegacyParent=JSDOMWindowBase,
+        V8CustomToJSObject,
+        InterfaceName=Window
     ] DOMWindow {
         // DOM Level 0
         attribute [Replaceable] Screen screen;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter, JSCustomGetter] History history;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter, JSCustomGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -53,18 +55,18 @@ module window {
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
         readonly attribute Crypto crypto;
-        attribute [DoNotCheckDomainSecurity, JSCustom, V8CustomSetter, V8Unforgeable, CPPCustom] Location location;
-
+#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
+        attribute [DoNotCheckSecurity, JSCustom, V8CustomSetter, V8Unforgeable] Location location;
+#endif
         attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
-
         DOMSelection getSelection();
 
-        readonly attribute [CheckAccessToNode] Element frameElement;
+        readonly attribute [CheckSecurityForNode] Element frameElement;
 
-        [DoNotCheckDomainSecurity] void focus();
-        [DoNotCheckDomainSecurity] void blur();
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void close();
+        [DoNotCheckSecurity] void focus();
+        [DoNotCheckSecurity] void blur();
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void close();
 
         void print();
         void stop();
@@ -77,18 +79,18 @@ module window {
                                            in [Optional] DOMObject dialogArgs,
                                            in [Optional] DOMString featureArgs);
 
-        void alert(in [Optional=CallWithDefaultValue] DOMString message);
-        boolean confirm(in [Optional=CallWithDefaultValue] DOMString message);
-        [ConvertNullStringTo=Null] DOMString prompt(in [Optional=CallWithDefaultValue] DOMString message,
-                                                    in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString defaultValue);
+        void alert(in [Optional=DefaultIsUndefined] DOMString message);
+        boolean confirm(in [Optional=DefaultIsUndefined] DOMString message);
+        [TreatReturnedNullStringAs=Null] DOMString prompt(in [Optional=DefaultIsUndefined] DOMString message,
+                                                    in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString defaultValue);
 
-        boolean find(in [Optional=CallWithDefaultValue] DOMString string,
-                     in [Optional=CallWithDefaultValue] boolean caseSensitive,
-                     in [Optional=CallWithDefaultValue] boolean backwards,
-                     in [Optional=CallWithDefaultValue] boolean wrap,
-                     in [Optional=CallWithDefaultValue] boolean wholeWord,
-                     in [Optional=CallWithDefaultValue] boolean searchInFrames,
-                     in [Optional=CallWithDefaultValue] boolean showDialog);
+        boolean find(in [Optional=DefaultIsUndefined] DOMString string,
+                     in [Optional=DefaultIsUndefined] boolean caseSensitive,
+                     in [Optional=DefaultIsUndefined] boolean backwards,
+                     in [Optional=DefaultIsUndefined] boolean wrap,
+                     in [Optional=DefaultIsUndefined] boolean wholeWord,
+                     in [Optional=DefaultIsUndefined] boolean searchInFrames,
+                     in [Optional=DefaultIsUndefined] boolean showDialog);
 
         attribute [Replaceable] boolean offscreenBuffering;
 
@@ -105,17 +107,17 @@ module window {
         readonly attribute long pageXOffset;
         readonly attribute long pageYOffset;
 
-        void scrollBy(in [Optional=CallWithDefaultValue] long x, in [Optional=CallWithDefaultValue] long y);
-        void scrollTo(in [Optional=CallWithDefaultValue] long x, in [Optional=CallWithDefaultValue] long y);
-        void scroll(in [Optional=CallWithDefaultValue] long x, in [Optional=CallWithDefaultValue] long y);
-        void moveBy(in [Optional=CallWithDefaultValue] float x, in [Optional=CallWithDefaultValue] float y); // FIXME: this should take longs not floats.
-        void moveTo(in [Optional=CallWithDefaultValue] float x, in [Optional=CallWithDefaultValue] float y); // FIXME: this should take longs not floats.
-        void resizeBy(in [Optional=CallWithDefaultValue] float x, in [Optional=CallWithDefaultValue] float y); // FIXME: this should take longs not floats.
-        void resizeTo(in [Optional=CallWithDefaultValue] float width, in [Optional=CallWithDefaultValue] float height); // FIXME: this should take longs not floats.
+        void scrollBy(in [Optional=DefaultIsUndefined] long x, in [Optional=DefaultIsUndefined] long y);
+        void scrollTo(in [Optional=DefaultIsUndefined] long x, in [Optional=DefaultIsUndefined] long y);
+        void scroll(in [Optional=DefaultIsUndefined] long x, in [Optional=DefaultIsUndefined] long y);
+        void moveBy(in [Optional=DefaultIsUndefined] float x, in [Optional=DefaultIsUndefined] float y); // FIXME: this should take longs not floats.
+        void moveTo(in [Optional=DefaultIsUndefined] float x, in [Optional=DefaultIsUndefined] float y); // FIXME: this should take longs not floats.
+        void resizeBy(in [Optional=DefaultIsUndefined] float x, in [Optional=DefaultIsUndefined] float y); // FIXME: this should take longs not floats.
+        void resizeTo(in [Optional=DefaultIsUndefined] float width, in [Optional=DefaultIsUndefined] float height); // FIXME: this should take longs not floats.
 
-        readonly attribute [DoNotCheckDomainSecurity] boolean closed;
+        readonly attribute [DoNotCheckSecurity] boolean closed;
 
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] unsigned long length;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] unsigned long length;
 
         attribute DOMString name;
 
@@ -127,13 +129,13 @@ module window {
 #endif
 
         // Self referential attributes
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] DOMWindow self;
-        readonly attribute [DoNotCheckDomainSecurity, V8Unforgeable] DOMWindow window;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] DOMWindow frames;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow self;
+        readonly attribute [DoNotCheckSecurity, V8Unforgeable] DOMWindow window;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow frames;
 
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter, V8CustomSetter] DOMWindow opener;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] DOMWindow parent;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter, V8Unforgeable, V8ReadOnly] DOMWindow top;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter, V8CustomSetter] DOMWindow opener;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow parent;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter, V8Unforgeable, V8ReadOnly] DOMWindow top;
 
         // DOM Level 2 AbstractView Interface
         readonly attribute Document document;
@@ -145,21 +147,21 @@ module window {
         readonly attribute StyleMedia styleMedia;
 
         // DOM Level 2 Style Interface
-        CSSStyleDeclaration getComputedStyle(in [Optional=CallWithDefaultValue] Element element,
-                                             in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString pseudoElement);
+        CSSStyleDeclaration getComputedStyle(in [Optional=DefaultIsUndefined] Element element,
+                                             in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString pseudoElement);
 
         // WebKit extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        CSSRuleList getMatchedCSSRules(in [Optional=CallWithDefaultValue] Element element,
-                                       in [Optional=CallWithDefaultValue] DOMString pseudoElement);
+        CSSRuleList getMatchedCSSRules(in [Optional=DefaultIsUndefined] Element element,
+                                       in [Optional=DefaultIsUndefined] DOMString pseudoElement);
 #endif
 
         attribute [Replaceable] double devicePixelRatio;
         
-        WebKitPoint webkitConvertPointFromPageToNode(in [Optional=CallWithDefaultValue] Node node, 
-                                                     in [Optional=CallWithDefaultValue] WebKitPoint p);
-        WebKitPoint webkitConvertPointFromNodeToPage(in [Optional=CallWithDefaultValue] Node node, 
-                                                     in [Optional=CallWithDefaultValue] WebKitPoint p);
+        WebKitPoint webkitConvertPointFromPageToNode(in [Optional=DefaultIsUndefined] Node node, 
+                                                     in [Optional=DefaultIsUndefined] WebKitPoint p);
+        WebKitPoint webkitConvertPointFromNodeToPage(in [Optional=DefaultIsUndefined] Node node, 
+                                                     in [Optional=DefaultIsUndefined] WebKitPoint p);
 
         readonly attribute [V8EnabledAtRuntime] DOMApplicationCache applicationCache;
 
@@ -171,12 +173,6 @@ module window {
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
         readonly attribute [V8EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
-#if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
-        const unsigned short TEMPORARY = 0;
-        const unsigned short PERSISTENT = 1;
-        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-#endif
 
 #if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
         // This is the interface orientation in degrees. Some examples are:
@@ -189,18 +185,18 @@ module window {
 
         // cross-document messaging
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin)
+        [DoNotCheckSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin)
             raises(DOMException);
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array messagePorts)
+        [DoNotCheckSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array messagePorts)
             raises(DOMException);
 
-        [DoNotCheckDomainSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin)
+        [DoNotCheckSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin)
             raises(DOMException);
-        [DoNotCheckDomainSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array transferList)
+        [DoNotCheckSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array transferList)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+        [DoNotCheckSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
             raises(DOMException);
 #endif
 
@@ -209,27 +205,27 @@ module window {
 #endif
 
         // Timers
-        [Custom] long setTimeout(in [Optional=CallWithDefaultValue] TimeoutHandler handler, 
-                                 in [Optional=CallWithDefaultValue] long timeout);
+        [Custom] long setTimeout(in [Optional=DefaultIsUndefined] TimeoutHandler handler, 
+                                 in [Optional=DefaultIsUndefined] long timeout);
         // [Custom] long setTimeout(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        void clearTimeout(in [Optional=CallWithDefaultValue] long handle);
+        void clearTimeout(in [Optional=DefaultIsUndefined] long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
         // [Custom] long setInterval(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        void clearInterval(in [Optional=CallWithDefaultValue] long handle);
+        void clearInterval(in [Optional=DefaultIsUndefined] long handle);
 
 #if defined(ENABLE_REQUEST_ANIMATION_FRAME)
         // WebKit animation extensions, being standardized in the WebPerf WG
-        long webkitRequestAnimationFrame(in [Callback] RequestAnimationFrameCallback callback, in [Optional=CallWithDefaultValue] Element element);
+        long webkitRequestAnimationFrame(in [Callback] RequestAnimationFrameCallback callback, in [Optional=DefaultIsUndefined] Element element);
         void webkitCancelAnimationFrame(in long id);
         void webkitCancelRequestAnimationFrame(in long id); // This is a deprecated alias for webkitCancelAnimationFrame(). Remove this when removing vendor prefix.
 #endif
 
         // Base64
-        DOMString atob(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString string)
+        DOMString atob(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString string)
             raises(DOMException);
-        DOMString btoa(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString string)
+        DOMString btoa(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString string)
             raises(DOMException);
 
         // Events
@@ -321,8 +317,6 @@ module window {
         attribute [Conditional=DEVICE_ORIENTATION,V8EnabledAtRuntime] EventListener ondevicemotion;
         attribute [Conditional=DEVICE_ORIENTATION,V8EnabledAtRuntime] EventListener ondeviceorientation;
 
-        attribute [Conditional=MEDIA_STREAM,V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
-
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
                                       in EventListener listener,
@@ -333,8 +327,8 @@ module window {
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 
-        [V8Custom=DOMWindowNOP] void captureEvents(/*in long eventFlags*/);
-        [V8Custom=DOMWindowNOP] void releaseEvents(/*in long eventFlags*/);
+        [V8Custom] void captureEvents(/*in long eventFlags*/);
+        [V8Custom] void releaseEvents(/*in long eventFlags*/);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Global constructors
@@ -399,94 +393,14 @@ module window {
         attribute ProcessingInstructionConstructor ProcessingInstruction;
         attribute [Conditional=SHADOW_DOM, V8EnabledAtRuntime=shadowDOM] ShadowRootConstructor WebKitShadowRoot;
 
-        attribute HTMLDocumentConstructor HTMLDocument;
-
-        attribute HTMLElementConstructor HTMLElement;
-        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
-        attribute HTMLAppletElementConstructor HTMLAppletElement;
-        attribute HTMLAreaElementConstructor HTMLAreaElement;
-        attribute HTMLBRElementConstructor HTMLBRElement;
-        attribute HTMLBaseElementConstructor HTMLBaseElement;
-        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
-        attribute HTMLBodyElementConstructor HTMLBodyElement;
-        attribute HTMLButtonElementConstructor HTMLButtonElement;
-        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
-        attribute HTMLDListElementConstructor HTMLDListElement;
-        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
-        attribute HTMLDivElementConstructor HTMLDivElement;
-        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
-        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
-        attribute HTMLFontElementConstructor HTMLFontElement;
-        attribute HTMLFormElementConstructor HTMLFormElement;
-        attribute HTMLFrameElementConstructor HTMLFrameElement;
-        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
-        attribute HTMLHRElementConstructor HTMLHRElement;
-        attribute HTMLHeadElementConstructor HTMLHeadElement;
-        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
-        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
-        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
-        attribute HTMLImageElementConstructor HTMLImageElement;
-        attribute HTMLInputElementConstructor HTMLInputElement;
-        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
-        attribute HTMLLIElementConstructor HTMLLIElement;
-        attribute HTMLLabelElementConstructor HTMLLabelElement;
-        attribute HTMLLegendElementConstructor HTMLLegendElement;
-        attribute HTMLLinkElementConstructor HTMLLinkElement;
-        attribute HTMLMapElementConstructor HTMLMapElement;
-        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
-        attribute HTMLMenuElementConstructor HTMLMenuElement;
-        attribute HTMLMetaElementConstructor HTMLMetaElement;
-#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
-        attribute HTMLMeterElementConstructor HTMLMeterElement;
-#endif
-        attribute HTMLModElementConstructor HTMLModElement;
-        attribute HTMLOListElementConstructor HTMLOListElement;
-        attribute HTMLObjectElementConstructor HTMLObjectElement;
-        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
-        attribute HTMLOptionElementConstructor HTMLOptionElement;
-        attribute HTMLOutputElementConstructor HTMLOutputElement;
-        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
-        attribute HTMLParamElementConstructor HTMLParamElement;
-        attribute HTMLPreElementConstructor HTMLPreElement;
-#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
-        attribute HTMLProgressElementConstructor HTMLProgressElement;
-#endif
-        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
-        attribute HTMLScriptElementConstructor HTMLScriptElement;
-        attribute HTMLSelectElementConstructor HTMLSelectElement;
-        attribute HTMLSpanElementConstructor HTMLSpanElement;
-        attribute HTMLStyleElementConstructor HTMLStyleElement;
-        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
-        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
-        attribute HTMLTableColElementConstructor HTMLTableColElement;
-        attribute HTMLTableElementConstructor HTMLTableElement;
-        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
-        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
-        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
-        attribute HTMLTitleElementConstructor HTMLTitleElement;
-        attribute HTMLUListElementConstructor HTMLUListElement;
-
-        attribute HTMLCollectionConstructor HTMLCollection;
-        attribute HTMLAllCollectionConstructor HTMLAllCollection;
-        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
-        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
-
-        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
-        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
+        attribute DOMWindowConstructor Window;
 
+        // FIXME: Should these Canvas constructors move to html/DOMWindowHTML with the rest of canvas?
         attribute CanvasPatternConstructor CanvasPattern;
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
+
         attribute ImageDataConstructor ImageData;
-        attribute [Conditional=WEBGL] WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute [Conditional=WEBGL] WebGLBufferConstructor WebGLBuffer;
-        attribute [Conditional=WEBGL] WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute [Conditional=WEBGL] WebGLProgramConstructor WebGLProgram;
-        attribute [Conditional=WEBGL] WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute [Conditional=WEBGL] WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute [Conditional=WEBGL] WebGLShaderConstructor WebGLShader;
-        attribute [Conditional=WEBGL] WebGLTextureConstructor WebGLTexture;
-        attribute [Conditional=WEBGL] WebGLUniformLocationConstructor WebGLUniformLocation;
         attribute TextMetricsConstructor TextMetrics;
 
         attribute DOMStringMapConstructor DOMStringMap;
@@ -523,14 +437,11 @@ module window {
         attribute WebKitAnimationEventConstructor WebKitAnimationEvent;
         attribute WebKitTransitionEventConstructor WebKitTransitionEvent;
         attribute WheelEventConstructor WheelEvent;
-        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
-        attribute [Conditional=SVG] SVGZoomEventConstructor SVGZoomEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceMotionEventConstructor DeviceMotionEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceOrientationEventConstructor DeviceOrientationEvent;
         attribute [Conditional=TOUCH_EVENTS] TouchEventConstructor TouchEvent;
         attribute StorageEventConstructor StorageEvent;
         attribute [Conditional=INPUT_SPEECH] SpeechInputEventConstructor SpeechInputEvent;
-        attribute [Conditional=MEDIA_STREAM] MediaStreamEventConstructor MediaStreamEvent;
         attribute [Conditional=WEBGL] WebGLContextEventConstructor WebGLContextEvent;
 
         attribute EventExceptionConstructor EventException;
@@ -555,41 +466,11 @@ module window {
 
         attribute EventSourceConstructor EventSource; // Usable with new the operator
 
-        // Mozilla has a separate XMLDocument object for XML documents. 
-        // We just use Document for this.
-        attribute DocumentConstructor XMLDocument;
-
-        attribute DOMParserConstructor DOMParser;
-        attribute XMLSerializerConstructor XMLSerializer;
-
-        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
-        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
-        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
-
-        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
-
 #if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
         attribute MessagePortConstructor MessagePort;
         attribute MessageChannelConstructor MessageChannel; // Usable with the new operator
 #endif
 
-#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
-        attribute WorkerConstructor Worker; // Usable with the new operator
-#endif
-
-#if defined(ENABLE_SHARED_WORKERS) && ENABLE_SHARED_WORKERS
-        attribute [JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
-#endif
-
-#if defined(ENABLE_VIDEO_TRACK) && ENABLE_VIDEO_TRACK
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
-#endif
-
         attribute DOMPluginConstructor Plugin;
         attribute DOMPluginArrayConstructor PluginArray;
 
@@ -601,15 +482,6 @@ module window {
 
         attribute StorageConstructor Storage;
 
-        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
-
 #if defined(ENABLE_ANIMATION_API) && ENABLE_ANIMATION_API
         attribute WebKitAnimationConstructor WebKitAnimation;
         attribute WebKitAnimationListConstructor WebKitAnimationList;
@@ -619,162 +491,6 @@ module window {
         attribute XPathResultConstructor XPathResult;
         attribute XPathExceptionConstructor XPathException;
 
-#if defined(ENABLE_SVG) && ENABLE_SVG
-        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
-        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
-        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
-        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
-        attribute SVGAElementConstructor SVGAElement;
-        attribute SVGAngleConstructor SVGAngle;
-        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
-        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
-        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
-        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
-        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
-        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
-        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
-        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
-        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
-        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
-        attribute SVGAnimatedStringConstructor SVGAnimatedString;
-        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
-        attribute SVGCircleElementConstructor SVGCircleElement;
-        attribute SVGClipPathElementConstructor SVGClipPathElement;
-        attribute SVGColorConstructor SVGColor;
-        attribute SVGCursorElementConstructor SVGCursorElement;
-//      attribute SVGCSSRuleConstructor SVGCSSRule;
-        attribute SVGDefsElementConstructor SVGDefsElement;
-        attribute SVGDescElementConstructor SVGDescElement;
-        attribute SVGDocumentConstructor SVGDocument;
-        attribute SVGElementConstructor SVGElement;
-        attribute SVGElementInstanceConstructor SVGElementInstance;
-        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
-        attribute SVGEllipseElementConstructor SVGEllipseElement;
-        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
-        attribute SVGExceptionConstructor SVGException;
-        attribute SVGGElementConstructor SVGGElement;
-        attribute SVGGradientElementConstructor SVGGradientElement;
-        attribute SVGImageElementConstructor SVGImageElement;
-        attribute SVGLengthConstructor SVGLength;
-        attribute SVGLengthListConstructor SVGLengthList;
-        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
-        attribute SVGLineElementConstructor SVGLineElement;
-        attribute SVGMarkerElementConstructor SVGMarkerElement;
-        attribute SVGMaskElementConstructor SVGMaskElement;
-        attribute SVGMatrixConstructor SVGMatrix;
-        attribute SVGMetadataElementConstructor SVGMetadataElement;
-        attribute SVGNumberConstructor SVGNumber;
-        attribute SVGNumberListConstructor SVGNumberList;
-        attribute SVGPaintConstructor SVGPaint;
-        attribute SVGPathElementConstructor SVGPathElement;
-        attribute SVGPathSegConstructor SVGPathSeg;
-        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
-        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
-        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
-        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
-        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
-        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
-        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
-        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
-        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
-        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
-        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
-        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
-        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
-        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
-        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
-        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
-        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
-        attribute SVGPathSegListConstructor SVGPathSegList;
-        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
-        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
-        attribute SVGPatternElementConstructor SVGPatternElement;
-        attribute SVGPointConstructor SVGPoint;
-        attribute SVGPointListConstructor SVGPointList;
-        attribute SVGPolygonElementConstructor SVGPolygonElement;
-        attribute SVGPolylineElementConstructor SVGPolylineElement;
-        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
-        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
-        attribute SVGRectConstructor SVGRect;
-        attribute SVGRectElementConstructor SVGRectElement;
-        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
-        attribute SVGScriptElementConstructor SVGScriptElement;
-        attribute SVGStopElementConstructor SVGStopElement;
-        attribute SVGStringListConstructor SVGStringList;
-        attribute SVGStyleElementConstructor SVGStyleElement;
-        attribute SVGSVGElementConstructor SVGSVGElement;
-        attribute SVGSwitchElementConstructor SVGSwitchElement;
-        attribute SVGSymbolElementConstructor SVGSymbolElement;
-        attribute SVGTextContentElementConstructor SVGTextContentElement;
-        attribute SVGTextElementConstructor SVGTextElement;
-        attribute SVGTextPathElementConstructor SVGTextPathElement;
-        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
-        attribute SVGTitleElementConstructor SVGTitleElement;
-        attribute SVGTransformConstructor SVGTransform;
-        attribute SVGTransformListConstructor SVGTransformList;
-        attribute SVGTRefElementConstructor SVGTRefElement;
-        attribute SVGTSpanElementConstructor SVGTSpanElement;
-        attribute SVGUnitTypesConstructor SVGUnitTypes;
-        attribute SVGUseElementConstructor SVGUseElement;
-        attribute SVGViewElementConstructor SVGViewElement;
-//      attribute SVGViewSpecConstructor SVGViewSpec;
-
-        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
-        attribute SVGAnimateElementConstructor SVGAnimateElement;
-        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
-        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
-        attribute SVGMPathElementConstructor SVGMPathElement;
-        attribute SVGSetElementConstructor SVGSetElement;
-
-#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
-        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
-        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
-        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
-//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
-        attribute SVGFontElementConstructor SVGFontElement;
-        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
-        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
-        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
-        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
-        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
-        attribute SVGGlyphElementConstructor SVGGlyphElement;
-        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
-        attribute SVGHKernElementConstructor SVGHKernElement;
-        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
-        attribute SVGVKernElementConstructor SVGVKernElement;
-#endif
-
-#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
-        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
-        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
-        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
-        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
-        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
-        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
-        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
-        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
-        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
-        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
-        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
-        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
-        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
-        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
-        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
-        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
-        attribute SVGFEImageElementConstructor SVGFEImageElement;
-        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
-        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
-        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
-        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
-        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
-        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
-        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
-        attribute SVGFETileElementConstructor SVGFETileElement;
-        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
-        attribute SVGFilterElementConstructor SVGFilterElement;
-#endif
-#endif
-
         attribute DOMFormDataConstructor FormData;
 
         attribute [Conditional=BLOB|FILE_SYSTEM] FileErrorConstructor FileError;
@@ -794,7 +510,7 @@ module window {
 
 #if defined(V8_BINDING) && V8_BINDING
         // window.toString() requires special handling in V8
-        [V8DoNotCheckSignature, DoNotCheckDomainSecurity, Custom, NotEnumerable] DOMString toString();
+        [V8DoNotCheckSignature, DoNotCheckSecurity, Custom, NotEnumerable] DOMString toString();
 #endif // defined(V8_BINDING)
     };
 
diff --git a/Source/WebCore/page/DOMWindowProperty.cpp b/Source/WebCore/page/DOMWindowProperty.cpp
index b6a9aba43..82f9316f7 100644
--- a/Source/WebCore/page/DOMWindowProperty.cpp
+++ b/Source/WebCore/page/DOMWindowProperty.cpp
@@ -49,4 +49,9 @@ void DOMWindowProperty::disconnectFrame()
     m_frame = 0;
 }
 
+void DOMWindowProperty::willDetachPage()
+{
+    // Subclasses should override this function to handle this notification.
+}
+
 }
diff --git a/Source/WebCore/page/DOMWindowProperty.h b/Source/WebCore/page/DOMWindowProperty.h
index 41baf437e..cd2d83724 100644
--- a/Source/WebCore/page/DOMWindowProperty.h
+++ b/Source/WebCore/page/DOMWindowProperty.h
@@ -33,7 +33,9 @@ class Frame;
 class DOMWindowProperty {
 public:
     explicit DOMWindowProperty(Frame*);
+
     virtual void disconnectFrame();
+    virtual void willDetachPage();
 
     Frame* frame() const { return m_frame; }
 
diff --git a/Source/WebCore/page/DragClient.h b/Source/WebCore/page/DragClient.h
index 090c29d62..1d9b25bdb 100644
--- a/Source/WebCore/page/DragClient.h
+++ b/Source/WebCore/page/DragClient.h
@@ -61,7 +61,7 @@ namespace WebCore {
 #if PLATFORM(MAC)
         // Mac-specific helper function to allow access to web archives and NSPasteboard extras in WebKit.
         // This is not abstract as that would require another #if PLATFORM(MAC) for the SVGImage client empty implentation.
-        virtual void declareAndWriteDragImage(NSPasteboard *, DOMElement*, NSURL *, NSString *, Frame*) { }
+        virtual void declareAndWriteDragImage(const String&, DOMElement*, NSURL *, NSString *, Frame*) { }
 #endif
         
         virtual void dragEnded() { }
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 7919d761e..4891aad0b 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -449,10 +449,10 @@ bool DragController::concludeEditDrag(DragData* dragData)
         RefPtr<Range> innerRange = innerFrame->selection()->toNormalizedRange();
         RefPtr<StylePropertySet> style = StylePropertySet::create();
         style->setProperty(CSSPropertyColor, color.serialized(), false);
-        if (!innerFrame->editor()->shouldApplyStyle(style->ensureCSSStyleDeclaration(), innerRange.get()))
+        if (!innerFrame->editor()->shouldApplyStyle(style.get(), innerRange.get()))
             return false;
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
-        innerFrame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetColor);
+        innerFrame->editor()->applyStyle(style.get(), EditActionSetColor);
         return true;
     }
 
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index 4d33e9f3d..2bb4f5129 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -45,7 +45,6 @@ OBJC_CLASS NSURL;
 namespace WebCore {
 
 class ArchiveResource;
-class CSSStyleDeclaration;
 class DocumentFragment;
 class Editor;
 class Element;
@@ -55,6 +54,7 @@ class KeyboardEvent;
 class Node;
 class Range;
 class SpellChecker;
+class StylePropertySet;
 class TextCheckerClient;
 class VisibleSelection;
 class VisiblePosition;
@@ -82,7 +82,7 @@ public:
     virtual bool shouldInsertText(const String&, Range*, EditorInsertAction) = 0;
     virtual bool shouldChangeSelectedRange(Range* fromRange, Range* toRange, EAffinity, bool stillSelecting) = 0;
     
-    virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*) = 0;
+    virtual bool shouldApplyStyle(StylePropertySet*, Range*) = 0;
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*) = 0;
 
     virtual void didBeginEditing() = 0;
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 9acfc54d2..4f0ddeee3 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -531,6 +531,8 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
 
     cancelFakeMouseMoveEvent();
 
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
+
     if (ScrollView* scrollView = m_frame->view()) {
         if (scrollView->isPointInScrollbarCorner(event.event().position()))
             return false;
@@ -697,7 +699,7 @@ bool EventHandler::eventMayStartDrag(const PlatformMouseEvent& event) const
     HitTestResult result(view->windowToContents(event.position()));
     m_frame->contentRenderer()->layer()->hitTest(request, result);
     DragState state;
-    return result.innerNode() && page->dragController()->draggableNode(m_frame, result.innerNode(), result.point(), state);
+    return result.innerNode() && page->dragController()->draggableNode(m_frame, result.innerNode(), roundedIntPoint(result.point()), state);
 }
 
 void EventHandler::updateSelectionForMouseDrag()
@@ -1031,7 +1033,7 @@ HitTestResult EventHandler::hitTestResultAtPoint(const LayoutPoint& point, bool
         result = widgetHitTestResult;
 
         if (testScrollbars == ShouldHitTestScrollbars) {
-            Scrollbar* eventScrollbar = view->scrollbarAtPoint(point);
+            Scrollbar* eventScrollbar = view->scrollbarAtPoint(roundedIntPoint(point));
             if (eventScrollbar)
                 result.setScrollbar(eventScrollbar);
         }
@@ -1046,7 +1048,7 @@ HitTestResult EventHandler::hitTestResultAtPoint(const LayoutPoint& point, bool
             FrameView* resultView = resultFrame->view();
             FrameView* mainView = mainFrame->view();
             if (resultView && mainView) {
-                LayoutPoint mainFramePoint = mainView->rootViewToContents(resultView->contentsToRootView(result.point()));
+                IntPoint mainFramePoint = mainView->rootViewToContents(resultView->contentsToRootView(roundedIntPoint(result.point())));
                 result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent, ignoreClipping, testScrollbars, hitType, padding);
             }
         }
@@ -1265,7 +1267,7 @@ OptionalCursor EventHandler::selectCursor(const MouseEventWithHitTestResults& ev
 
     if (renderer) {
         Cursor overrideCursor;
-        switch (renderer->getCursor(event.localPoint(), overrideCursor)) {
+        switch (renderer->getCursor(roundedIntPoint(event.localPoint()), overrideCursor)) {
         case SetCursorBasedOnStyle:
             break;
         case SetCursor:
@@ -2363,14 +2365,8 @@ bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
     }
     case PlatformEvent::GestureDoubleTap:
     case PlatformEvent::GestureScrollBegin:
-    case PlatformEvent::GestureScrollEnd: {
-        FrameView* view = m_frame->view();
-        if (!view)
-            return false;
-
-        view->handleGestureEvent(gestureEvent);
-        return true;
-    }
+    case PlatformEvent::GestureScrollEnd:
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
diff --git a/Source/WebCore/page/EventSource.cpp b/Source/WebCore/page/EventSource.cpp
index ea06600b1..543f1e1ac 100644
--- a/Source/WebCore/page/EventSource.cpp
+++ b/Source/WebCore/page/EventSource.cpp
@@ -98,6 +98,7 @@ PassRefPtr<EventSource> EventSource::create(ScriptExecutionContext* context, con
 
     source->setPendingActivity(source.get());
     source->connect();
+    source->suspendIfNeeded();
 
     return source.release();
 }
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index 51426a308..aa98c0249 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -54,6 +54,7 @@
 #include "ScrollAnimator.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SpatialNavigation.h"
 #include "Widget.h"
 #include "htmlediting.h" // For firstPositionInOrBeforeNode
@@ -154,7 +155,7 @@ void FocusController::setFocused(bool focused)
 
 static inline ShadowRoot* shadowRoot(Node* node)
 {
-    return node->isElementNode() ? toElement(node)->shadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
 }
 
 static inline bool isTreeScopeOwner(Node* node)
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 72ddd62cb..ee3c068c8 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -229,6 +229,15 @@ Frame::~Frame()
     }
 }
 
+bool Frame::inScope(TreeScope* scope) const
+{
+    ASSERT(scope);
+    HTMLFrameOwnerElement* owner = document()->ownerElement();
+    // Scoping test should be done only for child frames.
+    ASSERT(owner);
+    return owner->treeScope() == scope;
+}
+
 void Frame::addDestructionObserver(FrameDestructionObserver* observer)
 {
     m_destructionObservers.add(observer);
@@ -293,8 +302,10 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
     if (m_doc)
         m_doc->updateViewportArguments();
 
-    if (m_page && m_page->mainFrame() == this)
+    if (m_page && m_page->mainFrame() == this) {
         notifyChromeClientWheelEventHandlerCountChanged();
+        notifyChromeClientTouchEventHandlerCountChanged();
+    }
 }
 
 #if ENABLE(ORIENTATION_EVENTS)
@@ -481,7 +492,7 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
     // See 7538330 for one popular site that benefits from the id element check.
     // FIXME: This code is mirrored in FrameMac.mm. It would be nice to make the Mac code call the platform-agnostic
     // code, which would require converting the NSArray of NSStrings to a Vector of Strings somewhere along the way.
-    String resultFromNameAttribute = matchLabelsAgainstString(labels, element->getAttribute(nameAttr));
+    String resultFromNameAttribute = matchLabelsAgainstString(labels, element->getNameAttribute());
     if (!resultFromNameAttribute.isEmpty())
         return resultFromNameAttribute;
     
@@ -658,21 +669,19 @@ DOMWindow* Frame::domWindow() const
     return m_domWindow.get();
 }
 
-void Frame::pageDestroyed()
+void Frame::willDetachPage()
 {
-    // FIXME: Rename this function, since it's called not only from Page destructor, but in several other cases.
-    // This cleanup is needed whenever we remove a frame from page.
-
     if (Frame* parent = tree()->parent())
         parent->loader()->checkLoadComplete();
 
-    if (m_domWindow) {
-        m_domWindow->resetGeolocation();
 #if ENABLE(NOTIFICATIONS)
+    if (m_domWindow)
         m_domWindow->resetNotifications();
 #endif
-        m_domWindow->pageDestroyed();
-    }
+
+    HashSet<FrameDestructionObserver*>::iterator stop = m_destructionObservers.end();
+    for (HashSet<FrameDestructionObserver*>::iterator it = m_destructionObservers.begin(); it != stop; ++it)
+        (*it)->willDetachPage();
 
     // FIXME: It's unclear as to why this is called more than once, but it is,
     // so page() could be NULL.
@@ -681,8 +690,6 @@ void Frame::pageDestroyed()
 
     script()->clearScriptObjects();
     script()->updatePlatformScriptObjects();
-
-    detachFromPage();
 }
 
 void Frame::disconnectOwnerElement()
@@ -716,17 +723,16 @@ void Frame::transferChildFrameToNewDocument()
              m_page->decrementFrameCount();
         }
 
-        // FIXME: We should ideally allow existing Geolocation activities to continue
-        // when the Geolocation's iframe is reparented.
-        // See https://bugs.webkit.org/show_bug.cgi?id=55577
-        // and https://bugs.webkit.org/show_bug.cgi?id=52877
         if (m_domWindow) {
-            m_domWindow->resetGeolocation();
 #if ENABLE(NOTIFICATIONS)
             m_domWindow->resetNotifications();
 #endif
         }
 
+        HashSet<FrameDestructionObserver*>::iterator stop = m_destructionObservers.end();
+        for (HashSet<FrameDestructionObserver*>::iterator it = m_destructionObservers.begin(); it != stop; ++it)
+            (*it)->willDetachPage();
+
         m_page = newPage;
 
         if (newPage)
@@ -1020,16 +1026,30 @@ void Frame::notifyChromeClientWheelEventHandlerCountChanged() const
 {
     // Ensure that this method is being called on the main frame of the page.
     ASSERT(m_page && m_page->mainFrame() == this);
-    
+
     unsigned count = 0;
     for (const Frame* frame = this; frame; frame = frame->tree()->traverseNext()) {
         if (frame->document())
             count += frame->document()->wheelEventHandlerCount();
     }
-    
+
     m_page->chrome()->client()->numWheelEventHandlersChanged(count);
 }
 
+void Frame::notifyChromeClientTouchEventHandlerCountChanged() const
+{
+    // Ensure that this method is being called on the main frame of the page.
+    ASSERT(m_page && m_page->mainFrame() == this);
+
+    unsigned count = 0;
+    for (const Frame* frame = this; frame; frame = frame->tree()->traverseNext()) {
+        if (frame->document())
+            count += frame->document()->touchEventHandlerCount();
+    }
+
+    m_page->chrome()->client()->numTouchEventHandlersChanged(count);
+}
+
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
 struct ScopedFramePaintingState {
     ScopedFramePaintingState(Frame* theFrame, RenderObject* theRenderer)
@@ -1072,7 +1092,7 @@ DragImageRef Frame::nodeImage(Node* node)
     m_view->setNodeToDraw(node); // Enable special sub-tree drawing mode.
 
     LayoutRect topLevelRect;
-    IntRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size()));
     if (!buffer)
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index 18da5f36a..e06c0dfc7 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -74,6 +74,8 @@ namespace WebCore {
     class TiledBackingStoreClient { };
 #endif
 
+    class TreeScope;
+
     class Frame : public RefCounted<Frame>, public TiledBackingStoreClient {
     public:
         static PassRefPtr<Frame> create(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -89,8 +91,8 @@ namespace WebCore {
         void addDestructionObserver(FrameDestructionObserver*);
         void removeDestructionObserver(FrameDestructionObserver*);
 
+        void willDetachPage();
         void detachFromPage();
-        void pageDestroyed();
         void disconnectOwnerElement();
 
         Page* page() const;
@@ -123,6 +125,7 @@ namespace WebCore {
         void setIsDisconnected(bool);
         bool excludeFromTextSearch() const;
         void setExcludeFromTextSearch(bool);
+        bool inScope(TreeScope*) const;
 
         void injectUserScripts(UserScriptInjectionTime);
         
@@ -195,6 +198,7 @@ namespace WebCore {
 
         // Should only be called on the main frame of a page.
         void notifyChromeClientWheelEventHandlerCountChanged() const;
+        void notifyChromeClientTouchEventHandlerCountChanged() const;
 
     // ========
 
diff --git a/Source/WebCore/page/FrameDestructionObserver.cpp b/Source/WebCore/page/FrameDestructionObserver.cpp
index 358bf948e..94bf33687 100644
--- a/Source/WebCore/page/FrameDestructionObserver.cpp
+++ b/Source/WebCore/page/FrameDestructionObserver.cpp
@@ -58,4 +58,9 @@ void FrameDestructionObserver::frameDestroyed()
     m_frame = 0;
 }
 
+void FrameDestructionObserver::willDetachPage()
+{
+    // Subclasses should override this function to handle this notification.
+}
+
 }
diff --git a/Source/WebCore/page/FrameDestructionObserver.h b/Source/WebCore/page/FrameDestructionObserver.h
index 7110922ad..8989e4a9f 100644
--- a/Source/WebCore/page/FrameDestructionObserver.h
+++ b/Source/WebCore/page/FrameDestructionObserver.h
@@ -33,7 +33,10 @@ class Frame;
 class FrameDestructionObserver {
 public:
     explicit FrameDestructionObserver(Frame*);
+
     virtual void frameDestroyed();
+    virtual void willDetachPage();
+
     Frame* frame() const { return m_frame; }
 
 protected:
diff --git a/Source/WebCore/page/FrameTree.cpp b/Source/WebCore/page/FrameTree.cpp
index fa4982c9b..ced620072 100644
--- a/Source/WebCore/page/FrameTree.cpp
+++ b/Source/WebCore/page/FrameTree.cpp
@@ -103,7 +103,7 @@ void FrameTree::actuallyAppendChild(PassRefPtr<Frame> child)
     } else
         m_firstChild = child;
 
-    m_childCount++;
+    m_scopedChildCount = invalidCount;
 
     ASSERT(!m_lastChild->tree()->m_nextSibling);
 }
@@ -125,7 +125,7 @@ void FrameTree::removeChild(Frame* child)
     child->tree()->m_previousSibling = 0;
     child->tree()->m_nextSibling = 0;
 
-    m_childCount--;
+    m_scopedChildCount = invalidCount;
 }
 
 AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const
@@ -177,6 +177,64 @@ AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const
     return AtomicString(name);
 }
 
+inline Frame* FrameTree::scopedChild(unsigned index, TreeScope* scope) const
+{
+    unsigned scopedIndex = 0;
+    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
+        if (result->inScope(scope)) {
+            if (scopedIndex == index)
+                return result;
+            scopedIndex++;
+        }
+    }
+
+    return 0;
+}
+
+inline Frame* FrameTree::scopedChild(const AtomicString& name, TreeScope* scope) const
+{
+    for (Frame* child = firstChild(); child; child = child->tree()->nextSibling())
+        if (child->tree()->uniqueName() == name && child->inScope(scope))
+            return child;
+    return 0;
+}
+
+inline unsigned FrameTree::scopedChildCount(TreeScope* scope) const
+{
+    unsigned scopedCount = 0;
+    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
+        if (result->inScope(scope))
+            scopedCount++;
+    }
+
+    return scopedCount;
+}
+
+Frame* FrameTree::scopedChild(unsigned index) const
+{
+    return scopedChild(index, m_thisFrame->document());
+}
+
+Frame* FrameTree::scopedChild(const AtomicString& name) const
+{
+    return scopedChild(name, m_thisFrame->document());
+}
+
+unsigned FrameTree::scopedChildCount() const
+{
+    if (m_scopedChildCount == invalidCount)
+        m_scopedChildCount = scopedChildCount(m_thisFrame->document());
+    return m_scopedChildCount;
+}
+
+unsigned FrameTree::childCount() const
+{
+    unsigned count = 0;
+    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling())
+        ++count;
+    return count;
+}
+
 Frame* FrameTree::child(unsigned index) const
 {
     Frame* result = firstChild();
diff --git a/Source/WebCore/page/FrameTree.h b/Source/WebCore/page/FrameTree.h
index d8291f7b6..5f9e317a9 100644
--- a/Source/WebCore/page/FrameTree.h
+++ b/Source/WebCore/page/FrameTree.h
@@ -20,23 +20,28 @@
 #ifndef FrameTree_h
 #define FrameTree_h
 
+#include <wtf/NotFound.h>
 #include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
     class Frame;
+    class TreeScope;
 
     class FrameTree {
         WTF_MAKE_NONCOPYABLE(FrameTree);
     public:
+        const static unsigned invalidCount = static_cast<unsigned>(WTF::notFound);
+
         FrameTree(Frame* thisFrame, Frame* parentFrame) 
             : m_thisFrame(thisFrame)
             , m_parent(parentFrame)
             , m_previousSibling(0)
             , m_lastChild(0)
-            , m_childCount(0)
+            , m_scopedChildCount(invalidCount)
         {
         }
+
         ~FrameTree();
 
         const AtomicString& name() const { return m_name; }
@@ -50,7 +55,6 @@ namespace WebCore {
         Frame* previousSibling() const { return m_previousSibling; }
         Frame* firstChild() const { return m_firstChild.get(); }
         Frame* lastChild() const { return m_lastChild; }
-        unsigned childCount() const { return m_childCount; }
 
         bool isDescendantOf(const Frame* ancestor) const;
         Frame* traverseNext(const Frame* stayWithin = 0) const;
@@ -65,15 +69,25 @@ namespace WebCore {
         Frame* child(unsigned index) const;
         Frame* child(const AtomicString& name) const;
         Frame* find(const AtomicString& name) const;
+        unsigned childCount() const;
 
         AtomicString uniqueChildName(const AtomicString& requestedName) const;
 
         Frame* top(bool checkForDisconnectedFrame = false) const;
 
+        Frame* scopedChild(unsigned index) const;
+        Frame* scopedChild(const AtomicString& name) const;
+        unsigned scopedChildCount() const;
+
     private:
         Frame* deepLastChild() const;
         void actuallyAppendChild(PassRefPtr<Frame>);
 
+        bool scopedBy(TreeScope*) const;
+        Frame* scopedChild(unsigned index, TreeScope*) const;
+        Frame* scopedChild(const AtomicString& name, TreeScope*) const;
+        unsigned scopedChildCount(TreeScope*) const;
+
         Frame* m_thisFrame;
 
         Frame* m_parent;
@@ -85,7 +99,7 @@ namespace WebCore {
         Frame* m_previousSibling;
         RefPtr<Frame> m_firstChild;
         Frame* m_lastChild;
-        unsigned m_childCount;
+        mutable unsigned m_scopedChildCount;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index baba068e4..024c484f0 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -61,6 +61,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "ScrollAnimator.h"
+#include "ScrollingCoordinator.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
 
@@ -70,9 +71,6 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
-#if PLATFORM(CHROMIUM)
-#include "TraceEvent.h"
-#endif
 #endif
 
 #if ENABLE(SVG)
@@ -85,10 +83,6 @@
 #include "TiledBackingStore.h"
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -296,8 +290,6 @@ void FrameView::init()
             setCanHaveScrollbars(false);
         LayoutUnit marginWidth = frameElt->marginWidth();
         LayoutUnit marginHeight = frameElt->marginHeight();
-        // FIXME: Change to roughlyEquals or >= 0 when we move to floats. 
-        // See https://bugs.webkit.org/show_bug.cgi?id=66148
         if (marginWidth != -1)
             setMarginWidth(marginWidth);
         if (marginHeight != -1)
@@ -327,6 +319,13 @@ void FrameView::recalculateScrollbarOverlayStyle()
     ScrollbarOverlayStyle overlayStyle = ScrollbarOverlayStyleDefault;
 
     Color backgroundColor = documentBackgroundColor();
+#if USE(ACCELERATED_COMPOSITING)
+    if (RenderView* root = rootRenderer(this)) {
+        RenderLayerCompositor* compositor = root->compositor();
+        compositor->documentBackgroundColorDidChange();
+    }
+#endif
+
     if (backgroundColor.isValid()) {
         // Reduce the background color from RGB to a lightness value
         // and determine which scrollbar style to use based on a lightness
@@ -1222,26 +1221,6 @@ void FrameView::removeWidgetToUpdate(RenderEmbeddedObject* object)
     m_widgetUpdateSet->remove(object);
 }
 
-void FrameView::zoomAnimatorTransformChanged(float scale, float x, float y, ZoomAnimationState state)
-{
-    if (state == ZoomAnimationFinishing) {
-        if (Page* page = m_frame->page())
-            page->setPageScaleFactor(page->pageScaleFactor() * scale, IntPoint(scale * scrollX() - x, scale * scrollY() - y));
-        scrollAnimator()->resetZoom();
-    }
-
-#if USE(ACCELERATED_COMPOSITING)
-    if (RenderView* root = rootRenderer(this)) {
-        if (root->usesCompositing()) {
-            root->compositor()->scheduleLayerFlush();
-#if PLATFORM(CHROMIUM)
-            TRACE_EVENT("FrameView::zoomAnimatorTransformChanged", this, 0);
-#endif
-        }
-    }
-#endif
-}
-
 void FrameView::setMediaType(const String& mediaType)
 {
     m_mediaType = mediaType;
@@ -1328,32 +1307,58 @@ void FrameView::setCannotBlitToWindow()
 
 void FrameView::addSlowRepaintObject()
 {
-    if (!m_slowRepaintObjectCount)
+    if (!m_slowRepaintObjectCount++) {
         updateCanBlitOnScrollRecursively();
-    m_slowRepaintObjectCount++;
+
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasSlowRepaintObjectsDidChange(this);
+        }
+    }
 }
 
 void FrameView::removeSlowRepaintObject()
 {
     ASSERT(m_slowRepaintObjectCount > 0);
     m_slowRepaintObjectCount--;
-    if (!m_slowRepaintObjectCount)
+    if (!m_slowRepaintObjectCount) {
         updateCanBlitOnScrollRecursively();
+
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasSlowRepaintObjectsDidChange(this);
+        }
+    }
 }
 
 void FrameView::addFixedObject()
 {
-    if (!m_fixedObjectCount && platformWidget())
-        updateCanBlitOnScrollRecursively();
-    ++m_fixedObjectCount;
+    if (!m_fixedObjectCount++) {
+        if (platformWidget())
+            updateCanBlitOnScrollRecursively();
+
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasFixedObjectsDidChange(this);
+        }
+    }
 }
 
 void FrameView::removeFixedObject()
 {
     ASSERT(m_fixedObjectCount > 0);
     --m_fixedObjectCount;
-    if (!m_fixedObjectCount)
+
+    if (!m_fixedObjectCount) {
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasFixedObjectsDidChange(this);
+        }
+
+        // FIXME: In addFixedObject() we only call this if there's a platform widget,
+        // why isn't the same check being made here?
         updateCanBlitOnScrollRecursively();
+    }
 }
 
 int FrameView::scrollXForFixedPosition() const
@@ -1463,6 +1468,10 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
         RenderBox* renderBox = *it;
         if (renderBox->style()->position() != FixedPosition)
             continue;
+#if USE(ACCELERATED_COMPOSITING)
+        if (renderBox->layer()->isComposited())
+            continue;
+#endif
         IntRect updateRect = renderBox->layer()->repaintRectIncludingDescendants();
         updateRect = contentsToRootView(updateRect);
         if (!isCompositedContentLayer && clipsRepaints())
@@ -1740,6 +1749,20 @@ bool FrameView::shouldRubberBandInDirection(ScrollDirection direction) const
     return page->chrome()->client()->shouldRubberBandInDirection(direction);
 }
 
+bool FrameView::requestScrollPositionUpdate(const IntPoint& position)
+{
+#if ENABLE(THREADED_SCROLLING)
+    if (Page* page = m_frame->page()) {
+        if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+            return scrollingCoordinator->requestScrollPositionUpdate(this, position);
+    }
+#else
+    UNUSED_PARAM(position);
+#endif
+
+    return false;
+}
+
 HostWindow* FrameView::hostWindow() const
 {
     Page* page = frame() ? frame()->page() : 0;
@@ -1770,7 +1793,7 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
         if (m_repaintCount == cRepaintRectUnionThreshold) {
             IntRect unionedRect;
             for (unsigned i = 0; i < cRepaintRectUnionThreshold; ++i)
-                unionedRect.unite(m_repaintRects[i]);
+                unionedRect.unite(pixelSnappedIntRect(m_repaintRects[i]));
             m_repaintRects.clear();
             m_repaintRects.append(unionedRect);
         }
@@ -1885,11 +1908,11 @@ void FrameView::doDeferredRepaints()
     for (unsigned i = 0; i < size; i++) {
 #if USE(TILED_BACKING_STORE)
         if (frame()->tiledBackingStore()) {
-            frame()->tiledBackingStore()->invalidate(m_repaintRects[i]);
+            frame()->tiledBackingStore()->invalidate(pixelSnappedIntRect(m_repaintRects[i]));
             continue;
         }
 #endif
-        ScrollView::repaintContentRectangle(m_repaintRects[i], false);
+        ScrollView::repaintContentRectangle(pixelSnappedIntRect(m_repaintRects[i]), false);
     }
     m_repaintRects.clear();
     m_repaintCount = 0;
@@ -2080,8 +2103,11 @@ void FrameView::unscheduleRelayout()
 #if ENABLE(REQUEST_ANIMATION_FRAME)
 void FrameView::serviceScriptedAnimations(DOMTimeStamp time)
 {
-    Vector<RefPtr<Document> > documents;
+    Vector<AnimationController*> animations;
+    for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
+        frame->animation()->serviceAnimations();
 
+    Vector<RefPtr<Document> > documents;
     for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
         documents.append(frame->document());
 
@@ -2290,12 +2316,10 @@ void FrameView::performPostLayoutTasks()
             break;
     }
 
-#if ENABLE(THREADED_SCROLLING)
     if (Page* page = m_frame->page()) {
         if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
             scrollingCoordinator->frameViewLayoutUpdated(this);
     }
-#endif
 
     scrollToAnchor();
 
@@ -2464,9 +2488,9 @@ IntRect FrameView::windowClipRectForLayer(const RenderLayer* layer, bool clipToL
     // Apply the clip from the layer.
     IntRect clipRect;
     if (clipToLayerContents)
-        clipRect = layer->childrenClipRect();
+        clipRect = pixelSnappedIntRect(layer->childrenClipRect());
     else
-        clipRect = layer->selfClipRect();
+        clipRect = pixelSnappedIntRect(layer->selfClipRect());
     clipRect = contentsToWindow(clipRect); 
     return intersection(clipRect, windowClipRect());
 }
@@ -2817,7 +2841,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (!frame())
         return;
 
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_frame.get(), rect);
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_frame.get(), p, rect);
 
     Document* document = m_frame->document();
 
@@ -3293,6 +3317,30 @@ void FrameView::removeChild(Widget* widget)
     ScrollView::removeChild(widget);
 }
 
+bool FrameView::wheelEvent(const PlatformWheelEvent& wheelEvent)
+{
+    // We don't allow mouse wheeling to happen in a ScrollView that has had its scrollbars explicitly disabled.
+    if (!canHaveScrollbars())
+        return false;
+
+#if !PLATFORM(WX)
+    if (platformWidget())
+        return false;
+#endif
+
+#if ENABLE(THREADED_SCROLLING)
+    if (Page* page = m_frame->page()) {
+        if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator()) {
+            if (scrollingCoordinator->coordinatesScrollingForFrameView(this))
+                return scrollingCoordinator->handleWheelEvent(this, wheelEvent);
+        }
+    }
+#endif
+
+    return ScrollableArea::handleWheelEvent(wheelEvent);
+}
+
+
 bool FrameView::isVerticalDocument() const
 {
     RenderView* root = rootRenderer(this);
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 51fe7c370..cfd35a36c 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -169,8 +169,7 @@ public:
     void scrollPositionChangedViaPlatformWidget();
     virtual void repaintFixedElementsAfterScrolling();
     virtual bool shouldRubberBandInDirection(ScrollDirection) const;
-
-    virtual void zoomAnimatorTransformChanged(float, float, float, ZoomAnimationState);
+    virtual bool requestScrollPositionUpdate(const IntPoint&) OVERRIDE;
 
     String mediaType() const;
     void setMediaType(const String&);
@@ -184,9 +183,11 @@ public:
 
     void addSlowRepaintObject();
     void removeSlowRepaintObject();
+    bool hasSlowRepaintObjects() const { return m_slowRepaintObjectCount; }
 
     void addFixedObject();
     void removeFixedObject();
+    bool hasFixedObjects() const { return m_fixedObjectCount > 0; }
 
     // Functions for querying the current scrolled position, negating the effects of overhang
     // and adjusting for page scale.
@@ -315,6 +316,11 @@ public:
     virtual void addChild(PassRefPtr<Widget>) OVERRIDE;
     virtual void removeChild(Widget*) OVERRIDE;
 
+    // This function exists for ports that need to handle wheel events manually.
+    // On Mac WebKit1 the underlying NSScrollView just does the scrolling, but on most other platforms
+    // we need this function in order to do the scroll ourselves.
+    bool wheelEvent(const PlatformWheelEvent&);
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
@@ -336,8 +342,6 @@ private:
     void updateCanBlitOnScrollRecursively();
     bool contentsInCompositedLayer() const;
 
-    bool hasFixedObjects() const { return m_fixedObjectCount > 0; }
-
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
 
     void updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow);
diff --git a/Source/WebCore/page/GestureTapHighlighter.cpp b/Source/WebCore/page/GestureTapHighlighter.cpp
index 2038b0af6..4ed7c55c2 100644
--- a/Source/WebCore/page/GestureTapHighlighter.cpp
+++ b/Source/WebCore/page/GestureTapHighlighter.cpp
@@ -55,7 +55,7 @@ inline LayoutPoint ownerFrameToMainFrameOffset(const RenderObject* o)
 
     Frame* mainFrame = containingFrame->page()->mainFrame();
 
-    LayoutPoint mainFramePoint = mainFrame->view()->rootViewToContents(containingFrame->view()->contentsToRootView(LayoutPoint()));
+    LayoutPoint mainFramePoint = mainFrame->view()->rootViewToContents(containingFrame->view()->contentsToRootView(IntPoint()));
     return mainFramePoint;
 }
 
@@ -95,8 +95,8 @@ inline bool strikes(const LayoutRect& a, const LayoutRect& b)
 
 inline void shiftXEdgesToContainIfStrikes(LayoutRect& rect, const LayoutRect& other)
 {
-    int leftSide = rect.x();
-    int rightSide = rect.maxX();
+    LayoutUnit leftSide = rect.x();
+    LayoutUnit rightSide = rect.maxX();
 
     if (!other.isEmpty() && strikes(rect, other)) {
         leftSide = std::min(leftSide, other.x());
@@ -146,7 +146,7 @@ Path pathForRenderer(RenderObject* o)
 
     // Merge all center boxes (all but the first and the last).
     LayoutRect mid;
-    for (int i = 1; i < rects.size() - 1; ++i)
+    for (size_t i = 1; i < rects.size() - 1; ++i)
         mid.uniteIfNonZero(rects.at(i));
 
     Vector<LayoutRect> drawableRects;
@@ -177,9 +177,9 @@ Path pathForRenderer(RenderObject* o)
         shiftXEdgesToContainIfStrikes(middle, drawableRects.at(2));
     }
 
-    for (int i = 0; i < drawableRects.size(); ++i) {
-        LayoutRect prev = (i - 1) >= 0 ? drawableRects.at(i - 1) : LayoutRect();
-        LayoutRect next = (i + 1) < drawableRects.size() ? drawableRects.at(i + 1) : LayoutRect();
+    for (size_t i = 0; i < drawableRects.size(); ++i) {
+        LayoutRect prev = i ? drawableRects.at(i - 1) : LayoutRect();
+        LayoutRect next = i < (drawableRects.size() - 1) ? drawableRects.at(i + 1) : LayoutRect();
         addHighlightRect(path, drawableRects.at(i), prev, next);
     }
 
diff --git a/Source/WebCore/page/History.cpp b/Source/WebCore/page/History.cpp
index a1f9a05f6..f38a8c92b 100644
--- a/Source/WebCore/page/History.cpp
+++ b/Source/WebCore/page/History.cpp
@@ -77,6 +77,11 @@ bool History::stateChanged() const
     return m_lastStateObjectRequested != stateInternal();
 }
 
+bool History::isSameAsCurrentState(SerializedScriptValue* state) const
+{
+    return state == stateInternal();
+}
+
 void History::back()
 {
     go(-1);
diff --git a/Source/WebCore/page/History.h b/Source/WebCore/page/History.h
index bd6f6aa21..889c37410 100644
--- a/Source/WebCore/page/History.h
+++ b/Source/WebCore/page/History.h
@@ -45,7 +45,6 @@ public:
 
     unsigned length() const;
     SerializedScriptValue* state();
-    bool stateChanged() const;
     void back();
     void forward();
     void go(int distance);
@@ -54,6 +53,9 @@ public:
     void forward(ScriptExecutionContext*);
     void go(ScriptExecutionContext*, int distance);
 
+    bool stateChanged() const;
+    bool isSameAsCurrentState(SerializedScriptValue*) const;
+
     enum StateObjectType {
         StateObjectPush,
         StateObjectReplace
diff --git a/Source/WebCore/page/History.idl b/Source/WebCore/page/History.idl
index f7036403a..6e8f6ab06 100644
--- a/Source/WebCore/page/History.idl
+++ b/Source/WebCore/page/History.idl
@@ -27,21 +27,21 @@ module window {
 
     interface [
 #if defined(V8_BINDING) && V8_BINDING
-        CheckDomainSecurity,
+        CheckSecurity,
 #endif
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomNamedSetter,
         JSGenerateIsReachable=ImplFrame,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         OmitConstructor
     ] History {
         readonly attribute unsigned long length;
         readonly attribute [CachedAttribute, Custom] SerializedScriptValue state;
 
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void back();
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void forward();
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void go(in [Optional=CallWithDefaultValue] long distance);
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void back();
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void forward();
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void go(in [Optional=DefaultIsUndefined] long distance);
         
         [Custom, V8EnabledAtRuntime] void pushState(in any data, in DOMString title, in [Optional] DOMString url)
             raises(DOMException);
diff --git a/Source/WebCore/page/Location.idl b/Source/WebCore/page/Location.idl
index d5d27e2c6..4f196fc0d 100644
--- a/Source/WebCore/page/Location.idl
+++ b/Source/WebCore/page/Location.idl
@@ -30,25 +30,26 @@ module window {
 
     interface [
 #if defined(V8_BINDING) && V8_BINDING
-        CheckDomainSecurity,
+        CheckSecurity,
 #endif
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomNamedSetter,
         JSGenerateIsReachable=ImplFrame,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         JSCustomDefineOwnProperty,
-        JSCustomPrototypePutDelegate,
-        JSCustomPrototypeDefineOwnProperty,
-        OmitConstructor
+        JSCustomNamedGetterOnPrototype,
+        JSCustomDefineOwnPropertyOnPrototype,
+        OmitConstructor,
+        V8CustomToJSObject
     ] Location {
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-                 attribute [DoNotCheckDomainSecurityOnSetter, CustomSetter, V8Unforgeable] DOMString href;
+                 attribute [DoNotCheckSecurityOnSetter, CustomSetter, V8Unforgeable] DOMString href;
 #endif
 
-        [Custom, V8OnInstance] void assign(in [Optional=CallWithDefaultValue] DOMString url);
-        [Custom, V8OnInstance] void replace(in [Optional=CallWithDefaultValue] DOMString url);
-        [Custom, V8OnInstance] void reload();
+        [Custom, V8Unforgeable] void assign(in [Optional=DefaultIsUndefined] DOMString url);
+        [Custom, V8Unforgeable] void replace(in [Optional=DefaultIsUndefined] DOMString url);
+        [Custom, V8Unforgeable] void reload();
 
         // URI decomposition attributes
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
@@ -64,10 +65,10 @@ module window {
 #endif
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [NotEnumerable, Custom, V8OnInstance, V8ReadOnly, ImplementedAs=toStringFunction] DOMString toString();
+        [NotEnumerable, Custom, V8Unforgeable, V8ReadOnly, ImplementedAs=toStringFunction] DOMString toString();
 #endif
 #if defined(V8_BINDING) && V8_BINDING
-        [NotEnumerable, Custom, V8OnInstance, V8ReadOnly] DOMObject valueOf();
+        [NotEnumerable, Custom, V8Unforgeable, V8ReadOnly] DOMObject valueOf();
 #endif
     };
 
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index b394cd8d1..76328a7a5 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -23,39 +23,23 @@
 #include "config.h"
 #include "Navigator.h"
 
-#include "Chrome.h"
 #include "CookieJar.h"
 #include "DOMMimeTypeArray.h"
 #include "DOMPluginArray.h"
 #include "Document.h"
-#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "Geolocation.h"
+#include "Page.h"
 #include "PointerLock.h"
-#include "KURL.h"
 #include "Language.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "PlatformString.h"
 #include "PluginData.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
 
-#if ENABLE(GAMEPAD)
-#include "GamepadList.h"
-#include "Gamepads.h"
-#endif
-
-#if ENABLE(MEDIA_STREAM)
-#include "NavigatorUserMediaErrorCallback.h"
-#include "NavigatorUserMediaSuccessCallback.h"
-#include "UserMediaRequest.h"
-#endif
-
 namespace WebCore {
 
 Navigator::Navigator(Frame* frame)
@@ -67,10 +51,15 @@ Navigator::~Navigator()
 {
 }
 
-void Navigator::resetGeolocation()
+void Navigator::provideSupplement(const AtomicString& name, PassOwnPtr<NavigatorSupplement> supplement)
 {
-    if (m_geolocation)
-        m_geolocation->reset();
+    ASSERT(!m_suppliments.get(name.impl()));
+    m_suppliments.set(name.impl(), supplement);
+}
+
+NavigatorSupplement* Navigator::requireSupplement(const AtomicString& name)
+{
+    return m_suppliments.get(name.impl());
 }
 
 // If this function returns true, we need to hide the substring "4." that would otherwise
@@ -151,13 +140,6 @@ bool Navigator::javaEnabled() const
     return m_frame->settings()->isJavaEnabled();
 }
 
-Geolocation* Navigator::geolocation() const
-{
-    if (!m_geolocation)
-        m_geolocation = Geolocation::create(m_frame);
-    return m_geolocation.get();
-}
-
 #if ENABLE(POINTER_LOCK)
 PointerLock* Navigator::webkitPointer() const
 {
@@ -172,133 +154,4 @@ void Navigator::getStorageUpdates()
     // FIXME: Remove this method or rename to yieldForStorageUpdates.
 }
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
-static HashSet<String>* protocolWhitelist;
-
-static void initProtocolHandlerWhitelist()
-{
-    protocolWhitelist = new HashSet<String>;
-    static const char* protocols[] = {
-        "irc",
-        "mailto",
-        "mms",
-        "news",
-        "nntp",
-        "sms",
-        "smsto",
-        "tel",
-        "urn",
-        "webcal",
-    };
-    for (size_t i = 0; i < WTF_ARRAY_LENGTH(protocols); ++i)
-        protocolWhitelist->add(protocols[i]);
-}
-
-static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
-{
-    // The specification requires that it is a SYNTAX_ERR if the "%s" token is
-    // not present.
-    static const char token[] = "%s";
-    int index = url.find(token);
-    if (-1 == index) {
-        ec = SYNTAX_ERR;
-        return false;
-    }
-
-    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
-    // the "%s" token and prepending the base url, does not resolve.
-    String newURL = url;
-    newURL.remove(index, WTF_ARRAY_LENGTH(token) - 1);
-
-    KURL base(ParsedURLString, baseURL);
-    KURL kurl(base, newURL);
-
-    if (kurl.isEmpty() || !kurl.isValid()) {
-        ec = SYNTAX_ERR;
-        return false;
-    }
-
-    return true;
-}
-
-static bool isProtocolWhitelisted(const String& scheme)
-{
-    if (!protocolWhitelist)
-        initProtocolHandlerWhitelist();
-    return protocolWhitelist->contains(scheme);
-}
-
-static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
-{
-    if (scheme.startsWith("web+")) {
-        if (isValidProtocol(scheme))
-            return true;
-        ec = SECURITY_ERR;
-        return false;
-    }
-
-    if (isProtocolWhitelisted(scheme))
-        return true;
-    ec = SECURITY_ERR;
-    return false;
-}
-
-void Navigator::registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec)
-{
-    if (!m_frame)
-        return;
-
-    Document* document = m_frame->document();
-    if (!document)
-        return;
-
-    String baseURL = document->baseURL().baseAsString();
-
-    if (!verifyCustomHandlerURL(baseURL, url, ec))
-        return;
-
-    if (!verifyProtocolHandlerScheme(scheme, ec))
-        return;
-
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-
-    page->chrome()->registerProtocolHandler(scheme, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
-}
-#endif
-
-#if ENABLE(MEDIA_STREAM)
-void Navigator::webkitGetUserMedia(const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
-{
-    if (!successCallback)
-        return;
-
-    if (!m_frame)
-        return;
-
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-
-    RefPtr<UserMediaRequest> request = UserMediaRequest::create(m_frame->document(), page->userMediaClient(), options, successCallback, errorCallback);
-    if (!request) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
-
-    request->start();
-}
-#endif
-
-#if ENABLE(GAMEPAD)
-GamepadList* Navigator::gamepads()
-{
-    if (!m_gamepads)
-        m_gamepads = GamepadList::create();
-    sampleGamepads(m_gamepads.get());
-    return m_gamepads.get();
-}
-#endif
-
 } // namespace WebCore
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index 07c9d2b4b..750eeaa57 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -22,7 +22,9 @@
 
 #include "DOMWindowProperty.h"
 #include "NavigatorBase.h"
+#include "NavigatorSupplement.h"
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -32,11 +34,7 @@ namespace WebCore {
 class DOMMimeTypeArray;
 class DOMPluginArray;
 class Frame;
-class GamepadList;
-class Geolocation;
 class PointerLock;
-class NavigatorUserMediaErrorCallback;
-class NavigatorUserMediaSuccessCallback;
 class PluginData;
 
 typedef int ExceptionCode;
@@ -46,8 +44,6 @@ public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
     virtual ~Navigator();
 
-    void resetGeolocation();
-
     String appVersion() const;
     String language() const;
     DOMPluginArray* plugins() const;
@@ -57,8 +53,6 @@ public:
 
     virtual String userAgent() const;
 
-    Geolocation* geolocation() const;
-
 #if ENABLE(POINTER_LOCK)
     PointerLock* webkitPointer() const;
 #endif
@@ -66,29 +60,17 @@ public:
     // Relinquishes the storage lock, if one exists.
     void getStorageUpdates();
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
-    void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode&);
-#endif
-
-#if ENABLE(MEDIA_STREAM)
-    virtual void webkitGetUserMedia(const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
-#endif
-
-#if ENABLE(GAMEPAD)
-    // FIXME: This method should be in WebCore/Modules/gamepad.
-    GamepadList* gamepads();
-#endif
+    void provideSupplement(const AtomicString&, PassOwnPtr<NavigatorSupplement>);
+    NavigatorSupplement* requireSupplement(const AtomicString&);
 
 private:
     explicit Navigator(Frame*);
 
+    typedef HashMap<AtomicStringImpl*, OwnPtr<NavigatorSupplement> > NavigatorSupplementMap;
+    NavigatorSupplementMap m_suppliments;
+
     mutable RefPtr<DOMPluginArray> m_plugins;
     mutable RefPtr<DOMMimeTypeArray> m_mimeTypes;
-    mutable RefPtr<Geolocation> m_geolocation;
-#if ENABLE(GAMEPAD)
-    // FIXME: This state should be in WebCore/Modules/gamepad.
-    mutable RefPtr<GamepadList> m_gamepads;
-#endif
 #if ENABLE(POINTER_LOCK)
     mutable RefPtr<PointerLock> m_pointer;
 #endif
diff --git a/Source/WebCore/page/Navigator.idl b/Source/WebCore/page/Navigator.idl
index 213fab125..400d8e010 100644
--- a/Source/WebCore/page/Navigator.idl
+++ b/Source/WebCore/page/Navigator.idl
@@ -40,27 +40,11 @@ module window {
 
         readonly attribute boolean onLine;
 
-#if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
-        readonly attribute [V8EnabledAtRuntime] Geolocation geolocation;
-#endif
-
 #if defined(ENABLE_POINTER_LOCK) && ENABLE_POINTER_LOCK
         readonly attribute [V8EnabledAtRuntime] PointerLock webkitPointer;
 #endif
 
         void getStorageUpdates(); // FIXME: Remove this method or rename to yieldForStorageUpdates.
-
-#if defined(ENABLE_REGISTER_PROTOCOL_HANDLER) && ENABLE_REGISTER_PROTOCOL_HANDLER
-        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
-            raises(DomException);
-#endif
-
-#if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        [Custom, V8EnabledAtRuntime] void webkitGetUserMedia(in DOMString options,
-                                                           in [Callback=FunctionOnly] NavigatorUserMediaSuccessCallback successCallback,
-                                                           in [Callback=FunctionOnly, Optional] NavigatorUserMediaErrorCallback errorCallback)
-            raises(DOMException);
-#endif
     };
 
 }
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
new file mode 100644
index 000000000..a773b57dd
--- /dev/null
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorRegisterProtocolHandler.h"
+
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+
+#include "Chrome.h"
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "Page.h"
+#include <wtf/HashSet.h>
+
+namespace WebCore {
+
+static HashSet<String>* protocolWhitelist;
+
+static void initProtocolHandlerWhitelist()
+{
+    protocolWhitelist = new HashSet<String>;
+    static const char* protocols[] = {
+        "irc",
+        "mailto",
+        "mms",
+        "news",
+        "nntp",
+        "sms",
+        "smsto",
+        "tel",
+        "urn",
+        "webcal",
+    };
+    for (size_t i = 0; i < WTF_ARRAY_LENGTH(protocols); ++i)
+        protocolWhitelist->add(protocols[i]);
+}
+
+static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
+{
+    // The specification requires that it is a SYNTAX_ERR if the "%s" token is
+    // not present.
+    static const char token[] = "%s";
+    int index = url.find(token);
+    if (-1 == index) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
+    // the "%s" token and prepending the base url, does not resolve.
+    String newURL = url;
+    newURL.remove(index, WTF_ARRAY_LENGTH(token) - 1);
+
+    KURL base(ParsedURLString, baseURL);
+    KURL kurl(base, newURL);
+
+    if (kurl.isEmpty() || !kurl.isValid()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+static bool isProtocolWhitelisted(const String& scheme)
+{
+    if (!protocolWhitelist)
+        initProtocolHandlerWhitelist();
+    return protocolWhitelist->contains(scheme);
+}
+
+static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
+{
+    if (scheme.startsWith("web+")) {
+        if (isValidProtocol(scheme))
+            return true;
+        ec = SECURITY_ERR;
+        return false;
+    }
+
+    if (isProtocolWhitelisted(scheme))
+        return true;
+    ec = SECURITY_ERR;
+    return false;
+}
+
+NavigatorRegisterProtocolHandler::NavigatorRegisterProtocolHandler()
+{
+}
+
+NavigatorRegisterProtocolHandler::~NavigatorRegisterProtocolHandler()
+{
+}
+
+void NavigatorRegisterProtocolHandler::registerProtocolHandler(Navigator* navigator, const String& scheme, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!navigator->frame())
+        return;
+
+    Document* document = navigator->frame()->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (!verifyProtocolHandlerScheme(scheme, ec))
+        return;
+
+    Page* page = navigator->frame()->page();
+    if (!page)
+        return;
+
+    page->chrome()->registerProtocolHandler(scheme, baseURL, url, navigator->frame()->displayStringModifiedByEncoding(title));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_INTENTS)
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.h b/Source/WebCore/page/NavigatorRegisterProtocolHandler.h
new file mode 100644
index 000000000..15e25ec01
--- /dev/null
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef NavigatorRegisterProtocolHandler_h
+#define NavigatorRegisterProtocolHandler_h
+
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Navigator;
+
+typedef int ExceptionCode;
+
+class NavigatorRegisterProtocolHandler {
+public:
+    static void registerProtocolHandler(Navigator*, const String& scheme, const String& url, const String& title, ExceptionCode&);
+
+private:
+    NavigatorRegisterProtocolHandler();
+    ~NavigatorRegisterProtocolHandler();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
+
+#endif // NavigatorRegisterProtocolHandler_h
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.idl b/Source/WebCore/page/NavigatorRegisterProtocolHandler.idl
new file mode 100644
index 000000000..174d06343
--- /dev/null
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.idl
@@ -0,0 +1,30 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+module window {
+
+    interface [
+        Conditional=REGISTER_PROTOCOL_HANDLER,
+        Supplemental=Navigator
+    ] NavigatorRegisterProtocolHandler {
+        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
+            raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/page/NavigatorSupplement.cpp b/Source/WebCore/page/NavigatorSupplement.cpp
new file mode 100644
index 000000000..bb424d4d6
--- /dev/null
+++ b/Source/WebCore/page/NavigatorSupplement.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorSupplement.h"
+
+#include "Navigator.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+NavigatorSupplement::~NavigatorSupplement()
+{
+}
+
+void NavigatorSupplement::provideTo(Navigator* navigator, const AtomicString& key, PassOwnPtr<NavigatorSupplement> supplement)
+{
+    navigator->provideSupplement(key, supplement);
+}
+
+NavigatorSupplement* NavigatorSupplement::from(Navigator* navigator, const AtomicString& name)
+{
+    if (!navigator)
+        return 0;
+    return navigator->requireSupplement(name);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/page/NavigatorSupplement.h b/Source/WebCore/page/NavigatorSupplement.h
new file mode 100644
index 000000000..fc958fd96
--- /dev/null
+++ b/Source/WebCore/page/NavigatorSupplement.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NavigatorSupplement_h
+#define NavigatorSupplement_h
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class Navigator;
+
+class NavigatorSupplement {
+public:
+    virtual ~NavigatorSupplement();
+
+    static void provideTo(Navigator*, const AtomicString&, PassOwnPtr<NavigatorSupplement>);
+    static NavigatorSupplement* from(Navigator*, const AtomicString&);
+};
+
+} // namespace WebCore
+
+#endif // NavigatorSupplement_h
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index 492e949ee..1bad0a47b 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -29,8 +29,6 @@
 #include "ContextMenuClient.h"
 #include "ContextMenuController.h"
 #include "DOMWindow.h"
-#include "DeviceMotionController.h"
-#include "DeviceOrientationController.h"
 #include "DocumentMarkerController.h"
 #include "DragController.h"
 #include "EditorClient.h"
@@ -53,8 +51,6 @@
 #include "MediaCanStartListener.h"
 #include "Navigator.h"
 #include "NetworkStateNotifier.h"
-#include "NotificationController.h"
-#include "NotificationPresenter.h"
 #include "PageGroup.h"
 #include "PluginData.h"
 #include "PluginView.h"
@@ -66,13 +62,13 @@
 #include "RenderWidget.h"
 #include "RuntimeEnabledFeatures.h"
 #include "SchemeRegistry.h"
+#include "ScrollingCoordinator.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
-#include "SpeechInput.h"
-#include "SpeechInputClient.h"
 #include "StorageArea.h"
 #include "StorageNamespace.h"
 #include "TextResourceDecoder.h"
+#include "VoidCallback.h"
 #include "Widget.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -83,14 +79,6 @@
 #include "GeolocationController.h"
 #endif
 
-#if ENABLE(MEDIA_STREAM)
-#include "UserMediaClient.h"
-#endif
-
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 namespace WebCore {
 
 static HashSet<Page*>* allPages;
@@ -140,22 +128,9 @@ Page::Page(PageClients& pageClients)
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     , m_geolocationController(GeolocationController::create(this, pageClients.geolocationClient))
 #endif
-#if ENABLE(DEVICE_ORIENTATION)
-    , m_deviceMotionController(RuntimeEnabledFeatures::deviceMotionEnabled() ? DeviceMotionController::create(pageClients.deviceMotionClient) : nullptr)
-    , m_deviceOrientationController(RuntimeEnabledFeatures::deviceOrientationEnabled() ? DeviceOrientationController::create(this, pageClients.deviceOrientationClient) : nullptr)
-#endif
-#if ENABLE(NOTIFICATIONS)
-    , m_notificationController(NotificationController::create(this, pageClients.notificationClient))
-#endif
 #if ENABLE(POINTER_LOCK)
     , m_pointerLockController(PointerLockController::create(this))
 #endif
-#if ENABLE(INPUT_SPEECH)
-    , m_speechInputClient(pageClients.speechInputClient)
-#endif
-#if ENABLE(MEDIA_STREAM)
-    , m_userMediaClient(pageClients.userMediaClient)
-#endif
     , m_settings(Settings::create(this))
     , m_progress(ProgressTracker::create())
     , m_backForwardController(BackForwardController::create(this, pageClients.backForwardClient))
@@ -208,8 +183,10 @@ Page::~Page()
     setGroupName(String());
     allPages->remove(this);
     
-    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
-        frame->pageDestroyed();
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        frame->willDetachPage();
+        frame->detachFromPage();
+    }
 
     m_editorClient->pageDestroyed();
 
@@ -217,21 +194,15 @@ Page::~Page()
     m_inspectorController->inspectedPageDestroyed();
 #endif
 
-#if ENABLE(MEDIA_STREAM)
-    if (m_userMediaClient)
-        m_userMediaClient->pageDestroyed();
-#endif
-
-#if ENABLE(THREADED_SCROLLING)
     if (m_scrollingCoordinator)
         m_scrollingCoordinator->pageDestroyed();
-#endif
 
     backForward()->close();
 
 #ifndef NDEBUG
     pageCounter.decrement();
 #endif
+
 }
 
 ViewportArguments Page::viewportArguments() const
@@ -239,7 +210,6 @@ ViewportArguments Page::viewportArguments() const
     return mainFrame() && mainFrame()->document() ? mainFrame()->document()->viewportArguments() : ViewportArguments();
 }
 
-#if ENABLE(THREADED_SCROLLING)
 ScrollingCoordinator* Page::scrollingCoordinator()
 {
     if (!m_scrollingCoordinator && m_settings->scrollingCoordinatorEnabled())
@@ -247,7 +217,6 @@ ScrollingCoordinator* Page::scrollingCoordinator()
 
     return m_scrollingCoordinator.get();
 }
-#endif
 
 struct ViewModeInfo {
     const char* name;
@@ -974,16 +943,6 @@ double Page::minimumTimerInterval() const
     return m_minimumTimerInterval;
 }
 
-#if ENABLE(INPUT_SPEECH)
-SpeechInput* Page::speechInput()
-{
-    ASSERT(m_speechInputClient);
-    if (!m_speechInput.get())
-        m_speechInput = SpeechInput::create(m_speechInputClient);
-    return m_speechInput.get();
-}
-#endif
-
 void Page::dnsPrefetchingStateChanged()
 {
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
@@ -1076,7 +1035,7 @@ void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objec
 
     // The objects are only relevant if they are being painted within the viewRect().
     if (RenderView* view = object->view()) {
-        if (!objectPaintRect.intersects(view->viewRect()))
+        if (!objectPaintRect.intersects(pixelSnappedIntRect(view->viewRect())))
             return;
     }
 
@@ -1090,6 +1049,17 @@ void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objec
     }
 }
 
+void Page::provideSupplement(const AtomicString& name, PassOwnPtr<PageSupplement> supplement)
+{
+    ASSERT(!m_supplements.get(name.impl()));
+    m_supplements.set(name.impl(), supplement);
+}
+
+PageSupplement* Page::requireSupplement(const AtomicString& name)
+{
+    return m_supplements.get(name.impl());
+}
+
 Page::PageClients::PageClients()
     : chromeClient(0)
     , contextMenuClient(0)
@@ -1097,11 +1067,6 @@ Page::PageClients::PageClients()
     , dragClient(0)
     , inspectorClient(0)
     , geolocationClient(0)
-    , deviceMotionClient(0)
-    , deviceOrientationClient(0)
-    , speechInputClient(0)
-    , notificationClient(0)
-    , userMediaClient(0)
 {
 }
 
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index 5f6e20649..685eed7e7 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -24,11 +24,13 @@
 #include "FrameLoaderTypes.h"
 #include "FindOptions.h"
 #include "LayoutTypes.h"
+#include "PageSupplement.h"
 #include "PageVisibilityState.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
 #include "ViewportArguments.h"
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 
@@ -52,10 +54,6 @@ namespace WebCore {
     class ChromeClient;
     class ContextMenuClient;
     class ContextMenuController;
-    class DeviceMotionClient;
-    class DeviceMotionController;
-    class DeviceOrientationClient;
-    class DeviceOrientationController;
     class Document;
     class DragCaretController;
     class DragClient;
@@ -72,8 +70,6 @@ namespace WebCore {
     class InspectorController;
     class MediaCanStartListener;
     class Node;
-    class NotificationController;
-    class NotificationPresenter;
     class PageGroup;
     class PluginData;
     class PointerLockController;
@@ -85,13 +81,7 @@ namespace WebCore {
     class ScrollableArea;
     class ScrollingCoordinator;
     class Settings;
-    class SpeechInput;
-    class SpeechInputClient;
-    class UserMediaClient;
     class StorageNamespace;
-#if ENABLE(NOTIFICATIONS)
-    class NotificationPresenter;
-#endif
 
     typedef uint64_t LinkHash;
 
@@ -118,12 +108,7 @@ namespace WebCore {
             DragClient* dragClient;
             InspectorClient* inspectorClient;
             GeolocationClient* geolocationClient;
-            DeviceMotionClient* deviceMotionClient;
-            DeviceOrientationClient* deviceOrientationClient;
             RefPtr<BackForwardList> backForwardClient;
-            SpeechInputClient* speechInputClient;
-            NotificationPresenter* notificationClient;
-            UserMediaClient* userMediaClient;
         };
 
         Page(PageClients&);
@@ -184,25 +169,11 @@ namespace WebCore {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         GeolocationController* geolocationController() const { return m_geolocationController.get(); }
 #endif
-#if ENABLE(DEVICE_ORIENTATION)
-        DeviceMotionController* deviceMotionController() const { return m_deviceMotionController.get(); }
-        DeviceOrientationController* deviceOrientationController() const { return m_deviceOrientationController.get(); }
-#endif
-#if ENABLE(NOTIFICATIONS)
-        NotificationController* notificationController() const { return m_notificationController.get(); }
-#endif
 #if ENABLE(POINTER_LOCK)
         PointerLockController* pointerLockController() const { return m_pointerLockController.get(); }
 #endif
-#if ENABLE(INPUT_SPEECH)
-        SpeechInput* speechInput();
-#endif
-#if ENABLE(MEDIA_STREAM)
-        UserMediaClient* userMediaClient() const { return m_userMediaClient; }
-#endif
-#if ENABLE(THREADED_SCROLLING)
+
         ScrollingCoordinator* scrollingCoordinator();
-#endif
 
         Settings* settings() const { return m_settings.get(); }
         ProgressTracker* progress() const { return m_progress.get(); }
@@ -352,10 +323,16 @@ namespace WebCore {
         void setRelevantRepaintedObjectsCounterThreshold(uint64_t);
         void startCountingRelevantRepaintedObjects();
         void addRelevantRepaintedObject(RenderObject*, const IntRect& objectPaintRect);
-        
+
+        void provideSupplement(const AtomicString&, PassOwnPtr<PageSupplement>);
+        PageSupplement* requireSupplement(const AtomicString&);
+
     private:
         void initGroup();
 
+        typedef HashMap<AtomicStringImpl*, OwnPtr<PageSupplement> > PageSupplementMap;
+        PageSupplementMap m_supplements;
+
 #if ASSERT_DISABLED
         void checkFrameCountConsistency() const { }
 #else
@@ -383,26 +360,11 @@ namespace WebCore {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         OwnPtr<GeolocationController> m_geolocationController;
 #endif
-#if ENABLE(DEVICE_ORIENTATION)
-        OwnPtr<DeviceMotionController> m_deviceMotionController;
-        OwnPtr<DeviceOrientationController> m_deviceOrientationController;
-#endif
-#if ENABLE(NOTIFICATIONS)
-        OwnPtr<NotificationController> m_notificationController;
-#endif
 #if ENABLE(POINTER_LOCK)
         OwnPtr<PointerLockController> m_pointerLockController;
 #endif
-#if ENABLE(INPUT_SPEECH)
-        SpeechInputClient* m_speechInputClient;
-        OwnPtr<SpeechInput> m_speechInput;
-#endif
-#if ENABLE(MEDIA_STREAM)
-        UserMediaClient* m_userMediaClient;
-#endif
-#if ENABLE(THREADED_SCROLLING)
         RefPtr<ScrollingCoordinator> m_scrollingCoordinator;
-#endif
+
         OwnPtr<Settings> m_settings;
         OwnPtr<ProgressTracker> m_progress;
         
@@ -451,10 +413,6 @@ namespace WebCore {
 
         RefPtr<StorageNamespace> m_sessionStorage;
 
-#if ENABLE(NOTIFICATIONS)
-        NotificationPresenter* m_notificationPresenter;
-#endif
-
         ViewMode m_viewMode;
 
         double m_minimumTimerInterval;
diff --git a/Source/WebCore/page/PageSupplement.cpp b/Source/WebCore/page/PageSupplement.cpp
new file mode 100644
index 000000000..fb8c1e77e
--- /dev/null
+++ b/Source/WebCore/page/PageSupplement.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageSupplement.h"
+
+#include "Frame.h"
+#include "Page.h"
+
+namespace WebCore {
+
+PageSupplement::~PageSupplement()
+{
+}
+
+void PageSupplement::provideTo(Page* page, const AtomicString& key, PassOwnPtr<PageSupplement> supplement)
+{
+    page->provideSupplement(key, supplement);
+}
+
+PageSupplement* PageSupplement::from(Page* page, const AtomicString& name)
+{
+    if (!page)
+        return 0;
+    return page->requireSupplement(name);
+}
+
+PageSupplement* PageSupplement::from(Frame* frame, const AtomicString& name)
+{
+    if (!frame || !frame->page())
+        return 0;
+    return frame->page()->requireSupplement(name);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/page/PageSupplement.h b/Source/WebCore/page/PageSupplement.h
new file mode 100644
index 000000000..e1b48aa90
--- /dev/null
+++ b/Source/WebCore/page/PageSupplement.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageSupplement_h
+#define PageSupplement_h
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class Page;
+class Frame;
+
+class PageSupplement {
+public:
+    virtual ~PageSupplement();
+
+    static void provideTo(Page*, const AtomicString&, PassOwnPtr<PageSupplement>);
+    static PageSupplement* from(Page*, const AtomicString&);
+    static PageSupplement* from(Frame*, const AtomicString&);
+};
+
+} // namespace WebCore
+
+#endif // PageSupplement_h
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index b5cb963bb..ec50f88c8 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -173,6 +173,7 @@ Settings::Settings(Page* page)
     , m_acceleratedDrawingEnabled(false)
     , m_acceleratedFiltersEnabled(false)
     , m_isCSSCustomFilterEnabled(false)
+    , m_cssRegionsEnabled(false)
     // FIXME: This should really be disabled by default as it makes platforms that don't support the feature download files
     // they can't use by. Leaving enabled for now to not change existing behavior.
     , m_downloadableBinaryFontsEnabled(true)
@@ -227,7 +228,7 @@ Settings::Settings(Page* page)
     , m_mediaPlaybackRequiresUserGesture(false)
     , m_mediaPlaybackAllowsInline(true)
     , m_passwordEchoEnabled(false)
-    , m_suppressIncrementalRendering(false)
+    , m_suppressesIncrementalRendering(false)
     , m_backspaceKeyNavigationEnabled(true)
     , m_visualWordMovementEnabled(false)
 #if ENABLE(VIDEO_TRACK)
@@ -237,13 +238,13 @@ Settings::Settings(Page* page)
 #endif
     , m_perTileDrawingEnabled(false)
     , m_partialSwapEnabled(false)
-#if ENABLE(THREADED_SCROLLING)
     , m_scrollingCoordinatorEnabled(false)
-#endif
     , m_notificationsEnabled(true)
+    , m_needsIsLoadingInAPISenseQuirk(false)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchEventEmulationEnabled(false)
 #endif
+    , m_threadedAnimationEnabled(false)
     , m_loadsImagesAutomaticallyTimer(this, &Settings::loadsImagesAutomaticallyTimerFired)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 3a1406601..d3906f1e5 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -313,6 +313,9 @@ namespace WebCore {
         void setCSSCustomFilterEnabled(bool enabled) { m_isCSSCustomFilterEnabled = enabled; }
         bool isCSSCustomFilterEnabled() const { return m_isCSSCustomFilterEnabled; }
 
+        void setCSSRegionsEnabled(bool enabled) { m_cssRegionsEnabled = enabled; }
+        bool cssRegionsEnabled() const { return m_cssRegionsEnabled; }
+
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
@@ -480,8 +483,8 @@ namespace WebCore {
         void setPasswordEchoEnabled(bool flag) { m_passwordEchoEnabled = flag; }
         bool passwordEchoEnabled() const { return m_passwordEchoEnabled; }
 
-        void setSuppressIncrementalRendering(bool flag) { m_suppressIncrementalRendering = flag; }
-        bool suppressIncrementalRendering() const { return m_suppressIncrementalRendering; }
+        void setSuppressesIncrementalRendering(bool flag) { m_suppressesIncrementalRendering = flag; }
+        bool suppressesIncrementalRendering() const { return m_suppressesIncrementalRendering; }
         
         void setBackspaceKeyNavigationEnabled(bool flag) { m_backspaceKeyNavigationEnabled = flag; }
         bool backspaceKeyNavigationEnabled() const { return m_backspaceKeyNavigationEnabled; }
@@ -518,19 +521,24 @@ namespace WebCore {
         void setPartialSwapEnabled(bool enabled) { m_partialSwapEnabled = enabled; }
         bool partialSwapEnabled() const { return m_partialSwapEnabled; }
 
-#if ENABLE(THREADED_SCROLLING)
         void setScrollingCoordinatorEnabled(bool enabled) { m_scrollingCoordinatorEnabled = enabled; }
         bool scrollingCoordinatorEnabled() const { return m_scrollingCoordinatorEnabled; }
-#endif
 
         void setNotificationsEnabled(bool enabled) { m_notificationsEnabled = enabled; }
         bool notificationsEnabled() const { return m_notificationsEnabled; }
 
+        // Some apps needs isLoadingInAPISense to account for active subresource loaders.
+        void setNeedsIsLoadingInAPISenseQuirk(bool enabled) { m_needsIsLoadingInAPISenseQuirk = enabled; }
+        bool needsIsLoadingInAPISenseQuirk() const { return m_needsIsLoadingInAPISenseQuirk; }
+
 #if ENABLE(TOUCH_EVENTS)
         void setTouchEventEmulationEnabled(bool enabled) { m_touchEventEmulationEnabled = enabled; }
         bool isTouchEventEmulationEnabled() const { return m_touchEventEmulationEnabled; }
 #endif
 
+        void setThreadedAnimationEnabled(bool enabled) { m_threadedAnimationEnabled = enabled; }
+        bool threadedAnimationEnabled() const { return m_threadedAnimationEnabled; }
+
     private:
         Settings(Page*);
 
@@ -612,6 +620,7 @@ namespace WebCore {
         bool m_acceleratedDrawingEnabled : 1;
         bool m_acceleratedFiltersEnabled : 1;
         bool m_isCSSCustomFilterEnabled : 1;
+        bool m_cssRegionsEnabled : 1;
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
@@ -660,7 +669,7 @@ namespace WebCore {
         bool m_mediaPlaybackRequiresUserGesture : 1;
         bool m_mediaPlaybackAllowsInline : 1;
         bool m_passwordEchoEnabled : 1;
-        bool m_suppressIncrementalRendering : 1;
+        bool m_suppressesIncrementalRendering : 1;
         bool m_backspaceKeyNavigationEnabled : 1;
         bool m_visualWordMovementEnabled : 1;
 
@@ -672,15 +681,15 @@ namespace WebCore {
         bool m_perTileDrawingEnabled : 1;
         bool m_partialSwapEnabled : 1;
 
-#if ENABLE(THREADED_SCROLLING)
         bool m_scrollingCoordinatorEnabled : 1;
-#endif
 
         bool m_notificationsEnabled : 1;
+        bool m_needsIsLoadingInAPISenseQuirk : 1;
 
 #if ENABLE(TOUCH_EVENTS)
         bool m_touchEventEmulationEnabled : 1;
 #endif
+        bool m_threadedAnimationEnabled : 1;
 
         Timer<Settings> m_loadsImagesAutomaticallyTimer;
         void loadsImagesAutomaticallyTimerFired(Timer<Settings>*);
diff --git a/Source/WebCore/page/SpeechInput.cpp b/Source/WebCore/page/SpeechInput.cpp
index 6a8620a8f..4d7290c3f 100644
--- a/Source/WebCore/page/SpeechInput.cpp
+++ b/Source/WebCore/page/SpeechInput.cpp
@@ -117,6 +117,17 @@ void SpeechInput::cancelRecognition(int listenerId)
     m_client->cancelRecognition(listenerId);
 }
 
+const AtomicString& SpeechInput::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("SpeechInput"));
+    return name;
+}
+
+void provideSpeechInputTo(Page* page, SpeechInputClient* client)
+{
+    PageSupplement::provideTo(page, SpeechInput::supplementName(), SpeechInput::create(client));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INPUT_SPEECH)
diff --git a/Source/WebCore/page/SpeechInput.h b/Source/WebCore/page/SpeechInput.h
index 6fee65ceb..bab9e3643 100644
--- a/Source/WebCore/page/SpeechInput.h
+++ b/Source/WebCore/page/SpeechInput.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(INPUT_SPEECH)
 
+#include "PageSupplement.h"
 #include "SpeechInputListener.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -47,12 +48,16 @@ class SpeechInputListener;
 // This class connects the input elements requiring speech input with the platform specific
 // speech recognition engine. It provides methods for the input elements to activate speech
 // recognition and methods for the speech recognition engine to return back the results.
-class SpeechInput : public SpeechInputListener {
+class SpeechInput : public SpeechInputListener,
+                    public PageSupplement {
     WTF_MAKE_NONCOPYABLE(SpeechInput);
 public:
     virtual ~SpeechInput();
 
     static PassOwnPtr<SpeechInput> create(SpeechInputClient*);
+    static const AtomicString& supplementName();
+    static SpeechInput* from(Frame* frame) { return static_cast<SpeechInput*>(PageSupplement::from(frame, supplementName())); }
+    static SpeechInput* from(Page* page) { return static_cast<SpeechInput*>(PageSupplement::from(page, supplementName())); }
 
     // Generates a unique ID for the given listener to be used for speech requests.
     // This should be the first call made by listeners before anything else.
diff --git a/Source/WebCore/page/SpeechInputClient.h b/Source/WebCore/page/SpeechInputClient.h
index 4f8fd5e25..e26f979f8 100644
--- a/Source/WebCore/page/SpeechInputClient.h
+++ b/Source/WebCore/page/SpeechInputClient.h
@@ -40,6 +40,7 @@ namespace WebCore {
 class IntRect;
 class SecurityOrigin;
 class SpeechInputListener;
+class Page;
 
 // Provides an interface for SpeechInput to call into the embedder.
 class SpeechInputClient {
@@ -65,6 +66,8 @@ protected:
     virtual ~SpeechInputClient() { }
 };
 
+void provideSpeechInputTo(Page*, SpeechInputClient*);
+
 } // namespace WebCore
 
 #endif // ENABLE(INPUT_SPEECH)
diff --git a/Source/WebCore/page/SuspendableTimer.cpp b/Source/WebCore/page/SuspendableTimer.cpp
index 2a4d2e521..dd3e89f18 100644
--- a/Source/WebCore/page/SuspendableTimer.cpp
+++ b/Source/WebCore/page/SuspendableTimer.cpp
@@ -35,8 +35,8 @@ SuspendableTimer::SuspendableTimer(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_nextFireInterval(0)
     , m_repeatInterval(0)
-#if !ASSERT_DISABLED
     , m_active(false)
+#if !ASSERT_DISABLED
     , m_suspended(false)
 #endif
 {
diff --git a/Source/WebCore/page/animation/AnimationBase.cpp b/Source/WebCore/page/animation/AnimationBase.cpp
index 4fd0409ec..1e665ec56 100644
--- a/Source/WebCore/page/animation/AnimationBase.cpp
+++ b/Source/WebCore/page/animation/AnimationBase.cpp
@@ -451,6 +451,23 @@ public:
         dst->setTransform(blendFunc(anim, a->transform(), b->transform(), progress));
     }
 };
+
+#if ENABLE(CSS_FILTERS)
+class PropertyWrapperAcceleratedFilter : public PropertyWrapper<const FilterOperations&> {
+public:
+    PropertyWrapperAcceleratedFilter()
+        : PropertyWrapper<const FilterOperations&>(CSSPropertyWebkitFilter, &RenderStyle::filter, &RenderStyle::setFilter)
+    {
+    }
+    
+    virtual bool animationIsAccelerated() const { return true; }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        dst->setFilter(blendFunc(anim, a->filter(), b->filter(), progress));
+    }
+};
+#endif
 #endif // USE(ACCELERATED_COMPOSITING)
 
 static inline size_t shadowListLength(const ShadowData* shadow)
@@ -1025,14 +1042,16 @@ void AnimationBase::ensurePropertyMap()
 #if USE(ACCELERATED_COMPOSITING)
         gPropertyWrappers->append(new PropertyWrapperAcceleratedOpacity());
         gPropertyWrappers->append(new PropertyWrapperAcceleratedTransform());
+#if ENABLE(CSS_FILTERS)
+        gPropertyWrappers->append(new PropertyWrapperAcceleratedFilter());
+#endif
 #else
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyOpacity, &RenderStyle::opacity, &RenderStyle::setOpacity));
         gPropertyWrappers->append(new PropertyWrapper<const TransformOperations&>(CSSPropertyWebkitTransform, &RenderStyle::transform, &RenderStyle::setTransform));
-#endif
-
 #if ENABLE(CSS_FILTERS)
         gPropertyWrappers->append(new PropertyWrapper<const FilterOperations&>(CSSPropertyWebkitFilter, &RenderStyle::filter, &RenderStyle::setFilter));
 #endif
+#endif
 
         gPropertyWrappers->append(new PropertyWrapperVisitedAffectedColor(CSSPropertyWebkitColumnRuleColor, MaybeInvalidColor, &RenderStyle::columnRuleColor, &RenderStyle::setColumnRuleColor, &RenderStyle::visitedLinkColumnRuleColor, &RenderStyle::setVisitedLinkColumnRuleColor));
         gPropertyWrappers->append(new PropertyWrapperVisitedAffectedColor(CSSPropertyWebkitTextStrokeColor, MaybeInvalidColor, &RenderStyle::textStrokeColor, &RenderStyle::setTextStrokeColor, &RenderStyle::visitedLinkTextStrokeColor, &RenderStyle::setVisitedLinkTextStrokeColor));
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index 745d5146b..4930b54f4 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -35,6 +35,7 @@
 #include "CompositeAnimation.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameView.h"
 #include "RenderView.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitAnimationList.h"
@@ -44,7 +45,6 @@
 
 namespace WebCore {
 
-// FIXME: Why isn't this set to 60fps or something?
 static const double cAnimationTimerDelay = 0.025;
 static const double cBeginAnimationUpdateTimeNotSet = -1;
 
@@ -84,9 +84,9 @@ bool AnimationControllerPrivate::clear(RenderObject* renderer)
     return animation->suspended();
 }
 
-void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = false*/)
+double AnimationControllerPrivate::updateAnimations(SetChanged callSetChanged/* = DoNotCallSetChanged*/)
 {
-    double needsService = -1;
+    double timeToNextService = -1;
     bool calledSetChanged = false;
 
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
@@ -94,10 +94,10 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
         CompositeAnimation* compAnim = it->second.get();
         if (!compAnim->suspended() && compAnim->hasAnimations()) {
             double t = compAnim->timeToNextService();
-            if (t != -1 && (t < needsService || needsService == -1))
-                needsService = t;
-            if (needsService == 0) {
-                if (callSetChanged) {
+            if (t != -1 && (t < timeToNextService || timeToNextService == -1))
+                timeToNextService = t;
+            if (!timeToNextService) {
+                if (callSetChanged == CallSetChanged) {
                     Node* node = it->first->node();
                     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
                     node->setNeedsStyleRecalc(SyntheticStyleChange);
@@ -108,28 +108,48 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
             }
         }
     }
-    
+
     if (calledSetChanged)
         m_frame->document()->updateStyleIfNeeded();
-    
+
+    return timeToNextService;
+}
+
+void AnimationControllerPrivate::updateAnimationTimerForRenderer(RenderObject* renderer)
+{
+    double timeToNextService = 0;
+
+    RefPtr<CompositeAnimation> compAnim = m_compositeAnimations.get(renderer);
+    if (!compAnim->suspended() && compAnim->hasAnimations())
+        timeToNextService = compAnim->timeToNextService();
+
+    if (m_animationTimer.isActive())
+        m_animationTimer.stop();
+    m_animationTimer.startOneShot(timeToNextService);
+}
+
+void AnimationControllerPrivate::updateAnimationTimer(SetChanged callSetChanged/* = DoNotCallSetChanged*/)
+{
+    double timeToNextService = updateAnimations(callSetChanged);
+
     // If we want service immediately, we start a repeating timer to reduce the overhead of starting
-    if (needsService == 0) {
+    if (!timeToNextService) {
         if (!m_animationTimer.isActive() || m_animationTimer.repeatInterval() == 0)
             m_animationTimer.startRepeating(cAnimationTimerDelay);
         return;
     }
-    
+
     // If we don't need service, we want to make sure the timer is no longer running
-    if (needsService < 0) {
+    if (timeToNextService < 0) {
         if (m_animationTimer.isActive())
             m_animationTimer.stop();
         return;
     }
-    
+
     // Otherwise, we want to start a one-shot timer so we get here again
     if (m_animationTimer.isActive())
         m_animationTimer.stop();
-    m_animationTimer.startOneShot(needsService);
+    m_animationTimer.startOneShot(timeToNextService);
 }
 
 void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<AnimationControllerPrivate>*)
@@ -143,7 +163,7 @@ void AnimationControllerPrivate::fireEventsAndUpdateStyle()
     RefPtr<Frame> protector = m_frame;
 
     bool updateStyle = !m_eventsToDispatch.isEmpty() || !m_nodeChangesToDispatch.isEmpty();
-    
+
     // fire all the events
     Vector<EventToDispatch> eventsToDispatch = m_eventsToDispatch;
     m_eventsToDispatch.clear();
@@ -154,14 +174,14 @@ void AnimationControllerPrivate::fireEventsAndUpdateStyle()
         else
             it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
     }
-    
+
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
         (*it)->setNeedsStyleRecalc(SyntheticStyleChange);
-    
+
     m_nodeChangesToDispatch.clear();
-    
+
     if (updateStyle && m_frame)
         m_frame->document()->updateStyleIfNeeded();
 }
@@ -194,6 +214,16 @@ void AnimationControllerPrivate::addNodeChangeToDispatch(PassRefPtr<Node> node)
     startUpdateStyleIfNeededDispatcher();
 }
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+void AnimationControllerPrivate::animationFrameCallbackFired()
+{
+    double timeToNextService = updateAnimations(CallSetChanged);
+
+    if (timeToNextService >= 0)
+        m_frame->document()->view()->scheduleAnimation();
+}
+#endif
+
 void AnimationControllerPrivate::animationTimerFired(Timer<AnimationControllerPrivate>*)
 {
     // Make sure animationUpdateTime is updated, so that it is current even if no
@@ -202,7 +232,7 @@ void AnimationControllerPrivate::animationTimerFired(Timer<AnimationControllerPr
 
     // When the timer fires, all we do is call setChanged on all DOM nodes with running animations and then do an immediate
     // updateStyleIfNeeded.  It will then call back to us with new information.
-    updateAnimationTimer(true);
+    updateAnimationTimer(CallSetChanged);
 
     // Fire events right away, to avoid a flash of unanimated style after an animation completes, and before
     // the 'end' event fires.
@@ -499,8 +529,13 @@ PassRefPtr<RenderStyle> AnimationController::updateAnimations(RenderObject* rend
     RefPtr<CompositeAnimation> rendererAnimations = m_data->accessCompositeAnimation(renderer);
     RefPtr<RenderStyle> blendedStyle = rendererAnimations->animate(renderer, oldStyle, newStyle);
 
-    if (renderer->parent() || newStyle->animations() || (oldStyle && oldStyle->animations()))
-        m_data->updateAnimationTimer();
+    if (renderer->parent() || newStyle->animations() || (oldStyle && oldStyle->animations())) {
+        m_data->updateAnimationTimerForRenderer(renderer);
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+        if (FrameView* view = renderer->document()->view())
+            view->scheduleAnimation();
+#endif
+    }
 
     if (blendedStyle != newStyle) {
         // If the animations/transitions change opacity or transform, we need to update
@@ -557,6 +592,13 @@ void AnimationController::resumeAnimations()
     m_data->resumeAnimations();
 }
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+void AnimationController::serviceAnimations()
+{
+    m_data->animationFrameCallbackFired();
+}
+#endif
+
 void AnimationController::suspendAnimationsForDocument(Document* document)
 {
     m_data->suspendAnimationsForDocument(document);
diff --git a/Source/WebCore/page/animation/AnimationController.h b/Source/WebCore/page/animation/AnimationController.h
index ccdc6c4a4..18772dd59 100644
--- a/Source/WebCore/page/animation/AnimationController.h
+++ b/Source/WebCore/page/animation/AnimationController.h
@@ -66,6 +66,9 @@ public:
 
     void suspendAnimations();
     void resumeAnimations();
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void serviceAnimations();
+#endif
 
     void suspendAnimationsForDocument(Document*);
     void resumeAnimationsForDocument(Document*);
diff --git a/Source/WebCore/page/animation/AnimationControllerPrivate.h b/Source/WebCore/page/animation/AnimationControllerPrivate.h
index 41eebff16..8f3ee7f6c 100644
--- a/Source/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/Source/WebCore/page/animation/AnimationControllerPrivate.h
@@ -51,13 +51,20 @@ class RenderObject;
 class RenderStyle;
 class WebKitAnimationList;
 
+enum SetChanged {
+    DoNotCallSetChanged = 0,
+    CallSetChanged = 1
+};
+
 class AnimationControllerPrivate {
     WTF_MAKE_NONCOPYABLE(AnimationControllerPrivate); WTF_MAKE_FAST_ALLOCATED;
 public:
     AnimationControllerPrivate(Frame*);
     ~AnimationControllerPrivate();
 
-    void updateAnimationTimer(bool callSetChanged = false);
+    // Returns the time until the next animation needs to be serviced, or -1 if there are none.
+    double updateAnimations(SetChanged callSetChanged = DoNotCallSetChanged);
+    void updateAnimationTimer(SetChanged callSetChanged = DoNotCallSetChanged);
 
     PassRefPtr<CompositeAnimation> accessCompositeAnimation(RenderObject*);
     bool clear(RenderObject*);
@@ -71,6 +78,9 @@ public:
 
     void suspendAnimations();
     void resumeAnimations();
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void animationFrameCallbackFired();
+#endif
 
     void suspendAnimationsForDocument(Document*);
     void resumeAnimationsForDocument(Document*);
@@ -98,6 +108,8 @@ public:
     void animationWillBeRemoved(AnimationBase*);
 
     PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
+
+    void updateAnimationTimerForRenderer(RenderObject*);
     
 private:
     void animationTimerFired(Timer<AnimationControllerPrivate>*);
diff --git a/Source/WebCore/page/mac/EventHandlerMac.mm b/Source/WebCore/page/mac/EventHandlerMac.mm
index 2630dbb8a..55dd8169d 100644
--- a/Source/WebCore/page/mac/EventHandlerMac.mm
+++ b/Source/WebCore/page/mac/EventHandlerMac.mm
@@ -41,6 +41,7 @@
 #include "MouseEventWithHitTestResults.h"
 #include "NotImplemented.h"
 #include "Page.h"
+#include "Pasteboard.h"
 #include "PlatformEventFactoryMac.h"
 #include "RenderWidget.h"
 #include "RuntimeApplicationChecks.h"
@@ -668,11 +669,11 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
 
 PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
 {
-    NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:NSDragPboard];
     // Must be done before ondragstart adds types and data to the pboard,
     // also done for security, as it erases data from the last drag
-    [pasteboard declareTypes:[NSArray array] owner:nil];
-    return ClipboardMac::create(Clipboard::DragAndDrop, pasteboard, ClipboardWritable, m_frame);
+    Pasteboard pasteboard(NSDragPboard);
+    pasteboard.clear();
+    return ClipboardMac::create(Clipboard::DragAndDrop, String(NSDragPboard), ClipboardWritable, m_frame);
 }
 
 #endif
diff --git a/Source/WebCore/page/mac/FrameMac.mm b/Source/WebCore/page/mac/FrameMac.mm
index 1c835afac..7b45a395e 100644
--- a/Source/WebCore/page/mac/FrameMac.mm
+++ b/Source/WebCore/page/mac/FrameMac.mm
@@ -158,7 +158,7 @@ NSImage* Frame::snapshotDragImage(Node* node, NSRect* imageRect, NSRect* element
     m_doc->updateLayout();        // forces style recalc - needed since changing the drag state might
                                         // imply new styles, plus JS could have changed other things
     LayoutRect topLevelRect;
-    NSRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     m_view->setNodeToDraw(node);              // invoke special sub-tree drawing mode
     NSImage* result = imageFromRect(paintingRect);
@@ -167,7 +167,7 @@ NSImage* Frame::snapshotDragImage(Node* node, NSRect* imageRect, NSRect* element
     m_view->setNodeToDraw(0);
 
     if (elementRect)
-        *elementRect = topLevelRect;
+        *elementRect = pixelSnappedIntRect(topLevelRect);
     if (imageRect)
         *imageRect = paintingRect;
     return result;
@@ -182,7 +182,7 @@ DragImageRef Frame::nodeImage(Node* node)
     m_doc->updateLayout(); // forces style recalc
 
     LayoutRect topLevelRect;
-    NSRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     m_view->setNodeToDraw(node); // invoke special sub-tree drawing mode
     NSImage* result = imageFromRect(paintingRect);
diff --git a/Source/WebCore/page/qt/EventHandlerQt.cpp b/Source/WebCore/page/qt/EventHandlerQt.cpp
index 06db10455..8aebb9c9a 100644
--- a/Source/WebCore/page/qt/EventHandlerQt.cpp
+++ b/Source/WebCore/page/qt/EventHandlerQt.cpp
@@ -50,9 +50,11 @@
 #include "RenderWidget.h"
 #include "Scrollbar.h"
 
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
 QT_BEGIN_NAMESPACE
 Q_GUI_EXPORT extern bool qt_tab_all_widgets; // from qapplication.cpp
 QT_END_NAMESPACE
+#endif
 
 namespace WebCore {
 
@@ -64,7 +66,11 @@ const double EventHandler::TextDragDelay = 0.0;
 
 bool EventHandler::tabsToAllFormControls(KeyboardEvent* event) const
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    return !isKeyboardOptionTab(event);
+#else
     return (isKeyboardOptionTab(event) ? !qt_tab_all_widgets : qt_tab_all_widgets);
+#endif
 }
 
 void EventHandler::focusDocumentView()
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
index e569b2c25..5c14d995d 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
@@ -25,8 +25,6 @@
 
 #include "config.h"
 
-#if ENABLE(THREADED_SCROLLING)
-
 #include "ScrollingCoordinator.h"
 
 #include "Frame.h"
@@ -35,49 +33,54 @@
 #include "Page.h"
 #include "PlatformWheelEvent.h"
 #include "Region.h"
+#include "RenderView.h"
 #include "ScrollAnimator.h"
+#include "ScrollingTreeState.h"
+#include <wtf/MainThread.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerCompositor.h"
+#endif
+
+#if ENABLE(THREADED_SCROLLING)
 #include "ScrollingThread.h"
 #include "ScrollingTree.h"
-#include "ScrollingTreeState.h"
 #include <wtf/Functional.h>
-#include <wtf/MainThread.h>
 #include <wtf/PassRefPtr.h>
+#endif
 
 namespace WebCore {
 
-PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
-{
-    return adoptRef(new ScrollingCoordinator(page));
-}
-
 ScrollingCoordinator::ScrollingCoordinator(Page* page)
     : m_page(page)
-    , m_scrollingTree(ScrollingTree::create(this))
+#if ENABLE(THREADED_SCROLLING)
     , m_scrollingTreeState(ScrollingTreeState::create())
+    , m_scrollingTree(ScrollingTree::create(this))
     , m_scrollingTreeStateCommitterTimer(this, &ScrollingCoordinator::scrollingTreeStateCommitterTimerFired)
+#endif
 {
 }
 
-ScrollingCoordinator::~ScrollingCoordinator()
-{
-    ASSERT(!m_page);
-    ASSERT(!m_scrollingTree);
-}
-
 void ScrollingCoordinator::pageDestroyed()
 {
     ASSERT(m_page);
     m_page = 0;
 
+#if ENABLE(THREADED_SCROLLING)
+    m_scrollingTreeStateCommitterTimer.stop();
+
     // Invalidating the scrolling tree will break the reference cycle between the ScrollingCoordinator and ScrollingTree objects.
     ScrollingThread::dispatch(bind(&ScrollingTree::invalidate, m_scrollingTree.release()));
+#endif
 }
 
+#if ENABLE(THREADED_SCROLLING)
 ScrollingTree* ScrollingCoordinator::scrollingTree() const
 {
     ASSERT(m_scrollingTree);
     return m_scrollingTree.get();
 }
+#endif
 
 bool ScrollingCoordinator::coordinatesScrollingForFrameView(FrameView* frameView) const
 {
@@ -88,37 +91,66 @@ bool ScrollingCoordinator::coordinatesScrollingForFrameView(FrameView* frameView
     if (frameView->frame() != m_page->mainFrame())
         return false;
 
-    return true;
+    // We currently only support composited mode.
+#if USE(ACCELERATED_COMPOSITING)
+    RenderView* renderView = m_page->mainFrame()->contentRenderer();
+    if (!renderView)
+        return false;
+    return renderView->usesCompositing();
+#else
+    return false;
+#endif
 }
 
-void ScrollingCoordinator::frameViewLayoutUpdated(FrameView* frameView)
+static Region computeNonFastScrollableRegion(FrameView* frameView)
 {
-    ASSERT(isMainThread());
-    ASSERT(m_page);
+    Region nonFastScrollableRegion;
 
-    if (!coordinatesScrollingForFrameView(frameView))
-        return;
+    HashSet<FrameView*> childFrameViews;
+    for (HashSet<RefPtr<Widget> >::const_iterator it = frameView->children()->begin(), end = frameView->children()->end(); it != end; ++it) {
+        if ((*it)->isFrameView())
+            childFrameViews.add(static_cast<FrameView*>(it->get()));
+    }
 
-    // Compute the region of the page that we can't do fast scrolling for. This currently includes
-    // all scrollable areas, such as subframes, overflow divs and list boxes.
-    Region nonScrollableRegion;
     if (const FrameView::ScrollableAreaSet* scrollableAreas = frameView->scrollableAreas()) {
         for (FrameView::ScrollableAreaSet::const_iterator it = scrollableAreas->begin(), end = scrollableAreas->end(); it != end; ++it) {
             ScrollableArea* scrollableArea = *it;
 
             // Check if this area can be scrolled at all.
+            // If this scrollable area is a frame view that itself has scrollable areas, then we need to add it to the region.
             if ((!scrollableArea->horizontalScrollbar() || !scrollableArea->horizontalScrollbar()->enabled())
-                && (!scrollableArea->verticalScrollbar() || !scrollableArea->verticalScrollbar()->enabled()))
-                continue;
+                && (!scrollableArea->verticalScrollbar() || !scrollableArea->verticalScrollbar()->enabled())
+                && (!childFrameViews.contains(static_cast<FrameView*>(scrollableArea)) || !static_cast<FrameView*>(scrollableArea)->scrollableAreas()))
+                    continue;
 
-            nonScrollableRegion.unite(scrollableArea->scrollableAreaBoundingBox());
+            nonFastScrollableRegion.unite(scrollableArea->scrollableAreaBoundingBox());
         }
     }
 
-    m_scrollingTreeState->setViewportRect(IntRect(IntPoint(), frameView->visibleContentRect().size()));
-    m_scrollingTreeState->setContentsSize(frameView->contentsSize());
-    m_scrollingTreeState->setNonFastScrollableRegion(nonScrollableRegion);
-    scheduleTreeStateCommit();
+    return nonFastScrollableRegion;
+}
+
+void ScrollingCoordinator::frameViewLayoutUpdated(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    // Compute the region of the page that we can't do fast scrolling for. This currently includes
+    // all scrollable areas, such as subframes, overflow divs and list boxes. We need to do this even if the
+    // frame view whose layout was updated is not the main frame.
+    Region nonFastScrollableRegion = computeNonFastScrollableRegion(m_page->mainFrame()->view());
+    setNonFastScrollableRegion(nonFastScrollableRegion);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return;
+
+    setScrollParameters(frameView->horizontalScrollElasticity(),
+                        frameView->verticalScrollElasticity(),
+                        frameView->horizontalScrollbar() && frameView->horizontalScrollbar()->enabled(),
+                        frameView->verticalScrollbar() && frameView->verticalScrollbar()->enabled(),
+                        IntRect(IntPoint(), frameView->visibleContentRect().size()),
+                        frameView->contentsSize());
+
 }
 
 void ScrollingCoordinator::frameViewWheelEventHandlerCountChanged(FrameView*)
@@ -129,6 +161,91 @@ void ScrollingCoordinator::frameViewWheelEventHandlerCountChanged(FrameView*)
     recomputeWheelEventHandlerCount();
 }
 
+void ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return;
+
+    updateShouldUpdateScrollLayerPositionOnMainThread();
+}
+
+void ScrollingCoordinator::frameViewHasFixedObjectsDidChange(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return;
+
+    updateShouldUpdateScrollLayerPositionOnMainThread();
+}
+
+static GraphicsLayer* scrollLayerForFrameView(FrameView* frameView)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    Frame* frame = frameView->frame();
+    if (!frame)
+        return 0;
+
+    RenderView* renderView = frame->contentRenderer();
+    if (!renderView)
+        return 0;
+    return renderView->compositor()->scrollLayer();
+#else
+    return 0;
+#endif
+}
+
+void ScrollingCoordinator::frameViewRootLayerDidChange(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (frameView->frame() != m_page->mainFrame())
+        return;
+
+    frameViewLayoutUpdated(frameView);
+    recomputeWheelEventHandlerCount();
+    updateShouldUpdateScrollLayerPositionOnMainThread();
+    setScrollLayer(scrollLayerForFrameView(frameView));
+}
+
+bool ScrollingCoordinator::requestScrollPositionUpdate(FrameView* frameView, const IntPoint& scrollPosition)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return false;
+
+#if ENABLE(THREADED_SCROLLING)
+    ScrollingThread::dispatch(bind(&ScrollingTree::setMainFrameScrollPosition, m_scrollingTree.get(), scrollPosition));
+    return true;
+#else
+    UNUSED_PARAM(scrollPosition);
+    return false;
+#endif
+}
+
+bool ScrollingCoordinator::handleWheelEvent(FrameView*, const PlatformWheelEvent& wheelEvent)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+#if ENABLE(THREADED_SCROLLING)
+    if (m_scrollingTree->willWheelEventStartSwipeGesture(wheelEvent))
+        return false;
+
+    ScrollingThread::dispatch(bind(&ScrollingTree::handleWheelEvent, m_scrollingTree.get(), wheelEvent));
+#else
+    UNUSED_PARAM(wheelEvent);
+#endif
+    return true;
+}
+
 void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollPosition)
 {
     ASSERT(isMainThread());
@@ -141,8 +258,25 @@ void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollP
         return;
 
     frameView->setConstrainsScrollingToContentEdge(false);
-    frameView->scrollToOffsetWithoutAnimation(scrollPosition);
+    frameView->notifyScrollPositionChanged(scrollPosition);
+    frameView->setConstrainsScrollingToContentEdge(true);
+}
+
+void ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    FrameView* frameView = m_page->mainFrame()->view();
+
+    // Make sure to update the main frame scroll position before changing the scroll layer position,
+    // otherwise we'll introduce jittering on pages with slow repaint objects (like background-attachment: fixed).
+    frameView->updateCompositingLayers();
+    frameView->setConstrainsScrollingToContentEdge(false);
+    frameView->notifyScrollPositionChanged(scrollPosition);
     frameView->setConstrainsScrollingToContentEdge(true);
+
+    if (GraphicsLayer* scrollLayer = scrollLayerForFrameView(frameView))
+        scrollLayer->setPosition(-frameView->scrollPosition());
+#endif
 }
 
 void ScrollingCoordinator::recomputeWheelEventHandlerCount()
@@ -152,11 +286,60 @@ void ScrollingCoordinator::recomputeWheelEventHandlerCount()
         if (frame->document())
             wheelEventHandlerCount += frame->document()->wheelEventHandlerCount();
     }
+    setWheelEventHandlerCount(wheelEventHandlerCount);
+}
+
+void ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread()
+{
+    FrameView* frameView = m_page->mainFrame()->view();
+
+    // FIXME: Having fixed objects on the page should not trigger the slow path.
+    setShouldUpdateScrollLayerPositionOnMainThread(frameView->hasSlowRepaintObjects() || frameView->hasFixedObjects());
+}
+
+#if ENABLE(THREADED_SCROLLING)
+void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
+{
+    m_scrollingTreeState->setScrollLayer(scrollLayer);
+    scheduleTreeStateCommit();
+}
 
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region& region)
+{
+    m_scrollingTreeState->setNonFastScrollableRegion(region);
+    scheduleTreeStateCommit();
+}
+
+void ScrollingCoordinator::setScrollParameters(ScrollElasticity horizontalScrollElasticity,
+                                               ScrollElasticity verticalScrollElasticity,
+                                               bool hasEnabledHorizontalScrollbar,
+                                               bool hasEnabledVerticalScrollbar,
+                                               const IntRect& viewportRect,
+                                               const IntSize& contentsSize)
+{
+    m_scrollingTreeState->setHorizontalScrollElasticity(horizontalScrollElasticity);
+    m_scrollingTreeState->setVerticalScrollElasticity(verticalScrollElasticity);
+    m_scrollingTreeState->setHasEnabledHorizontalScrollbar(hasEnabledHorizontalScrollbar);
+    m_scrollingTreeState->setHasEnabledVerticalScrollbar(hasEnabledVerticalScrollbar);
+
+    m_scrollingTreeState->setViewportRect(viewportRect);
+    m_scrollingTreeState->setContentsSize(contentsSize);
+    scheduleTreeStateCommit();
+}
+
+
+void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerCount)
+{
     m_scrollingTreeState->setWheelEventHandlerCount(wheelEventHandlerCount);
     scheduleTreeStateCommit();
 }
 
+void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool shouldUpdateScrollLayerPositionOnMainThread)
+{
+    m_scrollingTreeState->setShouldUpdateScrollLayerPositionOnMainThread(shouldUpdateScrollLayerPositionOnMainThread);
+    scheduleTreeStateCommit();
+}
+
 void ScrollingCoordinator::scheduleTreeStateCommit()
 {
     if (m_scrollingTreeStateCommitterTimer.isActive())
@@ -189,7 +372,6 @@ void ScrollingCoordinator::commitTreeState()
     OwnPtr<ScrollingTreeState> treeState = m_scrollingTreeState->commit();
     ScrollingThread::dispatch(bind(&ScrollingTree::commitNewTreeState, m_scrollingTree.get(), treeState.release()));
 }
+#endif
 
 } // namespace WebCore
-
-#endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.h b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
index eb597b8b0..00b289fe2 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.h
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
@@ -26,14 +26,16 @@
 #ifndef ScrollingCoordinator_h
 #define ScrollingCoordinator_h
 
-#if ENABLE(THREADED_SCROLLING)
-
 #include "GraphicsLayer.h"
 #include "IntRect.h"
+#include "ScrollTypes.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
+
+#if ENABLE(THREADED_SCROLLING)
 #include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/Threading.h>
+#endif
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
@@ -45,11 +47,12 @@ class FrameView;
 class GraphicsLayer;
 class Page;
 class PlatformWheelEvent;
-class ScrollingTree;
+class Region;
+class ScrollingCoordinatorPrivate;
 class ScrollingTreeState;
 
-#if ENABLE(GESTURE_EVENTS)
-class PlatformGestureEvent;
+#if ENABLE(THREADED_SCROLLING)
+class ScrollingTree;
 #endif
 
 class ScrollingCoordinator : public ThreadSafeRefCounted<ScrollingCoordinator> {
@@ -59,7 +62,9 @@ public:
 
     void pageDestroyed();
 
+#if ENABLE(THREADED_SCROLLING)
     ScrollingTree* scrollingTree() const;
+#endif
 
     // Return whether this scrolling coordinator handles scrolling for the given frame view.
     bool coordinatesScrollingForFrameView(FrameView*) const;
@@ -71,37 +76,68 @@ public:
     // frame view's underlying document.
     void frameViewWheelEventHandlerCountChanged(FrameView*);
 
-    // Should be called whenever the scroll layer for the given frame view changes.
-    void frameViewScrollLayerDidChange(FrameView*, const GraphicsLayer*);
+    // Should be called whenever the slow repaint objects counter changes between zero and one.
+    void frameViewHasSlowRepaintObjectsDidChange(FrameView*);
+
+    // Should be called whenever the fixed objects counter changes between zero and one.
+    // FIXME: This is a temporary workaround so that we'll fall into main thread scrolling mode
+    // if a page has fixed elements. The scrolling tree should know about the fixed elements
+    // so it can make sure they stay fixed even when we scroll on the scrolling thread.
+    void frameViewHasFixedObjectsDidChange(FrameView*);
+
+    // Should be called whenever the root layer for the given frame view changes.
+    void frameViewRootLayerDidChange(FrameView*);
 
     // Should be called whenever the horizontal scrollbar layer for the given frame view changes.
     void frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer* horizontalScrollbarLayer);
 
-    // Should be called whenever the horizontal scrollbar layer for the given frame view changes.
+    // Should be called whenever the vertical scrollbar layer for the given frame view changes.
     void frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer* verticalScrollbarLayer);
 
+    // Requests that the scrolling coordinator updates the scroll position of the given frame view. If this function returns true, it means that the
+    // position will be updated asynchronously. If it returns false, the caller should update the scrolling position itself.
+    bool requestScrollPositionUpdate(FrameView*, const IntPoint&);
+
+    // Handle the wheel event on the scrolling thread. Returns whether the event was handled or not.
+    bool handleWheelEvent(FrameView*, const PlatformWheelEvent&);
+
     // Dispatched by the scrolling tree whenever the main frame scroll position changes.
     void updateMainFrameScrollPosition(const IntPoint&);
 
+    // Dispatched by the scrolling tree whenever the main frame scroll position changes and the scroll layer position needs to be updated as well.
+    void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint&);
+
 private:
     explicit ScrollingCoordinator(Page*);
 
     void recomputeWheelEventHandlerCount();
+    void updateShouldUpdateScrollLayerPositionOnMainThread();
 
+    void setScrollLayer(GraphicsLayer*);
+    void setNonFastScrollableRegion(const Region&);
+    void setScrollParameters(ScrollElasticity horizontalScrollElasticity, ScrollElasticity verticalScrollElasticity,
+                             bool hasEnabledHorizontalScrollbar, bool hasEnabledVerticalScrollbar,
+                             const IntRect& viewportRect, const IntSize& contentsSize);
+    void setWheelEventHandlerCount(unsigned);
+    void setShouldUpdateScrollLayerPositionOnMainThread(bool);
+
+    Page* m_page;
+
+#if ENABLE(THREADED_SCROLLING)
     void scheduleTreeStateCommit();
+
     void scrollingTreeStateCommitterTimerFired(Timer<ScrollingCoordinator>*);
     void commitTreeStateIfNeeded();
     void commitTreeState();
 
-    Page* m_page;
-    RefPtr<ScrollingTree> m_scrollingTree;
-
     OwnPtr<ScrollingTreeState> m_scrollingTreeState;
+    RefPtr<ScrollingTree> m_scrollingTree;
     Timer<ScrollingCoordinator> m_scrollingTreeStateCommitterTimer;
+#endif
+
+    ScrollingCoordinatorPrivate* m_private;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(THREADED_SCROLLING)
-
 #endif // ScrollingCoordinator_h
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp
new file mode 100644
index 000000000..d06d6bb34
--- /dev/null
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ScrollingCoordinator.h"
+
+namespace WebCore {
+
+class ScrollingCoordinatorPrivate {
+};
+
+#if !ENABLE(THREADED_SCROLLING)
+PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
+{
+    return adoptRef(new ScrollingCoordinator(page));
+}
+
+ScrollingCoordinator::~ScrollingCoordinator()
+{
+    ASSERT(!m_page);
+}
+
+void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer*)
+{
+}
+
+void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer*)
+{
+}
+
+void ScrollingCoordinator::setScrollLayer(GraphicsLayer*)
+{
+}
+
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region&)
+{
+}
+
+void ScrollingCoordinator::setScrollParameters(ScrollElasticity, ScrollElasticity, bool, bool, const IntRect&, const IntSize&)
+{
+}
+
+void ScrollingCoordinator::setWheelEventHandlerCount(unsigned)
+{
+}
+
+void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool)
+{
+}
+
+#endif // !ENABLE(THREADED_SCROLLING)
+
+}
+
diff --git a/Source/WebCore/page/scrolling/ScrollingThread.cpp b/Source/WebCore/page/scrolling/ScrollingThread.cpp
index fc5a405da..f92969cc5 100644
--- a/Source/WebCore/page/scrolling/ScrollingThread.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingThread.cpp
@@ -71,17 +71,16 @@ void ScrollingThread::createThreadIfNeeded()
     // Wait for the thread to initialize the run loop.
     {
         MutexLocker locker(m_initializeRunLoopConditionMutex);
-
+#if PLATFORM(MAC)
         while (!m_threadRunLoop)
             m_initializeRunLoopCondition.wait(m_initializeRunLoopConditionMutex);
+#endif
     }
 }
 
-void* ScrollingThread::threadCallback(void* scrollingThread)
+void ScrollingThread::threadCallback(void* scrollingThread)
 {
     static_cast<ScrollingThread*>(scrollingThread)->threadBody();
-
-    return 0;
 }
 
 void ScrollingThread::threadBody()
diff --git a/Source/WebCore/page/scrolling/ScrollingThread.h b/Source/WebCore/page/scrolling/ScrollingThread.h
index 22671e4f5..d8dfa2de0 100644
--- a/Source/WebCore/page/scrolling/ScrollingThread.h
+++ b/Source/WebCore/page/scrolling/ScrollingThread.h
@@ -52,7 +52,7 @@ private:
     static ScrollingThread& shared();
 
     void createThreadIfNeeded();
-    static void* threadCallback(void* scrollingThread);
+    static void threadCallback(void* scrollingThread);
     void threadBody();
     void dispatchFunctionsFromScrollingThread();
 
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.cpp b/Source/WebCore/page/scrolling/ScrollingTree.cpp
index bc1c50d9f..d58c62bd3 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTree.cpp
@@ -46,6 +46,10 @@ ScrollingTree::ScrollingTree(ScrollingCoordinator* scrollingCoordinator)
     : m_scrollingCoordinator(scrollingCoordinator)
     , m_rootNode(ScrollingTreeNode::create(this))
     , m_hasWheelEventHandlers(false)
+    , m_canGoBack(false)
+    , m_canGoForward(false)
+    , m_mainFramePinnedToTheLeft(false)
+    , m_mainFramePinnedToTheRight(false)
 {
 }
 
@@ -54,25 +58,36 @@ ScrollingTree::~ScrollingTree()
     ASSERT(!m_scrollingCoordinator);
 }
 
-bool ScrollingTree::tryToHandleWheelEvent(const PlatformWheelEvent& wheelEvent)
+ScrollingTree::EventResult ScrollingTree::tryToHandleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
     {
         MutexLocker lock(m_mutex);
 
         if (m_hasWheelEventHandlers)
-            return false;
+            return SendToMainThread;
 
         if (!m_nonFastScrollableRegion.isEmpty()) {
             // FIXME: This is not correct for non-default scroll origins.
             IntPoint position = wheelEvent.position();
             position.moveBy(m_mainFrameScrollPosition);
             if (m_nonFastScrollableRegion.contains(position))
-                return false;
+                return SendToMainThread;
         }
     }
 
+    if (willWheelEventStartSwipeGesture(wheelEvent))
+        return DidNotHandleEvent;
+
     ScrollingThread::dispatch(bind(&ScrollingTree::handleWheelEvent, this, wheelEvent));
-    return true;
+    return DidHandleEvent;
+}
+
+void ScrollingTree::updateBackForwardState(bool canGoBack, bool canGoForward)
+{
+    MutexLocker locker(m_swipeStateMutex);
+
+    m_canGoBack = canGoBack;
+    m_canGoForward = canGoForward;
 }
 
 void ScrollingTree::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
@@ -82,13 +97,31 @@ void ScrollingTree::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
     m_rootNode->handleWheelEvent(wheelEvent);
 }
 
+void ScrollingTree::setMainFrameScrollPosition(const IntPoint& scrollPosition)
+{
+    ASSERT(ScrollingThread::isCurrentThread());
+
+    m_rootNode->setScrollPosition(scrollPosition);
+}
+
+static void derefScrollingCoordinator(ScrollingCoordinator* scrollingCoordinator)
+{
+    ASSERT(isMainThread());
+
+    scrollingCoordinator->deref();
+}
+
 void ScrollingTree::invalidate()
 {
     // Invalidate is dispatched by the ScrollingCoordinator class on the ScrollingThread
     // to break the reference cycle between ScrollingTree and ScrollingCoordinator when the
     // ScrollingCoordinator's page is destroyed.
     ASSERT(ScrollingThread::isCurrentThread());
-    m_scrollingCoordinator = nullptr;
+
+    // Since this can potentially be the last reference to the scrolling coordinator,
+    // we need to release it on the main thread since it has member variables (such as timers)
+    // that expect to be destroyed from the main thread.
+    callOnMainThread(bind(derefScrollingCoordinator, m_scrollingCoordinator.release().leakRef()));
 }
 
 void ScrollingTree::commitNewTreeState(PassOwnPtr<ScrollingTreeState> scrollingTreeState)
@@ -107,6 +140,14 @@ void ScrollingTree::commitNewTreeState(PassOwnPtr<ScrollingTreeState> scrollingT
     m_rootNode->update(scrollingTreeState.get());
 }
 
+void ScrollingTree::setMainFramePinState(bool pinnedToTheLeft, bool pinnedToTheRight)
+{
+    MutexLocker locker(m_swipeStateMutex);
+
+    m_mainFramePinnedToTheLeft = pinnedToTheLeft;
+    m_mainFramePinnedToTheRight = pinnedToTheRight;
+}
+
 void ScrollingTree::updateMainFrameScrollPosition(const IntPoint& scrollPosition)
 {
     if (!m_scrollingCoordinator)
@@ -120,6 +161,50 @@ void ScrollingTree::updateMainFrameScrollPosition(const IntPoint& scrollPosition
     callOnMainThread(bind(&ScrollingCoordinator::updateMainFrameScrollPosition, m_scrollingCoordinator.get(), scrollPosition));
 }
 
+void ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition)
+{
+    if (!m_scrollingCoordinator)
+        return;
+
+    {
+        MutexLocker lock(m_mutex);
+        m_mainFrameScrollPosition = scrollPosition;
+    }
+
+    callOnMainThread(bind(&ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition, m_scrollingCoordinator.get(), scrollPosition));
+}
+
+bool ScrollingTree::canGoBack()
+{
+    MutexLocker lock(m_swipeStateMutex);
+
+    return m_canGoBack;
+}
+
+bool ScrollingTree::canGoForward()
+{
+    MutexLocker lock(m_swipeStateMutex);
+
+    return m_canGoForward;
+}
+
+bool ScrollingTree::willWheelEventStartSwipeGesture(const PlatformWheelEvent& wheelEvent)
+{
+    if (wheelEvent.phase() != PlatformWheelEventPhaseBegan)
+        return false;
+    if (!wheelEvent.deltaX())
+        return false;
+
+    MutexLocker lock(m_swipeStateMutex);
+
+    if (wheelEvent.deltaX() > 0 && m_mainFramePinnedToTheLeft && m_canGoBack)
+        return true;
+    if (wheelEvent.deltaX() < 0 && m_mainFramePinnedToTheRight && m_canGoForward)
+        return true;
+
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.h b/Source/WebCore/page/scrolling/ScrollingTree.h
index 76cbfda0a..00d2584c0 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingTree.h
@@ -29,6 +29,7 @@
 #if ENABLE(THREADED_SCROLLING)
 
 #include "Region.h"
+#include <wtf/Functional.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -52,18 +53,37 @@ public:
     static PassRefPtr<ScrollingTree> create(ScrollingCoordinator*);
     ~ScrollingTree();
 
+    enum EventResult {
+        DidNotHandleEvent,
+        DidHandleEvent,
+        SendToMainThread
+    };
+
     // Can be called from any thread. Will try to handle the wheel event on the scrolling thread.
     // Returns true if the wheel event can be handled on the scrolling thread and false if the
     // event must be sent again to the WebCore event handler.
-    bool tryToHandleWheelEvent(const PlatformWheelEvent&);
+    EventResult tryToHandleWheelEvent(const PlatformWheelEvent&);
+
+    // Can be called from any thread. Will update the back forward state of the page, used for rubber-banding.
+    void updateBackForwardState(bool canGoBack, bool canGoForward);
 
     // Must be called from the scrolling thread. Handles the wheel event.
     void handleWheelEvent(const PlatformWheelEvent&);
 
+    void setMainFrameScrollPosition(const IntPoint&);
+
     void invalidate();
     void commitNewTreeState(PassOwnPtr<ScrollingTreeState>);
 
+    void setMainFramePinState(bool pinnedToTheLeft, bool pinnedToTheRight);
+
     void updateMainFrameScrollPosition(const IntPoint& scrollPosition);
+    void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition);
+
+    bool canGoBack();
+    bool canGoForward();
+
+    bool willWheelEventStartSwipeGesture(const PlatformWheelEvent&);
 
 private:
     explicit ScrollingTree(ScrollingCoordinator*);
@@ -75,6 +95,12 @@ private:
     Region m_nonFastScrollableRegion;
     IntPoint m_mainFrameScrollPosition;
     bool m_hasWheelEventHandlers;
+
+    Mutex m_swipeStateMutex;
+    bool m_canGoBack;
+    bool m_canGoForward;
+    bool m_mainFramePinnedToTheLeft;
+    bool m_mainFramePinnedToTheRight;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp b/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp
index bd94f00dc..8626b89ff 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp
@@ -34,6 +34,11 @@ namespace WebCore {
 
 ScrollingTreeNode::ScrollingTreeNode(ScrollingTree* scrollingTree)
     : m_scrollingTree(scrollingTree)
+    , m_shouldUpdateScrollLayerPositionOnMainThread(false)
+    , m_horizontalScrollElasticity(ScrollElasticityNone)
+    , m_verticalScrollElasticity(ScrollElasticityNone)
+    , m_hasEnabledHorizontalScrollbar(false)
+    , m_hasEnabledVerticalScrollbar(false)
 {
 }
 
@@ -48,6 +53,21 @@ void ScrollingTreeNode::update(ScrollingTreeState* state)
 
     if (state->changedProperties() & ScrollingTreeState::ContentsSize)
         m_contentsSize = state->contentsSize();
+
+    if (state->changedProperties() & ScrollingTreeState::ShouldUpdateScrollLayerPositionOnMainThread)
+        m_shouldUpdateScrollLayerPositionOnMainThread = state->shouldUpdateScrollLayerPositionOnMainThread();
+
+    if (state->changedProperties() & ScrollingTreeState::HorizontalScrollElasticity)
+        m_horizontalScrollElasticity = state->horizontalScrollElasticity();
+
+    if (state->changedProperties() & ScrollingTreeState::VerticalScrollElasticity)
+        m_verticalScrollElasticity = state->verticalScrollElasticity();
+
+    if (state->changedProperties() & ScrollingTreeState::HasEnabledHorizontalScrollbar)
+        m_hasEnabledHorizontalScrollbar = state->hasEnabledHorizontalScrollbar();
+
+    if (state->changedProperties() & ScrollingTreeState::HasEnabledVerticalScrollbar)
+        m_hasEnabledVerticalScrollbar = state->hasEnabledVerticalScrollbar();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeNode.h b/Source/WebCore/page/scrolling/ScrollingTreeNode.h
index d26293a89..258783e7d 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeNode.h
+++ b/Source/WebCore/page/scrolling/ScrollingTreeNode.h
@@ -29,6 +29,7 @@
 #if ENABLE(THREADED_SCROLLING)
 
 #include "IntRect.h"
+#include "ScrollTypes.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -44,19 +45,37 @@ public:
 
     virtual void update(ScrollingTreeState*);
     virtual void handleWheelEvent(const PlatformWheelEvent&) = 0;
+    virtual void setScrollPosition(const IntPoint&) = 0;
 
 protected:
     explicit ScrollingTreeNode(ScrollingTree*);
 
     ScrollingTree* scrollingTree() const { return m_scrollingTree; }
+
     const IntRect& viewportRect() const { return m_viewportRect; }
     const IntSize& contentsSize() const { return m_contentsSize; }
 
+    bool shouldUpdateScrollLayerPositionOnMainThread() const { return m_shouldUpdateScrollLayerPositionOnMainThread; }
+
+    ScrollElasticity horizontalScrollElasticity() const { return m_horizontalScrollElasticity; }
+    ScrollElasticity verticalScrollElasticity() const { return m_verticalScrollElasticity; }
+
+    bool hasEnabledHorizontalScrollbar() const { return m_hasEnabledHorizontalScrollbar; }
+    bool hasEnabledVerticalScrollbar() const { return m_hasEnabledVerticalScrollbar; }
+
 private:
     ScrollingTree* m_scrollingTree;
 
     IntRect m_viewportRect;
     IntSize m_contentsSize;
+
+    bool m_shouldUpdateScrollLayerPositionOnMainThread;
+
+    ScrollElasticity m_horizontalScrollElasticity;
+    ScrollElasticity m_verticalScrollElasticity;
+    
+    bool m_hasEnabledHorizontalScrollbar;
+    bool m_hasEnabledVerticalScrollbar;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeState.cpp b/Source/WebCore/page/scrolling/ScrollingTreeState.cpp
index c368152c3..ebf648d2b 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeState.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTreeState.cpp
@@ -38,6 +38,11 @@ PassOwnPtr<ScrollingTreeState> ScrollingTreeState::create()
 ScrollingTreeState::ScrollingTreeState()
     : m_changedProperties(0)
     , m_wheelEventHandlerCount(0)
+    , m_shouldUpdateScrollLayerPositionOnMainThread(false)
+    , m_horizontalScrollElasticity(ScrollElasticityNone)
+    , m_verticalScrollElasticity(ScrollElasticityNone)
+    , m_hasEnabledHorizontalScrollbar(false)
+    , m_hasEnabledVerticalScrollbar(false)
 {
 }
 
@@ -81,6 +86,51 @@ void ScrollingTreeState::setWheelEventHandlerCount(unsigned wheelEventHandlerCou
     m_changedProperties |= WheelEventHandlerCount;
 }
 
+void ScrollingTreeState::setShouldUpdateScrollLayerPositionOnMainThread(bool shouldUpdateScrollLayerPositionOnMainThread)
+{
+    if (m_shouldUpdateScrollLayerPositionOnMainThread == shouldUpdateScrollLayerPositionOnMainThread)
+        return;
+
+    m_shouldUpdateScrollLayerPositionOnMainThread = shouldUpdateScrollLayerPositionOnMainThread;
+    m_changedProperties |= ShouldUpdateScrollLayerPositionOnMainThread;
+}
+
+void ScrollingTreeState::setHorizontalScrollElasticity(ScrollElasticity horizontalScrollElasticity)
+{
+    if (m_horizontalScrollElasticity == horizontalScrollElasticity)
+        return;
+
+    m_horizontalScrollElasticity = horizontalScrollElasticity;
+    m_changedProperties |= HorizontalScrollElasticity;
+}
+
+void ScrollingTreeState::setVerticalScrollElasticity(ScrollElasticity verticalScrollElasticity)
+{
+    if (m_verticalScrollElasticity == verticalScrollElasticity)
+        return;
+
+    m_verticalScrollElasticity = verticalScrollElasticity;
+    m_changedProperties |= VerticalScrollElasticity;
+}
+
+void ScrollingTreeState::setHasEnabledHorizontalScrollbar(bool hasEnabledHorizontalScrollbar)
+{
+    if (m_hasEnabledHorizontalScrollbar == hasEnabledHorizontalScrollbar)
+        return;
+
+    m_hasEnabledHorizontalScrollbar = hasEnabledHorizontalScrollbar;
+    m_changedProperties |= HasEnabledHorizontalScrollbar;
+}
+
+void ScrollingTreeState::setHasEnabledVerticalScrollbar(bool hasEnabledVerticalScrollbar)
+{
+    if (m_hasEnabledVerticalScrollbar == hasEnabledVerticalScrollbar)
+        return;
+
+    m_hasEnabledVerticalScrollbar = hasEnabledVerticalScrollbar;
+    m_changedProperties |= HasEnabledVerticalScrollbar;
+}
+
 PassOwnPtr<ScrollingTreeState> ScrollingTreeState::commit()
 {
     OwnPtr<ScrollingTreeState> treeState = adoptPtr(new ScrollingTreeState(*this));
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeState.h b/Source/WebCore/page/scrolling/ScrollingTreeState.h
index fde884922..97cc77a94 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeState.h
+++ b/Source/WebCore/page/scrolling/ScrollingTreeState.h
@@ -31,6 +31,7 @@
 #include "GraphicsLayer.h"
 #include "IntRect.h"
 #include "Region.h"
+#include "ScrollTypes.h"
 #include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
@@ -53,7 +54,12 @@ public:
         ContentsSize = 1 << 1,
         NonFastScrollableRegion = 1 << 2,
         WheelEventHandlerCount = 1 << 3,
-        ScrollLayer = 1 << 4,
+        ShouldUpdateScrollLayerPositionOnMainThread = 1 << 4,
+        HorizontalScrollElasticity = 1 << 5,
+        VerticalScrollElasticity = 1 << 6,
+        HasEnabledHorizontalScrollbar = 1 << 7,
+        HasEnabledVerticalScrollbar = 1 << 8,
+        ScrollLayer = 1 << 9,
     };
 
     bool hasChangedProperties() const { return m_changedProperties; }
@@ -71,6 +77,21 @@ public:
     unsigned wheelEventHandlerCount() const { return m_wheelEventHandlerCount; }
     void setWheelEventHandlerCount(unsigned);
 
+    bool shouldUpdateScrollLayerPositionOnMainThread() const { return m_shouldUpdateScrollLayerPositionOnMainThread; }
+    void setShouldUpdateScrollLayerPositionOnMainThread(bool);
+
+    ScrollElasticity horizontalScrollElasticity() const { return m_horizontalScrollElasticity; }
+    void setHorizontalScrollElasticity(ScrollElasticity);
+
+    ScrollElasticity verticalScrollElasticity() const { return m_verticalScrollElasticity; }
+    void setVerticalScrollElasticity(ScrollElasticity);
+
+    bool hasEnabledHorizontalScrollbar() const { return m_hasEnabledHorizontalScrollbar; }
+    void setHasEnabledHorizontalScrollbar(bool);
+
+    bool hasEnabledVerticalScrollbar() const { return m_hasEnabledVerticalScrollbar; }
+    void setHasEnabledVerticalScrollbar(bool);
+
     PlatformLayer* platformScrollLayer() const;
     void setScrollLayer(const GraphicsLayer*);
 
@@ -89,6 +110,14 @@ private:
 
     unsigned m_wheelEventHandlerCount;
 
+    bool m_shouldUpdateScrollLayerPositionOnMainThread;
+
+    ScrollElasticity m_horizontalScrollElasticity;
+    ScrollElasticity m_verticalScrollElasticity;
+
+    bool m_hasEnabledHorizontalScrollbar;
+    bool m_hasEnabledVerticalScrollbar;
+
 #if PLATFORM(MAC)
     RetainPtr<PlatformLayer> m_platformScrollLayer;
 #endif
diff --git a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
new file mode 100644
index 000000000..e590138a6
--- /dev/null
+++ b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ScrollingCoordinator.h"
+
+#include "LayerChromium.h"
+#include "Region.h"
+
+namespace WebCore {
+
+class ScrollingCoordinatorPrivate {
+WTF_MAKE_NONCOPYABLE(ScrollingCoordinatorPrivate);
+public:
+    ScrollingCoordinatorPrivate() { }
+    ~ScrollingCoordinatorPrivate() { }
+
+    void setScrollLayer(LayerChromium* layer) { m_scrollLayer = layer; }
+    LayerChromium* scrollLayer() const { return m_scrollLayer.get(); }
+
+private:
+    RefPtr<LayerChromium> m_scrollLayer;
+};
+
+PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
+{
+    RefPtr<ScrollingCoordinator> coordinator(adoptRef(new ScrollingCoordinator(page)));
+    coordinator->m_private = new ScrollingCoordinatorPrivate;
+    return coordinator.release();
+}
+
+ScrollingCoordinator::~ScrollingCoordinator()
+{
+    ASSERT(!m_page);
+    delete m_private;
+}
+
+void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer* horizontalScrollbarLayer)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer* verticalScrollbarLayer)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
+{
+    m_private->setScrollLayer(scrollLayer ? scrollLayer->platformLayer() : 0);
+}
+
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region&)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::setScrollParameters(ScrollElasticity horizontalScrollElasticity, ScrollElasticity verticalScrollElasticity,
+                                               bool hasEnabledHorizontalScrollbar, bool hasEnabledVerticalScrollbar,
+                                               const IntRect& viewportRect, const IntSize& contentsSize)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerCount)
+{
+    if (LayerChromium* layer = m_private->scrollLayer())
+        layer->setHaveWheelEventHandlers(wheelEventHandlerCount > 0);
+}
+
+void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool should)
+{
+    // FIXME: Implement!
+}
+
+}
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
index 31fa76683..94335b0b2 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
@@ -42,6 +42,20 @@
 
 namespace WebCore {
 
+class ScrollingCoordinatorPrivate {
+};
+
+PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
+{
+    return adoptRef(new ScrollingCoordinator(page));
+}
+
+ScrollingCoordinator::~ScrollingCoordinator()
+{
+    ASSERT(!m_page);
+    ASSERT(!m_scrollingTree);
+}
+
 void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer*)
 {
     ASSERT(isMainThread());
@@ -64,18 +78,6 @@ void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView* f
     // FIXME: Implement.
 }
 
-void ScrollingCoordinator::frameViewScrollLayerDidChange(FrameView* frameView, const GraphicsLayer* scrollLayer)
-{
-    ASSERT(isMainThread());
-    ASSERT(m_page);
-
-    if (frameView->frame() != m_page->mainFrame())
-        return;
-
-    m_scrollingTreeState->setScrollLayer(scrollLayer);
-    scheduleTreeStateCommit();
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
index b1ae6ee76..97b3d22bc 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(THREADED_SCROLLING)
 
+#include "ScrollElasticityController.h"
 #include "ScrollingTreeNode.h"
 #include <wtf/RetainPtr.h>
 
@@ -35,18 +36,44 @@ OBJC_CLASS CALayer;
 
 namespace WebCore {
 
-class ScrollingTreeNodeMac : public ScrollingTreeNode {
+class ScrollingTreeNodeMac : public ScrollingTreeNode, private ScrollElasticityControllerClient {
 public:
     explicit ScrollingTreeNodeMac(ScrollingTree*);
+    virtual ~ScrollingTreeNodeMac();
 
 private:
+    // ScrollingTreeNode member functions.
     virtual void update(ScrollingTreeState*) OVERRIDE;
     virtual void handleWheelEvent(const PlatformWheelEvent&) OVERRIDE;
+    virtual void setScrollPosition(const IntPoint&) OVERRIDE;
+
+    // ScrollElasticityController member functions.
+    virtual bool allowsHorizontalStretching() OVERRIDE;
+    virtual bool allowsVerticalStretching() OVERRIDE;
+    virtual IntSize stretchAmount() OVERRIDE;
+    virtual bool pinnedInDirection(const FloatSize&) OVERRIDE;
+    virtual bool canScrollHorizontally() OVERRIDE;
+    virtual bool canScrollVertically() OVERRIDE;
+    virtual bool shouldRubberBandInDirection(ScrollDirection) OVERRIDE;
+    virtual IntPoint absoluteScrollPosition() OVERRIDE;
+    virtual void immediateScrollBy(const FloatSize&) OVERRIDE;
+    virtual void immediateScrollByWithoutContentEdgeConstraints(const FloatSize&) OVERRIDE;
+    virtual void startSnapRubberbandTimer() OVERRIDE;
+    virtual void stopSnapRubberbandTimer() OVERRIDE;
 
     IntPoint scrollPosition() const;
-    void setScrollPosition(const IntPoint&);
+    void setScrollLayerPosition(const IntPoint&);
+
+    IntPoint minimumScrollPosition() const;
+    IntPoint maximumScrollPosition() const;
 
     void scrollBy(const IntSize&);
+    void scrollByWithoutContentEdgeConstraints(const IntSize&);
+
+    void updateMainFramePinState(const IntPoint& scrollPosition);
+
+    ScrollElasticityController m_scrollElasticityController;
+    RetainPtr<CFRunLoopTimerRef> m_snapRubberbandTimer;
 
     RetainPtr<CALayer> m_scrollLayer;
 };
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
index 76a8e3eaf..966b2e18f 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
@@ -41,21 +41,175 @@ PassOwnPtr<ScrollingTreeNode> ScrollingTreeNode::create(ScrollingTree* scrolling
 
 ScrollingTreeNodeMac::ScrollingTreeNodeMac(ScrollingTree* scrollingTree)
     : ScrollingTreeNode(scrollingTree)
+    , m_scrollElasticityController(this)
 {
 }
 
+ScrollingTreeNodeMac::~ScrollingTreeNodeMac()
+{
+    if (m_snapRubberbandTimer)
+        CFRunLoopTimerInvalidate(m_snapRubberbandTimer.get());
+}
+
 void ScrollingTreeNodeMac::update(ScrollingTreeState* state)
 {
     ScrollingTreeNode::update(state);
 
     if (state->changedProperties() & ScrollingTreeState::ScrollLayer)
         m_scrollLayer = state->platformScrollLayer();
+
+    if (state->changedProperties() & (ScrollingTreeState::ScrollLayer | ScrollingTreeState::ContentsSize | ScrollingTreeState::ViewportRect))
+        updateMainFramePinState(scrollPosition());
 }
 
 void ScrollingTreeNodeMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
-    // FXIME: This needs to handle rubberbanding.
-    scrollBy(IntSize(-wheelEvent.deltaX(), -wheelEvent.deltaY()));
+    m_scrollElasticityController.handleWheelEvent(wheelEvent);
+}
+
+void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
+{
+    updateMainFramePinState(scrollPosition);
+
+    if (shouldUpdateScrollLayerPositionOnMainThread()) {
+        scrollingTree()->updateMainFrameScrollPositionAndScrollLayerPosition(scrollPosition);
+        return;
+    }
+
+    setScrollLayerPosition(scrollPosition);
+    scrollingTree()->updateMainFrameScrollPosition(scrollPosition);
+}
+
+bool ScrollingTreeNodeMac::allowsHorizontalStretching()
+{
+    switch (horizontalScrollElasticity()) {
+    case ScrollElasticityAutomatic:
+        return hasEnabledHorizontalScrollbar() || !hasEnabledVerticalScrollbar();
+    case ScrollElasticityNone:
+        return false;
+    case ScrollElasticityAllowed:
+        return true;
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool ScrollingTreeNodeMac::allowsVerticalStretching()
+{
+    switch (verticalScrollElasticity()) {
+    case ScrollElasticityAutomatic:
+        return hasEnabledVerticalScrollbar() || !hasEnabledHorizontalScrollbar();
+    case ScrollElasticityNone:
+        return false;
+    case ScrollElasticityAllowed:
+        return true;
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+IntSize ScrollingTreeNodeMac::stretchAmount()
+{
+    IntSize stretch;
+
+    if (scrollPosition().y() < minimumScrollPosition().y())
+        stretch.setHeight(scrollPosition().y() - minimumScrollPosition().y());
+    else if (scrollPosition().y() > maximumScrollPosition().y())
+        stretch.setHeight(scrollPosition().y() - maximumScrollPosition().y());
+
+    if (scrollPosition().x() < minimumScrollPosition().x())
+        stretch.setWidth(scrollPosition().x() - minimumScrollPosition().x());
+    else if (scrollPosition().x() > maximumScrollPosition().x())
+        stretch.setWidth(scrollPosition().x() - maximumScrollPosition().x());
+
+    return stretch;
+}
+
+bool ScrollingTreeNodeMac::pinnedInDirection(const FloatSize& delta)
+{
+    FloatSize limitDelta;
+
+    if (fabsf(delta.height()) >= fabsf(delta.width())) {
+        if (delta.height() < 0) {
+            // We are trying to scroll up.  Make sure we are not pinned to the top
+            limitDelta.setHeight(scrollPosition().y() - minimumScrollPosition().y());
+        } else {
+            // We are trying to scroll down.  Make sure we are not pinned to the bottom
+            limitDelta.setHeight(maximumScrollPosition().y() - scrollPosition().y());
+        }
+    } else if (delta.width()) {
+        if (delta.width() < 0) {
+            // We are trying to scroll left.  Make sure we are not pinned to the left
+            limitDelta.setHeight(scrollPosition().x() - minimumScrollPosition().x());
+        } else {
+            // We are trying to scroll right.  Make sure we are not pinned to the right
+            limitDelta.setHeight(maximumScrollPosition().x() - scrollPosition().x());
+        }
+    }
+
+    if ((delta.width() || delta.height()) && (limitDelta.width() < 1 && limitDelta.height() < 1))        
+        return true;
+
+    return false;
+}
+
+bool ScrollingTreeNodeMac::canScrollHorizontally()
+{
+    return hasEnabledHorizontalScrollbar();
+}
+
+bool ScrollingTreeNodeMac::canScrollVertically()
+{
+    return hasEnabledVerticalScrollbar();
+}
+
+bool ScrollingTreeNodeMac::shouldRubberBandInDirection(ScrollDirection direction)
+{
+    if (direction == ScrollLeft)
+        return !scrollingTree()->canGoBack();
+    if (direction == ScrollRight)
+        return !scrollingTree()->canGoForward();
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+IntPoint ScrollingTreeNodeMac::absoluteScrollPosition()
+{
+    return scrollPosition();
+}
+
+void ScrollingTreeNodeMac::immediateScrollBy(const FloatSize& offset)
+{
+    scrollBy(roundedIntSize(offset));
+}
+
+void ScrollingTreeNodeMac::immediateScrollByWithoutContentEdgeConstraints(const FloatSize& offset)
+{
+    scrollByWithoutContentEdgeConstraints(roundedIntSize(offset));
+}
+
+void ScrollingTreeNodeMac::startSnapRubberbandTimer()
+{
+    ASSERT(!m_snapRubberbandTimer);
+
+    CFTimeInterval timerInterval = 1.0 / 60.0;
+
+    m_snapRubberbandTimer = adoptCF(CFRunLoopTimerCreateWithHandler(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + timerInterval, timerInterval, 0, 0, ^(CFRunLoopTimerRef) {
+        m_scrollElasticityController.snapRubberBandTimerFired();
+    }));
+    CFRunLoopAddTimer(CFRunLoopGetCurrent(), m_snapRubberbandTimer.get(), kCFRunLoopDefaultMode);
+}
+
+void ScrollingTreeNodeMac::stopSnapRubberbandTimer()
+{
+    if (!m_snapRubberbandTimer)
+        return;
+
+    CFRunLoopTimerInvalidate(m_snapRubberbandTimer.get());
+    m_snapRubberbandTimer = nullptr;
 }
 
 IntPoint ScrollingTreeNodeMac::scrollPosition() const
@@ -64,16 +218,49 @@ IntPoint ScrollingTreeNodeMac::scrollPosition() const
     return IntPoint(-scrollLayerPosition.x, -scrollLayerPosition.y);
 }
 
-void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& position)
+void ScrollingTreeNodeMac::setScrollLayerPosition(const IntPoint& position)
 {
+    ASSERT(!shouldUpdateScrollLayerPositionOnMainThread());
     m_scrollLayer.get().position = CGPointMake(-position.x(), -position.y());
 }
 
-void ScrollingTreeNodeMac::scrollBy(const IntSize &offset)
+IntPoint ScrollingTreeNodeMac::minimumScrollPosition() const
+{
+    // FIXME: This should take the scroll origin into account.
+    return IntPoint(0, 0);
+}
+
+IntPoint ScrollingTreeNodeMac::maximumScrollPosition() const
+{
+    // FIXME: This should take the scroll origin into account.
+    IntPoint position(contentsSize().width() - viewportRect().width(),
+                      contentsSize().height() - viewportRect().height());
+
+    position.clampNegativeToZero();
+
+    return position;
+}
+
+void ScrollingTreeNodeMac::scrollBy(const IntSize& offset)
+{
+    IntPoint newScrollPosition = scrollPosition() + offset;
+    newScrollPosition = newScrollPosition.shrunkTo(maximumScrollPosition());
+    newScrollPosition = newScrollPosition.expandedTo(minimumScrollPosition());
+
+    setScrollPosition(newScrollPosition);
+}
+
+void ScrollingTreeNodeMac::scrollByWithoutContentEdgeConstraints(const IntSize& offset)
 {
     setScrollPosition(scrollPosition() + offset);
+}
+
+void ScrollingTreeNodeMac::updateMainFramePinState(const IntPoint& scrollPosition)
+{
+    bool pinnedToTheLeft = scrollPosition.x() <= minimumScrollPosition().x();
+    bool pinnedToTheRight = scrollPosition.x() >= maximumScrollPosition().x();
 
-    scrollingTree()->updateMainFrameScrollPosition(scrollPosition());
+    scrollingTree()->setMainFramePinState(pinnedToTheLeft, pinnedToTheRight);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/win/FrameCGWin.cpp b/Source/WebCore/page/win/FrameCGWin.cpp
index ea2c391e7..ab6a8a57c 100644
--- a/Source/WebCore/page/win/FrameCGWin.cpp
+++ b/Source/WebCore/page/win/FrameCGWin.cpp
@@ -98,7 +98,7 @@ DragImageRef Frame::nodeImage(Node* node)
         return 0;
 
     LayoutRect topLevelRect;
-    IntRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     document()->updateLayout();
 
diff --git a/Source/WebCore/platform/AsyncFileSystem.cpp b/Source/WebCore/platform/AsyncFileSystem.cpp
index c3c241224..7b811d4c3 100644
--- a/Source/WebCore/platform/AsyncFileSystem.cpp
+++ b/Source/WebCore/platform/AsyncFileSystem.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "AsyncFileSystemCallbacks.h"
+#include "ExceptionCode.h"
 #include "FileSystem.h"
 #include "NotImplemented.h"
 
@@ -44,7 +45,7 @@ const size_t AsyncFileSystem::persistentPathPrefixLength = sizeof(AsyncFileSyste
 const char AsyncFileSystem::temporaryPathPrefix[] = "temporary";
 const size_t AsyncFileSystem::temporaryPathPrefixLength = sizeof(AsyncFileSystem::temporaryPathPrefix) - 1;
 
-#if !PLATFORM(CHROMIUM)
+#if !PLATFORM(CHROMIUM) && !PLATFORM(GTK)
 bool AsyncFileSystem::isAvailable()
 {
     notImplemented();
@@ -56,10 +57,10 @@ bool AsyncFileSystem::isValidType(Type type)
     return type == Temporary || type == Persistent;
 }
 
-PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(Type, const String&)
+PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(Type)
 {
     notImplemented();
-    return 0;
+    return nullptr;
 }
 
 void AsyncFileSystem::openFileSystem(const String& basePath, const String& storageIdentifier, Type type, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index 44a52d5ed..d89445e80 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -43,8 +43,12 @@ enum CalcOperator {
     CalcAdd = '+',
     CalcSubtract = '-',
     CalcMultiply = '*',
-    CalcDivide = '/',
-    CalcMod = '%'
+    CalcDivide = '/'
+};
+
+enum CalculationPermittedValueRange {
+    CalculationRangeAll,
+    CalculationRangeNonNegative
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ContextMenu.h b/Source/WebCore/platform/ContextMenu.h
index 2c50a920b..00ceb2009 100644
--- a/Source/WebCore/platform/ContextMenu.h
+++ b/Source/WebCore/platform/ContextMenu.h
@@ -33,8 +33,6 @@
 #include "PlatformString.h"
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
-#elif PLATFORM(QT)
-#include <QMenu>
 #elif PLATFORM(WIN)
 #include <windows.h>
 #endif
diff --git a/Source/WebCore/platform/ContextMenuItem.h b/Source/WebCore/platform/ContextMenuItem.h
index 2520c64e6..15bff4839 100644
--- a/Source/WebCore/platform/ContextMenuItem.h
+++ b/Source/WebCore/platform/ContextMenuItem.h
@@ -39,8 +39,6 @@ typedef struct tagMENUITEMINFOW MENUITEMINFO;
 #elif PLATFORM(GTK)
 typedef struct _GtkMenuItem GtkMenuItem;
 typedef struct _GtkAction GtkAction;
-#elif PLATFORM(QT)
-#include <QAction>
 #elif PLATFORM(WX)
 class wxMenuItem;
 #endif
diff --git a/Source/WebCore/platform/CrossThreadCopier.h b/Source/WebCore/platform/CrossThreadCopier.h
index 39d11b501..3b6076142 100644
--- a/Source/WebCore/platform/CrossThreadCopier.h
+++ b/Source/WebCore/platform/CrossThreadCopier.h
@@ -42,6 +42,7 @@
 namespace WebCore {
 
     class IntRect;
+    class IntSize;
     class KURL;
     class ResourceError;
     class ResourceRequest;
@@ -72,6 +73,9 @@ namespace WebCore {
     template<> struct CrossThreadCopierBase<false, false, IntRect> : public CrossThreadCopierPassThrough<IntRect> {
     };
 
+    template<> struct CrossThreadCopierBase<false, false, IntSize> : public CrossThreadCopierPassThrough<IntSize> {
+    };
+
     // Custom copy methods.
     template<typename T> struct CrossThreadCopierBase<false, true, T> {
         typedef typename WTF::RemoveTemplate<T, RefPtr>::Type TypeWithoutRefPtr;
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
deleted file mode 100644
index 2a5f0f964..000000000
--- a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
+++ /dev/null
@@ -1,961 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DefaultLocalizationStrategy.h"
-
-#if USE(PLATFORM_STRATEGIES)
-
-#include "IntSize.h"
-#include "LocalizedStrings.h"
-#include "NotImplemented.h"
-#include "PlatformString.h"
-#include <wtf/MathExtras.h>
-#include <wtf/text/CString.h>
-#include <wtf/unicode/CharacterNames.h>
-#include <wtf/UnusedParam.h>
-
-#if USE(CF)
-#include <wtf/RetainPtr.h>
-#endif
-
-#if PLATFORM(MAC)
-#include "WebCoreSystemInterface.h"
-#endif
-
-namespace WebCore {
-
-// We can't use String::format for two reasons:
-//  1) It doesn't handle non-ASCII characters in the format string.
-//  2) It doesn't handle the %2$d syntax.
-// Note that because |format| is used as the second parameter to va_start, it cannot be a reference
-// type according to section 18.7/3 of the C++ N1905 standard.
-static String formatLocalizedString(String format, ...)
-{
-#if USE(CF)
-    va_list arguments;
-    va_start(arguments, format);
-    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
-    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
-    va_end(arguments);
-    return result.get();
-#elif PLATFORM(QT)
-    va_list arguments;
-    va_start(arguments, format);
-    QString result;
-    result.vsprintf(format.latin1().data(), arguments);
-    va_end(arguments);
-    return result;
-#else
-    notImplemented();
-    return format;
-#endif
-}
-
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-static String truncatedStringForLookupMenuItem(const String& original)
-{
-    if (original.isEmpty())
-        return original;
-    
-    // Truncate the string if it's too long. This is in consistency with AppKit.
-    unsigned maxNumberOfGraphemeClustersInLookupMenuItem = 24;
-    DEFINE_STATIC_LOCAL(String, ellipsis, (&horizontalEllipsis, 1));
-    
-    String trimmed = original.stripWhiteSpace();
-    unsigned numberOfCharacters = numCharactersInGraphemeClusters(trimmed, maxNumberOfGraphemeClustersInLookupMenuItem);
-    return numberOfCharacters == trimmed.length() ? trimmed : trimmed.left(numberOfCharacters) + ellipsis;
-}
-#endif
-
-DefaultLocalizationStrategy& DefaultLocalizationStrategy::shared()
-{
-    DEFINE_STATIC_LOCAL(DefaultLocalizationStrategy, defaultLocalizationStrategy, ());
-    return defaultLocalizationStrategy;
-}
-
-DefaultLocalizationStrategy::DefaultLocalizationStrategy()
-{
-}
-
-String DefaultLocalizationStrategy::inputElementAltText()
-{
-    return WEB_UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
-}
-
-String DefaultLocalizationStrategy::resetButtonDefaultLabel()
-{
-    return WEB_UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
-}
-
-String DefaultLocalizationStrategy::searchableIndexIntroduction()
-{
-    return WEB_UI_STRING("This is a searchable index. Enter search keywords: ",
-        "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
-}
-
-String DefaultLocalizationStrategy::submitButtonDefaultLabel()
-{
-    return WEB_UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
-}
-
-String DefaultLocalizationStrategy::fileButtonChooseFileLabel()
-{
-    return WEB_UI_STRING("Choose File", "title for a single file chooser button used in HTML forms");
-}
-
-String DefaultLocalizationStrategy::fileButtonChooseMultipleFilesLabel()
-{
-    return WEB_UI_STRING("Choose Files", "title for a multiple file chooser button used in HTML forms. This title should be as short as possible.");
-}
-
-String DefaultLocalizationStrategy::fileButtonNoFileSelectedLabel()
-{
-    return WEB_UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
-}
-
-String DefaultLocalizationStrategy::fileButtonNoFilesSelectedLabel()
-{
-    return WEB_UI_STRING("no files selected", "text to display in file button used in HTML forms when no files are selected and the button allows multiple files to be selected");
-}
-
-String DefaultLocalizationStrategy::defaultDetailsSummaryText()
-{
-    return WEB_UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
-}
-
-#if PLATFORM(MAC)
-String DefaultLocalizationStrategy::copyImageUnknownFileLabel()
-{
-    return WEB_UI_STRING("unknown", "Unknown filename");
-}
-#endif
-
-#if ENABLE(CONTEXT_MENUS)
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenLinkInNewWindow()
-{
-    return WEB_UI_STRING("Open Link in New Window", "Open in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagDownloadLinkToDisk()
-{
-    return WEB_UI_STRING("Download Linked File", "Download Linked File context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyLinkToClipboard()
-{
-    return WEB_UI_STRING("Copy Link", "Copy Link context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenImageInNewWindow()
-{
-    return WEB_UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagDownloadImageToDisk()
-{
-    return WEB_UI_STRING("Download Image", "Download Image context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyImageToClipboard()
-{
-    return WEB_UI_STRING("Copy Image", "Copy Image context menu item");
-}
-
-#if PLATFORM(QT)
-String DefaultLocalizationStrategy::contextMenuItemTagCopyImageUrlToClipboard()
-{
-    return WEB_UI_STRING("Copy Image Address", "Copy Image Address menu item");
-}
-#endif
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenVideoInNewWindow()
-{
-    return WEB_UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenAudioInNewWindow()
-{
-    return WEB_UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return WEB_UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return WEB_UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaControls()
-{
-    return WEB_UI_STRING("Controls", "Media Controls context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaLoop()
-{
-    return WEB_UI_STRING("Loop", "Media Loop context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagEnterVideoFullscreen()
-{
-    return WEB_UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMediaPlay()
-{
-    return WEB_UI_STRING("Play", "Media Play context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMediaPause()
-{
-    return WEB_UI_STRING("Pause", "Media Pause context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMediaMute()
-{
-    return WEB_UI_STRING("Mute", "Media Mute context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenFrameInNewWindow()
-{
-    return WEB_UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopy()
-{
-    return WEB_UI_STRING("Copy", "Copy context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagGoBack()
-{
-    return WEB_UI_STRING("Back", "Back context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagGoForward()
-{
-    return WEB_UI_STRING("Forward", "Forward context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStop()
-{
-    return WEB_UI_STRING("Stop", "Stop context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagReload()
-{
-    return WEB_UI_STRING("Reload", "Reload context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCut()
-{
-    return WEB_UI_STRING("Cut", "Cut context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagPaste()
-{
-    return WEB_UI_STRING("Paste", "Paste context menu item");
-}
-
-#if PLATFORM(GTK)
-
-String DefaultLocalizationStrategy::contextMenuItemTagDelete()
-{
-    notImplemented();
-    return "Delete";
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagInputMethods()
-{
-    notImplemented();
-    return "Input Methods";
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagUnicode()
-{
-    notImplemented();
-    return "Unicode";
-}
-
-#endif
-
-#if PLATFORM(GTK) || PLATFORM(QT)
-
-String DefaultLocalizationStrategy::contextMenuItemTagSelectAll()
-{
-    notImplemented();
-    return "Select All";
-}
-
-#endif
-
-String DefaultLocalizationStrategy::contextMenuItemTagNoGuessesFound()
-{
-    return WEB_UI_STRING("No Guesses Found", "No Guesses Found context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagIgnoreSpelling()
-{
-    return WEB_UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagLearnSpelling()
-{
-    return WEB_UI_STRING("Learn Spelling", "Learn Spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSearchWeb()
-{
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    RetainPtr<CFStringRef> searchProviderName(AdoptCF, wkCopyDefaultSearchProviderDisplayName());
-    return formatLocalizedString(WEB_UI_STRING("Search with %@", "Search with search provider context menu item with provider name inserted"), searchProviderName.get());
-#else
-    return WEB_UI_STRING("Search with Google", "Search with Google context menu item");
-#endif
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary(const String& selectedString)
-{
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
-    UNUSED_PARAM(selectedString);
-    return WEB_UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
-#else
-#if USE(CF)
-    RetainPtr<CFStringRef> selectedCFString(AdoptCF, truncatedStringForLookupMenuItem(selectedString).createCFString());
-    return formatLocalizedString(WEB_UI_STRING("Look Up “%@”", "Look Up context menu item with selected word"), selectedCFString.get());
-#else
-    return WEB_UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", truncatedStringForLookupMenuItem(selectedString));
-#endif
-#endif
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenLink()
-{
-    return WEB_UI_STRING("Open Link", "Open Link context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagIgnoreGrammar()
-{
-    return WEB_UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSpellingMenu()
-{
-    return WEB_UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowSpellingPanel(bool show)
-{
-    if (show)
-        return WEB_UI_STRING("Show Spelling and Grammar", "menu item title");
-    return WEB_UI_STRING("Hide Spelling and Grammar", "menu item title");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCheckSpelling()
-{
-    return WEB_UI_STRING("Check Document Now", "Check spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCheckSpellingWhileTyping()
-{
-    return WEB_UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCheckGrammarWithSpelling()
-{
-    return WEB_UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagFontMenu()
-{
-    return WEB_UI_STRING("Font", "Font context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagBold()
-{
-    return WEB_UI_STRING("Bold", "Bold context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagItalic()
-{
-    return WEB_UI_STRING("Italic", "Italic context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagUnderline()
-{
-    return WEB_UI_STRING("Underline", "Underline context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOutline()
-{
-    return WEB_UI_STRING("Outline", "Outline context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagWritingDirectionMenu()
-{
-    return WEB_UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagTextDirectionMenu()
-{
-    return WEB_UI_STRING("Selection Direction", "Selection direction context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagDefaultDirection()
-{
-    return WEB_UI_STRING("Default", "Default writing direction context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagLeftToRight()
-{
-    return WEB_UI_STRING("Left to Right", "Left to Right context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagRightToLeft()
-{
-    return WEB_UI_STRING("Right to Left", "Right to Left context menu item");
-}
-
-#if PLATFORM(MAC)
-
-String DefaultLocalizationStrategy::contextMenuItemTagSearchInSpotlight()
-{
-    return WEB_UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowFonts()
-{
-    return WEB_UI_STRING("Show Fonts", "Show fonts context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStyles()
-{
-    return WEB_UI_STRING("Styles...", "Styles context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowColors()
-{
-    return WEB_UI_STRING("Show Colors", "Show colors context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSpeechMenu()
-{
-    return WEB_UI_STRING("Speech", "Speech context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStartSpeaking()
-{
-    return WEB_UI_STRING("Start Speaking", "Start speaking context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStopSpeaking()
-{
-    return WEB_UI_STRING("Stop Speaking", "Stop speaking context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCorrectSpellingAutomatically()
-{
-    return WEB_UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSubstitutionsMenu()
-{
-    return WEB_UI_STRING("Substitutions", "Substitutions context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowSubstitutions(bool show)
-{
-    if (show) 
-        return WEB_UI_STRING("Show Substitutions", "menu item title");
-    return WEB_UI_STRING("Hide Substitutions", "menu item title");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartCopyPaste()
-{
-    return WEB_UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartQuotes()
-{
-    return WEB_UI_STRING("Smart Quotes", "Smart Quotes context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartDashes()
-{
-    return WEB_UI_STRING("Smart Dashes", "Smart Dashes context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartLinks()
-{
-    return WEB_UI_STRING("Smart Links", "Smart Links context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagTextReplacement()
-{
-    return WEB_UI_STRING("Text Replacement", "Text Replacement context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagTransformationsMenu()
-{
-    return WEB_UI_STRING("Transformations", "Transformations context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMakeUpperCase()
-{
-    return WEB_UI_STRING("Make Upper Case", "Make Upper Case context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMakeLowerCase()
-{
-    return WEB_UI_STRING("Make Lower Case", "Make Lower Case context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCapitalize()
-{
-    return WEB_UI_STRING("Capitalize", "Capitalize context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagChangeBack(const String& replacedString)
-{
-    notImplemented();
-    return replacedString;
-}
-
-#endif
-
-String DefaultLocalizationStrategy::contextMenuItemTagInspectElement()
-{
-    return WEB_UI_STRING("Inspect Element", "Inspect Element context menu item");
-}
-
-#endif // ENABLE(CONTEXT_MENUS)
-
-String DefaultLocalizationStrategy::searchMenuNoRecentSearchesText()
-{
-    return WEB_UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
-}
-
-String DefaultLocalizationStrategy::searchMenuRecentSearchesText()
-{
-    return WEB_UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
-}
-
-String DefaultLocalizationStrategy::searchMenuClearRecentSearchesText()
-{
-    return WEB_UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
-}
-
-String DefaultLocalizationStrategy::AXWebAreaText()
-{
-    return WEB_UI_STRING("HTML content", "accessibility role description for web area");
-}
-
-String DefaultLocalizationStrategy::AXLinkText()
-{
-    return WEB_UI_STRING("link", "accessibility role description for link");
-}
-
-String DefaultLocalizationStrategy::AXListMarkerText()
-{
-    return WEB_UI_STRING("list marker", "accessibility role description for list marker");
-}
-
-String DefaultLocalizationStrategy::AXImageMapText()
-{
-    return WEB_UI_STRING("image map", "accessibility role description for image map");
-}
-
-String DefaultLocalizationStrategy::AXHeadingText()
-{
-    return WEB_UI_STRING("heading", "accessibility role description for headings");
-}
-
-String DefaultLocalizationStrategy::AXDefinitionListTermText()
-{
-    return WEB_UI_STRING("term", "term word of a definition");
-}
-
-String DefaultLocalizationStrategy::AXDefinitionListDefinitionText()
-{
-    return WEB_UI_STRING("definition", "definition phrase");
-}
-
-#if PLATFORM(MAC)
-String DefaultLocalizationStrategy::AXARIAContentGroupText(const String& ariaType)
-{
-    if (ariaType == "ARIAApplicationAlert")
-        return WEB_UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
-    if (ariaType == "ARIAApplicationAlertDialog")
-        return WEB_UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
-    if (ariaType == "ARIAApplicationDialog")
-        return WEB_UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
-    if (ariaType == "ARIAApplicationLog")
-        return WEB_UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
-    if (ariaType == "ARIAApplicationMarquee")
-        return WEB_UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
-    if (ariaType == "ARIAApplicationStatus")
-        return WEB_UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
-    if (ariaType == "ARIAApplicationTimer")
-        return WEB_UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
-    if (ariaType == "ARIADocument")
-        return WEB_UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
-    if (ariaType == "ARIADocumentArticle")
-        return WEB_UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
-    if (ariaType == "ARIADocumentNote")
-        return WEB_UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
-    if (ariaType == "ARIADocumentRegion")
-        return WEB_UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
-    if (ariaType == "ARIALandmarkApplication")
-        return WEB_UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
-    if (ariaType == "ARIALandmarkBanner")
-        return WEB_UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
-    if (ariaType == "ARIALandmarkComplementary")
-        return WEB_UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
-    if (ariaType == "ARIALandmarkContentInfo")
-        return WEB_UI_STRING("content", "An ARIA accessibility group that contains content.");    
-    if (ariaType == "ARIALandmarkMain")
-        return WEB_UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
-    if (ariaType == "ARIALandmarkNavigation")
-        return WEB_UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
-    if (ariaType == "ARIALandmarkSearch")
-        return WEB_UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
-    if (ariaType == "ARIAUserInterfaceTooltip")
-        return WEB_UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
-    if (ariaType == "ARIATabPanel")
-        return WEB_UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
-    if (ariaType == "ARIADocumentMath")
-        return WEB_UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
-    return String();
-}
-#endif
-
-String DefaultLocalizationStrategy::AXButtonActionVerb()
-{
-    return WEB_UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXRadioButtonActionVerb() 
-{
-    return WEB_UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXTextFieldActionVerb()
-{
-    return WEB_UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXCheckedCheckBoxActionVerb()
-{
-    return WEB_UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXUncheckedCheckBoxActionVerb()
-{
-    return WEB_UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXMenuListActionVerb()
-{
-    notImplemented();
-    return "select";
-}
-
-String DefaultLocalizationStrategy::AXMenuListPopupActionVerb()
-{
-    notImplemented();
-    return "select";
-}
-
-String DefaultLocalizationStrategy::AXLinkActionVerb()
-{
-    return WEB_UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::missingPluginText()
-{
-    return WEB_UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
-}
-
-String DefaultLocalizationStrategy::crashedPluginText()
-{
-    return WEB_UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
-}
-
-String DefaultLocalizationStrategy::multipleFileUploadText(unsigned numberOfFiles)
-{
-    return formatLocalizedString(WEB_UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
-}
-
-String DefaultLocalizationStrategy::unknownFileSizeText()
-{
-    return WEB_UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
-}
-
-#if PLATFORM(WIN)
-
-String DefaultLocalizationStrategy::uploadFileText()
-{
-    notImplemented();
-    return "upload";
-}
-
-String DefaultLocalizationStrategy::allFilesText()
-{
-    notImplemented();
-    return "all files";
-}
-
-#endif
-
-#if PLATFORM(MAC)
-
-String DefaultLocalizationStrategy::builtInPDFPluginName()
-{
-    // Also exposed to DOM.
-    return WEB_UI_STRING("WebKit built-in PDF", "Pseudo plug-in name, visible in Installed Plug-ins page in Safari.");
-}
-
-String DefaultLocalizationStrategy::pdfDocumentTypeDescription()
-{
-    // Also exposed to DOM.
-    return WEB_UI_STRING("Portable Document Format", "Description of the (only) type supported by PDF pseudo plug-in. Visible in Installed Plug-ins page in Safari.");
-}
-
-String DefaultLocalizationStrategy::keygenMenuItem512()
-{
-    return WEB_UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String DefaultLocalizationStrategy::keygenMenuItem1024()
-{
-    return WEB_UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String DefaultLocalizationStrategy::keygenMenuItem2048()
-{
-    return WEB_UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String DefaultLocalizationStrategy::keygenKeychainItemName(const String& host)
-{
-    RetainPtr<CFStringRef> hostCFString(AdoptCF, host.createCFString());
-    return formatLocalizedString(WEB_UI_STRING("Key from %@", "Name of keychain key generated by the KEYGEN tag"), hostCFString.get());
-}
-
-#if PLATFORM(IOS)
-String DefaultLocalizationStrategy::htmlSelectMultipleItems(int count)
-{
-    return formatLocalizedString(WEB_UI_STRING("%d Items", "Present the number of selected <option> items in a <select multiple> element (iOS only)"), count);
-}
-#endif // PLATFORM(IOS)
-#endif // PLATFORM(MAC)
-
-String DefaultLocalizationStrategy::imageTitle(const String& filename, const IntSize& size)
-{
-#if USE(CF)
-#if !defined(BUILDING_ON_LEOPARD)
-    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
-    RetainPtr<CFLocaleRef> locale(AdoptCF, CFLocaleCopyCurrent());
-    RetainPtr<CFNumberFormatterRef> formatter(AdoptCF, CFNumberFormatterCreate(0, locale.get(), kCFNumberFormatterDecimalStyle));
-
-    int widthInt = size.width();
-    RetainPtr<CFNumberRef> width(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &widthInt));
-    RetainPtr<CFStringRef> widthString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), width.get()));
-
-    int heightInt = size.height();
-    RetainPtr<CFNumberRef> height(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &heightInt));
-    RetainPtr<CFStringRef> heightString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), height.get()));
-
-    return formatLocalizedString(WEB_UI_STRING("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), widthString.get(), heightString.get());
-#else
-    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
-    return formatLocalizedString(WEB_UI_STRING("%@ %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), size.width(), size.height());
-#endif
-#else
-    return formatLocalizedString(WEB_UI_STRING("<filename> %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
-#endif
-}
-
-String DefaultLocalizationStrategy::mediaElementLoadingStateText()
-{
-    return WEB_UI_STRING("Loading...", "Media controller status message when the media is loading");
-}
-
-String DefaultLocalizationStrategy::mediaElementLiveBroadcastStateText()
-{
-    return WEB_UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
-}
-
-String DefaultLocalizationStrategy::localizedMediaControlElementString(const String& name)
-{
-    if (name == "AudioElement")
-        return WEB_UI_STRING("audio element controller", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return WEB_UI_STRING("video element controller", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return WEB_UI_STRING("mute", "accessibility role description for mute button");
-    if (name == "UnMuteButton")
-        return WEB_UI_STRING("unmute", "accessibility role description for turn mute off button");
-    if (name == "PlayButton")
-        return WEB_UI_STRING("play", "accessibility role description for play button");
-    if (name == "PauseButton")
-        return WEB_UI_STRING("pause", "accessibility role description for pause button");
-    if (name == "Slider")
-        return WEB_UI_STRING("movie time", "accessibility role description for timeline slider");
-    if (name == "SliderThumb")
-        return WEB_UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
-    if (name == "RewindButton")
-        return WEB_UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return WEB_UI_STRING("return to realtime", "accessibility role description for return to real time button");
-    if (name == "CurrentTimeDisplay")
-        return WEB_UI_STRING("elapsed time", "accessibility role description for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return WEB_UI_STRING("remaining time", "accessibility role description for time remaining display");
-    if (name == "StatusDisplay")
-        return WEB_UI_STRING("status", "accessibility role description for movie status");
-    if (name == "FullscreenButton")
-        return WEB_UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
-    if (name == "SeekForwardButton")
-        return WEB_UI_STRING("fast forward", "accessibility role description for fast forward button");
-    if (name == "SeekBackButton")
-        return WEB_UI_STRING("fast reverse", "accessibility role description for fast reverse button");
-    if (name == "ShowClosedCaptionsButton")
-        return WEB_UI_STRING("show closed captions", "accessibility role description for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return WEB_UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
-
-    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
-    if (name == "ControlsPanel")
-        return String();
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String DefaultLocalizationStrategy::localizedMediaControlElementHelpText(const String& name)
-{
-    if (name == "AudioElement")
-        return WEB_UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return WEB_UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return WEB_UI_STRING("mute audio tracks", "accessibility help text for mute button");
-    if (name == "UnMuteButton")
-        return WEB_UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
-    if (name == "PlayButton")
-        return WEB_UI_STRING("begin playback", "accessibility help text for play button");
-    if (name == "PauseButton")
-        return WEB_UI_STRING("pause playback", "accessibility help text for pause button");
-    if (name == "Slider")
-        return WEB_UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
-    if (name == "SliderThumb")
-        return WEB_UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
-    if (name == "RewindButton")
-        return WEB_UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return WEB_UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
-    if (name == "CurrentTimeDisplay")
-        return WEB_UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return WEB_UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
-    if (name == "StatusDisplay")
-        return WEB_UI_STRING("current movie status", "accessibility help text for movie status display");
-    if (name == "SeekBackButton")
-        return WEB_UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
-    if (name == "SeekForwardButton")
-        return WEB_UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
-    if (name == "FullscreenButton")
-        return WEB_UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
-    if (name == "ShowClosedCaptionsButton")
-        return WEB_UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return WEB_UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String DefaultLocalizationStrategy::localizedMediaTimeDescription(float time)
-{
-    if (!isfinite(time))
-        return WEB_UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
-
-    int seconds = static_cast<int>(fabsf(time)); 
-    int days = seconds / (60 * 60 * 24);
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-
-    if (days)
-        return formatLocalizedString(WEB_UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
-    if (hours)
-        return formatLocalizedString(WEB_UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
-    if (minutes)
-        return formatLocalizedString(WEB_UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
-    return formatLocalizedString(WEB_UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
-}
-
-String DefaultLocalizationStrategy::validationMessageValueMissingText()
-{
-    return WEB_UI_STRING("value missing", "Validation message for required form control elements that have no value");
-}
-
-String DefaultLocalizationStrategy::validationMessageTypeMismatchText()
-{
-    return WEB_UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
-}
-
-String DefaultLocalizationStrategy::validationMessagePatternMismatchText()
-{
-    return WEB_UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
-}
-
-String DefaultLocalizationStrategy::validationMessageTooLongText()
-{
-    return WEB_UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
-}
-
-String DefaultLocalizationStrategy::validationMessageRangeUnderflowText()
-{
-    return WEB_UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
-}
-
-String DefaultLocalizationStrategy::validationMessageRangeOverflowText()
-{
-    return WEB_UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
-}
-
-String DefaultLocalizationStrategy::validationMessageStepMismatchText()
-{
-    return WEB_UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
-}
-
-} // namespace WebCore
-
-#endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.h b/Source/WebCore/platform/DefaultLocalizationStrategy.h
deleted file mode 100644
index 4fa4d9c5c..000000000
--- a/Source/WebCore/platform/DefaultLocalizationStrategy.h
+++ /dev/null
@@ -1,195 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DefaultLocalizationStrategy_h
-#define DefaultLocalizationStrategy_h
-
-#if USE(PLATFORM_STRATEGIES)
-
-#include "LocalizationStrategy.h"
-#include <wtf/text/WTFString.h>
-
-namespace WebCore {
-
-class DefaultLocalizationStrategy : public LocalizationStrategy {
-public:
-    DefaultLocalizationStrategy();
-
-    static DefaultLocalizationStrategy& shared();
-
-    virtual String inputElementAltText();
-    virtual String resetButtonDefaultLabel();
-    virtual String searchableIndexIntroduction();
-    virtual String submitButtonDefaultLabel();
-    virtual String fileButtonChooseFileLabel();
-    virtual String fileButtonChooseMultipleFilesLabel();
-    virtual String fileButtonNoFileSelectedLabel();
-    virtual String fileButtonNoFilesSelectedLabel();
-    virtual String defaultDetailsSummaryText();
-#if PLATFORM(MAC)
-    virtual String copyImageUnknownFileLabel();
-#endif
-#if ENABLE(CONTEXT_MENUS)
-    virtual String contextMenuItemTagOpenLinkInNewWindow();
-    virtual String contextMenuItemTagDownloadLinkToDisk();
-    virtual String contextMenuItemTagCopyLinkToClipboard();
-    virtual String contextMenuItemTagOpenImageInNewWindow();
-    virtual String contextMenuItemTagDownloadImageToDisk();
-    virtual String contextMenuItemTagCopyImageToClipboard();
-#if PLATFORM(QT)
-    virtual String contextMenuItemTagCopyImageUrlToClipboard();
-#endif
-    virtual String contextMenuItemTagOpenFrameInNewWindow();
-    virtual String contextMenuItemTagCopy();
-    virtual String contextMenuItemTagGoBack();
-    virtual String contextMenuItemTagGoForward();
-    virtual String contextMenuItemTagStop();
-    virtual String contextMenuItemTagReload();
-    virtual String contextMenuItemTagCut();
-    virtual String contextMenuItemTagPaste();
-#if PLATFORM(GTK)
-    virtual String contextMenuItemTagDelete();
-    virtual String contextMenuItemTagInputMethods();
-    virtual String contextMenuItemTagUnicode();
-#endif
-#if PLATFORM(GTK) || PLATFORM(QT)
-    virtual String contextMenuItemTagSelectAll();
-#endif
-    virtual String contextMenuItemTagNoGuessesFound();
-    virtual String contextMenuItemTagIgnoreSpelling();
-    virtual String contextMenuItemTagLearnSpelling();
-    virtual String contextMenuItemTagSearchWeb();
-    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString);
-    virtual String contextMenuItemTagOpenLink();
-    virtual String contextMenuItemTagIgnoreGrammar();
-    virtual String contextMenuItemTagSpellingMenu();
-    virtual String contextMenuItemTagShowSpellingPanel(bool show);
-    virtual String contextMenuItemTagCheckSpelling();
-    virtual String contextMenuItemTagCheckSpellingWhileTyping();
-    virtual String contextMenuItemTagCheckGrammarWithSpelling();
-    virtual String contextMenuItemTagFontMenu();
-    virtual String contextMenuItemTagBold();
-    virtual String contextMenuItemTagItalic();
-    virtual String contextMenuItemTagUnderline();
-    virtual String contextMenuItemTagOutline();
-    virtual String contextMenuItemTagWritingDirectionMenu();
-    virtual String contextMenuItemTagTextDirectionMenu();
-    virtual String contextMenuItemTagDefaultDirection();
-    virtual String contextMenuItemTagLeftToRight();
-    virtual String contextMenuItemTagRightToLeft();
-#if PLATFORM(MAC)
-    virtual String contextMenuItemTagSearchInSpotlight();
-    virtual String contextMenuItemTagShowFonts();
-    virtual String contextMenuItemTagStyles();
-    virtual String contextMenuItemTagShowColors();
-    virtual String contextMenuItemTagSpeechMenu();
-    virtual String contextMenuItemTagStartSpeaking();
-    virtual String contextMenuItemTagStopSpeaking();
-    virtual String contextMenuItemTagCorrectSpellingAutomatically();
-    virtual String contextMenuItemTagSubstitutionsMenu();
-    virtual String contextMenuItemTagShowSubstitutions(bool show);
-    virtual String contextMenuItemTagSmartCopyPaste();
-    virtual String contextMenuItemTagSmartQuotes();
-    virtual String contextMenuItemTagSmartDashes();
-    virtual String contextMenuItemTagSmartLinks();
-    virtual String contextMenuItemTagTextReplacement();
-    virtual String contextMenuItemTagTransformationsMenu();
-    virtual String contextMenuItemTagMakeUpperCase();
-    virtual String contextMenuItemTagMakeLowerCase();
-    virtual String contextMenuItemTagCapitalize();
-    virtual String contextMenuItemTagChangeBack(const String& replacedString);
-#endif
-    virtual String contextMenuItemTagInspectElement();
-    virtual String contextMenuItemTagOpenVideoInNewWindow();
-    virtual String contextMenuItemTagOpenAudioInNewWindow();
-    virtual String contextMenuItemTagCopyVideoLinkToClipboard();
-    virtual String contextMenuItemTagCopyAudioLinkToClipboard();
-    virtual String contextMenuItemTagToggleMediaControls();
-    virtual String contextMenuItemTagToggleMediaLoop();
-    virtual String contextMenuItemTagEnterVideoFullscreen();
-    virtual String contextMenuItemTagMediaPlay();
-    virtual String contextMenuItemTagMediaPause();
-    virtual String contextMenuItemTagMediaMute();
-#endif // ENABLE(CONTEXT_MENUS)
-    virtual String searchMenuNoRecentSearchesText();
-    virtual String searchMenuRecentSearchesText();
-    virtual String searchMenuClearRecentSearchesText();
-    virtual String AXWebAreaText();
-    virtual String AXLinkText();
-    virtual String AXListMarkerText();
-    virtual String AXImageMapText();
-    virtual String AXHeadingText();
-    virtual String AXDefinitionListTermText();
-    virtual String AXDefinitionListDefinitionText();
-#if PLATFORM(MAC)
-    virtual String AXARIAContentGroupText(const String& ariaType);
-#endif
-    virtual String AXButtonActionVerb();
-    virtual String AXRadioButtonActionVerb();
-    virtual String AXTextFieldActionVerb();
-    virtual String AXCheckedCheckBoxActionVerb();
-    virtual String AXUncheckedCheckBoxActionVerb();
-    virtual String AXMenuListActionVerb();
-    virtual String AXMenuListPopupActionVerb();
-    virtual String AXLinkActionVerb();
-    virtual String missingPluginText();
-    virtual String crashedPluginText();
-    virtual String multipleFileUploadText(unsigned numberOfFiles);
-    virtual String unknownFileSizeText();
-#if PLATFORM(WIN)
-    virtual String uploadFileText();
-    virtual String allFilesText();
-#endif
-#if PLATFORM(MAC)
-    virtual String builtInPDFPluginName();
-    virtual String pdfDocumentTypeDescription();
-    virtual String keygenMenuItem512();
-    virtual String keygenMenuItem1024();
-    virtual String keygenMenuItem2048();
-    virtual String keygenKeychainItemName(const String& host);
-#if PLATFORM(IOS)
-    virtual String htmlSelectMultipleItems(int);
-#endif // PLATFORM(IOS)
-#endif // PLATFORM(MAC)
-    virtual String imageTitle(const String& filename, const IntSize&);
-    virtual String mediaElementLoadingStateText();
-    virtual String mediaElementLiveBroadcastStateText();
-    virtual String localizedMediaControlElementString(const String&);
-    virtual String localizedMediaControlElementHelpText(const String&);
-    virtual String localizedMediaTimeDescription(float);
-    virtual String validationMessageValueMissingText();
-    virtual String validationMessageTypeMismatchText();
-    virtual String validationMessagePatternMismatchText();
-    virtual String validationMessageTooLongText();
-    virtual String validationMessageRangeUnderflowText();
-    virtual String validationMessageRangeOverflowText();
-    virtual String validationMessageStepMismatchText();
-};
-
-} // namespace WebCore
-
-#endif // USE(PLATFORM_STRATEGIES)
-
-#endif // DefaultLocalizationStrategy_h
diff --git a/Source/WebCore/platform/DragData.h b/Source/WebCore/platform/DragData.h
index 17abd44fa..ff818de4a 100644
--- a/Source/WebCore/platform/DragData.h
+++ b/Source/WebCore/platform/DragData.h
@@ -36,6 +36,7 @@
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
+#include <wtf/text/WTFString.h>
 
 #ifdef __OBJC__ 
 #import <Foundation/Foundation.h>
@@ -120,7 +121,7 @@ public:
     bool containsFiles() const;
     unsigned numberOfFiles() const;
 #if PLATFORM(MAC)
-    NSPasteboard *pasteboard() { return m_pasteboard.get(); }
+    const String& pasteboardName() { return m_pasteboardName; }
 #endif
 
 #if PLATFORM(QT) || PLATFORM(GTK)
@@ -146,7 +147,7 @@ private:
     DragOperation m_draggingSourceOperationMask;
     DragApplicationFlags m_applicationFlags;
 #if PLATFORM(MAC)
-    RetainPtr<NSPasteboard> m_pasteboard;
+    String m_pasteboardName;
 #endif
 #if PLATFORM(WIN)
     DragDataMap m_dragDataMap;
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 33c643e6d..9168ea6bb 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -198,12 +198,16 @@ RetainPtr<CFURLRef> pathAsURL(const String&);
 String filenameToString(const char*);
 String filenameForDisplay(const String&);
 CString applicationDirectoryPath();
+CString sharedResourcesPath();
 uint64_t getVolumeFreeSizeForPath(const char*);
 #endif
 
 #if PLATFORM(WIN) && !OS(WINCE)
 String localUserSpecificStorageDirectory();
 String roamingUserSpecificStorageDirectory();
+#endif
+
+#if PLATFORM(WIN) && USE(CF)
 bool safeCreateFile(const String&, CFDataRef);
 #endif
 
diff --git a/Source/WebCore/platform/FractionalLayoutUnit.h b/Source/WebCore/platform/FractionalLayoutUnit.h
new file mode 100644
index 000000000..77adaa796
--- /dev/null
+++ b/Source/WebCore/platform/FractionalLayoutUnit.h
@@ -0,0 +1,512 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutUnit_h
+#define FractionalLayoutUnit_h
+
+#include <limits.h>
+#include <limits>
+#include <stdlib.h>
+
+namespace WebCore {
+
+static const int kFixedPointDenominator = 60;
+const int intMaxForLayoutUnit = INT_MAX / kFixedPointDenominator;
+const int intMinForLayoutUnit = -intMaxForLayoutUnit;
+
+class FractionalLayoutUnit {
+public:
+    FractionalLayoutUnit() : m_value(0) { }
+    FractionalLayoutUnit(int value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(unsigned short value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(unsigned int value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(float value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(double value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(const FractionalLayoutUnit& value) { m_value = value.rawValue(); }
+
+    inline int toInt() const { return m_value / kFixedPointDenominator; }
+    inline unsigned toUnsigned() const { ASSERT(m_value >= 0); return toInt(); }
+    inline float toFloat() const { return static_cast<float>(m_value) / kFixedPointDenominator; }
+    inline double toDouble() const { return static_cast<double>(m_value) / kFixedPointDenominator; }
+
+    operator int() const { return toInt(); }
+    operator unsigned() const { return toUnsigned(); }
+    operator float() const { return toFloat(); }
+    operator double() const { return toDouble(); }
+    operator bool() const { return m_value; }
+
+    inline int rawValue() const { return m_value; }
+    inline void setRawValue(int value) { m_value = value; }
+    inline void setRawValue(long long value)
+    {
+        ASSERT(value > std::numeric_limits<int>::min() && value < std::numeric_limits<int>::max());
+        m_value = static_cast<int>(value);
+    }
+
+    inline FractionalLayoutUnit abs()
+    {
+        FractionalLayoutUnit returnValue;
+        returnValue.setRawValue(::abs(m_value));
+        return returnValue;
+    }
+#if OS(DARWIN)
+    inline int wtf_ceil()
+#else
+    inline int ceil()
+#endif
+    {
+        if (m_value > 0)
+            return (m_value + kFixedPointDenominator - 1) / kFixedPointDenominator;
+        return (m_value - kFixedPointDenominator + 1) / kFixedPointDenominator;
+    }
+    inline int round()
+    {
+        if (m_value > 0)
+            return (m_value + (kFixedPointDenominator / 2)) / kFixedPointDenominator;
+        return (m_value - (kFixedPointDenominator / 2)) / kFixedPointDenominator;
+    }
+
+    inline int floor()
+    {
+        return toInt();
+    }
+
+    static float epsilon() { return 1 / kFixedPointDenominator; }
+    static const FractionalLayoutUnit max()
+    {
+        FractionalLayoutUnit m;
+        m.m_value = std::numeric_limits<int>::max();
+        return m;
+    }
+    static const FractionalLayoutUnit min()
+    {
+        FractionalLayoutUnit m;
+        m.m_value = std::numeric_limits<int>::min();
+        return m;
+    }
+    
+private:
+    inline bool isInBounds(int value)
+    {
+        return ::abs(value) < std::numeric_limits<int>::max() / kFixedPointDenominator;
+    }
+    inline bool isInBounds(unsigned value)
+    {
+        return value < static_cast<unsigned>(std::numeric_limits<int>::max()) / kFixedPointDenominator;
+    }
+    inline bool isInBounds(double value)
+    {
+        return ::fabs(value) < std::numeric_limits<int>::max() / kFixedPointDenominator;
+    }
+
+    int m_value;
+};
+
+inline bool operator<=(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() <= b.rawValue();
+}
+
+inline bool operator<=(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() <= b;
+}
+
+inline bool operator<=(const FractionalLayoutUnit& a, int b)
+{
+    return a <= FractionalLayoutUnit(b);
+}
+
+inline bool operator<=(const float a, const FractionalLayoutUnit& b)
+{
+    return a <= b.toFloat();
+}
+
+inline bool operator<=(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) <= b;
+}
+
+inline bool operator>=(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() >= b.rawValue();
+}
+
+inline bool operator>=(const FractionalLayoutUnit& a, int b)
+{
+    return a >= FractionalLayoutUnit(b);
+}
+
+inline bool operator>=(const float a, const FractionalLayoutUnit& b)
+{
+    return a >= b.toFloat();
+}
+
+inline bool operator>=(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() >= b;
+}
+
+inline bool operator>=(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) >= b;
+}
+
+inline bool operator<(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() < b.rawValue();
+}
+
+inline bool operator<(const FractionalLayoutUnit& a, int b)
+{
+    return a < FractionalLayoutUnit(b);
+}
+
+inline bool operator<(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() < b;
+}
+
+inline bool operator<(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) < b;
+}
+
+inline bool operator<(const float a, const FractionalLayoutUnit& b)
+{
+    return a < b.toFloat();
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() > b.rawValue();
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() > b;
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() > b;
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, int b)
+{
+    return a > FractionalLayoutUnit(b);
+}
+
+inline bool operator>(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) > b;
+}
+
+inline bool operator>(const float a, const FractionalLayoutUnit& b)
+{
+    return a > b.toFloat();
+}
+
+inline bool operator>(const double a, const FractionalLayoutUnit& b)
+{
+    return a > b.toDouble();
+}
+
+inline bool operator!=(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() != b.rawValue();
+}
+
+inline bool operator!=(const FractionalLayoutUnit& a, float b)
+{
+    return a != FractionalLayoutUnit(b);
+}
+
+inline bool operator!=(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) != b;
+}
+
+inline bool operator!=(const FractionalLayoutUnit& a, int b)
+{
+    return a != FractionalLayoutUnit(b);
+}
+
+inline bool operator==(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() == b.rawValue();
+}
+
+inline bool operator==(const FractionalLayoutUnit& a, int b)
+{
+    return a == FractionalLayoutUnit(b);
+}
+
+inline bool operator==(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) == b;
+}
+
+inline bool operator==(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() == b;
+}
+
+inline bool operator==(const float a, const FractionalLayoutUnit& b)
+{
+    return a == b.toFloat();
+}
+
+// For multiplication that's prone to overflow, this bounds it to FractionalLayoutUnit::max() and ::min()
+inline FractionalLayoutUnit boundedMultiply(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    long long rawVal = static_cast<long long>(a.rawValue()) * b.rawValue() / kFixedPointDenominator;
+    if (rawVal > std::numeric_limits<int>::max())
+        return FractionalLayoutUnit::max();
+    if (rawVal < std::numeric_limits<int>::min())
+        return FractionalLayoutUnit::min();
+    returnVal.setRawValue(rawVal);
+    return returnVal;
+}
+
+inline FractionalLayoutUnit operator*(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    long long rawVal = static_cast<long long>(a.rawValue()) * b.rawValue() / kFixedPointDenominator;
+    returnVal.setRawValue(rawVal);
+    return returnVal;
+}    
+
+inline double operator*(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() * b;
+}
+
+inline float operator*(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() * b;
+}
+
+inline FractionalLayoutUnit operator*(const FractionalLayoutUnit& a, int b)
+{
+    return a * FractionalLayoutUnit(b);
+}
+
+inline FractionalLayoutUnit operator*(const FractionalLayoutUnit& a, unsigned b)
+{
+    return a * FractionalLayoutUnit(b);
+}
+
+inline FractionalLayoutUnit operator*(unsigned a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) * b;
+}
+
+inline FractionalLayoutUnit operator*(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) * b;
+}
+
+inline float operator*(const float a, const FractionalLayoutUnit& b)
+{
+    return a * b.toFloat();
+}
+
+inline double operator*(const double a, const FractionalLayoutUnit& b)
+{
+    return a * b.toDouble();
+}
+
+inline FractionalLayoutUnit operator/(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    long long rawVal = static_cast<long long>(kFixedPointDenominator) * a.rawValue() / b.rawValue();
+    returnVal.setRawValue(rawVal);
+    return returnVal;
+}    
+
+inline float operator/(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() / b;
+}
+
+inline double operator/(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() / b;
+}
+
+inline FractionalLayoutUnit operator/(const FractionalLayoutUnit& a, int b)
+{
+    return a / FractionalLayoutUnit(b);
+}
+
+inline FractionalLayoutUnit operator/(const FractionalLayoutUnit& a, unsigned int b)
+{
+    return a / FractionalLayoutUnit(b);
+}
+
+inline float operator/(const float a, const FractionalLayoutUnit& b)
+{
+    return a / b.toFloat();
+}
+
+inline FractionalLayoutUnit operator/(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) / b;
+}
+
+inline FractionalLayoutUnit operator/(unsigned int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) / b;
+}
+
+inline FractionalLayoutUnit operator+(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    returnVal.setRawValue(a.rawValue() + b.rawValue());
+    return returnVal;
+}
+
+inline FractionalLayoutUnit operator+(const FractionalLayoutUnit& a, int b)
+{
+    return a + FractionalLayoutUnit(b);
+}
+
+inline float operator+(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() + b;
+}
+
+inline double operator+(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() + b;
+}
+
+inline FractionalLayoutUnit operator+(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) + b;
+}
+
+inline float operator+(const float a, const FractionalLayoutUnit& b)
+{
+    return a + b.toFloat();
+}
+
+inline FractionalLayoutUnit operator-(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    returnVal.setRawValue(a.rawValue() - b.rawValue());
+    return returnVal;
+}
+
+inline FractionalLayoutUnit operator-(const FractionalLayoutUnit& a, int b)
+{
+    return a - FractionalLayoutUnit(b);
+}
+
+inline float operator-(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() - b;
+}
+
+inline FractionalLayoutUnit operator-(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) - b;
+}
+
+inline float operator-(const float a, const FractionalLayoutUnit& b)
+{
+    return a - b.toFloat();
+}
+
+inline FractionalLayoutUnit operator-(const FractionalLayoutUnit& a)
+{
+    FractionalLayoutUnit returnVal;
+    returnVal.setRawValue(-a.rawValue());
+    return returnVal;
+}
+
+inline FractionalLayoutUnit& operator+=(FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    a = a + b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator+=(FractionalLayoutUnit& a, int b)
+{
+    a = a + b;
+    return a;
+}
+
+inline float& operator+=(float& a, const FractionalLayoutUnit& b)
+{
+    a = a + b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator-=(FractionalLayoutUnit& a, int b)
+{
+    a = a - b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator-=(FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    a = a - b;
+    return a;
+}
+
+inline float& operator-=(float& a, const FractionalLayoutUnit& b)
+{
+    a = a - b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, int b)
+{
+    a = a * b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, float b)
+{
+    a = a * b;
+    return a;
+}
+
+inline int snapSizeToPixel(FractionalLayoutUnit size, FractionalLayoutUnit location) 
+{
+    return (location + size).round() - location.round();
+}
+
+} // namespace WebCore
+
+#endif // FractionalLayoutUnit_h
diff --git a/Source/WebCore/platform/KURL.cpp b/Source/WebCore/platform/KURL.cpp
index 606280ab4..a3812c6a2 100644
--- a/Source/WebCore/platform/KURL.cpp
+++ b/Source/WebCore/platform/KURL.cpp
@@ -339,12 +339,6 @@ KURL::KURL(ParsedURLStringTag, const String& url)
     ASSERT(url == m_string);
 }
 
-KURL::KURL(ParsedURLStringTag, const URLString& url)
-{
-    parse(url.string());
-    ASSERT(url.string() == m_string);
-}
-
 KURL::KURL(const KURL& base, const String& relative)
 {
     init(base, relative, UTF8Encoding());
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index 9afced50e..a464dc3de 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -27,7 +27,6 @@
 #define KURL_h
 
 #include "PlatformString.h"
-#include "URLString.h"
 #include <wtf/HashMap.h>
 
 #if USE(CF)
@@ -70,7 +69,6 @@ public:
     // KURL object, or indiscernible from such.
     // It is usually best to avoid repeatedly parsing a string, unless memory saving outweigh the possible slow-downs.
     KURL(ParsedURLStringTag, const String&);
-    KURL(ParsedURLStringTag, const URLString&);
 #if USE(GOOGLEURL)
     KURL(WTF::HashTableDeletedValueType) : m_url(WTF::HashTableDeletedValue) { }
 #else
@@ -123,10 +121,8 @@ public:
 
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
-    URLString urlString() const { return URLString(m_url.string()); }
 #else
     const String& string() const { return m_string; }
-    URLString urlString() const { return URLString(m_string); }
 #endif
 
     String protocol() const;
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index 855d02f93..a6bc01939 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -149,4 +149,10 @@ PassOwnArrayPtr<Length> newLengthArray(const String& string, int& len)
     return r.release();
 }
 
+class SameSizeAsLength {
+    int32_t value;
+    int32_t metaData;
+};
+COMPILE_ASSERT(sizeof(Length) == sizeof(SameSizeAsLength), length_should_stay_small);
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/LocalizationStrategy.h b/Source/WebCore/platform/LocalizationStrategy.h
deleted file mode 100644
index 8fab764b8..000000000
--- a/Source/WebCore/platform/LocalizationStrategy.h
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Igalia S.L
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef LocalizationStrategy_h
-#define LocalizationStrategy_h
-
-#if USE(PLATFORM_STRATEGIES)
-
-#include <wtf/Forward.h>
-
-namespace WebCore {
-
-class IntSize;
-
-class LocalizationStrategy {
-public:    
-    virtual String inputElementAltText() = 0;
-    virtual String resetButtonDefaultLabel() = 0;
-    virtual String searchableIndexIntroduction() = 0;
-    virtual String submitButtonDefaultLabel() = 0;
-    virtual String fileButtonChooseFileLabel() = 0;
-    virtual String fileButtonChooseMultipleFilesLabel() = 0;
-    virtual String fileButtonNoFileSelectedLabel() = 0;
-    virtual String fileButtonNoFilesSelectedLabel() = 0;
-    virtual String defaultDetailsSummaryText() = 0;
-
-#if PLATFORM(MAC)
-    virtual String copyImageUnknownFileLabel() = 0;
-#endif
-
-#if ENABLE(CONTEXT_MENUS)
-    virtual String contextMenuItemTagOpenLinkInNewWindow() = 0;
-    virtual String contextMenuItemTagDownloadLinkToDisk() = 0;
-    virtual String contextMenuItemTagCopyLinkToClipboard() = 0;
-    virtual String contextMenuItemTagOpenImageInNewWindow() = 0;
-    virtual String contextMenuItemTagDownloadImageToDisk() = 0;
-    virtual String contextMenuItemTagCopyImageToClipboard() = 0;
-#if PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
-    virtual String contextMenuItemTagCopyImageUrlToClipboard() = 0;
-#endif
-    virtual String contextMenuItemTagOpenFrameInNewWindow() = 0;
-    virtual String contextMenuItemTagCopy() = 0;
-    virtual String contextMenuItemTagGoBack() = 0;
-    virtual String contextMenuItemTagGoForward() = 0;
-    virtual String contextMenuItemTagStop() = 0;
-    virtual String contextMenuItemTagReload() = 0;
-    virtual String contextMenuItemTagCut() = 0;
-    virtual String contextMenuItemTagPaste() = 0;
-#if PLATFORM(GTK)
-    virtual String contextMenuItemTagDelete() = 0;
-    virtual String contextMenuItemTagInputMethods() = 0;
-    virtual String contextMenuItemTagUnicode() = 0;
-#endif
-#if PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL)
-    virtual String contextMenuItemTagSelectAll() = 0;
-#endif
-    virtual String contextMenuItemTagNoGuessesFound() = 0;
-    virtual String contextMenuItemTagIgnoreSpelling() = 0;
-    virtual String contextMenuItemTagLearnSpelling() = 0;
-    virtual String contextMenuItemTagSearchWeb() = 0;
-    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString) = 0;
-    virtual String contextMenuItemTagOpenLink() = 0;
-    virtual String contextMenuItemTagIgnoreGrammar() = 0;
-    virtual String contextMenuItemTagSpellingMenu() = 0;
-    virtual String contextMenuItemTagShowSpellingPanel(bool show) = 0;
-    virtual String contextMenuItemTagCheckSpelling() = 0;
-    virtual String contextMenuItemTagCheckSpellingWhileTyping() = 0;
-    virtual String contextMenuItemTagCheckGrammarWithSpelling() = 0;
-    virtual String contextMenuItemTagFontMenu() = 0;
-    virtual String contextMenuItemTagBold() = 0;
-    virtual String contextMenuItemTagItalic() = 0;
-    virtual String contextMenuItemTagUnderline() = 0;
-    virtual String contextMenuItemTagOutline() = 0;
-    virtual String contextMenuItemTagWritingDirectionMenu() = 0;
-    virtual String contextMenuItemTagTextDirectionMenu() = 0;
-    virtual String contextMenuItemTagDefaultDirection() = 0;
-    virtual String contextMenuItemTagLeftToRight() = 0;
-    virtual String contextMenuItemTagRightToLeft() = 0;
-#if PLATFORM(MAC)
-    virtual String contextMenuItemTagSearchInSpotlight() = 0;
-    virtual String contextMenuItemTagShowFonts() = 0;
-    virtual String contextMenuItemTagStyles() = 0;
-    virtual String contextMenuItemTagShowColors() = 0;
-    virtual String contextMenuItemTagSpeechMenu() = 0;
-    virtual String contextMenuItemTagStartSpeaking() = 0;
-    virtual String contextMenuItemTagStopSpeaking() = 0;
-    virtual String contextMenuItemTagCorrectSpellingAutomatically() = 0;
-    virtual String contextMenuItemTagSubstitutionsMenu() = 0;
-    virtual String contextMenuItemTagShowSubstitutions(bool show) = 0;
-    virtual String contextMenuItemTagSmartCopyPaste() = 0;
-    virtual String contextMenuItemTagSmartQuotes() = 0;
-    virtual String contextMenuItemTagSmartDashes() = 0;
-    virtual String contextMenuItemTagSmartLinks() = 0;
-    virtual String contextMenuItemTagTextReplacement() = 0;
-    virtual String contextMenuItemTagTransformationsMenu() = 0;
-    virtual String contextMenuItemTagMakeUpperCase() = 0;
-    virtual String contextMenuItemTagMakeLowerCase() = 0;
-    virtual String contextMenuItemTagCapitalize() = 0;
-    virtual String contextMenuItemTagChangeBack(const String& replacedString) = 0;
-#endif
-    virtual String contextMenuItemTagOpenVideoInNewWindow() = 0;
-    virtual String contextMenuItemTagOpenAudioInNewWindow() = 0;
-    virtual String contextMenuItemTagCopyVideoLinkToClipboard() = 0;
-    virtual String contextMenuItemTagCopyAudioLinkToClipboard() = 0;
-    virtual String contextMenuItemTagToggleMediaControls() = 0;
-    virtual String contextMenuItemTagToggleMediaLoop() = 0;
-    virtual String contextMenuItemTagEnterVideoFullscreen() = 0;
-    virtual String contextMenuItemTagMediaPlay() = 0;
-    virtual String contextMenuItemTagMediaPause() = 0;
-    virtual String contextMenuItemTagMediaMute() = 0;
-    virtual String contextMenuItemTagInspectElement() = 0;
-#endif // ENABLE(CONTEXT_MENUS)
-
-    virtual String searchMenuNoRecentSearchesText() = 0;
-    virtual String searchMenuRecentSearchesText() = 0;
-    virtual String searchMenuClearRecentSearchesText() = 0;
-
-    virtual String AXWebAreaText() = 0;
-    virtual String AXLinkText() = 0;
-    virtual String AXListMarkerText() = 0;
-    virtual String AXImageMapText() = 0;
-    virtual String AXHeadingText() = 0;
-    virtual String AXDefinitionListTermText() = 0;
-    virtual String AXDefinitionListDefinitionText() = 0;
-
-#if PLATFORM(MAC)
-    virtual String AXARIAContentGroupText(const String& ariaType) = 0;
-#endif
-    
-    virtual String AXButtonActionVerb() = 0;
-    virtual String AXRadioButtonActionVerb() = 0;
-    virtual String AXTextFieldActionVerb() = 0;
-    virtual String AXCheckedCheckBoxActionVerb() = 0;
-    virtual String AXUncheckedCheckBoxActionVerb() = 0;
-    virtual String AXMenuListActionVerb() = 0;
-    virtual String AXMenuListPopupActionVerb() = 0;
-    virtual String AXLinkActionVerb() = 0;
-
-    virtual String missingPluginText() = 0;
-    virtual String crashedPluginText() = 0;
-    virtual String multipleFileUploadText(unsigned numberOfFiles) = 0;
-    virtual String unknownFileSizeText() = 0;
-
-#if PLATFORM(WIN)
-    virtual String uploadFileText() = 0;
-    virtual String allFilesText() = 0;
-#endif
-
-#if PLATFORM(MAC)
-    virtual String builtInPDFPluginName() = 0;
-    virtual String pdfDocumentTypeDescription() = 0;
-    virtual String keygenMenuItem512() = 0;
-    virtual String keygenMenuItem1024() = 0;
-    virtual String keygenMenuItem2048() = 0;
-    virtual String keygenKeychainItemName(const String& host) = 0;
-#endif
-
-    virtual String imageTitle(const String& filename, const IntSize& size) = 0;
-
-    virtual String mediaElementLoadingStateText() = 0;
-    virtual String mediaElementLiveBroadcastStateText() = 0;
-    virtual String localizedMediaControlElementString(const String&) = 0;
-    virtual String localizedMediaControlElementHelpText(const String&) = 0;
-    virtual String localizedMediaTimeDescription(float) = 0;
-
-    virtual String validationMessageValueMissingText() = 0;
-    virtual String validationMessageTypeMismatchText() = 0;
-    virtual String validationMessagePatternMismatchText() = 0;
-    virtual String validationMessageTooLongText() = 0;
-    virtual String validationMessageRangeUnderflowText() = 0;
-    virtual String validationMessageRangeOverflowText() = 0;
-    virtual String validationMessageStepMismatchText() = 0;
-
-protected:
-    virtual ~LocalizationStrategy()
-    {
-    }
-};
-
-} // namespace WebCore
-
-#endif // USE(PLATFORM_STRATEGIES)
-
-#endif // LocalizationStrategy_h
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index 1409bbf31..0383de6f7 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Igalia S.L
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,711 +27,931 @@
 #include "config.h"
 #include "LocalizedStrings.h"
 
-#include "DefaultLocalizationStrategy.h"
 #include "IntSize.h"
-#include "PlatformStrategies.h"
+#include "NotImplemented.h"
 #include "PlatformString.h"
+#include <wtf/MathExtras.h>
+#if USE(CF)
+#include <wtf/RetainPtr.h>
+#endif
+#include <wtf/UnusedParam.h>
+#include <wtf/unicode/CharacterNames.h>
+
+#if PLATFORM(MAC)
+#include "WebCoreSystemInterface.h"
+#endif
 
 namespace WebCore {
 
-#if USE(PLATFORM_STRATEGIES)
+// We can't use String::format for two reasons:
+//  1) It doesn't handle non-ASCII characters in the format string.
+//  2) It doesn't handle the %2$d syntax.
+// Note that because |format| is used as the second parameter to va_start, it cannot be a reference
+// type according to section 18.7/3 of the C++ N1905 standard.
+static String formatLocalizedString(String format, ...)
+{
+#if USE(CF)
+    va_list arguments;
+    va_start(arguments, format);
+    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
+    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
+    va_end(arguments);
+    return result.get();
+#else
+    notImplemented();
+    return format;
+#endif
+}
 
-static inline LocalizationStrategy* localizationStrategy()
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+static String truncatedStringForLookupMenuItem(const String& original)
 {
-    if (hasPlatformStrategies())
-        return platformStrategies()->localizationStrategy();
+    if (original.isEmpty())
+        return original;
+
+    // Truncate the string if it's too long. This is in consistency with AppKit.
+    unsigned maxNumberOfGraphemeClustersInLookupMenuItem = 24;
+    DEFINE_STATIC_LOCAL(String, ellipsis, (&horizontalEllipsis, 1));
 
-    return &DefaultLocalizationStrategy::shared();
+    String trimmed = original.stripWhiteSpace();
+    unsigned numberOfCharacters = numCharactersInGraphemeClusters(trimmed, maxNumberOfGraphemeClustersInLookupMenuItem);
+    return numberOfCharacters == trimmed.length() ? trimmed : trimmed.left(numberOfCharacters) + ellipsis;
 }
+#endif
 
 String inputElementAltText()
 {
-    return localizationStrategy()->inputElementAltText();
+    return WEB_UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
 }
 
 String resetButtonDefaultLabel()
 {
-    return localizationStrategy()->resetButtonDefaultLabel();
+    return WEB_UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
 }
 
 String searchableIndexIntroduction()
 {
-    return localizationStrategy()->searchableIndexIntroduction();
+    return WEB_UI_STRING("This is a searchable index. Enter search keywords: ",
+                         "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
 }
 
 String submitButtonDefaultLabel()
 {
-    return localizationStrategy()->submitButtonDefaultLabel();
+    return WEB_UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
 }
 
 String fileButtonChooseFileLabel()
 {
-    return localizationStrategy()->fileButtonChooseFileLabel();
+    return WEB_UI_STRING("Choose File", "title for a single file chooser button used in HTML forms");
 }
 
 String fileButtonChooseMultipleFilesLabel()
 {
-    return localizationStrategy()->fileButtonChooseMultipleFilesLabel();
+    return WEB_UI_STRING("Choose Files", "title for a multiple file chooser button used in HTML forms. This title should be as short as possible.");
 }
 
 String fileButtonNoFileSelectedLabel()
 {
-    return localizationStrategy()->fileButtonNoFileSelectedLabel();
+    return WEB_UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
 }
 
 String fileButtonNoFilesSelectedLabel()
 {
-    return localizationStrategy()->fileButtonNoFilesSelectedLabel();
+    return WEB_UI_STRING("no files selected", "text to display in file button used in HTML forms when no files are selected and the button allows multiple files to be selected");
 }
 
 String defaultDetailsSummaryText()
 {
-    return localizationStrategy()->defaultDetailsSummaryText();
+    return WEB_UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
 }
 
 #if PLATFORM(MAC)
 String copyImageUnknownFileLabel()
 {
-    return localizationStrategy()->copyImageUnknownFileLabel();
+    return WEB_UI_STRING("unknown", "Unknown filename");
 }
 #endif
 
 #if ENABLE(CONTEXT_MENUS)
 String contextMenuItemTagOpenLinkInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenLinkInNewWindow();
+    return WEB_UI_STRING("Open Link in New Window", "Open in New Window context menu item");
 }
 
 String contextMenuItemTagDownloadLinkToDisk()
 {
-    return localizationStrategy()->contextMenuItemTagDownloadLinkToDisk();
+    return WEB_UI_STRING("Download Linked File", "Download Linked File context menu item");
 }
 
 String contextMenuItemTagCopyLinkToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyLinkToClipboard();
+    return WEB_UI_STRING("Copy Link", "Copy Link context menu item");
 }
 
 String contextMenuItemTagOpenImageInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenImageInNewWindow();
+    return WEB_UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
 }
 
 String contextMenuItemTagDownloadImageToDisk()
 {
-    return localizationStrategy()->contextMenuItemTagDownloadImageToDisk();
+    return WEB_UI_STRING("Download Image", "Download Image context menu item");
 }
 
 String contextMenuItemTagCopyImageToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyImageToClipboard();
-}
-
-#if PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
-String contextMenuItemTagCopyImageUrlToClipboard()
-{
-    return localizationStrategy()->contextMenuItemTagCopyImageUrlToClipboard();
+    return WEB_UI_STRING("Copy Image", "Copy Image context menu item");
 }
-#endif
 
 String contextMenuItemTagOpenFrameInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenFrameInNewWindow();
+    return WEB_UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
 }
 
 String contextMenuItemTagCopy()
 {
-    return localizationStrategy()->contextMenuItemTagCopy();
+    return WEB_UI_STRING("Copy", "Copy context menu item");
 }
 
 String contextMenuItemTagGoBack()
 {
-    return localizationStrategy()->contextMenuItemTagGoBack();
+    return WEB_UI_STRING("Back", "Back context menu item");
 }
 
 String contextMenuItemTagGoForward()
 {
-    return localizationStrategy()->contextMenuItemTagGoForward();
+    return WEB_UI_STRING("Forward", "Forward context menu item");
 }
 
 String contextMenuItemTagStop()
 {
-    return localizationStrategy()->contextMenuItemTagStop();
+    return WEB_UI_STRING("Stop", "Stop context menu item");
 }
 
 String contextMenuItemTagReload()
 {
-    return localizationStrategy()->contextMenuItemTagReload();
+    return WEB_UI_STRING("Reload", "Reload context menu item");
 }
 
 String contextMenuItemTagCut()
 {
-    return localizationStrategy()->contextMenuItemTagCut();
+    return WEB_UI_STRING("Cut", "Cut context menu item");
 }
 
 String contextMenuItemTagPaste()
 {
-    return localizationStrategy()->contextMenuItemTagPaste();
+    return WEB_UI_STRING("Paste", "Paste context menu item");
 }
 
 #if PLATFORM(QT)
 String contextMenuItemTagSelectAll()
 {
-    return localizationStrategy()->contextMenuItemTagSelectAll();
+    notImplemented();
+    return "Select All";
 }
 #endif
 
 String contextMenuItemTagNoGuessesFound()
 {
-    return localizationStrategy()->contextMenuItemTagNoGuessesFound();
+    return WEB_UI_STRING("No Guesses Found", "No Guesses Found context menu item");
 }
 
 String contextMenuItemTagIgnoreSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagIgnoreSpelling();
+    return WEB_UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
 }
 
 String contextMenuItemTagLearnSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagLearnSpelling();
+    return WEB_UI_STRING("Learn Spelling", "Learn Spelling context menu item");
 }
 
 #if PLATFORM(MAC)
 String contextMenuItemTagSearchInSpotlight()
 {
-    return localizationStrategy()->contextMenuItemTagSearchInSpotlight();
+    return WEB_UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
 }
 #endif
 
 String contextMenuItemTagSearchWeb()
 {
-    return localizationStrategy()->contextMenuItemTagSearchWeb();
+#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    RetainPtr<CFStringRef> searchProviderName(AdoptCF, wkCopyDefaultSearchProviderDisplayName());
+    return formatLocalizedString(WEB_UI_STRING("Search with %@", "Search with search provider context menu item with provider name inserted"), searchProviderName.get());
+#else
+    return WEB_UI_STRING("Search with Google", "Search with Google context menu item");
+#endif
 }
 
 String contextMenuItemTagLookUpInDictionary(const String& selectedString)
 {
-    return localizationStrategy()->contextMenuItemTagLookUpInDictionary(selectedString);
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+    UNUSED_PARAM(selectedString);
+    return WEB_UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
+#else
+#if USE(CF)
+    RetainPtr<CFStringRef> selectedCFString(AdoptCF, truncatedStringForLookupMenuItem(selectedString).createCFString());
+    return formatLocalizedString(WEB_UI_STRING("Look Up “%@”", "Look Up context menu item with selected word"), selectedCFString.get());
+#else
+    return WEB_UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", truncatedStringForLookupMenuItem(selectedString));
+#endif
+#endif
 }
 
 String contextMenuItemTagOpenLink()
 {
-    return localizationStrategy()->contextMenuItemTagOpenLink();
+    return WEB_UI_STRING("Open Link", "Open Link context menu item");
 }
 
 String contextMenuItemTagIgnoreGrammar()
 {
-    return localizationStrategy()->contextMenuItemTagIgnoreGrammar();
+    return WEB_UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
 }
 
 String contextMenuItemTagSpellingMenu()
 {
-    return localizationStrategy()->contextMenuItemTagSpellingMenu();
+    return WEB_UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
 }
 
 String contextMenuItemTagShowSpellingPanel(bool show)
 {
-    return localizationStrategy()->contextMenuItemTagShowSpellingPanel(show);
+    if (show)
+        return WEB_UI_STRING("Show Spelling and Grammar", "menu item title");
+    return WEB_UI_STRING("Hide Spelling and Grammar", "menu item title");
 }
 
 String contextMenuItemTagCheckSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagCheckSpelling();
+    return WEB_UI_STRING("Check Document Now", "Check spelling context menu item");
 }
 
 String contextMenuItemTagCheckSpellingWhileTyping()
 {
-    return localizationStrategy()->contextMenuItemTagCheckSpellingWhileTyping();
+    return WEB_UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
 }
 
 String contextMenuItemTagCheckGrammarWithSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagCheckGrammarWithSpelling();
+    return WEB_UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
 }
 
 String contextMenuItemTagFontMenu()
 {
-    return localizationStrategy()->contextMenuItemTagFontMenu();
+    return WEB_UI_STRING("Font", "Font context sub-menu item");
 }
 
 #if PLATFORM(MAC)
 String contextMenuItemTagShowFonts()
 {
-    return localizationStrategy()->contextMenuItemTagShowFonts();
+    return WEB_UI_STRING("Show Fonts", "Show fonts context menu item");
 }
 #endif
 
 String contextMenuItemTagBold()
 {
-    return localizationStrategy()->contextMenuItemTagBold();
+    return WEB_UI_STRING("Bold", "Bold context menu item");
 }
 
 String contextMenuItemTagItalic()
 {
-    return localizationStrategy()->contextMenuItemTagItalic();
+    return WEB_UI_STRING("Italic", "Italic context menu item");
 }
 
 String contextMenuItemTagUnderline()
 {
-    return localizationStrategy()->contextMenuItemTagUnderline();
+    return WEB_UI_STRING("Underline", "Underline context menu item");
 }
 
 String contextMenuItemTagOutline()
 {
-    return localizationStrategy()->contextMenuItemTagOutline();
+    return WEB_UI_STRING("Outline", "Outline context menu item");
 }
 
 #if PLATFORM(MAC)
 String contextMenuItemTagStyles()
 {
-    return localizationStrategy()->contextMenuItemTagStyles();
+    return WEB_UI_STRING("Styles...", "Styles context menu item");
 }
 
 String contextMenuItemTagShowColors()
 {
-    return localizationStrategy()->contextMenuItemTagShowColors();
+    return WEB_UI_STRING("Show Colors", "Show colors context menu item");
 }
 
 String contextMenuItemTagSpeechMenu()
 {
-    return localizationStrategy()->contextMenuItemTagSpeechMenu();
+    return WEB_UI_STRING("Speech", "Speech context sub-menu item");
 }
 
 String contextMenuItemTagStartSpeaking()
 {
-    return localizationStrategy()->contextMenuItemTagStartSpeaking();
+    return WEB_UI_STRING("Start Speaking", "Start speaking context menu item");
 }
 
 String contextMenuItemTagStopSpeaking()
 {
-    return localizationStrategy()->contextMenuItemTagStopSpeaking();
+    return WEB_UI_STRING("Stop Speaking", "Stop speaking context menu item");
 }
 #endif
 
 String contextMenuItemTagWritingDirectionMenu()
 {
-    return localizationStrategy()->contextMenuItemTagWritingDirectionMenu();
+    return WEB_UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
 }
 
 String contextMenuItemTagTextDirectionMenu()
 {
-    return localizationStrategy()->contextMenuItemTagTextDirectionMenu();
+    return WEB_UI_STRING("Selection Direction", "Selection direction context sub-menu item");
 }
 
 String contextMenuItemTagDefaultDirection()
 {
-    return localizationStrategy()->contextMenuItemTagDefaultDirection();
+    return WEB_UI_STRING("Default", "Default writing direction context menu item");
 }
 
 String contextMenuItemTagLeftToRight()
 {
-    return localizationStrategy()->contextMenuItemTagLeftToRight();
+    return WEB_UI_STRING("Left to Right", "Left to Right context menu item");
 }
 
 String contextMenuItemTagRightToLeft()
 {
-    return localizationStrategy()->contextMenuItemTagRightToLeft();
+    return WEB_UI_STRING("Right to Left", "Right to Left context menu item");
 }
 
 #if PLATFORM(MAC)
 
 String contextMenuItemTagCorrectSpellingAutomatically()
 {
-    return localizationStrategy()->contextMenuItemTagCorrectSpellingAutomatically();
+    return WEB_UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
 }
 
 String contextMenuItemTagSubstitutionsMenu()
 {
-    return localizationStrategy()->contextMenuItemTagSubstitutionsMenu();
+    return WEB_UI_STRING("Substitutions", "Substitutions context sub-menu item");
 }
 
 String contextMenuItemTagShowSubstitutions(bool show)
 {
-    return localizationStrategy()->contextMenuItemTagShowSubstitutions(show);
+    if (show)
+        return WEB_UI_STRING("Show Substitutions", "menu item title");
+    return WEB_UI_STRING("Hide Substitutions", "menu item title");
 }
 
 String contextMenuItemTagSmartCopyPaste()
 {
-    return localizationStrategy()->contextMenuItemTagSmartCopyPaste();
+    return WEB_UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
 }
 
 String contextMenuItemTagSmartQuotes()
 {
-    return localizationStrategy()->contextMenuItemTagSmartQuotes();
+    return WEB_UI_STRING("Smart Quotes", "Smart Quotes context menu item");
 }
 
 String contextMenuItemTagSmartDashes()
 {
-    return localizationStrategy()->contextMenuItemTagSmartDashes();
+    return WEB_UI_STRING("Smart Dashes", "Smart Dashes context menu item");
 }
 
 String contextMenuItemTagSmartLinks()
 {
-    return localizationStrategy()->contextMenuItemTagSmartLinks();
+    return WEB_UI_STRING("Smart Links", "Smart Links context menu item");
 }
 
 String contextMenuItemTagTextReplacement()
 {
-    return localizationStrategy()->contextMenuItemTagTextReplacement();
+    return WEB_UI_STRING("Text Replacement", "Text Replacement context menu item");
 }
 
 String contextMenuItemTagTransformationsMenu()
 {
-    return localizationStrategy()->contextMenuItemTagTransformationsMenu();
+    return WEB_UI_STRING("Transformations", "Transformations context sub-menu item");
 }
 
 String contextMenuItemTagMakeUpperCase()
 {
-    return localizationStrategy()->contextMenuItemTagMakeUpperCase();
+    return WEB_UI_STRING("Make Upper Case", "Make Upper Case context menu item");
 }
 
 String contextMenuItemTagMakeLowerCase()
 {
-    return localizationStrategy()->contextMenuItemTagMakeLowerCase();
+    return WEB_UI_STRING("Make Lower Case", "Make Lower Case context menu item");
 }
 
 String contextMenuItemTagCapitalize()
 {
-    return localizationStrategy()->contextMenuItemTagCapitalize();
+    return WEB_UI_STRING("Capitalize", "Capitalize context menu item");
 }
 
 String contextMenuItemTagChangeBack(const String& replacedString)
 {
-    return localizationStrategy()->contextMenuItemTagChangeBack(replacedString);
+    notImplemented();
+    return replacedString;
 }
 
 #endif // PLATFORM(MAC)
 
 String contextMenuItemTagOpenVideoInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenVideoInNewWindow();
+    return WEB_UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
 }
 
 String contextMenuItemTagOpenAudioInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenAudioInNewWindow();
+    return WEB_UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
 }
 
 String contextMenuItemTagCopyVideoLinkToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyVideoLinkToClipboard();
+    return WEB_UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
 }
 
 String contextMenuItemTagCopyAudioLinkToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyAudioLinkToClipboard();
+    return WEB_UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
 }
 
 String contextMenuItemTagToggleMediaControls()
 {
-    return localizationStrategy()->contextMenuItemTagToggleMediaControls();
+    return WEB_UI_STRING("Controls", "Media Controls context menu item");
 }
 
 String contextMenuItemTagToggleMediaLoop()
 {
-    return localizationStrategy()->contextMenuItemTagToggleMediaLoop();
+    return WEB_UI_STRING("Loop", "Media Loop context menu item");
 }
 
 String contextMenuItemTagEnterVideoFullscreen()
 {
-    return localizationStrategy()->contextMenuItemTagEnterVideoFullscreen();
+    return WEB_UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
 }
 
 String contextMenuItemTagMediaPlay()
 {
-    return localizationStrategy()->contextMenuItemTagMediaPlay();
+    return WEB_UI_STRING("Play", "Media Play context menu item");
 }
 
 String contextMenuItemTagMediaPause()
 {
-    return localizationStrategy()->contextMenuItemTagMediaPause();
+    return WEB_UI_STRING("Pause", "Media Pause context menu item");
 }
 
 String contextMenuItemTagMediaMute()
 {
-    return localizationStrategy()->contextMenuItemTagMediaMute();
+    return WEB_UI_STRING("Mute", "Media Mute context menu item");
 }
     
 String contextMenuItemTagInspectElement()
 {
-    return localizationStrategy()->contextMenuItemTagInspectElement();
+    return WEB_UI_STRING("Inspect Element", "Inspect Element context menu item");
 }
 
 #endif // ENABLE(CONTEXT_MENUS)
 
 String searchMenuNoRecentSearchesText()
 {
-    return localizationStrategy()->searchMenuNoRecentSearchesText();
+    return WEB_UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
 }
 
-String searchMenuRecentSearchesText ()
+String searchMenuRecentSearchesText()
 {
-    return localizationStrategy()->searchMenuRecentSearchesText ();
+    return WEB_UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
 }
 
 String searchMenuClearRecentSearchesText()
 {
-    return localizationStrategy()->searchMenuClearRecentSearchesText();
+    return WEB_UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
 }
 
 String AXWebAreaText()
 {
-    return localizationStrategy()->AXWebAreaText();
+    return WEB_UI_STRING("HTML content", "accessibility role description for web area");
 }
 
 String AXLinkText()
 {
-    return localizationStrategy()->AXLinkText();
+    return WEB_UI_STRING("link", "accessibility role description for link");
 }
 
 String AXListMarkerText()
 {
-    return localizationStrategy()->AXListMarkerText();
+    return WEB_UI_STRING("list marker", "accessibility role description for list marker");
 }
 
 String AXImageMapText()
 {
-    return localizationStrategy()->AXImageMapText();
+    return WEB_UI_STRING("image map", "accessibility role description for image map");
 }
 
 String AXHeadingText()
 {
-    return localizationStrategy()->AXHeadingText();
+    return WEB_UI_STRING("heading", "accessibility role description for headings");
 }
 
 String AXDefinitionListTermText()
 {
-    return localizationStrategy()->AXDefinitionListTermText();
+    return WEB_UI_STRING("term", "term word of a definition");
 }
 
 String AXDefinitionListDefinitionText()
 {
-    return localizationStrategy()->AXDefinitionListDefinitionText();
+    return WEB_UI_STRING("definition", "definition phrase");
 }
 
 #if PLATFORM(MAC)
 String AXARIAContentGroupText(const String& ariaType)
 {
-    return localizationStrategy()->AXARIAContentGroupText(ariaType);
+    if (ariaType == "ARIAApplicationAlert")
+        return WEB_UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
+    if (ariaType == "ARIAApplicationAlertDialog")
+        return WEB_UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
+    if (ariaType == "ARIAApplicationDialog")
+        return WEB_UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
+    if (ariaType == "ARIAApplicationLog")
+        return WEB_UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
+    if (ariaType == "ARIAApplicationMarquee")
+        return WEB_UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");
+    if (ariaType == "ARIAApplicationStatus")
+        return WEB_UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");
+    if (ariaType == "ARIAApplicationTimer")
+        return WEB_UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");
+    if (ariaType == "ARIADocument")
+        return WEB_UI_STRING("document", "An ARIA accessibility group that acts as a document.");
+    if (ariaType == "ARIADocumentArticle")
+        return WEB_UI_STRING("article", "An ARIA accessibility group that acts as an article.");
+    if (ariaType == "ARIADocumentNote")
+        return WEB_UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");
+    if (ariaType == "ARIADocumentRegion")
+        return WEB_UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");
+    if (ariaType == "ARIALandmarkApplication")
+        return WEB_UI_STRING("application", "An ARIA accessibility group that acts as an application.");
+    if (ariaType == "ARIALandmarkBanner")
+        return WEB_UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");
+    if (ariaType == "ARIALandmarkComplementary")
+        return WEB_UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");
+    if (ariaType == "ARIALandmarkContentInfo")
+        return WEB_UI_STRING("content", "An ARIA accessibility group that contains content.");
+    if (ariaType == "ARIALandmarkMain")
+        return WEB_UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");
+    if (ariaType == "ARIALandmarkNavigation")
+        return WEB_UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");
+    if (ariaType == "ARIALandmarkSearch")
+        return WEB_UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");
+    if (ariaType == "ARIAUserInterfaceTooltip")
+        return WEB_UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");
+    if (ariaType == "ARIATabPanel")
+        return WEB_UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
+    if (ariaType == "ARIADocumentMath")
+        return WEB_UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
+    return String();
 }
 #endif
     
 String AXButtonActionVerb()
 {
-    return localizationStrategy()->AXButtonActionVerb();
+    return WEB_UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
 }
 
 String AXRadioButtonActionVerb()
 {
-    return localizationStrategy()->AXRadioButtonActionVerb();
+    return WEB_UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
 }
 
 String AXTextFieldActionVerb()
 {
-    return localizationStrategy()->AXTextFieldActionVerb();
+    return WEB_UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
 }
 
 String AXCheckedCheckBoxActionVerb()
 {
-    return localizationStrategy()->AXCheckedCheckBoxActionVerb();
+    return WEB_UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
 }
 
 String AXUncheckedCheckBoxActionVerb()
 {
-    return localizationStrategy()->AXUncheckedCheckBoxActionVerb();
+    return WEB_UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
 }
 
 String AXLinkActionVerb()
 {
-    return localizationStrategy()->AXLinkActionVerb();
+    return WEB_UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
 }
 
 String AXMenuListPopupActionVerb()
 {
-    return localizationStrategy()->AXMenuListPopupActionVerb();
+    notImplemented();
+    return "select";
 }
 
 String AXMenuListActionVerb()
 {
-    return localizationStrategy()->AXMenuListActionVerb();
+    notImplemented();
+    return "select";
 }
 
 String missingPluginText()
 {
-    return localizationStrategy()->missingPluginText();
+    return WEB_UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
 }
 
 String crashedPluginText()
 {
-    return localizationStrategy()->crashedPluginText();
+    return WEB_UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
 }
 
 String multipleFileUploadText(unsigned numberOfFiles)
 {
-    return localizationStrategy()->multipleFileUploadText(numberOfFiles);
+    return formatLocalizedString(WEB_UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
 }
 
 String unknownFileSizeText()
 {
-    return localizationStrategy()->unknownFileSizeText();
+    return WEB_UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
 }
 
 #if PLATFORM(WIN)
 String uploadFileText()
 {
-    return localizationStrategy()->uploadFileText();
+    notImplemented();
+    return "upload";
 }
 
 String allFilesText()
 {
-    return localizationStrategy()->allFilesText();
+    notImplemented();
+    return "all files";
 }
 #endif
 
 #if PLATFORM(MAC)
 String builtInPDFPluginName()
 {
-    return localizationStrategy()->builtInPDFPluginName();
+    // Also exposed to DOM.
+    return WEB_UI_STRING("WebKit built-in PDF", "Pseudo plug-in name, visible in Installed Plug-ins page in Safari.");
 }
 
 String pdfDocumentTypeDescription()
 {
-    return localizationStrategy()->pdfDocumentTypeDescription();
+    // Also exposed to DOM.
+    return WEB_UI_STRING("Portable Document Format", "Description of the (only) type supported by PDF pseudo plug-in. Visible in Installed Plug-ins page in Safari.");
 }
 
 String keygenMenuItem512()
 {
-    return localizationStrategy()->keygenMenuItem512();
+    return WEB_UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String keygenMenuItem1024()
 {
-    return localizationStrategy()->keygenMenuItem1024();
+    return WEB_UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String keygenMenuItem2048()
 {
-    return localizationStrategy()->keygenMenuItem2048();
+    return WEB_UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String keygenKeychainItemName(const String& host)
 {
-    return localizationStrategy()->keygenKeychainItemName(host);
+    RetainPtr<CFStringRef> hostCFString(AdoptCF, host.createCFString());
+    return formatLocalizedString(WEB_UI_STRING("Key from %@", "Name of keychain key generated by the KEYGEN tag"), hostCFString.get());
 }
 
 #endif
 
-String imageTitle(const String& filename, const IntSize& size)
+#if PLATFORM(IOS)
+String htmlSelectMultipleItems(size_t count)
 {
-    return localizationStrategy()->imageTitle(filename, size);
+    switch (count) {
+    case 0:
+        return WEB_UI_STRING("0 Items", "Present the element <select multiple> when no <option> items are selected (iOS only)");
+    case 1:
+        return WEB_UI_STRING("1 Item", "Present the element <select multiple> when a single <option> is selected (iOS only)");
+    default:
+        return formatLocalizedString(WEB_UI_STRING("%zu Items", "Present the number of selected <option> items in a <select multiple> element (iOS only)"), count);
+    }
 }
+#endif
 
-String mediaElementLoadingStateText()
+String imageTitle(const String& filename, const IntSize& size)
 {
-    return localizationStrategy()->mediaElementLoadingStateText();
-}
+#if USE(CF)
+#if !defined(BUILDING_ON_LEOPARD)
+    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
+    RetainPtr<CFLocaleRef> locale(AdoptCF, CFLocaleCopyCurrent());
+    RetainPtr<CFNumberFormatterRef> formatter(AdoptCF, CFNumberFormatterCreate(0, locale.get(), kCFNumberFormatterDecimalStyle));
 
-String mediaElementLiveBroadcastStateText()
-{
-    return localizationStrategy()->mediaElementLiveBroadcastStateText();
+    int widthInt = size.width();
+    RetainPtr<CFNumberRef> width(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &widthInt));
+    RetainPtr<CFStringRef> widthString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), width.get()));
+
+    int heightInt = size.height();
+    RetainPtr<CFNumberRef> height(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &heightInt));
+    RetainPtr<CFStringRef> heightString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), height.get()));
+
+    return formatLocalizedString(WEB_UI_STRING("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), widthString.get(), heightString.get());
+#else
+    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
+    return formatLocalizedString(WEB_UI_STRING("%@ %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), size.width(), size.height());
+#endif
+#else
+    return formatLocalizedString(WEB_UI_STRING("<filename> %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
+#endif
 }
 
-String localizedMediaControlElementString(const String& controlName)
+String mediaElementLoadingStateText()
 {
-    return localizationStrategy()->localizedMediaControlElementString(controlName);
+    return WEB_UI_STRING("Loading...", "Media controller status message when the media is loading");
 }
 
-String localizedMediaControlElementHelpText(const String& controlName)
+String mediaElementLiveBroadcastStateText()
 {
-    return localizationStrategy()->localizedMediaControlElementHelpText(controlName);
+    return WEB_UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
+}
+
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return WEB_UI_STRING("audio element controller", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return WEB_UI_STRING("video element controller", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return WEB_UI_STRING("mute", "accessibility role description for mute button");
+    if (name == "UnMuteButton")
+        return WEB_UI_STRING("unmute", "accessibility role description for turn mute off button");
+    if (name == "PlayButton")
+        return WEB_UI_STRING("play", "accessibility role description for play button");
+    if (name == "PauseButton")
+        return WEB_UI_STRING("pause", "accessibility role description for pause button");
+    if (name == "Slider")
+        return WEB_UI_STRING("movie time", "accessibility role description for timeline slider");
+    if (name == "SliderThumb")
+        return WEB_UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
+    if (name == "RewindButton")
+        return WEB_UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return WEB_UI_STRING("return to realtime", "accessibility role description for return to real time button");
+    if (name == "CurrentTimeDisplay")
+        return WEB_UI_STRING("elapsed time", "accessibility role description for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return WEB_UI_STRING("remaining time", "accessibility role description for time remaining display");
+    if (name == "StatusDisplay")
+        return WEB_UI_STRING("status", "accessibility role description for movie status");
+    if (name == "FullscreenButton")
+        return WEB_UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
+    if (name == "SeekForwardButton")
+        return WEB_UI_STRING("fast forward", "accessibility role description for fast forward button");
+    if (name == "SeekBackButton")
+        return WEB_UI_STRING("fast reverse", "accessibility role description for fast reverse button");
+    if (name == "ShowClosedCaptionsButton")
+        return WEB_UI_STRING("show closed captions", "accessibility role description for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return WEB_UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
+
+    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
+    if (name == "ControlsPanel")
+        return String();
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return WEB_UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return WEB_UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return WEB_UI_STRING("mute audio tracks", "accessibility help text for mute button");
+    if (name == "UnMuteButton")
+        return WEB_UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
+    if (name == "PlayButton")
+        return WEB_UI_STRING("begin playback", "accessibility help text for play button");
+    if (name == "PauseButton")
+        return WEB_UI_STRING("pause playback", "accessibility help text for pause button");
+    if (name == "Slider")
+        return WEB_UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
+    if (name == "SliderThumb")
+        return WEB_UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
+    if (name == "RewindButton")
+        return WEB_UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return WEB_UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
+    if (name == "CurrentTimeDisplay")
+        return WEB_UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return WEB_UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
+    if (name == "StatusDisplay")
+        return WEB_UI_STRING("current movie status", "accessibility help text for movie status display");
+    if (name == "SeekBackButton")
+        return WEB_UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
+    if (name == "SeekForwardButton")
+        return WEB_UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
+    if (name == "FullscreenButton")
+        return WEB_UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
+    if (name == "ShowClosedCaptionsButton")
+        return WEB_UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return WEB_UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
+
+    ASSERT_NOT_REACHED();
+    return String();
 }
 
 String localizedMediaTimeDescription(float time)
 {
-    return localizationStrategy()->localizedMediaTimeDescription(time);
+    if (!isfinite(time))
+        return WEB_UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
+
+    int seconds = static_cast<int>(fabsf(time));
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days)
+        return formatLocalizedString(WEB_UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
+    if (hours)
+        return formatLocalizedString(WEB_UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
+    if (minutes)
+        return formatLocalizedString(WEB_UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
+    return formatLocalizedString(WEB_UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
 }
 
 String validationMessageValueMissingText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return WEB_UI_STRING("value missing", "Validation message for required form control elements that have no value");
 }
 
 String validationMessageValueMissingForCheckboxText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForFileText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForMultipleFileText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForRadioText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForSelectText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageTypeMismatchText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return WEB_UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
 }
 
 String validationMessageTypeMismatchForEmailText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return validationMessageTypeMismatchText();
 }
 
 String validationMessageTypeMismatchForMultipleEmailText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return validationMessageTypeMismatchText();
 }
 
 String validationMessageTypeMismatchForURLText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return validationMessageTypeMismatchText();
 }
 
 String validationMessagePatternMismatchText()
 {
-    return localizationStrategy()->validationMessagePatternMismatchText();
+    return WEB_UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
 }
 
 String validationMessageTooLongText(int, int)
 {
-    return localizationStrategy()->validationMessageTooLongText();
+    return WEB_UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
 }
 
 String validationMessageRangeUnderflowText(const String&)
 {
-    return localizationStrategy()->validationMessageRangeUnderflowText();
+    return WEB_UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
 }
 
 String validationMessageRangeOverflowText(const String&)
 {
-    return localizationStrategy()->validationMessageRangeOverflowText();
+    return WEB_UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
 }
 
 String validationMessageStepMismatchText(const String&, const String&)
 {
-    return localizationStrategy()->validationMessageStepMismatchText();
-}
-
-#endif // USE(PLATFORM_STRATEGIES)
-
-#if !PLATFORM(MAC) && !PLATFORM(WIN)
-String localizedString(const char* key)
-{
-    return String::fromUTF8(key, strlen(key));
+    return WEB_UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
 }
-#endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index a73c991fe..3ebbef722 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -174,6 +174,10 @@ namespace WebCore {
     String keygenKeychainItemName(const String& host);
 #endif
 
+#if PLATFORM(IOS)
+    String htmlSelectMultipleItems(size_t num);
+#endif
+
     String imageTitle(const String& filename, const IntSize& size);
 
     String mediaElementLoadingStateText();
@@ -198,11 +202,12 @@ namespace WebCore {
     String validationMessageRangeOverflowText(const String& maximum);
     String validationMessageStepMismatchText(const String& base, const String& step);
 
-
+#if !PLATFORM(CHROMIUM)
 #define WEB_UI_STRING(string, description) WebCore::localizedString(string)
 #define WEB_UI_STRING_KEY(string, key, description) WebCore::localizedString(key)
 
     String localizedString(const char* key);
+#endif
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/Pasteboard.h b/Source/WebCore/platform/Pasteboard.h
index 8e5f91bb8..17dadd072 100644
--- a/Source/WebCore/platform/Pasteboard.h
+++ b/Source/WebCore/platform/Pasteboard.h
@@ -29,14 +29,14 @@
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
-
+#include <wtf/text/WTFString.h>
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
 #endif
-
 #if PLATFORM(GTK)
 #include <PasteboardHelper.h>
 #endif
+#include <wtf/Vector.h>
 
 // FIXME: This class is too high-level to be in the platform directory, since it
 // uses the DOM and makes calls to Editor. It should either be divested of its
@@ -60,11 +60,11 @@ typedef struct HWND__* HWND;
 namespace WebCore {
 
 #if PLATFORM(MAC)
-extern NSString *WebArchivePboardType;
-extern NSString *WebSmartPastePboardType;
-extern NSString *WebURLNamePboardType;
-extern NSString *WebURLPboardType;
-extern NSString *WebURLsWithTitlesPboardType;
+extern const char* WebArchivePboardType;
+extern const char* WebSmartPastePboardType;
+extern const char* WebURLNamePboardType;
+extern const char* WebURLPboardType;
+extern const char* WebURLsWithTitlesPboardType;
 #endif
 
 class Clipboard;
@@ -81,7 +81,7 @@ class Pasteboard {
 public:
 #if PLATFORM(MAC)
     // This is required to support OS X services.
-    void writeSelectionForTypes(NSArray* pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame*);
+    void writeSelectionForTypes(const Vector<String>& pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame*);
     Pasteboard(const String& pasteboardName);
 #endif
     
@@ -109,7 +109,7 @@ private:
     Pasteboard();
 
 #if PLATFORM(MAC)
-    RetainPtr<NSPasteboard> m_pasteboard;
+    String m_pasteboardName;
 #endif
 
 #if PLATFORM(WIN)
diff --git a/Source/WebCore/platform/PasteboardStrategy.h b/Source/WebCore/platform/PasteboardStrategy.h
new file mode 100644
index 000000000..515f55d49
--- /dev/null
+++ b/Source/WebCore/platform/PasteboardStrategy.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PasteboardStrategy_h
+#define PasteboardStrategy_h
+
+#if USE(PLATFORM_STRATEGIES)
+
+#include "SharedBuffer.h"
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Color;
+    
+class PasteboardStrategy {
+public:
+#if PLATFORM(MAC)
+    virtual void getTypes(Vector<String>& types, const String& pasteboardName) = 0;
+    virtual PassRefPtr<SharedBuffer> bufferForType(const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual void getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual String stringForType(const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual int changeCount(const String& pasteboardName) = 0;
+    virtual String uniqueName() = 0;
+    virtual Color color(const String& pasteboardName) = 0;
+    
+    virtual void copy(const String& fromPasteboard, const String& toPasteboard) = 0;
+    virtual void setTypes(const Vector<String>& pasteboardTypes, const String& pasteboardName) = 0;
+    virtual void setBufferForType(PassRefPtr<SharedBuffer>, const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual void setPathnamesForType(const Vector<String>&, const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual void setStringForType(const String&, const String& pasteboardType, const String& pasteboardName) = 0;
+#endif
+protected:
+    virtual ~PasteboardStrategy()
+    {
+    }
+};
+
+}
+#endif // USE(PLATFORM_STRATEGIES)
+
+#endif // !PasteboardStrategy_h
diff --git a/Source/WebCore/platform/PlatformMouseEvent.h b/Source/WebCore/platform/PlatformMouseEvent.h
index a3dcce490..20aecf107 100644
--- a/Source/WebCore/platform/PlatformMouseEvent.h
+++ b/Source/WebCore/platform/PlatformMouseEvent.h
@@ -40,13 +40,6 @@ typedef struct _Evas_Event_Mouse_Up Evas_Event_Mouse_Up;
 typedef struct _Evas_Event_Mouse_Move Evas_Event_Mouse_Move;
 #endif
 
-#if PLATFORM(QT)
-QT_BEGIN_NAMESPACE
-class QInputEvent;
-class QGraphicsSceneMouseEvent;
-QT_END_NAMESPACE
-#endif
-
 #if PLATFORM(WIN)
 typedef struct HWND__* HWND;
 typedef unsigned UINT;
@@ -122,11 +115,6 @@ namespace WebCore {
         int eventNumber() const { return m_eventNumber; }
 #endif
 
-#if PLATFORM(QT)
-        PlatformMouseEvent(QInputEvent*, int clickCount);
-        PlatformMouseEvent(QGraphicsSceneMouseEvent*, int clickCount);
-#endif
-
 #if PLATFORM(WIN)
         PlatformMouseEvent(HWND, UINT, WPARAM, LPARAM, bool didActivateWebView = false);
         void setClickCount(int count) { m_clickCount = count; }
diff --git a/Source/WebCore/WebCore.gyp/mac/Empty.cpp b/Source/WebCore/platform/PlatformPasteboard.h
index d25a2b763..2f94a667a 100644
--- a/Source/WebCore/WebCore.gyp/mac/Empty.cpp
+++ b/Source/WebCore/platform/PlatformPasteboard.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,5 +23,46 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-// This is an empty file used to convince Xcode to link a library when it
-// wouldn't otherwise have any reason to do so.
+#ifndef PlatformPasteboard_h
+#define PlatformPasteboard_h
+
+#include "SharedBuffer.h"
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+#if PLATFORM(MAC)
+OBJC_CLASS NSPasteboard;
+#endif
+
+namespace WebCore {
+
+class Color;
+
+class PlatformPasteboard {
+public:
+    PlatformPasteboard(const String& pasteboardName);
+    static String uniqueName();
+    
+    void getTypes(Vector<String>& types);
+    PassRefPtr<SharedBuffer> bufferForType(const String& pasteboardType);
+    void getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType);
+    String stringForType(const String& pasteboardType);
+    int changeCount() const;
+    Color color();
+    
+    void copy(const String& fromPasteboard);
+    void setTypes(const Vector<String>& pasteboardTypes);
+    void setBufferForType(PassRefPtr<SharedBuffer>, const String& pasteboardType);
+    void setPathnamesForType(const Vector<String>& pathnames, const String& pasteboardType);
+    void setStringForType(const String&, const String& pasteboardType);
+
+private:
+#if PLATFORM(MAC)
+    RetainPtr<NSPasteboard> m_pasteboard;
+#endif
+};
+
+}
+
+#endif // !PlatformPasteboard_h
diff --git a/Source/WebCore/platform/PlatformStrategies.cpp b/Source/WebCore/platform/PlatformStrategies.cpp
index dc9fc35a7..643f37505 100644
--- a/Source/WebCore/platform/PlatformStrategies.cpp
+++ b/Source/WebCore/platform/PlatformStrategies.cpp
@@ -29,8 +29,6 @@
 
 #include "PlatformStrategies.h"
 
-#include "DefaultLocalizationStrategy.h"
-
 namespace WebCore {
 
 static PlatformStrategies* s_platformStrategies;
@@ -59,11 +57,6 @@ bool hasPlatformStrategies()
     return s_platformStrategies;
 }
 
-LocalizationStrategy* PlatformStrategies::createLocalizationStrategy()
-{
-    return new DefaultLocalizationStrategy;
-}
-
 } // namespace WebCore
 
 #endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/PlatformStrategies.h b/Source/WebCore/platform/PlatformStrategies.h
index 7482d6005..c85ee5903 100644
--- a/Source/WebCore/platform/PlatformStrategies.h
+++ b/Source/WebCore/platform/PlatformStrategies.h
@@ -31,8 +31,8 @@
 namespace WebCore {
 
 class CookiesStrategy;
+class PasteboardStrategy;
 class PluginStrategy;
-class LocalizationStrategy;
 class VisitedLinkStrategy;
 
 class PlatformStrategies {
@@ -51,26 +51,25 @@ public:
         return m_pluginStrategy;
     }
 
-    LocalizationStrategy* localizationStrategy()
-    {
-        if (!m_localizationStrategy)
-            m_localizationStrategy = createLocalizationStrategy();
-        return m_localizationStrategy;
-    }
-
     VisitedLinkStrategy* visitedLinkStrategy()
     {
         if (!m_visitedLinkStrategy)
             m_visitedLinkStrategy = createVisitedLinkStrategy();
         return m_visitedLinkStrategy;
     }
+    PasteboardStrategy* pasteboardStrategy()
+    {
+        if (!m_pasteboardStrategy)
+            m_pasteboardStrategy = createPasteboardStrategy();
+        return m_pasteboardStrategy;
+    }
 
 protected:
     PlatformStrategies()
         : m_cookiesStrategy(0)
         , m_pluginStrategy(0)
-        , m_localizationStrategy(0)
         , m_visitedLinkStrategy(0)
+        , m_pasteboardStrategy(0)
     {
     }
 
@@ -81,13 +80,13 @@ protected:
 private:
     virtual CookiesStrategy* createCookiesStrategy() = 0;
     virtual PluginStrategy* createPluginStrategy() = 0;
-    virtual LocalizationStrategy* createLocalizationStrategy();
     virtual VisitedLinkStrategy* createVisitedLinkStrategy() = 0;
+    virtual PasteboardStrategy* createPasteboardStrategy() = 0; 
 
     CookiesStrategy* m_cookiesStrategy;
     PluginStrategy* m_pluginStrategy;
-    LocalizationStrategy* m_localizationStrategy;
     VisitedLinkStrategy* m_visitedLinkStrategy;
+    PasteboardStrategy* m_pasteboardStrategy;
 };
 
 PlatformStrategies* platformStrategies();
diff --git a/Source/WebCore/platform/PlatformTouchPoint.h b/Source/WebCore/platform/PlatformTouchPoint.h
index b18192d90..6e1594f30 100644
--- a/Source/WebCore/platform/PlatformTouchPoint.h
+++ b/Source/WebCore/platform/PlatformTouchPoint.h
@@ -48,7 +48,7 @@ public:
     PlatformTouchPoint() { };
 
 #if PLATFORM(QT)
-    PlatformTouchPoint(const QTouchEvent::TouchPoint&);
+    PlatformTouchPoint(const QTouchEvent::TouchPoint&, State);
 #elif PLATFORM(EFL)
     PlatformTouchPoint(unsigned id, const IntPoint& windowPos, State);
 #endif
diff --git a/Source/WebCore/platform/PlatformWheelEvent.h b/Source/WebCore/platform/PlatformWheelEvent.h
index f76f4c958..64e0f2463 100644
--- a/Source/WebCore/platform/PlatformWheelEvent.h
+++ b/Source/WebCore/platform/PlatformWheelEvent.h
@@ -37,13 +37,6 @@ typedef struct _GdkEventScroll GdkEventScroll;
 typedef struct _Evas_Event_Mouse_Wheel Evas_Event_Mouse_Wheel;
 #endif
 
-#if PLATFORM(QT)
-QT_BEGIN_NAMESPACE
-class QWheelEvent;
-class QGraphicsSceneWheelEvent;
-QT_END_NAMESPACE
-#endif
-
 #if PLATFORM(WIN)
 typedef struct HWND__* HWND;
 typedef unsigned WPARAM;
@@ -161,12 +154,6 @@ namespace WebCore {
         bool hasPreciseScrollingDeltas() const { return m_hasPreciseScrollingDeltas; }
 #endif
 
-#if PLATFORM(QT)
-        PlatformWheelEvent(QWheelEvent*);
-        PlatformWheelEvent(QGraphicsSceneWheelEvent*);
-        void applyDelta(int delta, Qt::Orientation);
-#endif
-
 #if PLATFORM(WIN)
         PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isMouseHWheel);
         PlatformWheelEvent(HWND, const FloatSize& delta, const FloatPoint& location);
diff --git a/Source/WebCore/platform/ScrollAnimator.cpp b/Source/WebCore/platform/ScrollAnimator.cpp
index f73c5cc06..d4ded3483 100644
--- a/Source/WebCore/platform/ScrollAnimator.cpp
+++ b/Source/WebCore/platform/ScrollAnimator.cpp
@@ -52,9 +52,6 @@ ScrollAnimator::ScrollAnimator(ScrollableArea* scrollableArea)
     : m_scrollableArea(scrollableArea)
     , m_currentPosX(0)
     , m_currentPosY(0)
-    , m_currentZoomScale(1)
-    , m_currentZoomTransX(0)
-    , m_currentZoomTransY(0)
 {
 }
 
@@ -125,12 +122,6 @@ bool ScrollAnimator::handleWheelEvent(const PlatformWheelEvent& e)
     return handled;
 }
 
-#if ENABLE(GESTURE_EVENTS)
-void ScrollAnimator::handleGestureEvent(const PlatformGestureEvent&)
-{
-}
-#endif
-
 FloatPoint ScrollAnimator::currentPosition() const
 {
     return FloatPoint(m_currentPosX, m_currentPosY);
@@ -141,31 +132,4 @@ void ScrollAnimator::notifyPositionChanged()
     m_scrollableArea->setScrollOffsetFromAnimation(IntPoint(m_currentPosX, m_currentPosY));
 }
 
-void ScrollAnimator::notifyZoomChanged(ZoomAnimationState state)
-{
-    m_scrollableArea->zoomAnimatorTransformChanged(m_currentZoomScale, m_currentZoomTransX, m_currentZoomTransY,
-                                                   state == ZoomAnimationContinuing ? ScrollableArea::ZoomAnimationContinuing
-                                                                                    : ScrollableArea::ZoomAnimationFinishing);
-}
-
-FloatPoint ScrollAnimator::zoomTranslation() const
-{
-    return FloatPoint(m_currentZoomTransX, m_currentZoomTransY);
-}
-
-void ScrollAnimator::resetZoom()
-{
-    m_currentZoomScale = 1;
-    m_currentZoomTransX = 0;
-    m_currentZoomTransY = 0;
-}
-
-void ScrollAnimator::setZoomParametersForTest(float scale, float x, float y)
-{
-    m_currentZoomScale = scale;
-    m_currentZoomTransX = (1 - scale) * x;
-    m_currentZoomTransY = (1 - scale) * y;
-    notifyZoomChanged(ZoomAnimationContinuing); // Don't let page re-scale.
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimator.h b/Source/WebCore/platform/ScrollAnimator.h
index b33c45812..814d674e3 100644
--- a/Source/WebCore/platform/ScrollAnimator.h
+++ b/Source/WebCore/platform/ScrollAnimator.h
@@ -47,8 +47,6 @@ class PlatformGestureEvent;
 
 class ScrollAnimator {
 public:
-    enum ZoomAnimationState { ZoomAnimationContinuing, ZoomAnimationFinishing };
-
     static PassOwnPtr<ScrollAnimator> create(ScrollableArea*);
 
     virtual ~ScrollAnimator();
@@ -66,9 +64,6 @@ public:
     virtual void setIsActive() { }
 
     virtual bool handleWheelEvent(const PlatformWheelEvent&);
-#if ENABLE(GESTURE_EVENTS)
-    virtual void handleGestureEvent(const PlatformGestureEvent&);
-#endif
 
     FloatPoint currentPosition() const;
 
@@ -91,26 +86,18 @@ public:
     virtual void didAddHorizontalScrollbar(Scrollbar*) { }
     virtual void willRemoveHorizontalScrollbar(Scrollbar*) { }
 
-    float zoomScale() const { return m_currentZoomScale; }
-    FloatPoint zoomTranslation() const;
-    virtual void resetZoom();
-    virtual void setZoomParametersForTest(float, float, float);
-
     virtual bool shouldScrollbarParticipateInHitTesting(Scrollbar*) { return true; }
 
+    virtual void notifyContentAreaScrolled() { }
+
 protected:
     ScrollAnimator(ScrollableArea*);
 
     virtual void notifyPositionChanged();
-    virtual void notifyZoomChanged(ZoomAnimationState);
 
     ScrollableArea* m_scrollableArea;
     float m_currentPosX; // We avoid using a FloatPoint in order to reduce
     float m_currentPosY; // subclass code complexity.
-
-    float m_currentZoomScale;
-    float m_currentZoomTransX;
-    float m_currentZoomTransY;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.cpp b/Source/WebCore/platform/ScrollAnimatorNone.cpp
index 3d1472b38..083a18a70 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.cpp
+++ b/Source/WebCore/platform/ScrollAnimatorNone.cpp
@@ -371,36 +371,10 @@ void ScrollAnimatorNone::PerAxisData::updateVisibleLength(int visibleLength)
     m_visibleLength = visibleLength;
 }
 
-ScrollAnimatorNone::ZoomData::ZoomData(WebCore::ScrollAnimatorNone* parent)
-    : m_parent(parent)
-    , m_isAnimating(false)
-{
-}
-
-bool ScrollAnimatorNone::ZoomData::animateZoom(double currentTime)
-{
-    m_lastAnimationTime = currentTime;
-    double deltaTime = currentTime - m_startTime;
-
-    if (deltaTime > m_animationTime) {
-        m_parent->m_currentZoomScale = m_desiredScale;
-        m_parent->m_currentZoomTransX = m_desiredTransX;
-        m_parent->m_currentZoomTransY = m_desiredTransY;
-        return false;
-    }
-
-    double elapsedTimeFraction = deltaTime / m_animationTime;
-    m_parent->m_currentZoomScale = elapsedTimeFraction * (m_desiredScale - m_startScale) + m_startScale;
-    m_parent->m_currentZoomTransX = elapsedTimeFraction * m_desiredTransX;
-    m_parent->m_currentZoomTransY = elapsedTimeFraction * m_desiredTransY;
-    return true;
-}
-
 ScrollAnimatorNone::ScrollAnimatorNone(ScrollableArea* scrollableArea)
     : ScrollAnimator(scrollableArea)
     , m_horizontalData(this, &m_currentPosX, scrollableArea->visibleWidth())
     , m_verticalData(this, &m_currentPosY, scrollableArea->visibleHeight())
-    , m_zoomData(this)
     , m_animationTimer(this, &ScrollAnimatorNone::animationTimerFired)
 {
 }
@@ -470,63 +444,6 @@ void ScrollAnimatorNone::scrollToOffsetWithoutAnimation(const FloatPoint& offset
     notifyPositionChanged();
 }
 
-#if ENABLE(GESTURE_EVENTS)
-void ScrollAnimatorNone::zoom(const PlatformGestureEvent& pge)
-{
-    ASSERT(pge.type() == PlatformEvent::GestureDoubleTap);
-    // FIXME: modify this so we can start even if the timer is active.
-    if (!m_animationTimer.isActive()) {
-        m_currentZoomScale = 1;
-        m_currentZoomTransX = 0;
-        m_currentZoomTransY = 0;
-
-        double currentTime = WTF::monotonicallyIncreasingTime();
-        float scale = pge.deltaX();
-
-        m_zoomData.m_startTime = currentTime - kTickTime / 2;
-        m_zoomData.m_startScale = m_currentZoomScale;
-        m_zoomData.m_desiredScale = scale;
-        // FIXME: Document then simplify the following equations.
-        m_zoomData.m_desiredTransX = (1 - scale) * pge.globalPosition().x();
-        m_zoomData.m_desiredTransY = (1 - scale) * pge.globalPosition().y();
-#if ENABLE(DOUBLE_TAP_CENTERS)
-        if (pge.type() == PlatformEvent::GestureDoubleTap) {
-            // Zoom to centre of display. Pinch-to-zoom may not want this behaviour.
-            m_zoomData.m_desiredTransX += m_scrollableArea->visibleWidth() / 2 - pge.globalPosition().x();
-            m_zoomData.m_desiredTransY += m_scrollableArea->visibleHeight() / 2 - pge.globalPosition().y();
-        }
-#endif
-        m_zoomData.m_lastAnimationTime = currentTime;
-        m_zoomData.m_animationTime = kZoomTicks * kTickTime;
-
-        bool isContinuing = m_zoomData.animateZoom(currentTime);
-
-        double deltaToNextFrame = ceil((currentTime - m_startTime) * kFrameRate) / kFrameRate - (currentTime - m_startTime);
-        double nextTimerInterval = max(kMinimumTimerInterval, deltaToNextFrame);
-        if (isContinuing) {
-            m_animationTimer.startOneShot(nextTimerInterval);
-            m_zoomData.m_isAnimating = true;
-            notifyZoomChanged(ZoomAnimationContinuing);
-        } else
-            notifyZoomChanged(ZoomAnimationFinishing);
-    }
-}
-
-void ScrollAnimatorNone::handleGestureEvent(const PlatformGestureEvent& pge)
-{
-    TRACE_EVENT("ScrollAnimatorNone::handleGestureEvent", this, 0);
-    switch (pge.type()) {
-    case PlatformEvent::GestureDoubleTap:
-        zoom(pge);
-        break;
-
-    default:
-        // TODO: add any other event types we should handle
-        { }
-    }
-}
-#endif
-
 void ScrollAnimatorNone::willEndLiveResize()
 {
     updateVisibleLengths();
@@ -563,19 +480,6 @@ void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
     if (m_verticalData.m_startTime && m_verticalData.animateScroll(currentTime + deltaToNextFrame))
         continueAnimation = true;
 
-    if (m_zoomData.m_isAnimating) {
-#if PLATFORM(CHROMIUM)
-        TRACE_EVENT("ScrollAnimatorNone::notifyZoomChanged", this, 0);
-#endif
-        if (m_zoomData.m_startTime && m_zoomData.animateZoom(currentTime + deltaToNextFrame)) {
-            continueAnimation = true;
-            notifyZoomChanged(ZoomAnimationContinuing);
-        } else {
-            notifyZoomChanged(ZoomAnimationFinishing);
-            m_zoomData.m_isAnimating = false;
-        }
-    }
-
     if (continueAnimation) {
         double nextTimerInterval = max(kMinimumTimerInterval, deltaToNextFrame);
         timer->startOneShot(nextTimerInterval);
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.h b/Source/WebCore/platform/ScrollAnimatorNone.h
index f94d5239b..4d69a7c4a 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.h
+++ b/Source/WebCore/platform/ScrollAnimatorNone.h
@@ -50,11 +50,6 @@ public:
     virtual bool scroll(ScrollbarOrientation, ScrollGranularity, float step, float multiplier);
     virtual void scrollToOffsetWithoutAnimation(const FloatPoint&);
 
-#if ENABLE(GESTURE_EVENTS)
-    virtual void zoom(const PlatformGestureEvent&);
-    virtual void handleGestureEvent(const PlatformGestureEvent&);
-#endif
-
     virtual void willEndLiveResize();
     virtual void didAddVerticalScrollbar(Scrollbar*);
     virtual void didAddHorizontalScrollbar(Scrollbar*);
@@ -131,35 +126,12 @@ protected:
         int m_visibleLength;
     };
 
-    // While zooming, scale, posX and posY need to stay tightly coupled, so use a separate
-    // data structure.
-    struct ZoomData {
-        ZoomData(ScrollAnimatorNone* parent);
-        bool animateZoom(double currentTime);
-
-        ScrollAnimatorNone* m_parent;
-        bool m_isAnimating;
-
-        double m_startTime;
-
-        double m_animationTime;
-        double m_lastAnimationTime;
-
-        double m_startScale;
-        double m_desiredScale;
-        double m_desiredTransX;
-        double m_desiredTransY;
-    };
-
-    friend struct ZoomData;
-
     void animationTimerFired(Timer<ScrollAnimatorNone>*);
     void stopAnimationTimerIfNeeded();
     void updateVisibleLengths();
 
     PerAxisData m_horizontalData;
     PerAxisData m_verticalData;
-    ZoomData m_zoomData;
 
     double m_startTime;
     Timer<ScrollAnimatorNone> m_animationTimer;
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index f2bb054a3..4d14805ef 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -302,6 +302,7 @@ void ScrollView::setContentsSize(const IntSize& newSize)
         platformSetContentsSize();
     else
         updateScrollbars(scrollOffset());
+    updateOverhangAreas();
 }
 
 IntPoint ScrollView::maximumScrollPosition() const
@@ -500,7 +501,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
         if (hasHorizontalScrollbar != newHasHorizontalScrollbar && (hasHorizontalScrollbar || !avoidScrollbarCreation())) {
             if (scrollOrigin().y() && !newHasHorizontalScrollbar)
-                setScrollOriginY(scrollOrigin().y() - m_horizontalScrollbar->height());
+                ScrollableArea::setScrollOrigin(IntPoint(scrollOrigin().x(), scrollOrigin().y() - m_horizontalScrollbar->height()));
             if (m_horizontalScrollbar)
                 m_horizontalScrollbar->invalidate();
             setHasHorizontalScrollbar(newHasHorizontalScrollbar);
@@ -509,7 +510,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
         if (hasVerticalScrollbar != newHasVerticalScrollbar && (hasVerticalScrollbar || !avoidScrollbarCreation())) {
             if (scrollOrigin().x() && !newHasVerticalScrollbar)
-                setScrollOriginX(scrollOrigin().x() - m_verticalScrollbar->width());
+                ScrollableArea::setScrollOrigin(IntPoint(scrollOrigin().x() - m_verticalScrollbar->width(), scrollOrigin().y()));
             if (m_verticalScrollbar)
                 m_verticalScrollbar->invalidate();
             setHasVerticalScrollbar(newHasVerticalScrollbar);
@@ -655,21 +656,7 @@ void ScrollView::scrollContents(const IntSize& scrollDelta)
     }
 
     // Invalidate the overhang areas if they are visible.
-    IntRect horizontalOverhangRect;
-    IntRect verticalOverhangRect;
-    calculateOverhangAreasForPainting(horizontalOverhangRect, verticalOverhangRect);
-#if USE(ACCELERATED_COMPOSITING) && PLATFORM(CHROMIUM) && ENABLE(RUBBER_BANDING)
-    if (GraphicsLayer* overhangLayer = layerForOverhangAreas()) {
-        bool hasOverhangArea = !horizontalOverhangRect.isEmpty() || !verticalOverhangRect.isEmpty();
-        overhangLayer->setDrawsContent(hasOverhangArea);
-        if (hasOverhangArea)
-            overhangLayer->setNeedsDisplay();
-    }
-#endif
-    if (!horizontalOverhangRect.isEmpty())
-        hostWindow()->invalidateContentsAndRootView(horizontalOverhangRect, false /*immediate*/);
-    if (!verticalOverhangRect.isEmpty())
-        hostWindow()->invalidateContentsAndRootView(verticalOverhangRect, false /*immediate*/);
+    updateOverhangAreas();
 
     // This call will move children with native widgets (plugins) and invalidate them as well.
     frameRectsChanged();
@@ -845,30 +832,6 @@ void ScrollView::setScrollbarOverlayStyle(ScrollbarOverlayStyle overlayStyle)
     platformSetScrollbarOverlayStyle(overlayStyle);
 }
 
-bool ScrollView::wheelEvent(const PlatformWheelEvent& e)
-{
-    // We don't allow mouse wheeling to happen in a ScrollView that has had its scrollbars explicitly disabled.
-#if PLATFORM(WX)
-    if (!canHaveScrollbars()) {
-#else
-    if (!canHaveScrollbars() || platformWidget()) {
-#endif
-        return false;
-    }
-
-    return ScrollableArea::handleWheelEvent(e);
-}
-
-#if ENABLE(GESTURE_EVENTS)
-void ScrollView::gestureEvent(const PlatformGestureEvent& gestureEvent)
-{
-    if (platformWidget())
-        return;
-
-    ScrollableArea::handleGestureEvent(gestureEvent);
-}
-#endif
-
 void ScrollView::setFrameRect(const IntRect& newRect)
 {
     IntRect oldRect = frameRect();
@@ -1144,6 +1107,28 @@ void ScrollView::calculateOverhangAreasForPainting(IntRect& horizontalOverhangRe
     }
 }
 
+void ScrollView::updateOverhangAreas()
+{
+    if (!hostWindow())
+        return;
+
+    IntRect horizontalOverhangRect;
+    IntRect verticalOverhangRect;
+    calculateOverhangAreasForPainting(horizontalOverhangRect, verticalOverhangRect);
+#if USE(ACCELERATED_COMPOSITING) && PLATFORM(CHROMIUM) && ENABLE(RUBBER_BANDING)
+    if (GraphicsLayer* overhangLayer = layerForOverhangAreas()) {
+        bool hasOverhangArea = !horizontalOverhangRect.isEmpty() || !verticalOverhangRect.isEmpty();
+        overhangLayer->setDrawsContent(hasOverhangArea);
+        if (hasOverhangArea)
+            overhangLayer->setNeedsDisplay();
+    }
+#endif
+    if (!horizontalOverhangRect.isEmpty())
+        hostWindow()->invalidateContentsAndRootView(horizontalOverhangRect, false /*immediate*/);
+    if (!verticalOverhangRect.isEmpty())
+        hostWindow()->invalidateContentsAndRootView(verticalOverhangRect, false /*immediate*/);
+}
+
 void ScrollView::paintOverhangAreas(GraphicsContext* context, const IntRect& horizontalOverhangRect, const IntRect& verticalOverhangRect, const IntRect& dirtyRect)
 {
     ScrollbarTheme::theme()->paintOverhangAreas(this, context, horizontalOverhangRect, verticalOverhangRect, dirtyRect);
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index cb6ab4e3d..70511f16f 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -235,14 +235,6 @@ public:
     // For platforms that need to hit test scrollbars from within the engine's event handlers (like Win32).
     Scrollbar* scrollbarAtPoint(const IntPoint& windowPoint);
 
-    // This function exists for scrollviews that need to handle wheel events manually.
-    // On Mac the underlying NSScrollView just does the scrolling, but on other platforms
-    // (like Windows), we need this function in order to do the scroll ourselves.
-    bool wheelEvent(const PlatformWheelEvent&);
-#if ENABLE(GESTURE_EVENTS)
-    void gestureEvent(const PlatformGestureEvent&);
-#endif
-
     IntPoint convertChildToSelf(const Widget* child, const IntPoint& point) const
     {
         IntPoint newPoint = point;
@@ -297,7 +289,6 @@ protected:
     virtual void repaintContentRectangle(const IntRect&, bool now = false);
     virtual void paintContents(GraphicsContext*, const IntRect& damageRect) = 0;
 
-    void calculateOverhangAreasForPainting(IntRect& horizontalOverhangRect, IntRect& verticalOverhangRect);
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
 
     virtual void visibleContentsResized() = 0;
@@ -393,6 +384,9 @@ private:
    
     void platformSetScrollOrigin(const IntPoint&, bool updatePositionAtAll, bool updatePositionSynchronously);
 
+    void calculateOverhangAreasForPainting(IntRect& horizontalOverhangRect, IntRect& verticalOverhangRect);
+    void updateOverhangAreas();
+
 #if PLATFORM(MAC) && defined __OBJC__
 public:
     NSView* documentView() const;
diff --git a/Source/WebCore/platform/ScrollableArea.cpp b/Source/WebCore/platform/ScrollableArea.cpp
index 99b9babc3..58ad24205 100644
--- a/Source/WebCore/platform/ScrollableArea.cpp
+++ b/Source/WebCore/platform/ScrollableArea.cpp
@@ -71,22 +71,6 @@ void ScrollableArea::setScrollOrigin(const IntPoint& origin)
         m_scrollOriginChanged = true;
     }
 }
- 
-void ScrollableArea::setScrollOriginX(int x)
-{
-    if (m_scrollOrigin.x() != x) {
-        m_scrollOrigin.setX(x);
-        m_scrollOriginChanged = true;
-    }
-}
-
-void ScrollableArea::setScrollOriginY(int y)
-{
-    if (m_scrollOrigin.y() != y) {
-        m_scrollOrigin.setY(y);
-        m_scrollOriginChanged = true;
-    }
-}
 
 bool ScrollableArea::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
 {
@@ -133,48 +117,15 @@ void ScrollableArea::scrollToOffsetWithoutAnimation(const FloatPoint& offset)
 void ScrollableArea::scrollToOffsetWithoutAnimation(ScrollbarOrientation orientation, float offset)
 {
     if (orientation == HorizontalScrollbar)
-        scrollToXOffsetWithoutAnimation(offset);
+        scrollToOffsetWithoutAnimation(FloatPoint(offset, scrollAnimator()->currentPosition().y()));
     else
-        scrollToYOffsetWithoutAnimation(offset);
-}
-
-void ScrollableArea::scrollToXOffsetWithoutAnimation(float x)
-{
-    scrollToOffsetWithoutAnimation(FloatPoint(x, scrollAnimator()->currentPosition().y()));
-}
-
-void ScrollableArea::scrollToYOffsetWithoutAnimation(float y)
-{
-    scrollToOffsetWithoutAnimation(FloatPoint(scrollAnimator()->currentPosition().x(), y));
-}
-
-void ScrollableArea::zoomAnimatorTransformChanged(float, float, float, ZoomAnimationState)
-{
-    // Requires FrameView to override this.
-}
-
-bool ScrollableArea::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
-{
-    return scrollAnimator()->handleWheelEvent(wheelEvent);
-}
-
-#if ENABLE(GESTURE_EVENTS)
-void ScrollableArea::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
-{
-    scrollAnimator()->handleGestureEvent(gestureEvent);
+        scrollToOffsetWithoutAnimation(FloatPoint(scrollAnimator()->currentPosition().x(), offset));
 }
-#endif
 
-// NOTE: Only called from Internals for testing.
-void ScrollableArea::setScrollOffsetFromInternals(const IntPoint& offset)
-{
-    setScrollOffsetFromAnimation(offset);
-}
-
-void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
+void ScrollableArea::notifyScrollPositionChanged(const IntPoint& position)
 {
     // Tell the derived class to scroll its contents.
-    setScrollOffset(offset);
+    setScrollOffset(position);
 
     Scrollbar* verticalScrollbar = this->verticalScrollbar();
 
@@ -198,6 +149,27 @@ void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
         if (verticalScrollbar->isOverlayScrollbar() && !hasLayerForVerticalScrollbar())
             verticalScrollbar->invalidate();
     }
+
+    scrollAnimator()->notifyContentAreaScrolled();
+}
+
+bool ScrollableArea::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
+{
+    return scrollAnimator()->handleWheelEvent(wheelEvent);
+}
+
+// NOTE: Only called from Internals for testing.
+void ScrollableArea::setScrollOffsetFromInternals(const IntPoint& offset)
+{
+    setScrollOffsetFromAnimation(offset);
+}
+
+void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
+{
+    if (requestScrollPositionUpdate(offset))
+        return;
+
+    notifyScrollPositionChanged(offset);
 }
 
 void ScrollableArea::willStartLiveResize()
@@ -308,29 +280,6 @@ void ScrollableArea::setScrollbarOverlayStyle(ScrollbarOverlayStyle overlayStyle
     }
 }
 
-bool ScrollableArea::isPinnedInBothDirections(const IntSize& scrollDelta) const
-{
-    return isPinnedHorizontallyInDirection(scrollDelta.width()) && isPinnedVerticallyInDirection(scrollDelta.height());
-}
-
-bool ScrollableArea::isPinnedHorizontallyInDirection(int horizontalScrollDelta) const
-{
-    if (horizontalScrollDelta < 0 && isHorizontalScrollerPinnedToMinimumPosition())
-        return true;
-    if (horizontalScrollDelta > 0 && isHorizontalScrollerPinnedToMaximumPosition())
-        return true;
-    return false;
-}
-
-bool ScrollableArea::isPinnedVerticallyInDirection(int verticalScrollDelta) const
-{
-    if (verticalScrollDelta < 0 && isVerticalScrollerPinnedToMinimumPosition())
-        return true;
-    if (verticalScrollDelta > 0 && isVerticalScrollerPinnedToMaximumPosition())
-        return true;
-    return false;
-}
-
 void ScrollableArea::invalidateScrollbar(Scrollbar* scrollbar, const IntRect& rect)
 {
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index 353b6f074..8244ce833 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -42,20 +42,20 @@ class GraphicsLayer;
 
 class ScrollableArea {
 public:
-    enum ZoomAnimationState { ZoomAnimationContinuing, ZoomAnimationFinishing };
-
     bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1);
     void scrollToOffsetWithoutAnimation(const FloatPoint&);
     void scrollToOffsetWithoutAnimation(ScrollbarOrientation, float offset);
-    void scrollToXOffsetWithoutAnimation(float x);
-    void scrollToYOffsetWithoutAnimation(float x);
 
-    virtual void zoomAnimatorTransformChanged(float, float, float, ZoomAnimationState);
+    // Should be called when the scroll position changes externally, for example if the scroll layer position
+    // is updated on the scrolling thread and we need to notify the main thread.
+    void notifyScrollPositionChanged(const IntPoint&);
+
+    // Allows subclasses to handle scroll position updates themselves. If this member function
+    // returns true, the scrollable area won't actually update the scroll position and instead
+    // expect it to happen sometime in the future.
+    virtual bool requestScrollPositionUpdate(const IntPoint&) { return false; }
 
     bool handleWheelEvent(const PlatformWheelEvent&);
-#if ENABLE(GESTURE_EVENTS)
-    void handleGestureEvent(const PlatformGestureEvent&);
-#endif
 
     // Functions for controlling if you can scroll past the end of the document.
     bool constrainsScrollingToContentEdge() const { return m_constrainsScrollingToContentEdge; }
@@ -104,10 +104,6 @@ public:
     void invalidateScrollCorner(const IntRect&);
     virtual void getTickmarks(Vector<IntRect>&) const { }
 
-    // This function should be overriden by subclasses to perform the actual
-    // scroll of the content.
-    virtual void setScrollOffset(const IntPoint&) = 0;
-
     // Convert points and rects between the scrollbar and its containing view.
     // The client needs to implement these in order to be aware of layout effects
     // like CSS transforms.
@@ -147,21 +143,12 @@ public:
 
     virtual bool isOnActivePage() const { ASSERT_NOT_REACHED(); return true; }
     
-    bool isHorizontalScrollerPinnedToMinimumPosition() const { return !horizontalScrollbar() || scrollPosition(horizontalScrollbar()) <= minimumScrollPosition().x(); }
-    bool isHorizontalScrollerPinnedToMaximumPosition() const { return !horizontalScrollbar() || scrollPosition(horizontalScrollbar()) >= maximumScrollPosition().x(); }
-    bool isVerticalScrollerPinnedToMinimumPosition() const { return !verticalScrollbar() || scrollPosition(verticalScrollbar()) <= minimumScrollPosition().y(); }
-    bool isVerticalScrollerPinnedToMaximumPosition() const { return !verticalScrollbar() || scrollPosition(verticalScrollbar()) >= maximumScrollPosition().y(); }
-
     // Note that this only returns scrollable areas that can actually be scrolled.
     virtual ScrollableArea* enclosingScrollableArea() const = 0;
 
     // Returns the bounding box of this scrollable area, in the coordinate system of the enclosing scroll view.
     virtual IntRect scrollableAreaBoundingBox() const { ASSERT_NOT_REACHED(); return IntRect(); }
 
-    bool isPinnedInBothDirections(const IntSize&) const;
-    bool isPinnedHorizontallyInDirection(int horizontalScrollDelta) const;
-    bool isPinnedVerticallyInDirection(int verticalScrollDelta) const;
-
     virtual bool shouldRubberBandInDirection(ScrollDirection) const { return true; }
 
     virtual bool scrollAnimatorEnabled() const { return false; }
@@ -174,8 +161,6 @@ protected:
     virtual ~ScrollableArea();
 
     void setScrollOrigin(const IntPoint&);
-    void setScrollOriginX(int);
-    void setScrollOriginY(int);
     void resetScrollOriginChanged() { m_scrollOriginChanged = false; }
 
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&) = 0;
@@ -198,6 +183,10 @@ private:
     friend class ScrollAnimator;
     void setScrollOffsetFromAnimation(const IntPoint&);
 
+    // This function should be overriden by subclasses to perform the actual
+    // scroll of the content.
+    virtual void setScrollOffset(const IntPoint&) = 0;
+
     mutable OwnPtr<ScrollAnimator> m_scrollAnimator;
     bool m_constrainsScrollingToContentEdge : 1;
 
diff --git a/Source/WebCore/platform/Scrollbar.h b/Source/WebCore/platform/Scrollbar.h
index e4e72465b..39ac25465 100644
--- a/Source/WebCore/platform/Scrollbar.h
+++ b/Source/WebCore/platform/Scrollbar.h
@@ -103,13 +103,6 @@ public:
 
     bool mouseDown(const PlatformMouseEvent&);
 
-#if PLATFORM(QT)
-    // For platforms that wish to handle context menu events.
-    // FIXME: This is misplaced.  Normal hit testing should be used to populate a correct
-    // context menu.  There's no reason why the scrollbar should have to do it.
-    bool contextMenu(const PlatformMouseEvent& event);
-#endif
-
     ScrollbarTheme* theme() const { return m_theme; }
 
     virtual void setParent(ScrollView*);
@@ -128,6 +121,8 @@ public:
     virtual IntPoint convertToContainingView(const IntPoint&) const;
     virtual IntPoint convertFromContainingView(const IntPoint&) const;
 
+    void moveThumb(int pos, bool draggingDocument = false);
+
 protected:
     Scrollbar(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize, ScrollbarTheme* = 0);
 
@@ -142,8 +137,6 @@ protected:
     ScrollDirection pressedPartScrollDirection();
     ScrollGranularity pressedPartScrollGranularity();
     
-    void moveThumb(int pos, bool draggingDocument = false);
-
     ScrollableArea* m_scrollableArea;
     ScrollbarOrientation m_orientation;
     ScrollbarControlSize m_controlSize;
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.cpp b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
index fcbf484c0..62fd5e5d2 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -226,7 +226,11 @@ static float usedTotalSize(Scrollbar* scrollbar)
 int ScrollbarThemeComposite::thumbPosition(Scrollbar* scrollbar)
 {
     if (scrollbar->enabled()) {
-        float pos = max(0.0f, scrollbar->currentPos()) * (trackLength(scrollbar) - thumbLength(scrollbar)) / (usedTotalSize(scrollbar) - scrollbar->visibleSize());
+        float size = usedTotalSize(scrollbar) - scrollbar->visibleSize();
+        // Avoid doing a floating point divide by zero and return 1 when usedTotalSize == visibleSize.
+        if (!size)
+            return 1;
+        float pos = max(0.0f, scrollbar->currentPos()) * (trackLength(scrollbar) - thumbLength(scrollbar)) / size;
         return (pos < 1 && pos > 0) ? 1 : pos;
     }
     return 0;
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index 77aef2aa7..5b5953edc 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -233,16 +233,19 @@ const Vector<char>& SharedBuffer::buffer() const
 
 unsigned SharedBuffer::getSomeData(const char*& someData, unsigned position) const
 {
-    if (hasPlatformData() || m_purgeableBuffer) {
-        someData = data() + position;
-        return size() - position;
-    }
-
-    if (position >= m_size) {
+    unsigned totalSize = size();
+    if (position >= totalSize) {
         someData = 0;
         return 0;
     }
 
+    if (hasPlatformData() || m_purgeableBuffer) {
+        ASSERT(position < size());
+        someData = data() + position;
+        return totalSize - position;
+    }
+
+    ASSERT(position < m_size);
     unsigned consecutiveSize = m_buffer.size();
     if (position < consecutiveSize) {
         someData = m_buffer.data() + position;
@@ -250,14 +253,25 @@ unsigned SharedBuffer::getSomeData(const char*& someData, unsigned position) con
     }
  
     position -= consecutiveSize;
-    unsigned segmentedSize = m_size - consecutiveSize;
     unsigned segments = m_segments.size();
+    unsigned maxSegmentedSize = segments * segmentSize;
     unsigned segment = segmentIndex(position);
-    ASSERT(segment < segments);
+    if (segment < segments) {
+        unsigned bytesLeft = totalSize - consecutiveSize;
+        unsigned segmentedSize = min(maxSegmentedSize, bytesLeft);
 
-    unsigned positionInSegment = offsetInSegment(position);
-    someData = m_segments[segment] + positionInSegment;
-    return segment == segments - 1 ? segmentedSize - position : segmentSize - positionInSegment;
+        unsigned positionInSegment = offsetInSegment(position);
+        someData = m_segments[segment] + positionInSegment;
+        return segment == segments - 1 ? segmentedSize - position : segmentSize - positionInSegment;
+    }
+#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+    ASSERT(maxSegmentedSize <= position);
+    position -= maxSegmentedSize;
+    return copySomeDataFromDataArray(someData, position);
+#else
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
 }
 
 #if !USE(CF) || PLATFORM(QT)
diff --git a/Source/WebCore/platform/SharedBuffer.h b/Source/WebCore/platform/SharedBuffer.h
index 57cfc2949..fe3e4b6b8 100644
--- a/Source/WebCore/platform/SharedBuffer.h
+++ b/Source/WebCore/platform/SharedBuffer.h
@@ -136,6 +136,7 @@ private:
 #if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
     mutable Vector<RetainPtr<CFDataRef> > m_dataArray;
     void copyDataArrayAndClear(char *destination, unsigned bytesToCopy) const;
+    unsigned copySomeDataFromDataArray(const char*& someData, unsigned position) const;
 #endif
 #if USE(CF)
     SharedBuffer(CFDataRef);
diff --git a/Source/WebCore/platform/Widget.h b/Source/WebCore/platform/Widget.h
index 3f19b61e2..d710716ba 100644
--- a/Source/WebCore/platform/Widget.h
+++ b/Source/WebCore/platform/Widget.h
@@ -63,9 +63,9 @@ typedef GtkWidget* PlatformWidget;
 
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
-class QWidget;
+class QObject;
 QT_END_NAMESPACE
-typedef QWidget* PlatformWidget;
+typedef QObject* PlatformWidget;
 #endif
 
 #if PLATFORM(WX)
diff --git a/Source/WebCore/platform/audio/AudioBus.cpp b/Source/WebCore/platform/audio/AudioBus.cpp
index d6aa35002..e7f8902f7 100644
--- a/Source/WebCore/platform/audio/AudioBus.cpp
+++ b/Source/WebCore/platform/audio/AudioBus.cpp
@@ -225,6 +225,32 @@ void AudioBus::copyFrom(const AudioBus& sourceBus)
         vadd(sourceL, 1, sourceR, 1, destination, 1, length());
         float scale = 0.5;
         vsmul(destination, 1, &scale, destination, 1, length());
+    } else if (numberOfDestinationChannels == 6 && numberOfSourceChannels == 1) {
+        // Handle mono -> 5.1 case, copy mono channel to center. 
+        channel(2)->copyFrom(sourceBus.channel(0));
+        channel(0)->zero();
+        channel(1)->zero();
+        channel(3)->zero();
+        channel(4)->zero();
+        channel(5)->zero();
+    } else if (numberOfDestinationChannels == 1 && numberOfSourceChannels == 6) {
+        // Handle 5.1 -> mono case, copy center channel into mono.
+        // FIXME: We should have a better algorithm for this down mixing.
+        channel(0)->copyFrom(sourceBus.channel(2));
+    } else if (numberOfDestinationChannels < numberOfSourceChannels) {
+        // Default down mixing handling, just match the source channels with the first available destination channels. 
+        // 5.1 -> stereo case covered here. 
+        // FIXME: We should have a better algorithm for down mixing 5.1 to stereo.
+        // https://bugs.webkit.org/show_bug.cgi?id=79192
+        for (unsigned i = 0; i < numberOfDestinationChannels; ++i)
+            channel(i)->copyFrom(sourceBus.channel(i));
+    } else if (numberOfDestinationChannels > numberOfSourceChannels) {
+        // Default up mixing handling, just match the destination channels with the first available source channels. 
+        // Stereo -> 5.1 case covered here. 
+        for (unsigned i = 0; i < numberOfSourceChannels; ++i) 
+            channel(i)->copyFrom(sourceBus.channel(i));
+        for (unsigned i = numberOfSourceChannels; i < numberOfDestinationChannels; ++i)
+            channel(i)->zero();
     } else {
         // Case not handled
         ASSERT_NOT_REACHED();
@@ -256,6 +282,25 @@ void AudioBus::sumFrom(const AudioBus &sourceBus)
         float scale = 0.5;
         vsma(sourceL, 1, &scale, destination, 1, length());
         vsma(sourceR, 1, &scale, destination, 1, length());
+    } else if (numberOfDestinationChannels == 6 && numberOfSourceChannels == 1) {
+        // Handle mono -> 5.1 case, sum mono channel into center.
+        channel(2)->sumFrom(sourceBus.channel(0));
+    } else if (numberOfDestinationChannels == 1 && numberOfSourceChannels == 6) {
+        // Handle 5.1 -> mono case, sum center channel into mono.
+        // FIXME: We should have a better algorithm for this down mixing.
+        channel(0)->sumFrom(sourceBus.channel(2));
+    } else if (numberOfDestinationChannels < numberOfSourceChannels) {
+        // Default down mixing, just summing the first available destination channels. 
+        // 5.1 -> stereo case covered here.
+        // FIXME: We should have a better algorithm for down mixing 5.1 to stereo.
+        // https://bugs.webkit.org/show_bug.cgi?id=79192
+        for (unsigned i = 0; i < numberOfDestinationChannels; ++i) 
+            channel(i)->sumFrom(sourceBus.channel(i));
+    } else if (numberOfDestinationChannels > numberOfSourceChannels) {
+        // Default up mixing, just summing the first available source channels. 
+        // stereo -> 5.1 case covered here.
+        for (unsigned i = 0; i < numberOfSourceChannels; ++i) 
+            channel(i)->sumFrom(sourceBus.channel(i));
     } else {
         // Case not handled
         ASSERT_NOT_REACHED();
@@ -409,10 +454,6 @@ void AudioBus::processWithGainFromMonoStereo(const AudioBus &sourceBus, float* l
         }
     } else {
         // Process directly (without summing) to our bus
-        // If it is from the same bus and no need to change gain, just return
-        if (this == &sourceBus && *lastMixGain == targetGain && targetGain == 1.0)
-            return;
-
         if (sourceR && destinationR) {
             // Stereo
             PROCESS_WITH_GAIN(STEREO_NO_SUM)
@@ -437,6 +478,9 @@ void AudioBus::processWithGainFrom(const AudioBus &sourceBus, float* lastMixGain
         ASSERT_NOT_REACHED();
         return;
     }
+    // If it is copying from the same bus and no need to change gain, just return
+    if (!sumToBus && this == &sourceBus && *lastMixGain == targetGain && targetGain == 1.0)
+        return;
 
     // Dispatch for different channel layouts
     switch (numberOfChannels()) {
diff --git a/Source/WebCore/platform/audio/AudioUtilities.cpp b/Source/WebCore/platform/audio/AudioUtilities.cpp
index ff19cee69..7ec833ccd 100644
--- a/Source/WebCore/platform/audio/AudioUtilities.cpp
+++ b/Source/WebCore/platform/audio/AudioUtilities.cpp
@@ -56,38 +56,10 @@ float discreteTimeConstantForSampleRate(float timeConstant, float sampleRate)
     return 1 - powf(1 / 2.718282f, 1 / (sampleRate * timeConstant));
 }
 
-#if OS(WINDOWS) && COMPILER(MSVC) && !_M_IX86_FP
-// When compiling with MSVC with x87 FPU instructions using 80-bit
-// floats, we want very precise control over the arithmetic so that
-// rounding is done according to the IEEE 754 specification for
-// single- and double-precision floats. We want each operation to be
-// done with specified arithmetic precision and rounding consistent
-// with gcc, not extended to 80 bits automatically.
-//
-// These pragmas are equivalent to /fp:strict flag, but we only need
-// it for the function here.  (Using fp:strict everywhere can have
-// severe impact on floating point performance.)
-#pragma float_control(push)
-#pragma float_control(precise, on)
-#pragma fenv_access(on)
-#pragma float_control(except, on)
-#endif
-
 size_t timeToSampleFrame(double time, double sampleRate)
 {
-    // DO NOT CONSOLIDATE THESE ASSIGNMENTS INTO ONE! When compiling
-    // with Visual Studio, these assignments force the rounding of
-    // each operation according to IEEE 754, instead of leaving
-    // intermediate results in 80-bit precision which is not
-    // consistent with IEEE 754 double-precision rounding.
-    double r = time * sampleRate;
-    r += 0.5;
-    return static_cast<size_t>(r);
+    return static_cast<size_t>(round(time * sampleRate));
 }
-#if OS(WINDOWS) && COMPILER(MSVC) && !_M_IX86_FP
-// Restore normal floating-point semantics.
-#pragma float_control(pop)
-#endif
 } // AudioUtilites
 
 } // WebCore
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.cpp b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
index a55205705..d0f27b05f 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
@@ -40,16 +40,16 @@ namespace WebCore {
 
 using namespace AudioUtilities;
     
-DynamicsCompressor::DynamicsCompressor(bool isStereo, float sampleRate)
-    : m_isStereo(isStereo)
-    , m_sampleRate(sampleRate)
-    , m_compressor(sampleRate)
+DynamicsCompressor::DynamicsCompressor(float sampleRate, unsigned numberOfChannels)
+    : m_numberOfChannels(numberOfChannels)
+    , m_compressor(sampleRate, numberOfChannels)
 {
     // Uninitialized state - for parameter recalculation.
     m_lastFilterStageRatio = -1;
     m_lastAnchor = -1;
     m_lastFilterStageGain = -1;
 
+    setNumberOfChannels(numberOfChannels);
     initializeParameters();
 }
 
@@ -93,18 +93,20 @@ void DynamicsCompressor::setEmphasisStageParameters(unsigned stageIndex, float g
     float r1 = expf(-f1 * piFloat);
     float r2 = expf(-f2 * piFloat);
 
-    // Set pre-filter zero and pole to create an emphasis filter.
-    m_preFilter[stageIndex].setZero(r1);
-    m_preFilter[stageIndex].setPole(r2);
-    m_preFilterR[stageIndex].setZero(r1);
-    m_preFilterR[stageIndex].setPole(r2);
-
-    // Set post-filter with zero and pole reversed to create the de-emphasis filter.
-    // If there were no compressor kernel in between, they would cancel each other out (allpass filter).
-    m_postFilter[stageIndex].setZero(r2);
-    m_postFilter[stageIndex].setPole(r1);
-    m_postFilterR[stageIndex].setZero(r2);
-    m_postFilterR[stageIndex].setPole(r1);
+    ASSERT(m_numberOfChannels == m_preFilterPacks.size());
+
+    for (unsigned i = 0; i < m_numberOfChannels; ++i) {
+        // Set pre-filter zero and pole to create an emphasis filter.
+        ZeroPole& preFilter = m_preFilterPacks[i]->filters[stageIndex];
+        preFilter.setZero(r1);
+        preFilter.setPole(r2);
+
+        // Set post-filter with zero and pole reversed to create the de-emphasis filter.
+        // If there were no compressor kernel in between, they would cancel each other out (allpass filter).
+        ZeroPole& postFilter = m_postFilterPacks[i]->filters[stageIndex];
+        postFilter.setZero(r2);
+        postFilter.setPole(r1);
+    }
 }
 
 void DynamicsCompressor::setEmphasisParameters(float gain, float anchorFreq, float filterStageRatio)
@@ -117,18 +119,40 @@ void DynamicsCompressor::setEmphasisParameters(float gain, float anchorFreq, flo
 
 void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinationBus, unsigned framesToProcess)
 {
-    const float* sourceL = sourceBus->channel(0)->data();
-    const float* sourceR;
+    // Though numberOfChannels is retrived from destinationBus, we still name it numberOfChannels instead of numberOfDestinationChannels.
+    // It's because we internally match sourceChannels's size to destinationBus by channel up/down mix. Thus we need numberOfChannels
+    // to do the loop work for both m_sourceChannels and m_destinationChannels.
+
+    unsigned numberOfChannels = destinationBus->numberOfChannels();
+    unsigned numberOfSourceChannels = sourceBus->numberOfChannels();
 
-    if (sourceBus->numberOfChannels() > 1)
-        sourceR = sourceBus->channel(1)->data();
-    else
-        sourceR = sourceL;
+    ASSERT(numberOfChannels == m_numberOfChannels && numberOfSourceChannels);
 
-    ASSERT(destinationBus->numberOfChannels() == 2);
+    if (numberOfChannels != m_numberOfChannels || !numberOfSourceChannels) {
+        destinationBus->zero();
+        return;
+    }
+
+    switch (numberOfChannels) {
+    case 2: // stereo
+        m_sourceChannels[0] = sourceBus->channel(0)->data();
+
+        if (numberOfSourceChannels > 1)
+            m_sourceChannels[1] = sourceBus->channel(1)->data();
+        else
+            // Simply duplicate mono channel input data to right channel for stereo processing.
+            m_sourceChannels[1] = m_sourceChannels[0];
+
+        break;
+    default:
+        // FIXME : support other number of channels.
+        ASSERT_NOT_REACHED();
+        destinationBus->zero();
+        return;
+    }
 
-    float* destinationL = destinationBus->channel(0)->mutableData();
-    float* destinationR = destinationBus->channel(1)->mutableData();
+    for (unsigned i = 0; i < numberOfChannels; ++i)
+        m_destinationChannels[i] = destinationBus->channel(i)->mutableData();
 
     float filterStageGain = parameterValue(ParamFilterStageGain);
     float filterStageRatio = parameterValue(ParamFilterStageRatio);
@@ -144,16 +168,15 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
 
     // Apply pre-emphasis filter.
     // Note that the final three stages are computed in-place in the destination buffer.
-    m_preFilter[0].process(sourceL, destinationL, framesToProcess);
-    m_preFilter[1].process(destinationL, destinationL, framesToProcess);
-    m_preFilter[2].process(destinationL, destinationL, framesToProcess);
-    m_preFilter[3].process(destinationL, destinationL, framesToProcess);
-
-    if (isStereo()) {
-        m_preFilterR[0].process(sourceR, destinationR, framesToProcess);
-        m_preFilterR[1].process(destinationR, destinationR, framesToProcess);
-        m_preFilterR[2].process(destinationR, destinationR, framesToProcess);
-        m_preFilterR[3].process(destinationR, destinationR, framesToProcess);
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        const float* sourceData = m_sourceChannels[i];
+        float* destinationData = m_destinationChannels[i];
+        ZeroPole* preFilters = m_preFilterPacks[i]->filters;
+
+        preFilters[0].process(sourceData, destinationData, framesToProcess);
+        preFilters[1].process(destinationData, destinationData, framesToProcess);
+        preFilters[2].process(destinationData, destinationData, framesToProcess);
+        preFilters[3].process(destinationData, destinationData, framesToProcess);
     }
 
     float dbThreshold = parameterValue(ParamThreshold);
@@ -177,10 +200,9 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
 
     // Apply compression to the pre-filtered signal.
     // The processing is performed in place.
-    m_compressor.process(destinationL,
-                         destinationL,
-                         destinationR,
-                         destinationR,
+    m_compressor.process(m_destinationChannels.get(),
+                         m_destinationChannels.get(),
+                         numberOfChannels,
                          framesToProcess,
 
                          dbThreshold,
@@ -198,16 +220,14 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
                          );
 
     // Apply de-emphasis filter.
-    m_postFilter[0].process(destinationL, destinationL, framesToProcess);
-    m_postFilter[1].process(destinationL, destinationL, framesToProcess);
-    m_postFilter[2].process(destinationL, destinationL, framesToProcess);
-    m_postFilter[3].process(destinationL, destinationL, framesToProcess);
-
-    if (isStereo()) {
-        m_postFilterR[0].process(destinationR, destinationR, framesToProcess);
-        m_postFilterR[1].process(destinationR, destinationR, framesToProcess);
-        m_postFilterR[2].process(destinationR, destinationR, framesToProcess);
-        m_postFilterR[3].process(destinationR, destinationR, framesToProcess);
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        float* destinationData = m_destinationChannels[i];
+        ZeroPole* postFilters = m_postFilterPacks[i]->filters;
+
+        postFilters[0].process(destinationData, destinationData, framesToProcess);
+        postFilters[1].process(destinationData, destinationData, framesToProcess);
+        postFilters[2].process(destinationData, destinationData, framesToProcess);
+        postFilters[3].process(destinationData, destinationData, framesToProcess);
     }
 }
 
@@ -217,16 +237,35 @@ void DynamicsCompressor::reset()
     m_lastAnchor = -1;
     m_lastFilterStageGain = -1;
 
-    for (unsigned i = 0; i < 4; ++i) {
-        m_preFilter[i].reset();
-        m_preFilterR[i].reset();
-        m_postFilter[i].reset();
-        m_postFilterR[i].reset();
+    for (unsigned channel = 0; channel < m_numberOfChannels; ++channel) {
+        for (unsigned stageIndex = 0; stageIndex < 4; ++stageIndex) {
+            m_preFilterPacks[channel]->filters[stageIndex].reset();
+            m_postFilterPacks[channel]->filters[stageIndex].reset();
+        }
     }
 
     m_compressor.reset();
 }
 
+void DynamicsCompressor::setNumberOfChannels(unsigned numberOfChannels)
+{
+    if (m_preFilterPacks.size() == numberOfChannels)
+        return;
+
+    m_preFilterPacks.clear();
+    m_postFilterPacks.clear();
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        m_preFilterPacks.append(adoptPtr(new ZeroPoleFilterPack4()));
+        m_postFilterPacks.append(adoptPtr(new ZeroPoleFilterPack4()));
+    }
+
+    m_sourceChannels = adoptArrayPtr(new const float* [numberOfChannels]);
+    m_destinationChannels = adoptArrayPtr(new float* [numberOfChannels]);
+
+    m_compressor.setNumberOfChannels(numberOfChannels);
+    m_numberOfChannels = numberOfChannels;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.h b/Source/WebCore/platform/audio/DynamicsCompressor.h
index e0115ee27..d949f3068 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.h
@@ -33,6 +33,8 @@
 #include "DynamicsCompressorKernel.h"
 #include "ZeroPole.h"
 
+#include <wtf/OwnArrayPtr.h>
+
 namespace WebCore {
 
 class AudioBus;
@@ -62,25 +64,26 @@ public:
         ParamLast
     };
 
-    DynamicsCompressor(bool isStereo, float sampleRate);
+    DynamicsCompressor(float sampleRate, unsigned numberOfChannels);
 
     void process(const AudioBus* sourceBus, AudioBus* destinationBus, unsigned framesToProcess);
     void reset();
+    void setNumberOfChannels(unsigned);
 
     float parameterValue(unsigned parameterID);
 
-    bool isStereo() const { return m_isStereo; }
     float sampleRate() const { return m_sampleRate; }
     float nyquist() const { return m_sampleRate / 2; }
 
 protected:
+    unsigned m_numberOfChannels;
+
     // m_parameters holds the tweakable compressor parameters.
     // FIXME: expose some of the most important ones (such as threshold, attack, release)
     // as DynamicsCompressorNode attributes.
     float m_parameters[ParamLast];
     void initializeParameters();
 
-    bool m_isStereo;
     float m_sampleRate;
 
     // Emphasis filter controls.
@@ -88,11 +91,16 @@ protected:
     float m_lastAnchor;
     float m_lastFilterStageGain;
 
-    // Emphasis filters.
-    ZeroPole m_preFilter[4];
-    ZeroPole m_preFilterR[4];
-    ZeroPole m_postFilter[4];
-    ZeroPole m_postFilterR[4];
+    typedef struct {
+        ZeroPole filters[4];
+    } ZeroPoleFilterPack4;
+
+    // Per-channel emphasis filters.
+    Vector<OwnPtr<ZeroPoleFilterPack4> > m_preFilterPacks;
+    Vector<OwnPtr<ZeroPoleFilterPack4> > m_postFilterPacks;
+
+    OwnArrayPtr<const float*> m_sourceChannels;
+    OwnArrayPtr<float*> m_destinationChannels;
 
     void setEmphasisStageParameters(unsigned stageIndex, float gain, float normalizedFrequency /* 0 -> 1 */);
     void setEmphasisParameters(float gain, float anchorFreq, float filterStageRatio);
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
index a322a3302..3e943d120 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
@@ -52,20 +52,30 @@ static float saturate(float x, float k)
     return 1 - exp(-k * x);
 }
 
-DynamicsCompressorKernel::DynamicsCompressorKernel(float sampleRate)
+DynamicsCompressorKernel::DynamicsCompressorKernel(float sampleRate, unsigned numberOfChannels)
     : m_sampleRate(sampleRate)
     , m_lastPreDelayFrames(DefaultPreDelayFrames)
-    , m_preDelayBufferL(MaxPreDelayFrames)
-    , m_preDelayBufferR(MaxPreDelayFrames)
     , m_preDelayReadIndex(0)
     , m_preDelayWriteIndex(DefaultPreDelayFrames)
 {
+    setNumberOfChannels(numberOfChannels);
+
     // Initializes most member variables
     reset();
     
     m_meteringReleaseK = discreteTimeConstantForSampleRate(meteringReleaseTimeConstant, sampleRate);
 }
 
+void DynamicsCompressorKernel::setNumberOfChannels(unsigned numberOfChannels)
+{
+    if (m_preDelayBuffers.size() == numberOfChannels)
+        return;
+
+    m_preDelayBuffers.clear();
+    for (unsigned i = 0; i < numberOfChannels; ++i)
+        m_preDelayBuffers.append(adoptPtr(new AudioFloatArray(MaxPreDelayFrames)));
+}
+
 void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
 {
     // Re-configure look-ahead section pre-delay if delay time has changed.
@@ -75,17 +85,17 @@ void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
         
     if (m_lastPreDelayFrames != preDelayFrames) {
         m_lastPreDelayFrames = preDelayFrames;
-        m_preDelayBufferL.zero();
-        m_preDelayBufferR.zero();
+        for (unsigned i = 0; i < m_preDelayBuffers.size(); ++i)
+            m_preDelayBuffers[i]->zero();
+
         m_preDelayReadIndex = 0;
         m_preDelayWriteIndex = preDelayFrames;
     }
 }
 
-void DynamicsCompressorKernel::process(const float* sourceL,
-                                       float* destinationL,
-                                       const float* sourceR, /* stereo-linked */
-                                       float* destinationR,
+void DynamicsCompressorKernel::process(float* sourceChannels[],
+                                       float* destinationChannels[],
+                                       unsigned numberOfChannels,
                                        unsigned framesToProcess,
 
                                        float dbThreshold,
@@ -102,7 +112,8 @@ void DynamicsCompressorKernel::process(const float* sourceL,
                                        float releaseZone4
                                        )
 {
-    bool isStereo = destinationR;
+    ASSERT(m_preDelayBuffers.size() == numberOfChannels);
+
     float sampleRate = this->sampleRate();
 
     float dryMix = 1 - effectBlend;
@@ -164,6 +175,7 @@ void DynamicsCompressorKernel::process(const float* sourceL,
 
     const int nDivisions = framesToProcess / nDivisionFrames;
 
+    unsigned frameIndex = 0;
     for (int i = 0; i < nDivisions; ++i) {
         // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         // Calculate desired gain
@@ -247,8 +259,6 @@ void DynamicsCompressorKernel::process(const float* sourceL,
         // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
         {
-            float* delayBufferL = m_preDelayBufferL.data();
-            float* delayBufferR = m_preDelayBufferR.data();
             int preDelayReadIndex = m_preDelayReadIndex;
             int preDelayWriteIndex = m_preDelayWriteIndex;
             float detectorAverage = m_detectorAverage;
@@ -256,32 +266,19 @@ void DynamicsCompressorKernel::process(const float* sourceL,
 
             int loopFrames = nDivisionFrames;
             while (loopFrames--) {
-                float compressorInput;
-                float inputL;
-                float inputR = 0;
+                float compressorInput = 0;
 
                 // Predelay signal, computing compression amount from un-delayed version.
-                if (isStereo) {
-                    float undelayedL = *sourceL++;
-                    float undelayedR = *sourceR++;
-
-                    compressorInput = 0.5f * (undelayedL + undelayedR);
-
-                    inputL = delayBufferL[preDelayReadIndex];
-                    inputR = delayBufferR[preDelayReadIndex];
-
-                    delayBufferL[preDelayWriteIndex] = undelayedL;
-                    delayBufferR[preDelayWriteIndex] = undelayedR;
-                } else {
-                    compressorInput = *sourceL++;
-
-                    inputL = delayBufferL[preDelayReadIndex];
-                    delayBufferL[preDelayWriteIndex] = compressorInput;
+                for (unsigned i = 0; i < numberOfChannels; ++i) {
+                    float* delayBuffer = m_preDelayBuffers[i]->data();
+                    float undelayedSource = sourceChannels[i][frameIndex];
+                    delayBuffer[preDelayWriteIndex] = undelayedSource;
+
+                    float absUndelayedSource = undelayedSource > 0 ? undelayedSource : -undelayedSource;
+                    if (compressorInput < absUndelayedSource)
+                        compressorInput = absUndelayedSource;
                 }
 
-                preDelayReadIndex = (preDelayReadIndex + 1) & MaxPreDelayFramesMask;
-                preDelayWriteIndex = (preDelayWriteIndex + 1) & MaxPreDelayFramesMask;
-
                 // Calculate shaped power on undelayed input.
 
                 float scaledInput = compressorInput;
@@ -337,17 +334,14 @@ void DynamicsCompressorKernel::process(const float* sourceL,
                     m_meteringGain += (dbRealGain - m_meteringGain) * m_meteringReleaseK;
 
                 // Apply final gain.
-                if (isStereo) {
-                    float outputL = inputL;
-                    float outputR = inputR;
-
-                    outputL *= totalGain;
-                    outputR *= totalGain;
+                for (unsigned i = 0; i < numberOfChannels; ++i) {
+                    float* delayBuffer = m_preDelayBuffers[i]->data();
+                    destinationChannels[i][frameIndex] = delayBuffer[preDelayReadIndex] * totalGain;
+                }
 
-                    *destinationL++ = outputL;
-                    *destinationR++ = outputR;
-                } else
-                    *destinationL++ = inputL * totalGain;
+                frameIndex++;
+                preDelayReadIndex = (preDelayReadIndex + 1) & MaxPreDelayFramesMask;
+                preDelayWriteIndex = (preDelayWriteIndex + 1) & MaxPreDelayFramesMask;
             }
 
             // Locals back to member variables.
@@ -366,8 +360,9 @@ void DynamicsCompressorKernel::reset()
     m_meteringGain = 1;
 
     // Predelay section.
-    m_preDelayBufferL.zero();
-    m_preDelayBufferR.zero();
+    for (unsigned i = 0; i < m_preDelayBuffers.size(); ++i)
+        m_preDelayBuffers[i]->zero();
+
     m_preDelayReadIndex = 0;
     m_preDelayWriteIndex = DefaultPreDelayFrames;
 
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
index cf319b378..da8e4c8be 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
@@ -31,17 +31,21 @@
 
 #include "AudioArray.h"
 
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 
 class DynamicsCompressorKernel {
 public:
-    DynamicsCompressorKernel(float sampleRate);
+    DynamicsCompressorKernel(float sampleRate, unsigned numberOfChannels);
+
+    void setNumberOfChannels(unsigned);
 
     // Performs stereo-linked compression.
-    void process(const float *sourceL,
-                 float *destinationL,
-                 const float *sourceR,
-                 float *destinationR,
+    void process(float* sourceChannels[],
+                 float* destinationChannels[],
+                 unsigned numberOfChannels,
                  unsigned framesToProcess,
 
                  float dbThreshold,
@@ -66,7 +70,7 @@ public:
 
 protected:
     float m_sampleRate;
-    
+
     float m_detectorAverage;
     float m_compressorGain;
 
@@ -81,8 +85,7 @@ protected:
     unsigned m_lastPreDelayFrames;
     void setPreDelayTime(float);
 
-    AudioFloatArray m_preDelayBufferL;
-    AudioFloatArray m_preDelayBufferR;
+    Vector<OwnPtr<AudioFloatArray> > m_preDelayBuffers;
     int m_preDelayReadIndex;
     int m_preDelayWriteIndex;
 
diff --git a/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp b/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
index cb7355aa8..8f96c9694 100644
--- a/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
+++ b/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
@@ -80,13 +80,11 @@ HRTFDatabaseLoader::~HRTFDatabaseLoader()
 
 
 // Asynchronously load the database in this thread.
-static void* databaseLoaderEntry(void* threadData)
+static void databaseLoaderEntry(void* threadData)
 {
     HRTFDatabaseLoader* loader = reinterpret_cast<HRTFDatabaseLoader*>(threadData);
     ASSERT(loader);
     loader->load();
-    
-    return 0;
 }
 
 void HRTFDatabaseLoader::load()
@@ -121,7 +119,7 @@ void HRTFDatabaseLoader::waitForLoaderThreadCompletion()
     
     // waitForThreadCompletion() should not be called twice for the same thread.
     if (m_databaseLoaderThread)
-        waitForThreadCompletion(m_databaseLoaderThread, 0);
+        waitForThreadCompletion(m_databaseLoaderThread);
     m_databaseLoaderThread = 0;
 }
 
diff --git a/Source/WebCore/platform/audio/ReverbConvolver.cpp b/Source/WebCore/platform/audio/ReverbConvolver.cpp
index c611414cb..c6ab54e8e 100644
--- a/Source/WebCore/platform/audio/ReverbConvolver.cpp
+++ b/Source/WebCore/platform/audio/ReverbConvolver.cpp
@@ -53,11 +53,10 @@ const size_t RealtimeFrameLimit = 8192  + 4096; // ~278msec @ 44.1KHz
 const size_t MinFFTSize = 256;
 const size_t MaxRealtimeFFTSize = 2048;
 
-static void* backgroundThreadEntry(void* threadData)
+static void backgroundThreadEntry(void* threadData)
 {
     ReverbConvolver* reverbConvolver = static_cast<ReverbConvolver*>(threadData);
     reverbConvolver->backgroundThreadEntry();
-    return 0;
 }
 
 ReverbConvolver::ReverbConvolver(AudioChannel* impulseResponse, size_t renderSliceSize, size_t maxFFTSize, size_t convolverRenderPhase, bool useBackgroundThreads)
@@ -142,7 +141,7 @@ ReverbConvolver::~ReverbConvolver()
             m_backgroundThreadCondition.signal();
         }
 
-        waitForThreadCompletion(m_backgroundThread, 0);
+        waitForThreadCompletion(m_backgroundThread);
     }
 }
 
diff --git a/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp b/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
index 2cae4acab..2228f41d0 100644
--- a/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
+++ b/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
@@ -93,7 +93,7 @@ static GstCaps* getGStreamerMonoAudioCaps(float sampleRate)
 
 static GstAudioChannelPosition webKitWebAudioGStreamerChannelPosition(int channelIndex)
 {
-    GstAudioChannelPosition position;
+    GstAudioChannelPosition position = GST_AUDIO_CHANNEL_POSITION_NONE;
 
     switch (channelIndex) {
     case AudioBus::ChannelLeft:
diff --git a/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp b/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp
index ade778f5b..f9d635b44 100644
--- a/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp
+++ b/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp
@@ -23,6 +23,8 @@
 #include "AudioBus.h"
 
 #include "AudioFileReader.h"
+#include "CString.h"
+#include "FileSystem.h"
 #include "GOwnPtr.h"
 
 #include <gio/gio.h>
@@ -33,7 +35,7 @@ namespace WebCore {
 PassOwnPtr<AudioBus> AudioBus::loadPlatformResource(const char* name, float sampleRate)
 {
     GOwnPtr<gchar> filename(g_strdup_printf("%s.wav", name));
-    GOwnPtr<gchar> absoluteFilename(g_build_filename(DATA_DIR, "webkitgtk-"WEBKITGTK_API_VERSION_STRING, "resources", "audio", filename.get(), NULL));
+    GOwnPtr<gchar> absoluteFilename(g_build_filename(sharedResourcesPath().data(), "resources", "audio", filename.get(), NULL));
 
     GFile* file = g_file_new_for_path(filename.get());
     if (!g_file_query_exists(file, 0)) {
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
index 16127376e..b224d5cb0 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "ClipboardBlackBerry.h"
 
+#include "DOMStringList.h"
 #include "FileList.h"
 #include "NotImplemented.h"
 
@@ -72,14 +73,14 @@ bool ClipboardBlackBerry::setData(const String& type, const String& text)
     return true;
 }
 
-HashSet<String> ClipboardBlackBerry::types() const
+PassRefPtr<DOMStringList> ClipboardBlackBerry::types() const
 {
     // We use hardcoded list here since there seems to be no API to get the list.
-    HashSet<String> ret;
-    ret.add("text/plain");
-    ret.add("text/html");
-    ret.add("text/url");
-    return ret;
+    RefPtr<DOMStringList> ret = DOMStringList::create();
+    ret->append("text/plain");
+    ret->append("text/html");
+    ret->append("text/url");
+    return ret.release();
 }
 
 PassRefPtr<FileList> ClipboardBlackBerry::files() const
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
index 2f39f465e..255d6aa28 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
@@ -36,7 +36,7 @@ public:
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
     virtual DragImageRef createDragImage(IntPoint&) const;
     virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
diff --git a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp
new file mode 100644
index 000000000..7319cb045
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp
@@ -0,0 +1,522 @@
+/*
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#define ENABLE_COOKIE_DEBUG 0
+
+#include "config.h"
+#include "CookieDatabaseBackingStore.h"
+
+#include "CookieManager.h"
+#include "Logging.h"
+#include "ParsedCookie.h"
+#include "SQLiteStatement.h"
+#include "SQLiteTransaction.h"
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE_COOKIE_DEBUG
+#include <BlackBerryPlatformLog.h>
+#define CookieLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLog(format, ...)
+#endif
+
+#include <BlackBerryPlatformExecutableMessage.h>
+
+using BlackBerry::Platform::MessageClient;
+using BlackBerry::Platform::TypedReplyBuffer;
+using BlackBerry::Platform::createMethodCallMessage;
+
+static const double s_databaseTimerInterval = 2;
+
+namespace WebCore {
+
+CookieDatabaseBackingStore::CookieDatabaseBackingStore()
+    : MessageClient(MessageClient::ReplyFeature | MessageClient::SyncFeature)
+    , m_tableName("cookies") // This is chosen to match Mozilla's table name.
+    , m_dbTimer(this, &CookieDatabaseBackingStore::sendChangesToDatabaseTimerFired)
+    , m_insertStatement(0)
+    , m_updateStatement(0)
+    , m_deleteStatement(0)
+{
+    m_dbTimerClient = new BlackBerry::Platform::GenericTimerClient(this);
+    m_dbTimer.setClient(m_dbTimerClient);
+
+    pthread_attr_t threadAttrs;
+    pthread_attr_init(&threadAttrs);
+    createThread("cookie_database", threadAttrs);
+}
+
+CookieDatabaseBackingStore::~CookieDatabaseBackingStore()
+{
+    delete m_dbTimerClient;
+    m_dbTimerClient = 0;
+    // FIXME: This object will never be deleted due to the set up of CookieManager (it's a singleton)
+    CookieLog("CookieBackingStore - Destructing");
+#ifndef NDEBUG
+    {
+        MutexLocker lock(m_mutex);
+        ASSERT(m_changedCookies.isEmpty());
+    }
+#endif
+}
+
+void CookieDatabaseBackingStore::upgradeTableIfNeeded(const String& databaseFields, const String& primaryKeyFields)
+{
+    ASSERT(isCurrentThread());
+
+    bool creationTimeExists = false;
+    bool protocolExists = false;
+
+    if (!m_db.tableExists(m_tableName))
+        return;
+
+    // Check if the existing table has the required database fields
+    {
+        String query = "PRAGMA table_info(" + m_tableName + ");";
+
+        SQLiteStatement statement(m_db, query);
+        if (statement.prepare()) {
+            LOG_ERROR("Cannot prepare statement to query cookie table info. sql:%s", query.utf8().data());
+            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            return;
+        }
+
+        while (statement.step() == SQLResultRow) {
+            DEFINE_STATIC_LOCAL(String, creationTime, ("creationTime"));
+            DEFINE_STATIC_LOCAL(String, protocol, ("protocol"));
+            String name = statement.getColumnText(1);
+            if (name == creationTime)
+                creationTimeExists = true;
+            if (name == protocol)
+                protocolExists = true;
+            if (creationTimeExists && protocolExists)
+                return;
+        }
+        LOG(Network, "Need to update cookie table schema.");
+    }
+
+    // Drop and recreate the cookie table to update to the latest database fields.
+    // We do not use alter table - add column because that method cannot add primary keys.
+    Vector<String> commands;
+
+    // Backup existing table
+    String renameQuery = "ALTER TABLE " + m_tableName + " RENAME TO Backup_" + m_tableName + ";";
+    commands.append(renameQuery);
+
+    // Recreate the cookie table using the new database and primary key fields
+    String createTableQuery("CREATE TABLE ");
+    createTableQuery += m_tableName;
+    createTableQuery += " (" + databaseFields + ", " + primaryKeyFields + ");";
+    commands.append(createTableQuery);
+
+    // Copy the old data into the new table. If a column does not exists,
+    // we have to put a '' in the select statement to make the number of columns
+    // equal in the insert statement.
+    String migrationQuery("INSERT OR REPLACE INTO ");
+    migrationQuery += m_tableName;
+    migrationQuery += " SELECT *";
+    if (!creationTimeExists)
+        migrationQuery += ",''";
+    if (!protocolExists)
+        migrationQuery += ",''";
+    migrationQuery += " FROM Backup_" + m_tableName;
+    commands.append(migrationQuery);
+
+    // The new columns will be blank, set the new values.
+    if (!creationTimeExists) {
+        String setCreationTimeQuery = "UPDATE " + m_tableName + " SET creationTime = lastAccessed;";
+        commands.append(setCreationTimeQuery);
+    }
+
+    if (!protocolExists) {
+        String setProtocolQuery = "UPDATE " + m_tableName + " SET protocol = 'http' WHERE isSecure = '0';";
+        String setProtocolQuery2 = "UPDATE " + m_tableName + " SET protocol = 'https' WHERE isSecure = '1';";
+        commands.append(setProtocolQuery);
+        commands.append(setProtocolQuery2);
+    }
+
+    // Drop the backup table
+    String dropBackupQuery = "DROP TABLE IF EXISTS Backup_" + m_tableName + ";";
+    commands.append(dropBackupQuery);
+
+    SQLiteTransaction transaction(m_db, false);
+    transaction.begin();
+    size_t commandSize = commands.size();
+    for (size_t i = 0; i < commandSize; ++i) {
+        if (!m_db.executeCommand(commands[i])) {
+            LOG_ERROR("Failed to alter cookie table when executing sql:%s", commands[i].utf8().data());
+            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            transaction.rollback();
+
+            // We should never get here, but if we do, rename the current cookie table for future restoration. This has the side effect of
+            // clearing the current cookie table, but that's better than continually hitting this case and hence never being able to use the
+            // cookie table.
+            ASSERT_NOT_REACHED();
+            String renameQuery = "ALTER TABLE " + m_tableName + " RENAME TO Backup2_" + m_tableName + ";";
+            if (!m_db.executeCommand(renameQuery)) {
+                LOG_ERROR("Failed to backup existing cookie table.");
+                LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            }
+            return;
+        }
+    }
+    transaction.commit();
+    LOG(Network, "Successfully updated cookie table schema.");
+}
+
+void CookieDatabaseBackingStore::open(const String& cookieJar)
+{
+    dispatchMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeOpen, this, cookieJar));
+}
+
+void CookieDatabaseBackingStore::invokeOpen(const String& cookieJar)
+{
+    ASSERT(isCurrentThread());
+    if (m_db.isOpen())
+        close();
+
+    if (!m_db.open(cookieJar)) {
+        LOG_ERROR("Could not open the cookie database. No cookie will be stored!");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return;
+    }
+
+    m_db.executeCommand("PRAGMA locking_mode=EXCLUSIVE;");
+    m_db.executeCommand("PRAGMA journal_mode=TRUNCATE;");
+
+    const String primaryKeyFields("PRIMARY KEY (protocol, host, path, name)");
+    const String databaseFields("name TEXT, value TEXT, host TEXT, path TEXT, expiry DOUBLE, lastAccessed DOUBLE, isSecure INTEGER, isHttpOnly INTEGER, creationTime DOUBLE, protocol TEXT");
+    // Update table to add the new column creationTime and protocol for backwards compatability.
+    upgradeTableIfNeeded(databaseFields, primaryKeyFields);
+
+    // Create table if not exsist in case that the upgradeTableIfNeeded() failed accidentally.
+    String createTableQuery("CREATE TABLE IF NOT EXISTS ");
+    createTableQuery += m_tableName;
+    // This table schema is compliant with Mozilla's.
+    createTableQuery += " (" + databaseFields + ", " + primaryKeyFields+");";
+
+    if (!m_db.executeCommand(createTableQuery)) {
+        LOG_ERROR("Could not create the table to store the cookies into. No cookie will be stored!");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        close();
+        return;
+    }
+
+    String insertQuery("INSERT OR REPLACE INTO ");
+    insertQuery += m_tableName;
+    insertQuery += " (name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime, protocol) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10);";
+
+    m_insertStatement = new SQLiteStatement(m_db, insertQuery);
+    if (m_insertStatement->prepare()) {
+        LOG_ERROR("Cannot save cookies");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+    }
+
+    String updateQuery("UPDATE ");
+    updateQuery += m_tableName;
+    // The where statement is chosen to match CookieMap key.
+    updateQuery += " SET name = ?1, value = ?2, host = ?3, path = ?4, expiry = ?5, lastAccessed = ?6, isSecure = ?7, isHttpOnly = ?8, creationTime = ?9, protocol = ?10 where protocol = ?10 and name = ?1 and host = ?3 and path = ?4;";
+    m_updateStatement = new SQLiteStatement(m_db, updateQuery);
+
+    if (m_updateStatement->prepare()) {
+        LOG_ERROR("Cannot update cookies");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+    }
+
+    String deleteQuery("DELETE FROM ");
+    deleteQuery += m_tableName;
+    // The where statement is chosen to match CookieMap key.
+    deleteQuery += " WHERE name=?1 and host=?2 and path=?3 and protocol=?4;";
+    m_deleteStatement = new SQLiteStatement(m_db, deleteQuery);
+
+    if (m_deleteStatement->prepare()) {
+        LOG_ERROR("Cannot delete cookies");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+    }
+
+}
+
+void CookieDatabaseBackingStore::close()
+{
+    ASSERT(isCurrentThread());
+    CookieLog("CookieBackingStore - Closing");
+
+    size_t changedCookiesSize;
+    {
+        MutexLocker lock(m_mutex);
+        if (m_dbTimer.started())
+            m_dbTimer.stop();
+        changedCookiesSize = m_changedCookies.size();
+    }
+
+    if (changedCookiesSize > 0)
+        invokeSendChangesToDatabase();
+
+    delete m_insertStatement;
+    m_insertStatement = 0;
+    delete m_updateStatement;
+    m_updateStatement = 0;
+    delete m_deleteStatement;
+    m_deleteStatement = 0;
+
+    if (m_db.isOpen())
+        m_db.close();
+}
+
+void CookieDatabaseBackingStore::insert(const ParsedCookie* cookie)
+{
+    CookieLog("CookieBackingStore - adding inserting cookie %s to queue.", cookie->toString().utf8().data());
+    addToChangeQueue(cookie, Insert);
+}
+
+void CookieDatabaseBackingStore::update(const ParsedCookie* cookie)
+{
+    CookieLog("CookieBackingStore - adding updating cookie %s to queue.", cookie->toString().utf8().data());
+    addToChangeQueue(cookie, Update);
+}
+
+void CookieDatabaseBackingStore::remove(const ParsedCookie* cookie)
+{
+    CookieLog("CookieBackingStore - adding deleting cookie %s to queue.", cookie->toString().utf8().data());
+    addToChangeQueue(cookie, Delete);
+}
+
+void CookieDatabaseBackingStore::removeAll()
+{
+    dispatchMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeRemoveAll, this));
+}
+
+void CookieDatabaseBackingStore::invokeRemoveAll()
+{
+    ASSERT(isCurrentThread());
+    if (!m_db.isOpen())
+        return;
+
+    CookieLog("CookieBackingStore - remove All cookies from backingstore");
+
+    {
+        MutexLocker lock(m_mutex);
+        m_changedCookies.clear();
+    }
+
+    String deleteQuery("DELETE FROM ");
+    deleteQuery += m_tableName;
+    deleteQuery += ";";
+
+    SQLiteStatement deleteStatement(m_db, deleteQuery);
+    if (deleteStatement.prepare()) {
+        LOG_ERROR("Could not prepare DELETE * statement");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return;
+    }
+
+    if (!deleteStatement.executeCommand()) {
+        LOG_ERROR("Cannot delete cookie from database");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return;
+    }
+}
+
+void CookieDatabaseBackingStore::getCookiesFromDatabase(Vector<ParsedCookie*>& stackOfCookies, unsigned int limit)
+{
+    // It is not a huge performance hit to wait on the reply here because this is only done once during setup and when turning off private mode.
+    TypedReplyBuffer< Vector<ParsedCookie*>* > replyBuffer(0);
+    dispatchMessage(createMethodCallMessageWithReturn(&CookieDatabaseBackingStore::invokeGetCookiesWithLimit, &replyBuffer, this, limit));
+    Vector<ParsedCookie*>* cookies = replyBuffer.pointer();
+    stackOfCookies.swap(*cookies);
+    delete cookies;
+}
+
+Vector<ParsedCookie*>* CookieDatabaseBackingStore::invokeGetCookiesWithLimit(unsigned int limit)
+{
+    ASSERT(isCurrentThread());
+
+    // Check that the table exists to avoid doing an unnecessary request.
+    if (!m_db.isOpen())
+        return 0;
+
+    StringBuilder selectQuery;
+    selectQuery.append("SELECT name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime, protocol FROM ");
+    selectQuery.append(m_tableName);
+    if (limit > 0) {
+        selectQuery.append(" ORDER BY lastAccessed ASC");
+        selectQuery.append(" LIMIT " + String::number(limit));
+    }
+    selectQuery.append(";");
+
+    CookieLog("CookieBackingStore - invokeGetAllCookies with select query %s", selectQuery.toString().utf8().data());
+
+    SQLiteStatement selectStatement(m_db, selectQuery.toString());
+
+    if (selectStatement.prepare()) {
+        LOG_ERROR("Cannot retrieved cookies from the database");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return 0;
+    }
+
+    Vector<ParsedCookie*>* cookies = new Vector<ParsedCookie*>;
+    while (selectStatement.step() == SQLResultRow) {
+        // There is a row to fetch
+
+        String name = selectStatement.getColumnText(0);
+        String value = selectStatement.getColumnText(1);
+        String domain = selectStatement.getColumnText(2);
+        String path = selectStatement.getColumnText(3);
+        double expiry = selectStatement.getColumnDouble(4);
+        double lastAccessed = selectStatement.getColumnDouble(5);
+        bool isSecure = selectStatement.getColumnInt(6);
+        bool isHttpOnly = selectStatement.getColumnInt(7);
+        double creationTime = selectStatement.getColumnDouble(8);
+        String protocol = selectStatement.getColumnText(9);
+
+        cookies->append(new ParsedCookie(name, value, domain, protocol, path, expiry, lastAccessed, creationTime, isSecure, isHttpOnly));
+    }
+
+    return cookies;
+}
+
+void CookieDatabaseBackingStore::sendChangesToDatabaseSynchronously()
+{
+    CookieLog("CookieBackingStore - sending to database immediately");
+    {
+        MutexLocker lock(m_mutex);
+        if (m_dbTimer.started())
+            m_dbTimer.stop();
+    }
+    dispatchSyncMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeSendChangesToDatabase, this));
+}
+
+void CookieDatabaseBackingStore::sendChangesToDatabase(int nextInterval)
+{
+    MutexLocker lock(m_mutex);
+    if (!m_dbTimer.started()) {
+        CookieLog("CookieBackingStore - Starting one shot send to database");
+        m_dbTimer.start(nextInterval);
+    } else {
+#if !NDEBUG
+        CookieLog("CookieBackingStore - Timer already running, skipping this request");
+#endif
+    }
+}
+
+void CookieDatabaseBackingStore::sendChangesToDatabaseTimerFired()
+{
+    dispatchMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeSendChangesToDatabase, this));
+}
+
+void CookieDatabaseBackingStore::invokeSendChangesToDatabase()
+{
+    ASSERT(isCurrentThread());
+
+    if (!m_db.isOpen()) {
+        LOG_ERROR("Timer Fired, but database is closed.");
+        return;
+    }
+
+    Vector<CookieAction> changedCookies;
+    {
+        MutexLocker lock(m_mutex);
+        changedCookies.swap(m_changedCookies);
+        ASSERT(m_changedCookies.isEmpty());
+    }
+
+    if (changedCookies.isEmpty()) {
+        CookieLog("CookieBackingStore - Timer fired, but no cookies in changelist");
+        return;
+    }
+    CookieLog("CookieBackingStore - Timer fired, sending changes to database. We have %d changes", changedCookies.size());
+    SQLiteTransaction transaction(m_db, false);
+    transaction.begin();
+
+    // Iterate through every element in the change list to make calls
+    // If error occurs, ignore it and continue to the next statement
+    size_t sizeOfChange = changedCookies.size();
+    for (size_t i = 0; i < sizeOfChange; i++) {
+        SQLiteStatement* m_statement;
+        const ParsedCookie cookie = changedCookies[i].first;
+        UpdateParameter action = changedCookies[i].second;
+
+        if (action == Delete) {
+            m_statement = m_deleteStatement;
+            CookieLog("CookieBackingStore - deleting cookie %s.", cookie.toString().utf8().data());
+
+            // Binds all the values
+            if (m_statement->bindText(1, cookie.name()) || m_statement->bindText(2, cookie.domain())
+                || m_statement->bindText(3, cookie.path()) || m_statement->bindText(4, cookie.protocol())) {
+                LOG_ERROR("Cannot bind cookie data to delete");
+                LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+                ASSERT_NOT_REACHED();
+                continue;
+            }
+        } else {
+            if (action == Update) {
+                CookieLog("CookieBackingStore - updating cookie %s.", cookie.toString().utf8().data());
+                m_statement = m_updateStatement;
+            } else {
+                CookieLog("CookieBackingStore - inserting cookie %s.", cookie.toString().utf8().data());
+                m_statement = m_insertStatement;
+            }
+
+            // Binds all the values
+            if (m_statement->bindText(1, cookie.name()) || m_statement->bindText(2, cookie.value())
+                || m_statement->bindText(3, cookie.domain()) || m_statement->bindText(4, cookie.path())
+                || m_statement->bindDouble(5, cookie.expiry()) || m_statement->bindDouble(6, cookie.lastAccessed())
+                || m_statement->bindInt64(7, cookie.isSecure()) || m_statement->bindInt64(8, cookie.isHttpOnly())
+                || m_statement->bindDouble(9, cookie.creationTime()) || m_statement->bindText(10, cookie.protocol())) {
+                LOG_ERROR("Cannot bind cookie data to save");
+                LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+                ASSERT_NOT_REACHED();
+                continue;
+            }
+        }
+
+        int rc = m_statement->step();
+        m_statement->reset();
+        if (rc != SQLResultOk && rc != SQLResultDone) {
+            LOG_ERROR("Cannot make call to the database");
+            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            ASSERT_NOT_REACHED();
+            continue;
+        }
+    }
+    transaction.commit();
+    CookieLog("CookieBackingStore - transaction complete");
+}
+
+void CookieDatabaseBackingStore::addToChangeQueue(const ParsedCookie* changedCookie, UpdateParameter actionParam)
+{
+    ASSERT(!changedCookie->isSession());
+    ParsedCookie cookieCopy(changedCookie);
+    CookieAction action(cookieCopy, actionParam);
+    {
+        MutexLocker lock(m_mutex);
+        m_changedCookies.append(action);
+        CookieLog("CookieBackingStore - m_changedcookies has %d.", m_changedCookies.size());
+    }
+    sendChangesToDatabase(s_databaseTimerInterval);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h
new file mode 100644
index 000000000..b9b7decdd
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CookieDatabaseBackingStore_h
+#define CookieDatabaseBackingStore_h
+
+#include "PlatformString.h"
+#include "SQLiteDatabase.h"
+#include "Timer.h"
+
+#include <BlackBerryPlatformMessageClient.h>
+#include <BlackBerryPlatformTimer.h>
+#include <GenericTimerClient.h>
+#include <ThreadTimerClient.h>
+#include <wtf/ThreadingPrimitives.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class ParsedCookie;
+
+class CookieDatabaseBackingStore : public BlackBerry::Platform::MessageClient
+                                 , public BlackBerry::Platform::ThreadTimerClient {
+public:
+    static CookieDatabaseBackingStore* create() { return new CookieDatabaseBackingStore; }
+
+    void open(const String& cookieJar);
+
+    void insert(const ParsedCookie*);
+    void update(const ParsedCookie*);
+    void remove(const ParsedCookie*);
+
+    void removeAll();
+
+    // If a limit is not set, the method will return all cookies in the database
+    void getCookiesFromDatabase(Vector<ParsedCookie*>& stackOfCookies, unsigned int limit = 0);
+
+    void sendChangesToDatabaseSynchronously();
+
+    // ThreadTimerClient methods
+    virtual bool willFireTimer() { return true; }
+    virtual int getPulseCode() const { return pulseCode(); }
+    virtual int getConnectionId() const { return connectionId(); }
+    virtual int defaultTimerPriority() const { return threadPriority(); }
+
+private:
+    enum UpdateParameter {
+        Insert,
+        Update,
+        Delete,
+    };
+
+    CookieDatabaseBackingStore();
+    ~CookieDatabaseBackingStore();
+
+    void addToChangeQueue(const ParsedCookie* changedCookie, UpdateParameter actionParam);
+    void sendChangesToDatabase(int interval);
+    void sendChangesToDatabaseTimerFired();
+    void upgradeTableIfNeeded(const String& databaseSchema, const String& primarykeyFields);
+
+    void invokeOpen(const String& cookieJar);
+    void invokeRemoveAll();
+    Vector<ParsedCookie*>* invokeGetCookiesWithLimit(unsigned int limit);
+    void invokeSendChangesToDatabase();
+
+    void close();
+
+    typedef pair<const ParsedCookie, UpdateParameter> CookieAction;
+    Vector<CookieAction> m_changedCookies;
+    Mutex m_mutex;
+
+    String m_tableName;
+    BlackBerry::Platform::Timer<CookieDatabaseBackingStore> m_dbTimer;
+    BlackBerry::Platform::GenericTimerClient* m_dbTimerClient;
+    SQLiteDatabase m_db;
+    SQLiteStatement *m_insertStatement;
+    SQLiteStatement *m_updateStatement;
+    SQLiteStatement *m_deleteStatement;
+};
+
+CookieDatabaseBackingStore& cookieBackingStore();
+
+} // namespace WebCore
+
+#endif // CookieDatabaseBackingStore_h
diff --git a/Source/WebCore/platform/blackberry/CookieJarBlackBerry.cpp b/Source/WebCore/platform/blackberry/CookieJarBlackBerry.cpp
new file mode 100644
index 000000000..395c6af27
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieJarBlackBerry.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
+ */
+
+#include "config.h"
+#include "CookieJar.h"
+
+#include "Cookie.h"
+#include "CookieManager.h"
+#include "Document.h"
+#include "Frame.h"
+#include "FrameLoaderClientBlackBerry.h"
+#include "KURL.h"
+#include "NotImplemented.h"
+#include "Page.h"
+#include "PageGroupLoadDeferrer.h"
+#include "Settings.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+String cookies(Document const* document, KURL const& url)
+{
+    Frame* frame = document->frame();
+    Page* page = frame ? frame->page() : 0;
+
+    if (!page)
+        return String();
+
+    if (!(frame && frame->loader() && frame->loader()->client()))
+        return String();
+
+    if (!static_cast<FrameLoaderClientBlackBerry*>(frame->loader()->client())->cookiesEnabled())
+        return String();
+
+    ASSERT(document && url == document->cookieURL());
+    // 'HttpOnly' cookies should no be accessible from scripts, so we filter them out here
+    return cookieManager().getCookie(url, NoHttpOnlyCookie);
+}
+
+void setCookies(Document* document, KURL const& url, String const& value)
+{
+    Frame* frame = document->frame();
+    Page* page = frame ? frame->page() : 0;
+
+    if (!page)
+        return;
+
+    if (!(frame && frame->loader() && frame->loader()->client()))
+        return;
+
+    if (!static_cast<FrameLoaderClientBlackBerry*>(frame->loader()->client())->cookiesEnabled())
+        return;
+
+    ASSERT(document && url == document->cookieURL());
+    cookieManager().setCookies(url, value);
+}
+
+bool cookiesEnabled(Document const*)
+{
+    // FIXME. Currently cookie is enabled by default, no setting on property page.
+    return true;
+}
+
+bool getRawCookies(const Document* document, const KURL& url, Vector<Cookie>& rawCookies)
+{
+    Vector<ParsedCookie*> result;
+    cookieManager().getRawCookies(result, url, WithHttpOnlyCookies);
+    for (size_t i = 0; i < result.size(); i++)
+        result[i]->appendWebCoreCookie(rawCookies);
+    return true;
+}
+
+void deleteCookie(const Document* document, const KURL& url, const String& cookieName)
+{
+    // Cookies are not bound to the document. Therefore, we don't need to pass
+    // in the document object to find the targeted cookies in cookie manager.
+    cookieManager().removeCookieWithName(url, cookieName);
+}
+
+String cookieRequestHeaderFieldValue(const Document* document, const KURL &url)
+{
+    ASSERT(document);
+
+    if (!(document->frame() && document->frame()->loader() && document->frame()->loader()->client()))
+        return String();
+
+    if (!static_cast<FrameLoaderClientBlackBerry*>(document->frame()->loader()->client())->cookiesEnabled())
+        return String();
+
+    return cookieManager().getCookie(url, WithHttpOnlyCookies);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieManager.cpp b/Source/WebCore/platform/blackberry/CookieManager.cpp
new file mode 100644
index 000000000..d79380fd9
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieManager.cpp
@@ -0,0 +1,598 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#define ENABLE_COOKIE_DEBUG 0
+#define ENABLE_COOKIE_SUPER_VERBOSE_DEBUG 0
+#define ENABLE_COOKIE_LIMIT_DEBUG 0
+
+#include "config.h"
+#include "CookieManager.h"
+
+#include "CookieDatabaseBackingStore.h"
+#include "CookieParser.h"
+#include "CurrentTime.h"
+#include "FileSystem.h"
+#include "Logging.h"
+#include "WebSettings.h"
+#include <BlackBerryPlatformClient.h>
+#include <BlackBerryPlatformExecutableMessage.h>
+#include <BlackBerryPlatformMessageClient.h>
+#include <BlackBerryPlatformNavigatorHandler.h>
+#include <stdlib.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE_COOKIE_DEBUG
+#include <BlackBerryPlatformLog.h>
+#endif
+
+#if ENABLE_COOKIE_SUPER_VERBOSE_DEBUG
+#define CookieLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLog(format, ...)
+#endif // ENABLE_COOKIE_SUPER_VERBOSE_DEBUG
+
+#if ENABLE_COOKIE_LIMIT_DEBUG
+#define CookieLimitLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLimitLog(format, ...)
+#endif // ENABLE_COOKIE_LIMIT_DEBUG
+
+namespace WebCore {
+
+// Max count constants.
+static const unsigned s_globalMaxCookieCount = 6000;
+static const unsigned s_maxCookieCountPerHost = 60;
+static const unsigned s_cookiesToDeleteWhenLimitReached = 60;
+static const unsigned s_delayToStartCookieCleanup = 10;
+
+static void flushCookiesOnExit(void)
+{
+    cookieManager().flushCookiesToBackingStore();
+}
+
+CookieManager& cookieManager()
+{
+    static CookieManager *cookieManager = 0;
+    if (!cookieManager) {
+        // Open the cookieJar now and get the backing store cookies to fill the manager.
+        cookieManager = new CookieManager;
+        cookieManager->m_cookieBackingStore->open(cookieManager->cookieJar());
+        cookieManager->getBackingStoreCookies();
+        CookieLog("CookieManager - Backingstore load complete.\n");
+
+        atexit(&flushCookiesOnExit);
+    }
+    return *cookieManager;
+}
+
+CookieManager::CookieManager()
+    : m_count(0)
+    , m_privateMode(false)
+    , m_shouldDumpAllCookies(false)
+    , m_cookieJarFileName(pathByAppendingComponent(BlackBerry::Platform::Client::get()->getApplicationDataDirectory().c_str(), "/cookieCollection.db"))
+    , m_policy(CookieStorageAcceptPolicyAlways)
+    , m_cookieBackingStore(CookieDatabaseBackingStore::create())
+    , m_limitTimer(this, &CookieManager::cookieLimitCleanUp)
+{
+}
+
+CookieManager::~CookieManager()
+{
+    removeAllCookies(DoNotRemoveFromBackingStore);
+    // FIXME: m_managerMap and the top layer protocolMaps are not properly deleted.
+    // Do not delete any protocol maps to avoid double-deletion of the maps that are
+    // being used for both secure and non-secure protocols; this leak is OK since
+    // there's nothing important in the hashtable destructors, and the memory will be reclaimed on exit
+
+    // FIXME: CookieDatabaseBackingStore is not deleted, only flushed
+    // (currently the destructor is never called since this class is a
+    // singleton; on exit, the db is flushed manually. This call is only here
+    // as a fallback in case this class is made a non-singleton.
+    m_cookieBackingStore->sendChangesToDatabaseSynchronously();
+}
+
+// Sorting logic is based on Cookie Spec RFC6265, section 5.4.2
+static bool cookieSorter(ParsedCookie* a, ParsedCookie* b)
+{
+    if (a->path().length() == b->path().length())
+        return a->creationTime() <= b->creationTime();
+    return a->path().length() > b->path().length();
+}
+
+// Returns whether the protocol supports domains
+static bool shouldIgnoreDomain(const String protocol)
+{
+    // ignore domain security for file and local
+    return protocol == "file" || protocol == "local";
+}
+
+void CookieManager::setCookies(const KURL& url, const String& value)
+{
+    CookieLog("CookieManager - Setting cookies");
+    CookieParser parser(url);
+    Vector<ParsedCookie*> cookies = parser.parse(value);
+
+    for (size_t i = 0; i < cookies.size(); ++i) {
+        ParsedCookie* cookie = cookies[i];
+        if (!shouldRejectForSecurityReason(cookie, url)) {
+            BackingStoreRemovalPolicy treatment = m_privateMode ? DoNotRemoveFromBackingStore : RemoveFromBackingStore;
+            checkAndTreatCookie(cookie, treatment);
+        } else
+            delete cookie;
+    }
+}
+
+bool CookieManager::shouldRejectForSecurityReason(const ParsedCookie* cookie, const KURL& url)
+{
+    // We have to disable the following check because sites like Facebook and
+    // Gmail currently do not follow the spec.
+#if 0
+    // Check if path attribute is a prefix of the request URI.
+    if (!url.path().startsWith(cookie->path())) {
+        LOG_ERROR("Cookie %s is rejected because its path does not math the URL %s\n", cookie->toString().utf8().data(), url.string().utf8().data());
+        return true;
+    }
+#endif
+
+    // ignore domain security if protocol doesn't have domains
+    if (shouldIgnoreDomain(cookie->protocol()))
+        return false;
+
+    // Reject Cookie if domain is empty
+    if (!cookie->domain().length())
+        return true;
+
+    if (!cookie->hasDefaultDomain()) {
+        // Check if the domain contains an embedded dot.
+        int dotPosition = cookie->domain().find(".", 1);
+        if (dotPosition == -1 || static_cast<unsigned int>(dotPosition) == cookie->domain().length()) {
+            LOG_ERROR("Cookie %s is rejected because its domain does not contain an embedded dot.\n", cookie->toString().utf8().data());
+            return true;
+        }
+    }
+
+    // The request host should domain match the Domain attribute.
+    // Domain string starts with a dot, so a.b.com should domain match .a.b.com.
+    // add a "." at beginning of host name, because it can handle many cases such as
+    // a.b.com matches b.com, a.b.com matches .B.com and a.b.com matches .A.b.Com
+    // and so on.
+    String hostDomainName = url.host();
+    hostDomainName = hostDomainName.startsWith(".") ? hostDomainName : "." + hostDomainName;
+    if (!hostDomainName.endsWith(cookie->domain(), false)) {
+        LOG_ERROR("Cookie %s is rejected because its domain does not domain match the URL %s\n", cookie->toString().utf8().data(), url.string().utf8().data());
+        return true;
+    }
+    // We should check for an embedded dot in the portion of string in the host not in the domain
+    // but to match firefox behaviour we do not.
+
+    return false;
+}
+
+String CookieManager::getCookie(const KURL& url, CookieFilter filter) const
+{
+    Vector<ParsedCookie*> rawCookies;
+    rawCookies.reserveInitialCapacity(s_maxCookieCountPerHost);
+
+    // Retrieve cookies related to this url
+    getRawCookies(rawCookies, url, filter);
+
+    CookieLog("CookieManager - there are %d cookies in raw cookies\n", rawCookies.size());
+
+    // Generate the cookie header string using the retrieved cookies
+    StringBuilder cookieStringBuilder;
+    cookieStringBuilder.reserveCapacity(512);
+    size_t cookieSize = rawCookies.size();
+    for (size_t i = 0; i < cookieSize; i++) {
+        cookieStringBuilder.append(rawCookies[i]->toNameValuePair());
+        if (i != cookieSize-1)
+            cookieStringBuilder.append("; ");
+    }
+
+    CookieLog("CookieManager - cookieString is - %s\n", cookieStringBuilder.toString().utf8().data());
+
+    return cookieStringBuilder.toString();
+}
+
+void CookieManager::getRawCookies(Vector<ParsedCookie*> &stackOfCookies, const KURL& requestURL, CookieFilter filter) const
+{
+    CookieLog("CookieManager - getRawCookies - processing url with domain - %s & protocol: %s & path: %s\n", requestURL.host().utf8().data(), requestURL.protocol().utf8().data(), requestURL.path().utf8().data());
+
+    bool specialCaseForLocal = (requestURL.protocolIs("local") || requestURL.protocolIs("file")) && m_shouldDumpAllCookies;
+    bool isConnectionSecure = requestURL.protocolIs("https") || requestURL.protocolIs("wss") || specialCaseForLocal;
+
+    Vector<ParsedCookie*> cookieCandidates;
+    Vector<CookieMap*> protocolsToSearch;
+
+    if (specialCaseForLocal)
+        copyValuesToVector(m_managerMap, protocolsToSearch);
+    else {
+        protocolsToSearch.append(m_managerMap.get(requestURL.protocol()));
+        // FIXME: this is a hack for webworks apps; RFC 6265 says "Cookies do not provide isolation by scheme"
+        // so we should not be checking protocols at all. See PR 135595
+        if (m_shouldDumpAllCookies) {
+            protocolsToSearch.append(m_managerMap.get("file"));
+            protocolsToSearch.append(m_managerMap.get("local"));
+       }
+    }
+
+    Vector<String> delimitedHost;
+    requestURL.host().lower().split(".", true, delimitedHost);
+
+    // Go through all the protocol trees that we need to search for
+    // and get all cookies that are valid for this domain
+    for (size_t k = 0; k < protocolsToSearch.size(); k++) {
+        CookieMap* currentMap = protocolsToSearch[k];
+
+        // if no cookies exist for this protocol, break right away
+        if (!currentMap)
+            continue;
+
+        CookieLog("CookieManager - looking at protocol map %s \n", currentMap->getName().utf8().data());
+
+        // Special case for local and files - because WebApps expect to get ALL cookies from the backing-store on local protocol
+        if (specialCaseForLocal) {
+            CookieLog("CookieManager - special case find in protocol map - %s\n", currentMap->getName().utf8().data());
+            currentMap->getAllChildCookies(&cookieCandidates);
+        } else {
+            // Get cookies from the null domain map
+            currentMap->getAllCookies(&cookieCandidates);
+
+            // Get cookies from the valid domain maps
+            int i = delimitedHost.size() - 1;
+            while (i >= 0) {
+                CookieLog("CookieManager - finding %s in currentmap\n", delimitedHost[i].utf8().data());
+                currentMap = currentMap->getSubdomainMap(delimitedHost[i]);
+                // if this subdomain/domain does not exist in our mapping then we simply exit
+                if (!currentMap) {
+                    CookieLog("CookieManager - cannot find next map exiting the while loop.\n");
+                    break;
+                }
+                CookieLog("CookieManager - found the map, grabbing cookies from this map\n");
+                currentMap->getAllCookies(&cookieCandidates);
+                i--;
+            }
+        }
+    }
+
+    CookieLog("CookieManager - there are %d cookies in candidate\n", cookieCandidates.size());
+
+    for (size_t i = 0; i < cookieCandidates.size(); ++i) {
+        ParsedCookie* cookie = cookieCandidates[i];
+
+        // According to the path-matches rules in RFC6265, section 5.1.4,
+        // we should add a '/' at the end of cookie-path for comparison if the cookie-path is not end with '/'.
+        String path = cookie->path();
+        CookieLog("CookieManager - comparing cookie path %s (len %d) to request path %s (len %d)", path.utf8().data(), path.length(), requestURL.path().utf8().data(), path.length());
+        if (!equalIgnoringCase(path, requestURL.path()) && !path.endsWith("/", false))
+            path += "/";
+
+        // Only secure connections have access to secure cookies. Unless specialCaseForLocal is true
+        // Get the cookies filtering out HttpOnly cookies if requested.
+        if (requestURL.path().startsWith(path, false) && (isConnectionSecure || !cookie->isSecure()) && (filter == WithHttpOnlyCookies || !cookie->isHttpOnly())) {
+            CookieLog("CookieManager - cookie chosen - %s\n", cookie->toString().utf8().data());
+            cookie->setLastAccessed(currentTime());
+            stackOfCookies.append(cookie);
+        }
+    }
+
+    std::sort(stackOfCookies.begin(), stackOfCookies.end(), cookieSorter);
+}
+
+void CookieManager::removeAllCookies(BackingStoreRemovalPolicy backingStoreRemoval)
+{
+    HashMap<String, CookieMap*>::iterator first = m_managerMap.begin();
+    HashMap<String, CookieMap*>::iterator end = m_managerMap.end();
+    for (HashMap<String, CookieMap*>::iterator it = first; it != end; ++it)
+        it->second->deleteAllCookiesAndDomains();
+
+    if (backingStoreRemoval == RemoveFromBackingStore)
+        m_cookieBackingStore->removeAll();
+    m_count = 0;
+}
+
+void CookieManager::setCookieJar(const char* fileName)
+{
+    m_cookieJarFileName = String(fileName);
+    m_cookieBackingStore->open(m_cookieJarFileName);
+}
+
+void CookieManager::checkAndTreatCookie(ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
+{
+    CookieLog("CookieManager - checkAndTreatCookie - processing url with domain - %s & protocol %s\n", candidateCookie->domain().utf8().data(), candidateCookie->protocol().utf8().data());
+
+    const bool ignoreDomain = shouldIgnoreDomain(candidateCookie->protocol());
+
+    // Determine which protocol tree to add the cookie to. Create one if necessary.
+    CookieMap* curMap = 0;
+    if (m_managerMap.contains(candidateCookie->protocol()))
+        curMap = m_managerMap.get(candidateCookie->protocol());
+    else {
+        // Check if it is a secure version, if it is, link it to the non-secure version
+        // Link curMap to the new protocol as well as the old one if it doesn't exist
+        if (candidateCookie->protocol() == "https") {
+            curMap = m_managerMap.get("http");
+            if (!curMap) {
+                curMap = new CookieMap("http");
+                m_managerMap.add("http", curMap);
+            }
+        } else if (candidateCookie->protocol() == "wss") {
+            curMap = m_managerMap.get("ws");
+            if (!curMap) {
+                curMap = new CookieMap("ws");
+                m_managerMap.add("ws", curMap);
+            }
+        } else
+            curMap = new CookieMap(candidateCookie->protocol());
+
+        CookieLog("CookieManager - adding protocol cookiemap - %s\n", curMap->getName().utf8().data());
+
+        m_managerMap.add(candidateCookie->protocol(), curMap);
+    }
+
+    // If protocol support domain, we have to traverse the domain tree to find the right
+    // cookieMap to handle with
+    if (!ignoreDomain)
+        curMap = findOrCreateCookieMap(curMap, candidateCookie->domain(), candidateCookie->hasExpired());
+
+    // Now that we have the proper map for this cookie, we can modify it
+    // If cookie does not exist and has expired, delete it
+    // If cookie exists and it has expired, so we must remove it from the map, if not update it
+    // If cookie expired and came from the BackingStore (therefore does not exist), we have to remove from database
+    // If cookie does not exist & it's valid, add it to the current map
+
+    if (candidateCookie->hasExpired() || candidateCookie->isForceExpired()) {
+        // Special case for getBackingStoreCookies() to catch expired cookies
+        if (postToBackingStore == BackingStoreCookieEntry)
+            m_cookieBackingStore->remove(candidateCookie);
+        else if (curMap) {
+            bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
+            if (cookieAlreadyExists) {
+                CookieLog("CookieManager - expired cookie exists in memory");
+                ParsedCookie* expired = curMap->removeCookie(candidateCookie);
+                // Cookie is useless, Remove the cookie from the backingstore if it exists
+                // Backup check for BackingStoreCookieEntry incase someone incorrectly uses this enum
+                if (postToBackingStore != BackingStoreCookieEntry && !expired->isSession()) {
+                    CookieLog("CookieManager - expired cookie is nonsession, deleting from db");
+                    m_cookieBackingStore->remove(expired);
+                }
+                delete expired;
+            }
+        } else
+            delete candidateCookie;
+    } else {
+        ASSERT(curMap);
+        bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
+        if (cookieAlreadyExists)
+            update(curMap, candidateCookie, postToBackingStore);
+        else
+            addCookieToMap(curMap, candidateCookie, postToBackingStore);
+    }
+}
+
+void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
+{
+    ParsedCookie* oldestCookie = 0;
+    // Check if we have not reached the per cookie domain limit.
+    // If that is not true, we check if the global limit has been reached if backingstore mode is on
+    // Two points:
+    // 1) We only do a global check if backingstore mode is on because the global cookie limit only
+    //    counts session cookies that are saved in the database. If the user goes over the limit
+    //    when they are in private mode, we know that the total cookie limit will be under the limit
+    //    once the user goes back to normal mode (memory deleted and reloaded from the database)
+    // 2) We use else if for this statement because if we remove a cookie in the 1st statement
+    //    then it means the global count will never exceed the limit
+
+    CookieLimitLog("CookieManager - local count: %d  global count: %d", targetMap->count(), m_count);
+    if (targetMap->count() >= s_maxCookieCountPerHost) {
+        CookieLog("CookieManager - deleting oldest cookie from this map due to domain count.\n");
+        oldestCookie = targetMap->removeOldestCookie();
+    } else if (m_count >= s_globalMaxCookieCount && (postToBackingStore != DoNotRemoveFromBackingStore)) {
+        CookieLimitLog("CookieManager - Global limit reached, initiate cookie limit clean up.");
+        initiateCookieLimitCleanUp();
+    }
+
+    CookieLog("CookieManager - adding new cookie - %s.\n", candidateCookie->toString().utf8().data());
+
+    targetMap->addCookie(candidateCookie);
+
+    // Only add non session cookie to the backing store.
+    if (postToBackingStore == RemoveFromBackingStore) {
+        if (oldestCookie && !oldestCookie->isSession()) {
+            CookieLog("CookieManager - oldestCookie exists, deleting it from backingstore and destructing.\n");
+            m_cookieBackingStore->remove(oldestCookie);
+        }
+        if (!candidateCookie->isSession())
+            m_cookieBackingStore->insert(candidateCookie);
+    }
+    if (oldestCookie)
+        delete oldestCookie;
+}
+
+void CookieManager::update(CookieMap* targetMap, ParsedCookie* newCookie, BackingStoreRemovalPolicy postToBackingStore)
+{
+    // If old cookie is non-session and new one is, we have to delete it from backingstore
+    // If new cookie is non-session and old one is, we have to add it to backingstore
+    // If both sessions are non-session, then we update it in the backingstore
+
+    CookieLog("CookieManager - updating new cookie - %s.\n", newCookie->toString().utf8().data());
+
+    ParsedCookie* oldCookie = targetMap->updateCookie(newCookie);
+
+    ASSERT(oldCookie);
+
+    if (postToBackingStore == RemoveFromBackingStore) {
+        bool newIsSession = newCookie->isSession();
+        bool oldIsSession = oldCookie->isSession();
+        if (!newIsSession && !oldIsSession)
+            m_cookieBackingStore->update(newCookie);
+        else if (newIsSession && !oldIsSession) {
+            // Must manually decrease the counter because it was not counted when
+            // the cookie was removed in cookieMap.
+            removedCookie();
+            m_cookieBackingStore->remove(oldCookie);
+        } else if (!newIsSession && oldIsSession) {
+            // Must manually increase the counter because it was not counted when
+            // the cookie was added in cookieMap.
+            addedCookie();
+            m_cookieBackingStore->insert(newCookie);
+        }
+    }
+    delete oldCookie;
+}
+
+void CookieManager::getBackingStoreCookies()
+{
+    // This method should be called just after having created the cookieManager
+    // NEVER afterwards!
+    ASSERT(!m_count);
+
+    Vector<ParsedCookie*> cookies;
+    m_cookieBackingStore->getCookiesFromDatabase(cookies);
+    CookieLog("CookieManager - Backingstore has %d cookies, loading them in memory now", cookies.size());
+    for (size_t i = 0; i < cookies.size(); ++i) {
+        ParsedCookie* newCookie = cookies[i];
+        checkAndTreatCookie(newCookie, BackingStoreCookieEntry);
+    }
+}
+
+void CookieManager::setPrivateMode(const bool mode)
+{
+    if (m_privateMode == mode)
+        return;
+
+    m_privateMode = mode;
+    if (!mode) {
+        removeAllCookies(DoNotRemoveFromBackingStore);
+        getBackingStoreCookies();
+    }
+}
+
+CookieMap* CookieManager::findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly)
+{
+    // Explode the domain with the '.' delimiter
+    Vector<String> delimitedHost;
+    domain.split(".", delimitedHost);
+
+    CookieMap* curMap = protocolMap;
+    size_t hostSize = delimitedHost.size();
+
+    CookieLog("CookieManager - looking at protocol map %s \n", protocolMap->getName().utf8().data());
+
+    // Find & create necessary CookieMaps by traversing down the domain tree
+    // Each CookieMap represent a subsection of the domain, delimited by "."
+    int i = hostSize - 1;
+    while (i >= 0) {
+        CookieLog("CookieManager - finding %s in currentmap\n", delimitedHost[i].utf8().data());
+        CookieMap* nextMap = curMap->getSubdomainMap(delimitedHost[i]);
+        if (!nextMap) {
+            CookieLog("CookieManager - cannot find map\n");
+            if (findOnly)
+                return 0;
+            CookieLog("CookieManager - creating %s in currentmap %s\n", delimitedHost[i].utf8().data(), curMap->getName().utf8().data());
+            nextMap = new CookieMap(delimitedHost[i]);
+            CookieLog("CookieManager - adding subdomain to map\n");
+            curMap->addSubdomainMap(delimitedHost[i], nextMap);
+        }
+        curMap = nextMap;
+        i--;
+    }
+    return curMap;
+}
+
+
+void CookieManager::removeCookieWithName(const KURL& url, const String& cookieName)
+{
+    // We get all cookies from all domains that domain matches the request domain
+    // and delete any cookies with the specified name that path matches the request path
+    Vector<ParsedCookie*> results;
+    getRawCookies(results, url, WithHttpOnlyCookies);
+    // Delete the cookies that path matches the request path
+    for (size_t i = 0; i < results.size(); i++) {
+        ParsedCookie* cookie = results[i];
+        if (!equalIgnoringCase(cookie->name(), cookieName))
+            continue;
+        if (url.path().startsWith(cookie->path(), false)) {
+            cookie->forceExpire();
+            checkAndTreatCookie(cookie, RemoveFromBackingStore);
+        }
+    }
+}
+
+void CookieManager::initiateCookieLimitCleanUp()
+{
+    if (!m_limitTimer.isActive()) {
+        CookieLog("CookieManager - Starting a timer for cookie cleanup");
+        m_limitTimer.startOneShot(s_delayToStartCookieCleanup);
+    } else {
+#if !NDEBUG
+        CookieLog("CookieManager - Cookie cleanup timer already running");
+#endif
+    }
+}
+
+void CookieManager::cookieLimitCleanUp(Timer<CookieManager>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_limitTimer);
+
+    CookieLimitLog("CookieManager - Starting cookie clean up");
+
+    size_t numberOfCookiesOverLimit = (m_count > s_globalMaxCookieCount) ? m_count - s_globalMaxCookieCount : 0;
+    size_t amountToDelete = s_cookiesToDeleteWhenLimitReached + numberOfCookiesOverLimit;
+
+    CookieLimitLog("CookieManager - Excess: %d  Amount to Delete: %d", numberOfCookiesOverLimit, amountToDelete);
+
+    // Call the database to delete 'amountToDelete' of cookies
+    Vector<ParsedCookie*> cookiesToDelete;
+    cookiesToDelete.reserveInitialCapacity(amountToDelete);
+
+    CookieLimitLog("CookieManager - Calling database to clean up");
+    m_cookieBackingStore->getCookiesFromDatabase(cookiesToDelete, amountToDelete);
+
+    // Cookies are ordered in ASC order by lastAccessed
+    for (size_t i = 0; i < amountToDelete; ++i) {
+        // Expire them and call checkandtreat to delete them from memory and database
+        ParsedCookie* newCookie = cookiesToDelete[i];
+        CookieLimitLog("CookieManager - Expire cookie: %s and delete", newCookie->toString().utf8().data());
+        newCookie->forceExpire();
+        checkAndTreatCookie(newCookie, RemoveFromBackingStore);
+    }
+
+    CookieLimitLog("CookieManager - Cookie clean up complete.");
+}
+
+void CookieManager::flushCookiesToBackingStore()
+{
+    CookieLog("CookieManager - flushCookiesToBackingStore starting.\n");
+    // This is called from shutdown, so we need to be sure the OS doesn't kill us before the db write finishes.
+    // Once should be enough since this extends terimination by 2 seconds.
+    BlackBerry::Platform::NavigatorHandler::sendExtendTerminate();
+    m_cookieBackingStore->sendChangesToDatabaseSynchronously();
+    CookieLog("CookieManager - flushCookiesToBackingStore finished.\n");
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieManager.h b/Source/WebCore/platform/blackberry/CookieManager.h
new file mode 100644
index 000000000..b97b9f962
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieManager.h
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2010, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CookieManager_h
+#define CookieManager_h
+
+#include "CookieMap.h"
+#include "ParsedCookie.h"
+#include "PlatformString.h"
+#include "Timer.h"
+#include <BlackBerryPlatformGuardedPointer.h>
+#include <wtf/HashMap.h>
+
+namespace WTF {
+class String;
+}
+
+namespace WebCore {
+
+class CookieDatabaseBackingStore;
+class KURL;
+
+enum BackingStoreRemovalPolicy {
+    RemoveFromBackingStore,
+    BackingStoreCookieEntry,
+    DoNotRemoveFromBackingStore
+};
+
+enum CookieFilter {
+    NoHttpOnlyCookie,
+    WithHttpOnlyCookies,
+};
+
+enum CookieStorageAcceptPolicy {
+    CookieStorageAcceptPolicyAlways,
+    CookieStorageAcceptPolicyNever,
+    CookieStorageAcceptPolicyOnlyFromMainDocumentDomain
+};
+
+/*
+  * The CookieManager class is a singleton class that handles and selectively persists
+  * incoming cookies. This class contains a tree of domains for quicker
+  * cookie domain lookup. The top of the tree represents a null value for a null domain.
+  * The null domain contains references to top level domains and each node below
+  * represents a sub-section of a domain, delimited by "."
+  *
+  * If a cookie has a domain "a.b.com", it will be stored in the node named "a" in this tree.
+  * in the branch ""->"com"->"b"->"a"
+  *
+  * Cookie specs follow the RFC 6265 spec sheet.
+  * http://tools.ietf.org/html/rfc6265
+  */
+
+class CookieManager: public BlackBerry::Platform::GuardedPointerBase {
+public:
+    bool canLocalAccessAllCookies() const { return m_shouldDumpAllCookies; }
+    void setCanLocalAccessAllCookies(bool enabled) { m_shouldDumpAllCookies = enabled; }
+
+    void setCookies(const KURL&, const String& value);
+
+    void removeAllCookies(BackingStoreRemovalPolicy);
+    void removeCookieWithName(const KURL&, const String& cookieName);
+
+    unsigned short cookiesCount() const { return m_count; }
+
+    void setCookieJar(const char*);
+    const String& cookieJar() const { return m_cookieJarFileName; }
+
+    // Count update method
+    void removedCookie()
+    {
+        ASSERT(m_count > 0);
+        --m_count;
+    }
+    void addedCookie() { ++m_count; }
+
+    static unsigned maxCookieLength() { return s_maxCookieLength; }
+
+    void setCookiePolicy(CookieStorageAcceptPolicy policy) { m_policy = policy; }
+    CookieStorageAcceptPolicy cookiePolicy() const { return m_policy; }
+    void setPrivateMode(const bool);
+
+    String getCookie(const KURL& requestURL, CookieFilter) const;
+
+    // Returns all cookies that are associated with the specified URL as raw cookies.
+    void getRawCookies(Vector<ParsedCookie*>& stackOfCookies, const KURL& requestURL, CookieFilter = WithHttpOnlyCookies) const;
+
+    void flushCookiesToBackingStore();
+
+private:
+    friend CookieManager& cookieManager();
+
+    CookieManager();
+    ~CookieManager();
+
+    void checkAndTreatCookie(ParsedCookie*, BackingStoreRemovalPolicy);
+
+    bool shouldRejectForSecurityReason(const ParsedCookie*, const KURL&);
+
+    void addCookieToMap(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
+    void update(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
+
+    CookieMap* findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly);
+
+    void initiateCookieLimitCleanUp();
+    void cookieLimitCleanUp(Timer<CookieManager>*);
+
+    HashMap<String, CookieMap*> m_managerMap;
+
+    unsigned short m_count;
+
+    bool m_privateMode;
+    bool m_shouldDumpAllCookies;
+
+    String m_cookieJarFileName;
+
+    // FIXME: This method should be removed.
+    void getBackingStoreCookies();
+
+    // Cookie size limit of 4kB as advised per RFC2109
+    static const unsigned s_maxCookieLength = 4096;
+
+    CookieStorageAcceptPolicy m_policy;
+
+    CookieDatabaseBackingStore* m_cookieBackingStore;
+    Timer<CookieManager> m_limitTimer;
+
+};
+
+// Get the global instance.
+CookieManager& cookieManager();
+
+} // namespace WebCore
+
+#endif // CookieManager_h
diff --git a/Source/WebCore/platform/blackberry/CookieMap.cpp b/Source/WebCore/platform/blackberry/CookieMap.cpp
new file mode 100644
index 000000000..4c6d541ad
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieMap.cpp
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#define ENABLE_COOKIE_DEBUG 0
+
+#include "config.h"
+#include "CookieMap.h"
+
+#include "CookieManager.h"
+#include "Logging.h"
+#include "ParsedCookie.h"
+#include <wtf/text/CString.h>
+
+#if ENABLE_COOKIE_DEBUG
+#include <BlackBerryPlatformLog.h>
+#define CookieLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLog(format, ...)
+#endif // ENABLE_COOKIE_DEBUG
+
+namespace WebCore {
+
+CookieMap::CookieMap(const String& name)
+    : m_oldestCookie(0)
+    , m_name(name)
+{
+}
+
+CookieMap::~CookieMap()
+{
+    deleteAllCookiesAndDomains();
+}
+
+bool CookieMap::existsCookie(const ParsedCookie* cookie) const
+{
+    String key = cookie->name() + cookie->path();
+    return m_cookieMap.contains(key);
+}
+
+void CookieMap::addCookie(ParsedCookie* cookie)
+{
+    String key = cookie->name() + cookie->path();
+
+    CookieLog("CookieMap - Attempting to add cookie - %s", cookie->name().utf8().data());
+
+    ASSERT(!m_cookieMap.contains(key));
+    m_cookieMap.add(key, cookie);
+    if (!cookie->isSession())
+        cookieManager().addedCookie();
+    if (!m_oldestCookie || m_oldestCookie->lastAccessed() > cookie->lastAccessed())
+        m_oldestCookie = cookie;
+}
+
+ParsedCookie* CookieMap::updateCookie(ParsedCookie* newCookie)
+{
+    String key = newCookie->name() + newCookie->path();
+    ParsedCookie* oldCookie = m_cookieMap.take(key);
+    ASSERT(oldCookie);
+    m_cookieMap.add(key, newCookie);
+    if (oldCookie == m_oldestCookie)
+        updateOldestCookie();
+    return oldCookie;
+}
+
+ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
+{
+    // Find a previous entry for deletion
+    String key = cookie->name() + cookie->path();
+    ParsedCookie* prevCookie = m_cookieMap.take(key);
+
+    if (!prevCookie)
+        return 0;
+
+    if (prevCookie == m_oldestCookie)
+        updateOldestCookie();
+    else if (prevCookie != cookie) {
+        // The cookie we used to search is force expired, we must do the same
+        // to the cookie in memory too.
+        if (cookie->isForceExpired())
+            prevCookie->forceExpire();
+        delete cookie;
+    }
+
+    if (!prevCookie->isSession())
+        cookieManager().removedCookie();
+    return prevCookie;
+}
+
+CookieMap* CookieMap::getSubdomainMap(const String& subdomain)
+{
+#if ENABLE_COOKIE_DEBUG
+    if (!m_subdomains.contains(subdomain))
+        CookieLog("CookieMap - %s does not exist in this map", subdomain.utf8().data());
+#endif
+    return m_subdomains.get(subdomain);
+}
+
+void CookieMap::addSubdomainMap(const String& subdomain, CookieMap* newDomain)
+{
+    CookieLog("CookieMap - Attempting to add subdomain - %s", subdomain.utf8().data());
+    m_subdomains.add(subdomain, newDomain);
+}
+
+void CookieMap::getAllCookies(Vector<ParsedCookie*>* stackOfCookies)
+{
+    CookieLog("CookieMap - Attempting to copy Map:%s cookies with %d cookies into vectors", m_name.utf8().data(), m_cookieMap.size());
+
+    Vector<ParsedCookie*> newCookies;
+    copyValuesToVector(m_cookieMap, newCookies);
+    for (size_t i = 0; i < newCookies.size(); i++) {
+        ParsedCookie* newCookie = newCookies[i];
+        if (newCookie->hasExpired()) {
+            // Notice that we don't delete from backingstore. These expired cookies will be
+            // deleted when manager loads the backingstore again.
+            ParsedCookie* expired = removeCookie(newCookie);
+            delete expired;
+        } else
+            stackOfCookies->append(newCookie);
+    }
+
+    CookieLog("CookieMap - stack of cookies now have %d cookies in it", (*stackOfCookies).size());
+}
+
+ParsedCookie* CookieMap::removeOldestCookie()
+{
+    // FIXME: Make sure it finds the GLOBAL oldest cookie, not the first oldestcookie it finds.
+    ParsedCookie* oldestCookie = m_oldestCookie;
+
+    // If this map has an oldestCookie, remove it. If not, do a DFS to search for a child that does
+    if (!oldestCookie) {
+
+        CookieLog("CookieMap - no oldestCookie exist");
+
+        // Base case is if the map has no child and no cookies, we return a null.
+        if (!m_subdomains.size()) {
+            CookieLog("CookieMap - no subdomains, base case reached, return 0");
+            return 0;
+        }
+
+        CookieLog("CookieMap - looking into subdomains");
+
+        for (HashMap<String, CookieMap*>::iterator it = m_subdomains.begin(); it != m_subdomains.end(); ++it) {
+            oldestCookie = it->second->removeOldestCookie();
+            if (oldestCookie)
+                break;
+        }
+    } else {
+        CookieLog("CookieMap - oldestCookie exist.");
+        oldestCookie = removeCookie(m_oldestCookie);
+    }
+
+    return oldestCookie;
+}
+
+void CookieMap::updateOldestCookie()
+{
+    if (!m_cookieMap.size())
+        m_oldestCookie = 0;
+    else {
+        HashMap<String, ParsedCookie*>::iterator it = m_cookieMap.begin();
+        m_oldestCookie = it->second;
+        ++it;
+        for (; it != m_cookieMap.end(); ++it)
+            if (m_oldestCookie->lastAccessed() > it->second->lastAccessed())
+                m_oldestCookie = it->second;
+    }
+}
+
+void CookieMap::deleteAllCookiesAndDomains()
+{
+    deleteAllValues(m_subdomains);
+    m_subdomains.clear();
+    deleteAllValues(m_cookieMap);
+    m_cookieMap.clear();
+
+    m_oldestCookie = 0;
+}
+
+void CookieMap::getAllChildCookies(Vector<ParsedCookie*>* stackOfCookies)
+{
+    CookieLog("CookieMap - getAllChildCookies in Map - %s", getName().utf8().data());
+    getAllCookies(stackOfCookies);
+    for (HashMap<String, CookieMap*>::iterator it = m_subdomains.begin(); it != m_subdomains.end(); ++it)
+        it->second->getAllChildCookies(stackOfCookies);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieMap.h b/Source/WebCore/platform/blackberry/CookieMap.h
new file mode 100644
index 000000000..73ba13fac
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieMap.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CookieMap_h
+#define CookieMap_h
+
+#include "HashMap.h"
+#include "PlatformString.h"
+#include "Vector.h"
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class ParsedCookie;
+
+/* A cookie map is a node in the tree held by CookieManager that represents
+ * cookies that matches a common domain.
+ *
+ * A CookieMap holds reference to the cookies that it contains and the child
+ * domains that exist within the tree.
+ *
+ * The number of cookie per host is limited by CookieManager::s_maxCookieCountPerHost
+ */
+
+class CookieMap {
+
+public:
+    CookieMap(const String& name = "");
+    ~CookieMap();
+
+    unsigned int count() const { return m_cookieMap.size(); }
+    const String& getName() const { return m_name; }
+
+    void addCookie(ParsedCookie*);
+
+    // Returning the original cookie object so manager can keep a reference to the updates in the database queue.
+    ParsedCookie* updateCookie(ParsedCookie*);
+
+    // Need to return the reference to the removed cookie so manager can deal with it (garbage collect).
+    ParsedCookie* removeCookie(const ParsedCookie*);
+    bool existsCookie(const ParsedCookie*) const;
+
+    // Returns a map with that given subdomain.
+    CookieMap* getSubdomainMap(const String&);
+    void addSubdomainMap(const String&, CookieMap*);
+    void deleteAllCookiesAndDomains();
+
+    void getAllCookies(Vector<ParsedCookie*>*);
+    void getAllChildCookies(Vector<ParsedCookie*>* stackOfCookies);
+    ParsedCookie* removeOldestCookie();
+
+private:
+    void updateOldestCookie();
+
+    // The key is the tuple (name, path).
+    // The spec asks to have also domain, which is implied by choosing the CookieMap relevant to the domain.
+    HashMap<String, ParsedCookie*> m_cookieMap;
+
+    // The key is a subsection of the domain.
+    // ex: if inserting accounts.google.com & this cookiemap is "com", this subdomain map will contain "google"
+    // the "google" cookiemap will contain "accounts" in its subdomain map.
+    HashMap<String, CookieMap*> m_subdomains;
+
+    // Store the oldest cookie to speed up LRU checks.
+    ParsedCookie* m_oldestCookie;
+    const String m_name;
+
+    // FIXME : should have a m_shouldUpdate flag to update the network layer only when the map has changed.
+};
+
+} // namespace WebCore
+
+#endif // CookieMap_h
diff --git a/Source/WebCore/platform/blackberry/CookieParser.cpp b/Source/WebCore/platform/blackberry/CookieParser.cpp
new file mode 100644
index 000000000..e1eb44aa4
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieParser.cpp
@@ -0,0 +1,369 @@
+/*
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */ 
+
+#include "config.h"
+#include "CookieParser.h"
+
+#include "CurrentTime.h"
+#include "Logging.h"
+#include "ParsedCookie.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+#define LOG_AND_DELETE(format, ...) \
+    { \
+        LOG_ERROR(format, ## __VA_ARGS__); \
+        delete res; \
+        return 0; \
+    }
+
+static inline bool isCookieHeaderSeparator(UChar c)
+{
+    return (c == '\r' || c =='\n');
+}
+
+static inline bool isLightweightSpace(UChar c)
+{
+    return (c == ' ' || c == '\t');
+}
+
+CookieParser::CookieParser(const KURL& defaultCookieURL)
+    : m_defaultCookieURL(defaultCookieURL)
+{
+}
+
+CookieParser::~CookieParser()
+{
+}
+
+Vector<ParsedCookie*> CookieParser::parse(const String& cookies)
+{
+    unsigned cookieStart, cookieEnd = 0;
+    double curTime = currentTime();
+    Vector<ParsedCookie*, 4> parsedCookies;
+
+    unsigned cookiesLength = cookies.length();
+    if (!cookiesLength) // Code below doesn't handle this case
+        return parsedCookies;
+
+    // Iterate over the header to parse all the cookies.
+    while (cookieEnd <= cookiesLength) {
+        cookieStart = cookieEnd;
+        
+        // Find a cookie separator.
+        while (cookieEnd <= cookiesLength && !isCookieHeaderSeparator(cookies[cookieEnd]))
+            cookieEnd++;
+
+        // Detect an empty cookie and go to the next one.
+        if (cookieStart == cookieEnd) {
+            ++cookieEnd;
+            continue;
+        }
+
+        if (cookieEnd < cookiesLength && isCookieHeaderSeparator(cookies[cookieEnd]))
+            ++cookieEnd;
+
+        ParsedCookie* cookie = parseOneCookie(cookies, cookieStart, cookieEnd - 1, curTime);
+        if (cookie)
+            parsedCookies.append(cookie);
+    }
+    return parsedCookies;
+}
+
+// The cookie String passed into this method will only contian the name value pairs as well as other related cookie
+// attributes such as max-age and domain. Set-Cookie should never be part of this string.
+ParsedCookie* CookieParser::parseOneCookie(const String& cookie, unsigned start, unsigned end, double curTime)
+{
+    ParsedCookie* res = new ParsedCookie(curTime);
+
+    if (!res)
+        LOG_AND_DELETE("Out of memory");
+
+    res->setProtocol(m_defaultCookieURL.protocol());
+
+    // Parse [NAME "="] VALUE
+    unsigned tokenEnd = start; // Token end contains the position of the '=' or the end of a token
+    unsigned pairEnd = start; // Pair end contains always the position of the ';'
+
+    // find the *first* ';' and the '=' (if they exist)
+    bool quoteFound = false;
+    bool foundEqual = false;
+    while (pairEnd < end && (cookie[pairEnd] != ';' || quoteFound)) {
+        if (tokenEnd == start && cookie[pairEnd] == '=') {
+            tokenEnd = pairEnd;
+            foundEqual = true;
+        }
+        if (cookie[pairEnd] == '"')
+            quoteFound = !quoteFound;
+        pairEnd++;
+    }
+
+    unsigned tokenStart = start;
+
+    bool hasName = false; // This is a hack to avoid changing too much in this
+                          // brutally brittle code.
+    if (tokenEnd != start) {
+        // There is a '=' so parse the NAME
+        unsigned nameEnd = tokenEnd;
+
+        // The tokenEnd is the position of the '=' so the nameEnd is one less
+        nameEnd--;
+
+        // Remove lightweight spaces.
+        while (nameEnd && isLightweightSpace(cookie[nameEnd]))
+            nameEnd--;
+
+        while (tokenStart < nameEnd && isLightweightSpace(cookie[tokenStart]))
+            tokenStart++;
+
+        if (nameEnd + 1 <= tokenStart)
+            LOG_AND_DELETE("Empty name. Rejecting the cookie");
+
+        String name = cookie.substring(tokenStart, nameEnd + 1 - start);
+        res->setName(name);
+        hasName = true;
+    }
+
+    // Now parse the VALUE
+    tokenStart = tokenEnd + 1;
+    if (!hasName)
+        --tokenStart;
+
+    // Skip lightweight spaces in our token
+    while (tokenStart < pairEnd && isLightweightSpace(cookie[tokenStart]))
+        tokenStart++;
+
+    tokenEnd = pairEnd;
+    while (tokenEnd > tokenStart && isLightweightSpace(cookie[tokenEnd - 1]))
+        tokenEnd--;
+
+    String value;
+    if (tokenEnd == tokenStart) {
+        // Firefox accepts empty value so we will do the same
+        value = String();
+    } else
+        value = cookie.substring(tokenStart, tokenEnd - tokenStart);
+
+    if (hasName)
+        res->setValue(value);
+    else if (foundEqual) {
+        delete res;
+        return 0;
+    } else
+        res->setName(value); // No NAME=VALUE, only NAME
+
+    while (pairEnd < end) {
+        // Switch to the next pair as pairEnd is on the ';' and fast-forward any lightweight spaces.
+        pairEnd++;
+        while (pairEnd < end && isLightweightSpace(cookie[pairEnd]))
+            pairEnd++;
+
+        tokenStart = pairEnd;
+        tokenEnd = tokenStart; // initialize token end to catch first '='
+
+        while (pairEnd < end && cookie[pairEnd] != ';') {
+            if (tokenEnd == tokenStart && cookie[pairEnd] == '=')
+                tokenEnd = pairEnd;
+            pairEnd++;
+        }
+
+        // FIXME : should we skip lightweight spaces here ?
+
+        unsigned length = tokenEnd - tokenStart;
+        unsigned tokenStartSvg = tokenStart;
+
+        String parsedValue;
+        if (tokenStart != tokenEnd) {
+            // There is an equal sign so remove lightweight spaces in VALUE
+            tokenStart = tokenEnd + 1;
+            while (tokenStart < pairEnd && isLightweightSpace(cookie[tokenStart]))
+                tokenStart++;
+
+            tokenEnd = pairEnd;
+            while (tokenEnd > tokenStart && isLightweightSpace(cookie[tokenEnd - 1]))
+                tokenEnd--;
+
+            parsedValue = cookie.substring(tokenStart, tokenEnd - tokenStart);
+        } else {
+            // If the parsedValue is empty, initialise it in case we need it
+            parsedValue = String();
+            // Handle a token without value.
+            length = pairEnd - tokenStart;
+        }
+
+       // Detect which "cookie-av" is parsed
+       // Look at the first char then parse the whole for performance issue
+        switch (cookie[tokenStartSvg]) {
+        case 'P':
+        case 'p' : {
+            if (length >= 4 && cookie.find("ath", tokenStartSvg + 1, false)) {
+                // We need the path to be decoded to match those returned from KURL::path().
+                // The path attribute may or may not include percent-encoded characters. Fortunately
+                // if there are no percent-encoded characters, decoding the url is a no-op.
+                res->setPath(decodeURLEscapeSequences(parsedValue));
+            } else
+                LOG_AND_DELETE("Invalid cookie %s (path)", cookie.ascii().data());
+            break;
+        }
+
+        case 'D':
+        case 'd' : {
+            if (length >= 6 && cookie.find("omain", tokenStartSvg + 1, false)) {
+                if (parsedValue.length() > 1 && parsedValue[0] == '"' && parsedValue[parsedValue.length() - 1] == '"')
+                    parsedValue = parsedValue.substring(1, parsedValue.length() - 2);
+                // If the domain does not start with a dot, add one for security checks,
+                // For example: ab.c.com dose not domain match b.c.com;
+                String realDomain = parsedValue[0] == '.' ? parsedValue : "." + parsedValue;
+                res->setDomain(realDomain);
+            } else
+                LOG_AND_DELETE("Invalid cookie %s (domain)", cookie.ascii().data());
+            break;
+        }
+
+        case 'E' :
+        case 'e' : {
+            if (length >= 7 && cookie.find("xpires", tokenStartSvg + 1, false))
+                res->setExpiry(parsedValue);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (expires)", cookie.ascii().data());
+            break;
+        }
+
+        case 'M' :
+        case 'm' : {
+            if (length >= 7 && cookie.find("ax-age", tokenStartSvg + 1, false))
+                res->setMaxAge(parsedValue);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (max-age)", cookie.ascii().data());
+            break;
+        }
+
+        case 'C' :
+        case 'c' : {
+            if (length >= 7 && cookie.find("omment", tokenStartSvg + 1, false))
+                // We do not have room for the comment part (and so do Mozilla) so just log the comment.
+                LOG(Network, "Comment %s for ParsedCookie : %s\n", parsedValue.ascii().data(), cookie.ascii().data());
+            else
+                LOG_AND_DELETE("Invalid cookie %s (comment)", cookie.ascii().data());
+            break;
+        }
+
+        case 'V' :
+        case 'v' : {
+            if (length >= 7 && cookie.find("ersion", tokenStartSvg + 1, false)) {
+                // Although the out-of-dated Cookie Spec(RFC2965, http://tools.ietf.org/html/rfc2965) defined
+                // the value of version can only contain DIGIT, some random sites, e.g. https://devforums.apple.com
+                // would use double quotation marks to quote the digit. So we need to get rid of them for compliance.
+                if (parsedValue.length() > 1 && parsedValue[0] == '"' && parsedValue[parsedValue.length() - 1] == '"')
+                    parsedValue = parsedValue.substring(1, parsedValue.length() - 2);
+
+                if (parsedValue.toInt() != 1)
+                    LOG_AND_DELETE("ParsedCookie version %d not supported (only support version=1)", parsedValue.toInt());
+            } else
+                LOG_AND_DELETE("Invalid cookie %s (version)", cookie.ascii().data());
+            break;
+        }
+
+        case 'S' :
+        case 's' : {
+            // Secure is a standalone token ("Secure;")
+            if (length >= 6 && cookie.find("ecure", tokenStartSvg + 1, false))
+                res->setSecureFlag(true);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (secure)", cookie.ascii().data());
+            break;
+        }
+        case 'H':
+        case 'h': {
+            // HttpOnly is a standalone token ("HttpOnly;")
+            if (length >= 8 && cookie.find("ttpOnly", tokenStartSvg + 1, false))
+                res->setIsHttpOnly(true);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (HttpOnly)", cookie.ascii().data());
+            break;
+        }
+
+        default : {
+            // If length == 0, we should be at the end of the cookie (case : ";\r") so ignore it
+            if (length)
+                LOG_ERROR("Invalid token for cookie %s", cookie.ascii().data());
+        }
+        }
+    }
+
+    // Check if the cookie is valid with respect to the size limit.
+    if (!res->isUnderSizeLimit())
+        LOG_AND_DELETE("ParsedCookie %s is above the 4kb in length : REJECTED", cookie.ascii().data());
+
+    // If some pair was not provided, during parsing then apply some default value
+    // the rest has been done in the constructor.
+
+    // If no domain was provided, set it to the host
+    if (!res->domain())
+        res->setDefaultDomain(m_defaultCookieURL);
+
+    // According to the Cookie Specificaiton (RFC6265, section 4.1.2.4 and 5.2.4, http://tools.ietf.org/html/rfc6265),
+    // If no path was provided or the first character of the path value is not '/', set it to the host's path
+    //
+    // REFERENCE
+    // 4.1.2.4. The Path Attribute
+    //
+    // The scope of each cookie is limited to a set of paths, controlled by
+    // the Path attribute. If the server omits the Path attribute, the user
+    // agent will use the "directory" of the request-uri's path component as
+    // the default value. (See Section 5.1.4 for more details.)
+    // ...........
+    // 5.2.4. The Path Attribute
+    //
+    // If the attribute-name case-insensitively matches the string "Path",
+    // the user agent MUST process the cookie-av as follows.
+    //
+    // If the attribute-value is empty or if the first character of the
+    // attribute-value is not %x2F ("/"):
+    //
+    // Let cookie-path be the default-path.
+    //
+    // Otherwise:
+    //
+    // Let cookie-path be the attribute-value.
+    //
+    // Append an attribute to the cookie-attribute-list with an attribute-
+    // name of Path and an attribute-value of cookie-path.
+    if (!res->path() || !res->path().length() || !res->path().startsWith("/", false)) {
+        String path = m_defaultCookieURL.string().substring(m_defaultCookieURL.pathStart(), m_defaultCookieURL.pathAfterLastSlash() - m_defaultCookieURL.pathStart() - 1);
+        if (path.isEmpty())
+            path = "/";
+        // Since this is reading the raw url string, it could contain percent-encoded sequences. We
+        // want it to be comparable to the return value of url.path(), which is not percent-encoded,
+        // so we must remove the escape sequences.
+        res->setPath(decodeURLEscapeSequences(path));
+    }
+ 
+    return res;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/URLString.h b/Source/WebCore/platform/blackberry/CookieParser.h
index 78e4b33ed..92e48d36e 100644
--- a/Source/WebCore/platform/URLString.h
+++ b/Source/WebCore/platform/blackberry/CookieParser.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2011 Google, Inc. All rights reserved.
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2010, 2012 Research In Motion Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,7 +11,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
@@ -20,33 +21,37 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef URLString_h
-#define URLString_h
+#ifndef CookieParser_h
+#define CookieParser_h
 
-#include <wtf/text/WTFString.h>
+#include "KURL.h"
+#include "Vector.h"
 
+namespace WTF {
+class String;
+}
 namespace WebCore {
 
-class KURL;
+class ParsedCookie;
 
-class URLString {
+class CookieParser {
 public:
-    const String& string() const { return m_string; }
+    CookieParser(const KURL& defaultCookieURL);
+    ~CookieParser();
+
+    // Parses a sequence of "Cookie:" header and return the parsed cookies.
+    Vector<ParsedCookie*> parse(const String& cookies);
 
 private:
-    friend class KURL;
-
-    explicit URLString(const String& string)
-        : m_string(string)
-    {
-    }
-    
-    String m_string;
+    // FIXME: curTime, start, end parameters should be removed. And this method can be public.
+    ParsedCookie* parseOneCookie(const String& cookie, unsigned start, unsigned end, double curTime);
+
+    KURL m_defaultCookieURL;
 };
 
-}
+} // namespace WebCore
 
-#endif
+#endif // CookieParser_h
diff --git a/Source/WebCore/platform/blackberry/ParsedCookie.cpp b/Source/WebCore/platform/blackberry/ParsedCookie.cpp
new file mode 100644
index 000000000..1ff7fe600
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/ParsedCookie.cpp
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ParsedCookie.h"
+
+#include "CookieManager.h"
+#include "CurrentTime.h"
+#include "KURL.h"
+#include "Logging.h"
+#include <curl/curl.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+ParsedCookie::ParsedCookie(double currentTime)
+    : m_expiry(0)
+    , m_creationTime(currentTime)
+    , m_lastAccessed(currentTime)
+    , m_isMaxAgeSet(false)
+    , m_hasDefaultDomain(false)
+    , m_isSecure(false)
+    , m_isHttpOnly(false)
+    , m_isSession(true)
+    , m_isForceExpired(false)
+{
+}
+
+ParsedCookie::ParsedCookie(const String& name, const String& value, const String& domain, const String& protocol, const String& path, double expiry, double lastAccessed, double creationTime, bool isSecure, bool isHttpOnly)
+    : m_name(name)
+    , m_value(value)
+    , m_domain(domain)
+    , m_protocol(protocol)
+    , m_path(path)
+    , m_expiry(expiry)
+    , m_creationTime(creationTime)
+    , m_lastAccessed(lastAccessed)
+    , m_isMaxAgeSet(false)
+    , m_hasDefaultDomain(false)
+    , m_isSecure(isSecure)
+    , m_isHttpOnly(isHttpOnly)
+    , m_isSession(false)
+    , m_isForceExpired(false)
+{
+}
+
+ParsedCookie::ParsedCookie(const ParsedCookie* cookie)
+    : m_name(String(cookie->m_name))
+    , m_value(String(cookie->m_value))
+    , m_domain(String(cookie->m_domain))
+    , m_protocol(String(cookie->m_protocol))
+    , m_path(String(cookie->m_path))
+    , m_expiry(cookie->m_expiry)
+    , m_creationTime(cookie->m_creationTime)
+    , m_lastAccessed(cookie->m_lastAccessed)
+    , m_isMaxAgeSet(cookie->m_isMaxAgeSet)
+    , m_hasDefaultDomain(cookie->m_hasDefaultDomain)
+    , m_isSecure(cookie->m_isSecure)
+    , m_isHttpOnly(cookie->m_isHttpOnly)
+    , m_isSession(cookie->m_isSession)
+    , m_isForceExpired(cookie->m_isForceExpired)
+{
+}
+
+ParsedCookie::~ParsedCookie()
+{
+}
+
+void ParsedCookie::setExpiry(const String& expiry)
+{
+    // If a cookie has both the Max-Age and the Expires attribute,
+    // the Max-Age attribute has precedence and controls the expiration date of the cookie.
+    if (m_isMaxAgeSet || expiry.isEmpty())
+        return;
+
+    m_isSession = false;
+
+    m_expiry = static_cast<double>(curl_getdate(expiry.utf8().data(), 0));
+
+    if (m_expiry == -1) {
+        LOG_ERROR("Could not parse date");
+        // In this case, consider that the cookie is session only
+        m_isSession = true;
+    }
+}
+
+void ParsedCookie::setMaxAge(const String& maxAge)
+{
+    // According to the HTTP Cookie specification (RFC6265, http://tools.ietf.org/html/rfc6265),
+    // the first character can be a DIGIT or a "-", and the reminder
+    // of the value can only contain DIGIT characters.
+    if (maxAge.isEmpty() || (maxAge[0] != '-' && !isASCIIDigit(maxAge[0]))) {
+        LOG_ERROR("Could not parse Max-Age : %s, first character can only be '-' or ascii digit.", maxAge.ascii().data());
+        return;
+    }
+
+    bool ok;
+    int value = maxAge.toIntStrict(&ok);
+
+    if (!ok) {
+        LOG_ERROR("Could not parse Max-Age : %s", maxAge.ascii().data());
+        return;
+    }
+    m_expiry = value;
+    m_isMaxAgeSet = true;
+    m_isSession = false;
+
+    // If maxAge value is not positive, let expiry-time be the earliest representable time.
+    if (m_expiry > 0)
+        m_expiry += currentTime();
+    else
+        m_expiry = 0;
+}
+
+void ParsedCookie::setDefaultDomain(const KURL& requestURL)
+{
+    setDomain(requestURL.host());
+    m_hasDefaultDomain = true;
+}
+
+bool ParsedCookie::hasExpired() const
+{
+    // Session cookies do not expire, they will just not be saved to the backing store.
+    return !m_isSession && (m_isForceExpired || m_expiry < currentTime());
+}
+
+bool ParsedCookie::isUnderSizeLimit() const
+{
+    return m_value.length() <= CookieManager::maxCookieLength() && m_name.length() <= CookieManager::maxCookieLength();
+}
+
+String ParsedCookie::toString() const
+{
+    StringBuilder builder;
+    builder.append(name());
+    builder.append(" = ");
+    builder.append(value());
+    builder.append("; Domain = ");
+    builder.append(domain());
+    builder.append("; Path = ");
+    builder.append(path());
+    builder.append("; Protocol = ");
+    builder.append(protocol());
+    return builder.toString();
+}
+
+String ParsedCookie::toNameValuePair() const
+{
+    static const String equal("=");
+
+    size_t cookieLength = m_name.length() + m_value.length() + 2;
+    Vector<UChar> result;
+    result.reserveInitialCapacity(cookieLength);
+    append(result, m_name);
+    append(result, equal);
+    append(result, m_value);
+
+    return String::adopt(result);
+}
+
+void ParsedCookie::appendWebCoreCookie(Vector<Cookie>& cookieVector) const
+{
+    cookieVector.append(Cookie(String(m_name), String(m_value), String(m_domain),
+            String(m_path), m_expiry, m_isHttpOnly, m_isSecure, m_isSession));
+}
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/ParsedCookie.h b/Source/WebCore/platform/blackberry/ParsedCookie.h
new file mode 100644
index 000000000..ca343d13f
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/ParsedCookie.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ParsedCookie_h
+#define ParsedCookie_h
+
+#include "Cookie.h"
+#include <wtf/FastAllocBase.h>
+
+namespace WTF {
+class String;
+}
+namespace WebCore {
+
+class KURL;
+
+// This class represents a cookie internally
+// It can either be created by the CookieParser which will then fill it
+// or it can be created by the backing store filling it in the constructor.
+class ParsedCookie {
+WTF_MAKE_FAST_ALLOCATED;
+public:
+    // Default cookie : empty domain, non secure and session
+    ParsedCookie(double currentTime);
+
+    // For backing store cookies (those cookies are never session cookies).
+    ParsedCookie(const String& name, const String& value, const String& domain, const String& protocol, const String& path, double expiry, double lastAccessed, double creationTime, bool isSecure, bool isHttpOnly);
+
+    ParsedCookie(const ParsedCookie*);
+
+    ~ParsedCookie();
+
+    const String& name() const { return m_name; }
+    void setName(const String& name) { m_name = name; }
+
+    const String& value() const { return m_value; }
+    void setValue(const String& value) { m_value = value; }
+
+    const String& path() const { return m_path; }
+    void setPath(const String& path) { m_path = path; }
+
+    const String& domain() const { return m_domain; }
+    void setDomain(const String& domain) { m_domain = domain.lower(); }
+
+    const String& protocol() const { return m_protocol; }
+    void setProtocol(const String& protocol) { m_protocol = protocol; }
+
+    // This is a special method used to set the domain to the request's url.
+    void setDefaultDomain(const KURL&);
+    bool hasDefaultDomain() const { return m_hasDefaultDomain; }
+
+    double expiry() const { return m_expiry; }
+    void setExpiry(const String&);
+    void forceExpire() { m_isForceExpired  = true; }
+    void setMaxAge(const String&);
+
+    double lastAccessed() const { return m_lastAccessed; }
+    void setLastAccessed(double lastAccessed) { m_lastAccessed = lastAccessed;}
+
+    double creationTime() const { return m_creationTime; }
+    void setCreationTime(double creationTime) { m_creationTime = creationTime; }
+
+    bool isSecure() const { return m_isSecure; }
+    void setSecureFlag(bool secure) { m_isSecure = secure; }
+
+    bool isHttpOnly() const { return m_isHttpOnly; }
+    void setIsHttpOnly(bool isHttpOnly) { m_isHttpOnly = isHttpOnly; }
+
+    bool isSession() const { return m_isSession; }
+
+    bool hasExpired() const;
+    bool isForceExpired() const { return m_isForceExpired; }
+    bool isUnderSizeLimit() const;
+
+    String toString() const;
+    String toNameValuePair() const;
+    void appendWebCoreCookie(Vector<Cookie>& cookieVector) const;
+
+private:
+    String m_name;
+    String m_value;
+    String m_domain;
+    String m_protocol;
+    String m_path;
+    double m_expiry;
+    double m_creationTime;
+    // This is used for the LRU replacement policy.
+    double m_lastAccessed;
+
+    bool m_isMaxAgeSet;
+    bool m_hasDefaultDomain;
+    bool m_isSecure;
+    bool m_isHttpOnly;
+    bool m_isSession;
+    bool m_isForceExpired;
+};
+
+} // namespace WebCore
+
+#endif // ParsedCookie_h
diff --git a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
new file mode 100644
index 000000000..c57813f1c
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
@@ -0,0 +1,978 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "RenderThemeBlackBerry.h"
+
+#include "CSSValueKeywords.h"
+#include "Frame.h"
+#include "MediaControlElements.h"
+#include "MediaPlayerPrivateBlackBerry.h"
+#include "PaintInfo.h"
+#include "RenderProgress.h"
+#include "RenderSlider.h"
+#include "RenderView.h"
+#include "UserAgentStyleSheets.h"
+
+namespace WebCore {
+
+// Sizes (unit px)
+const unsigned smallRadius = 1;
+const unsigned largeRadius = 3;
+const unsigned lineWidth = 1;
+const int marginSize = 4;
+const int mediaSliderThumbWidth = 40;
+const int mediaSliderThumbHeight = 13;
+const int mediaSliderThumbRadius = 5;
+const int sliderThumbWidth = 15;
+const int sliderThumbHeight = 25;
+
+// Checkbox check scalers
+const float checkboxLeftX = 7 / 40.0;
+const float checkboxLeftY = 1 / 2.0;
+const float checkboxMiddleX = 19 / 50.0;
+const float checkboxMiddleY = 7 / 25.0;
+const float checkboxRightX = 33 / 40.0;
+const float checkboxRightY = 1 / 5.0;
+const float checkboxStrokeThickness = 6.5;
+
+// Radio button scaler
+const float radioButtonCheckStateScaler = 7 / 30.0;
+
+// Multipliers
+const unsigned paddingDivisor = 5;
+
+// Colors
+const RGBA32 caretBottom = 0xff2163bf;
+const RGBA32 caretTop = 0xff69a5fa;
+
+const RGBA32 regularBottom = 0xffdcdee4;
+const RGBA32 regularTop = 0xfff7f2ee;
+const RGBA32 hoverBottom = 0xffb5d3fc;
+const RGBA32 hoverTop = 0xffcceaff;
+const RGBA32 depressedBottom = 0xff3388ff;
+const RGBA32 depressedTop = 0xff66a0f2;
+const RGBA32 disabledBottom = 0xffe7e7e7;
+const RGBA32 disabledTop = 0xffefefef;
+
+const RGBA32 regularBottomOutline = 0xff6e7073;
+const RGBA32 regularTopOutline = 0xffb9b8b8;
+const RGBA32 hoverBottomOutline = 0xff2163bf;
+const RGBA32 hoverTopOutline = 0xff69befa;
+const RGBA32 depressedBottomOutline = 0xff0c3d81;
+const RGBA32 depressedTopOutline = 0xff1d4d70;
+const RGBA32 disabledOutline = 0xffd5d9de;
+
+const RGBA32 progressRegularBottom = caretTop;
+const RGBA32 progressRegularTop = caretBottom;
+
+const RGBA32 rangeSliderRegularBottom = 0xfff6f2ee;
+const RGBA32 rangeSliderRegularTop = 0xffdee0e5;
+const RGBA32 rangeSliderRollBottom = 0xffc9e8fe;
+const RGBA32 rangeSliderRollTop = 0xffb5d3fc;
+
+const RGBA32 rangeSliderRegularBottomOutline = 0xffb9babd;
+const RGBA32 rangeSliderRegularTopOutline = 0xffb7b7b7;
+const RGBA32 rangeSliderRollBottomOutline = 0xff67abe0;
+const RGBA32 rangeSliderRollTopOutline = 0xff69adf9;
+
+const RGBA32 dragRegularLight = 0xfffdfdfd;
+const RGBA32 dragRegularDark = 0xffbababa;
+const RGBA32 dragRollLight = 0xfff2f2f2;
+const RGBA32 dragRollDark = 0xff69a8ff;
+
+const RGBA32 selection = 0xff2b8fff;
+
+const RGBA32 blackPen = Color::black;
+const RGBA32 focusRingPen = 0xffa3c8fe;
+
+float RenderThemeBlackBerry::defaultFontSize = 16;
+
+// We aim to match IE here.
+// -IE uses a font based on the encoding as the default font for form controls.
+// -Gecko uses MS Shell Dlg (actually calls GetStockObject(DEFAULT_GUI_FONT),
+// which returns MS Shell Dlg)
+// -Safari uses Lucida Grande.
+//
+// FIXME: The only case where we know we don't match IE is for ANSI encodings.
+// IE uses MS Shell Dlg there, which we render incorrectly at certain pixel
+// sizes (e.g. 15px). So we just use Arial for now.
+const String& RenderThemeBlackBerry::defaultGUIFont()
+{
+    DEFINE_STATIC_LOCAL(String, fontFace, ("Arial"));
+    return fontFace;
+}
+
+static PassRefPtr<Gradient> createLinearGradient(RGBA32 top, RGBA32 bottom, const IntPoint& a, const IntPoint& b)
+{
+    RefPtr<Gradient> gradient = Gradient::create(a, b);
+    gradient->addColorStop(0.0, Color(top));
+    gradient->addColorStop(1.0, Color(bottom));
+    return gradient.release();
+}
+
+static Path roundedRectForBorder(RenderObject* object, const IntRect& rect)
+{
+    RenderStyle* style = object->style();
+    LengthSize topLeftRadius = style->borderTopLeftRadius();
+    LengthSize topRightRadius = style->borderTopRightRadius();
+    LengthSize bottomLeftRadius = style->borderBottomLeftRadius();
+    LengthSize bottomRightRadius = style->borderBottomRightRadius();
+
+    Path roundedRect;
+    roundedRect.addRoundedRect(rect, IntSize(topLeftRadius.width().value(), topLeftRadius.height().value()),
+                                     IntSize(topRightRadius.width().value(), topRightRadius.height().value()),
+                                     IntSize(bottomLeftRadius.width().value(), bottomLeftRadius.height().value()),
+                                     IntSize(bottomRightRadius.width().value(), bottomRightRadius.height().value()));
+    return roundedRect;
+}
+
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
+{
+    static RenderTheme* theme = RenderThemeBlackBerry::create().leakRef();
+    return theme;
+}
+
+PassRefPtr<RenderTheme> RenderThemeBlackBerry::create()
+{
+    return adoptRef(new RenderThemeBlackBerry());
+}
+
+RenderThemeBlackBerry::RenderThemeBlackBerry()
+{
+}
+
+RenderThemeBlackBerry::~RenderThemeBlackBerry()
+{
+}
+
+String RenderThemeBlackBerry::extraDefaultStyleSheet()
+{
+    return String(themeBlackBerryUserAgentStyleSheet, sizeof(themeBlackBerryUserAgentStyleSheet));
+}
+
+#if ENABLE(VIDEO)
+String RenderThemeBlackBerry::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsBlackBerryUserAgentStyleSheet, sizeof(mediaControlsBlackBerryUserAgentStyleSheet));
+}
+
+String RenderThemeBlackBerry::formatMediaControlsRemainingTime(float, float duration) const
+{
+    // This is a workaround to make the appearance of media time controller in
+    // in-page mode the same as in fullscreen mode.
+    return formatMediaControlsTime(duration);
+}
+#endif
+
+double RenderThemeBlackBerry::caretBlinkInterval() const
+{
+    return 0; // Turn off caret blinking.
+}
+
+void RenderThemeBlackBerry::systemFont(int propId, FontDescription& fontDescription) const
+{
+    float fontSize = defaultFontSize;
+
+    if (propId == CSSValueWebkitMiniControl || propId ==  CSSValueWebkitSmallControl || propId == CSSValueWebkitControl) {
+        // Why 2 points smaller? Because that's what Gecko does. Note that we
+        // are assuming a 96dpi screen, which is the default value we use on Windows.
+        static const float pointsPerInch = 72.0f;
+        static const float pixelsPerInch = 96.0f;
+        fontSize -= (2.0f / pointsPerInch) * pixelsPerInch;
+    }
+
+    fontDescription.firstFamily().setFamily(defaultGUIFont());
+    fontDescription.setSpecifiedSize(fontSize);
+    fontDescription.setIsAbsoluteSize(true);
+    fontDescription.setGenericFamily(FontDescription::NoFamily);
+    fontDescription.setWeight(FontWeightNormal);
+    fontDescription.setItalic(false);
+}
+
+void RenderThemeBlackBerry::setButtonStyle(RenderStyle* style) const
+{
+    Length vertPadding(int(style->fontSize() / paddingDivisor), Fixed);
+    style->setPaddingTop(vertPadding);
+    style->setPaddingBottom(vertPadding);
+}
+
+void RenderThemeBlackBerry::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::adjustTextAreaStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+}
+
+bool RenderThemeBlackBerry::paintTextArea(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintTextFieldOrTextAreaOrSearchField(object, info, rect);
+}
+
+void RenderThemeBlackBerry::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+}
+
+bool RenderThemeBlackBerry::paintTextFieldOrTextAreaOrSearchField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    ASSERT(info.context);
+    GraphicsContext* context = info.context;
+
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeThickness(lineWidth);
+    if (!isEnabled(object))
+        context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
+    else if (isPressed(object))
+        info.context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else if (isHovered(object) || isFocused(object))
+        context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else
+        context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    Path textFieldRoundedRectangle = roundedRectForBorder(object, rect);
+    if (object->style()->appearance() == SearchFieldPart) {
+        // We force the fill color to White so as to match the background color of the search cancel button graphic.
+        context->setFillColor(Color::white, ColorSpaceDeviceRGB);
+        context->drawPath(textFieldRoundedRectangle);
+    } else
+        context->strokePath(textFieldRoundedRectangle);
+    context->restore();
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintTextField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintTextFieldOrTextAreaOrSearchField(object, info, rect);
+}
+
+void RenderThemeBlackBerry::adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+}
+
+void RenderThemeBlackBerry::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    static const float defaultControlFontPixelSize = 13;
+    static const float defaultCancelButtonSize = 9;
+    static const float minCancelButtonSize = 5;
+    static const float maxCancelButtonSize = 21;
+
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int cancelButtonSize = lroundf(std::min(std::max(minCancelButtonSize, defaultCancelButtonSize * fontScale), maxCancelButtonSize));
+    Length length(cancelButtonSize, Fixed);
+    style->setWidth(length);
+    style->setHeight(length);
+}
+
+bool RenderThemeBlackBerry::paintSearchField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintTextFieldOrTextAreaOrSearchField(object, info, rect);
+}
+
+bool RenderThemeBlackBerry::paintSearchFieldCancelButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    ASSERT(object->parent());
+    if (!object->parent() || !object->parent()->isBox())
+        return false;
+
+    RenderBox* parentRenderBox = toRenderBox(object->parent());
+
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    IntRect bounds = rect;
+    // Make sure the scaled button stays square and fits in its parent's box.
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Put the button in the middle vertically, and round up the value.
+    // So if it has to be one pixel off-center, it would be one pixel closer
+    // to the bottom of the field. This would look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* cancelImage = Image::loadPlatformResource("searchCancel").leakRef();
+    static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").leakRef();
+    paintInfo.context->drawImage(isPressed(object) ? cancelPressedImage : cancelImage, object->style()->colorSpace(), bounds);
+    return false;
+}
+
+void RenderThemeBlackBerry::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // These seem to be reasonable padding values from observation.
+    const int paddingLeft = 8;
+    const int paddingRight = 4;
+
+    const int minHeight = style->fontSize() * 2;
+
+    style->resetPadding();
+    style->setHeight(Length(Auto));
+
+    style->setPaddingRight(Length(minHeight + paddingRight, Fixed));
+    style->setPaddingLeft(Length(paddingLeft, Fixed));
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::calculateButtonSize(RenderStyle* style) const
+{
+    int size = style->fontSize();
+    Length length(size, Fixed);
+    if (style->appearance() == CheckboxPart || style->appearance() == RadioPart) {
+        style->setWidth(length);
+        style->setHeight(length);
+        return;
+    }
+
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    if (style->width().isIntrinsicOrAuto())
+        style->setWidth(length);
+
+    if (style->height().isAuto())
+        style->setHeight(length);
+}
+
+bool RenderThemeBlackBerry::paintCheckbox(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintButton(object, info, rect);
+}
+
+void RenderThemeBlackBerry::setCheckboxSize(RenderStyle* style) const
+{
+    calculateButtonSize(style);
+}
+
+bool RenderThemeBlackBerry::paintRadio(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintButton(object, info, rect);
+}
+
+void RenderThemeBlackBerry::setRadioSize(RenderStyle* style) const
+{
+    calculateButtonSize(style);
+}
+
+// If this function returns false, WebCore assumes the button is fully decorated
+bool RenderThemeBlackBerry::paintButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    ASSERT(info.context);
+    info.context->save();
+
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    Color check(blackPen);
+    if (!isEnabled(object)) {
+        info.context->setFillGradient(createLinearGradient(disabledTop, disabledBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
+    } else if (isPressed(object)) {
+        info.context->setFillGradient(createLinearGradient(depressedTop, depressedBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else if (isHovered(object)) {
+        info.context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else {
+        info.context->setFillGradient(createLinearGradient(regularTop, regularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    }
+
+    ControlPart part = object->style()->appearance();
+    switch (part) {
+    case CheckboxPart: {
+        FloatSize smallCorner(smallRadius, smallRadius);
+        Path path;
+        path.addRoundedRect(rect, smallCorner);
+        info.context->drawPath(path);
+
+        if (isChecked(object)) {
+            Path checkPath;
+            IntRect rect2 = rect;
+            rect2.inflate(-1);
+            checkPath.moveTo(FloatPoint(rect2.x() + rect2.width() * checkboxLeftX, rect2.y() + rect2.height() * checkboxLeftY));
+            checkPath.addLineTo(FloatPoint(rect2.x() + rect2.width() * checkboxMiddleX, rect2.maxY() - rect2.height() * checkboxMiddleY));
+            checkPath.addLineTo(FloatPoint(rect2.x() + rect2.width() * checkboxRightX, rect2.y() + rect2.height() * checkboxRightY));
+            info.context->setLineCap(RoundCap);
+            info.context->setStrokeColor(blackPen, ColorSpaceDeviceRGB);
+            info.context->setStrokeThickness(rect2.width() / checkboxStrokeThickness);
+            info.context->drawPath(checkPath);
+        }
+        break;
+    }
+    case RadioPart:
+        info.context->drawEllipse(rect);
+        if (isChecked(object)) {
+            IntRect rect2 = rect;
+            rect2.inflate(-rect.width() * radioButtonCheckStateScaler);
+            info.context->setFillColor(check, ColorSpaceDeviceRGB);
+            info.context->setStrokeColor(check, ColorSpaceDeviceRGB);
+            info.context->drawEllipse(rect2);
+        }
+        break;
+    case ButtonPart:
+    case PushButtonPart: {
+        FloatSize largeCorner(largeRadius, largeRadius);
+        Path path;
+        path.addRoundedRect(rect, largeCorner);
+        info.context->drawPath(path);
+        break;
+    }
+    case SquareButtonPart: {
+        Path path;
+        path.addRect(rect);
+        info.context->drawPath(path);
+        break;
+    }
+    default:
+        info.context->restore();
+        return true;
+    }
+
+    info.context->restore();
+    return false;
+}
+
+void RenderThemeBlackBerry::adjustMenuListStyle(CSSStyleSelector* css, RenderStyle* style, Element* element) const
+{
+    adjustMenuListButtonStyle(css, style, element);
+}
+
+void RenderThemeBlackBerry::adjustCheckboxStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setCheckboxSize(style);
+    style->setBoxShadow(nullptr);
+    Length margin(marginSize, Fixed);
+    style->setMarginBottom(margin);
+    style->setMarginRight(margin);
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::adjustRadioStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setRadioSize(style);
+    style->setBoxShadow(nullptr);
+    Length margin(marginSize, Fixed);
+    style->setMarginBottom(margin);
+    style->setMarginRight(margin);
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::paintMenuListButtonGradientAndArrow(GraphicsContext* context, RenderObject* object, IntRect buttonRect, const Path& clipPath)
+{
+    ASSERT(context);
+    context->save();
+    if (!isEnabled(object))
+        context->setFillGradient(createLinearGradient(disabledTop, disabledBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+    else if (isPressed(object))
+        context->setFillGradient(createLinearGradient(depressedTop, depressedBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+    else if (isHovered(object))
+        context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+    else
+        context->setFillGradient(createLinearGradient(regularTop, regularBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+
+    // 1. Paint the background of the button.
+    context->clip(clipPath);
+    context->drawRect(buttonRect);
+    context->restore();
+
+    // 2. Paint the button arrow.
+    buttonRect.inflate(-buttonRect.width() / 3);
+    buttonRect.move(0, buttonRect.height() * 7 / 20);
+    Path path;
+    path.moveTo(FloatPoint(buttonRect.x(), buttonRect.y()));
+    path.addLineTo(FloatPoint(buttonRect.x() + buttonRect.width(), buttonRect.y()));
+    path.addLineTo(FloatPoint(buttonRect.x() + buttonRect.width() / 2.0, buttonRect.y() + buttonRect.height() / 2.0));
+    path.closeSubpath();
+
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeThickness(lineWidth);
+    context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
+    context->setFillColor(Color::black, ColorSpaceDeviceRGB);
+    context->setLineJoin(BevelJoin);
+    context->fillPath(path);
+    context->restore();
+}
+
+static IntRect computeMenuListArrowButtonRect(const IntRect& rect)
+{
+    // FIXME: The menu list arrow button should have a minimum and maximum width (to ensure usability) or
+    // scale with respect to the font size used in the menu list control or some combination of both.
+    return IntRect(IntPoint(rect.maxX() - rect.height(), rect.y()), IntSize(rect.height(), rect.height()));
+}
+
+static void paintMenuListBackground(GraphicsContext* context, const Path& menuListPath, const Color& backgroundColor)
+{
+    ASSERT(context);
+    context->save();
+    context->setFillColor(backgroundColor, ColorSpaceDeviceRGB);
+    context->fillPath(menuListPath);
+    context->restore();
+}
+
+bool RenderThemeBlackBerry::paintMenuList(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    // Note, this method is not called if the menu list explicitly specifies either a border or background color.
+    // Instead, RenderThemeBlackBerry::paintMenuListButton is called. Therefore, when this method is called, we don't
+    // have to adjust rect with respect to the border dimensions.
+
+    ASSERT(info.context);
+    GraphicsContext* context = info.context;
+
+    Path menuListRoundedRectangle = roundedRectForBorder(object, rect);
+
+    // 1. Paint the background of the entire control.
+    paintMenuListBackground(context, menuListRoundedRectangle, Color::white);
+
+    // 2. Paint the background of the button and its arrow.
+    IntRect arrowButtonRectangle = computeMenuListArrowButtonRect(rect);
+    paintMenuListButtonGradientAndArrow(context, object, arrowButtonRectangle, menuListRoundedRectangle);
+
+    // 4. Stroke an outline around the entire control.
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeThickness(lineWidth);
+    if (!isEnabled(object))
+        context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
+    else if (isPressed(object))
+        context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else if (isHovered(object))
+        context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else
+        context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    context->strokePath(menuListRoundedRectangle);
+    context->restore();
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintMenuListButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    // Note, this method is only called if the menu list explicitly specifies either a border or background color.
+    // Otherwise, RenderThemeBlackBerry::paintMenuList is called. We need to fit the arrow button with the border box
+    // of the menu-list so as to not occlude the custom border.
+
+    // We compute menuListRoundedRectangle with respect to the dimensions of the entire menu-list control (i.e. rect) and
+    // its border radius so that we clip the contour of the arrow button (when we paint it below) to match the contour of
+    // the control.
+    Path menuListRoundedRectangle = roundedRectForBorder(object, rect);
+
+    // 1. Paint the background of the entire control.
+    Color fillColor = object->style()->visitedDependentColor(CSSPropertyBackgroundColor);
+    if (!fillColor.isValid())
+        fillColor = Color::white;
+    paintMenuListBackground(info.context, menuListRoundedRectangle, fillColor);
+
+    // 2. Paint the background of the button and its arrow.
+    IntRect bounds = IntRect(rect.x() + object->style()->borderLeftWidth(),
+                         rect.y() + object->style()->borderTopWidth(),
+                         rect.width() - object->style()->borderLeftWidth() - object->style()->borderRightWidth(),
+                         rect.height() - object->style()->borderTopWidth() - object->style()->borderBottomWidth());
+
+    IntRect arrowButtonRectangle = computeMenuListArrowButtonRect(bounds); // Fit the arrow button within the border box of the menu-list.
+    paintMenuListButtonGradientAndArrow(info.context, object, arrowButtonRectangle, menuListRoundedRectangle);
+    return false;
+}
+
+void RenderThemeBlackBerry::adjustSliderThumbSize(RenderStyle* style) const
+{
+    ControlPart part = style->appearance();
+    if (part == MediaVolumeSliderThumbPart || part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
+        style->setWidth(Length(part == SliderThumbVerticalPart ? sliderThumbHeight : sliderThumbWidth, Fixed));
+        style->setHeight(Length(part == SliderThumbVerticalPart ? sliderThumbWidth : sliderThumbHeight, Fixed));
+    } else if (part == MediaSliderThumbPart) {
+        style->setWidth(Length(mediaSliderThumbWidth, Fixed));
+        style->setHeight(Length(mediaSliderThumbHeight, Fixed));
+    }
+}
+
+bool RenderThemeBlackBerry::paintSliderTrack(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    const static int SliderTrackHeight = 5;
+    IntRect rect2;
+    if (object->style()->appearance() == SliderHorizontalPart) {
+        rect2.setHeight(SliderTrackHeight);
+        rect2.setWidth(rect.width());
+        rect2.setX(rect.x());
+        rect2.setY(rect.y() + (rect.height() - SliderTrackHeight) / 2);
+    } else {
+        rect2.setHeight(rect.height());
+        rect2.setWidth(SliderTrackHeight);
+        rect2.setX(rect.x() + (rect.width() - SliderTrackHeight) / 2);
+        rect2.setY(rect.y());
+    }
+    return paintSliderTrackRect(object, info, rect2);
+}
+
+bool RenderThemeBlackBerry::paintSliderTrackRect(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintSliderTrackRect(object, info, rect, rangeSliderRegularTopOutline, rangeSliderRegularBottomOutline,
+                rangeSliderRegularTop, rangeSliderRegularBottom);
+}
+
+bool RenderThemeBlackBerry::paintSliderTrackRect(RenderObject* object, const PaintInfo& info, const IntRect& rect,
+        RGBA32 strokeColorStart, RGBA32 strokeColorEnd, RGBA32 fillColorStart, RGBA32 fillColorEnd)
+{
+    FloatSize smallCorner(smallRadius, smallRadius);
+
+    info.context->save();
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    info.context->setStrokeGradient(createLinearGradient(strokeColorStart, strokeColorEnd, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
+    info.context->setFillGradient(createLinearGradient(fillColorStart, fillColorEnd, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    Path path;
+    path.addRoundedRect(rect, smallCorner);
+    info.context->fillPath(path);
+
+    info.context->restore();
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintSliderThumb(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    FloatSize largeCorner(largeRadius, largeRadius);
+
+    info.context->save();
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    if (isPressed(object) || isHovered(object)) {
+        info.context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
+        info.context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else {
+        info.context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
+        info.context->setFillGradient(createLinearGradient(regularTop, regularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    }
+
+    Path path;
+    path.addRoundedRect(rect, largeCorner);
+    info.context->fillPath(path);
+
+    bool isVertical = rect.width() > rect.height();
+    IntPoint startPoint(rect.x() + (isVertical ? 5 : 2), rect.y() + (isVertical ? 2 : 5));
+    IntPoint endPoint(rect.x() + (isVertical ? 20 : 2), rect.y() + (isVertical ? 2 : 20));
+    const int lineOffset = 2;
+    const int shadowOffset = 1;
+
+    for (int i = 0; i < 3; i++) {
+        if (isVertical) {
+            startPoint.setY(startPoint.y() + lineOffset);
+            endPoint.setY(endPoint.y() + lineOffset);
+        } else {
+            startPoint.setX(startPoint.x() + lineOffset);
+            endPoint.setX(endPoint.x() + lineOffset);
+        }
+        if (isPressed(object) || isHovered(object))
+            info.context->setStrokeColor(dragRollLight, ColorSpaceDeviceRGB);
+        else
+            info.context->setStrokeColor(dragRegularLight, ColorSpaceDeviceRGB);
+        info.context->drawLine(startPoint, endPoint);
+
+        if (isVertical) {
+            startPoint.setY(startPoint.y() + shadowOffset);
+            endPoint.setY(endPoint.y() + shadowOffset);
+        } else {
+            startPoint.setX(startPoint.x() + shadowOffset);
+            endPoint.setX(endPoint.x() + shadowOffset);
+        }
+        if (isPressed(object) || isHovered(object))
+            info.context->setStrokeColor(dragRollDark, ColorSpaceDeviceRGB);
+        else
+            info.context->setStrokeColor(dragRegularDark, ColorSpaceDeviceRGB);
+        info.context->drawLine(startPoint, endPoint);
+    }
+    info.context->restore();
+    return false;
+}
+
+static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    context->drawImage(image, ColorSpaceDeviceRGB, rect);
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintMediaPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = Image::loadPlatformResource("play").leakRef();
+    static Image* mediaPause = Image::loadPlatformResource("pause").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->canPlay() ? mediaPlay : mediaPause);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaMuteButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaMute = Image::loadPlatformResource("speaker").leakRef();
+    static Image* mediaUnmute = Image::loadPlatformResource("speaker_mute").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->muted() || !mediaElement->volume() ? mediaUnmute : mediaMute);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaFullscreenButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    if (!toParentMediaElement(object))
+        return false;
+
+    static Image* mediaFullscreen = Image::loadPlatformResource("fullscreen").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaFullscreen);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    IntRect rect2(rect.x() + 3, rect.y() + 14, rect.width() - 6, 2);
+
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+
+    if (!mediaElement)
+        return false;
+
+    float loaded = 0;
+    // FIXME: replace loaded with commented out one when buffer bug is fixed (see comment in
+    // MediaPlayerPrivateMMrenderer::percentLoaded).
+    // loaded = mediaElement->percentLoaded();
+    if (mediaElement->player())
+        loaded = static_cast<MediaPlayerPrivate *>(mediaElement->player()->implementation())->percentLoaded();
+    float position = mediaElement->duration() > 0 ? (mediaElement->currentTime() / mediaElement->duration()) : 0;
+
+    int x = rect.x() + 3;
+    int y = rect.y() + 14;
+    int w = rect.width() - 6;
+    int h = 2;
+
+    int wPlayed = (w * position);
+    int wLoaded = (w - mediaSliderThumbWidth) * loaded + mediaSliderThumbWidth;
+
+    IntRect played(x, y, wPlayed, h);
+    IntRect buffered(x, y, wLoaded, h);
+
+    // This is to paint main slider bar.
+    bool result = paintSliderTrackRect(object, paintInfo, rect2);
+
+    if (loaded > 0 || position > 0) {
+        // This is to paint buffered bar.
+        paintSliderTrackRect(object, paintInfo, buffered, Color::darkGray, Color::darkGray, Color::darkGray, Color::darkGray);
+
+        // This is to paint played part of bar (left of slider thumb) using selection color.
+        paintSliderTrackRect(object, paintInfo, played, selection, selection, selection, selection);
+    }
+    return result;
+
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    if (!object->parent())
+        return false;
+
+    RenderSlider* slider = toRenderSlider(object->parent()->parent()->parent());
+    if (!slider)
+        return false;
+
+    paintInfo.context->save();
+    Path mediaThumbRoundedRectangle;
+    mediaThumbRoundedRectangle.addRoundedRect(rect, FloatSize(mediaSliderThumbRadius, mediaSliderThumbRadius));
+    paintInfo.context->setStrokeStyle(SolidStroke);
+    paintInfo.context->setStrokeThickness(0.5);
+    paintInfo.context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
+
+    if (isPressed(object) || isHovered(object) || slider->inDragMode()) {
+        paintInfo.context->setFillGradient(createLinearGradient(selection, Color(selection).dark().rgb(),
+                rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else {
+        paintInfo.context->setFillGradient(createLinearGradient(Color::white, Color(Color::white).dark().rgb(),
+                rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    }
+    paintInfo.context->fillPath(mediaThumbRoundedRectangle);
+    paintInfo.context->restore();
+
+    return true;
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaVolumeSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    float pad = rect.width() * 0.45;
+    float x = rect.x() + pad;
+    float y = rect.y() + pad;
+    float width = rect.width() * 0.1;
+    float height = rect.height() - (2.0 * pad);
+
+    IntRect rect2(x, y, width, height);
+
+    return paintSliderTrackRect(object, paintInfo, rect2);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaVolumeSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    static Image* mediaVolumeThumb = Image::loadPlatformResource("volume_thumb").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaVolumeThumb);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+Color RenderThemeBlackBerry::platformFocusRingColor() const
+{
+    return focusRingPen;
+}
+
+#if ENABLE(TOUCH_EVENTS)
+Color RenderThemeBlackBerry::platformTapHighlightColor() const
+{
+    // Same color as 'focusRingPen' + 80 of alpha channel.
+    return Color(163, 200, 254, 80);
+}
+#endif
+
+Color RenderThemeBlackBerry::platformActiveSelectionBackgroundColor() const
+{
+    return Color(selection);
+}
+
+double RenderThemeBlackBerry::animationRepeatIntervalForProgressBar(RenderProgress* renderProgress) const
+{
+    return renderProgress->isDeterminate() ? 0.0 : 0.1;
+}
+
+double RenderThemeBlackBerry::animationDurationForProgressBar(RenderProgress* renderProgress) const
+{
+    return renderProgress->isDeterminate() ? 0.0 : 2.0;
+}
+
+bool RenderThemeBlackBerry::paintProgressBar(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    if (!object->isProgress())
+        return true;
+
+    RenderProgress* renderProgress = toRenderProgress(object);
+
+    FloatSize smallCorner(smallRadius, smallRadius);
+
+    info.context->save();
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    info.context->setStrokeGradient(createLinearGradient(rangeSliderRegularTopOutline, rangeSliderRegularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    info.context->setFillGradient(createLinearGradient(rangeSliderRegularTop, rangeSliderRegularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    Path path;
+    path.addRoundedRect(rect, smallCorner);
+    info.context->fillPath(path);
+
+    IntRect rect2 = rect;
+    rect2.setX(rect2.x() + 1);
+    rect2.setHeight(rect2.height() - 2);
+    rect2.setY(rect2.y() + 1);
+    info.context->setStrokeStyle(NoStroke);
+    info.context->setStrokeThickness(0);
+    if (renderProgress->isDeterminate()) {
+        rect2.setWidth(rect2.width() * renderProgress->position() - 2);
+        info.context->setFillGradient(createLinearGradient(progressRegularTop, progressRegularBottom, rect2.maxXMinYCorner(), rect2.maxXMaxYCorner()));
+    } else {
+        // Animating
+        rect2.setWidth(rect2.width() - 2);
+        RefPtr<Gradient> gradient = Gradient::create(rect2.minXMaxYCorner(), rect2.maxXMaxYCorner());
+        gradient->addColorStop(0.0, Color(progressRegularBottom));
+        gradient->addColorStop(renderProgress->animationProgress(), Color(progressRegularTop));
+        gradient->addColorStop(1.0, Color(progressRegularBottom));
+        info.context->setFillGradient(gradient);
+    }
+    Path path2;
+    path2.addRoundedRect(rect2, smallCorner);
+    info.context->fillPath(path2);
+
+    info.context->restore();
+    return false;
+}
+
+Color RenderThemeBlackBerry::platformActiveTextSearchHighlightColor() const
+{
+    return Color(255, 150, 50); // Orange.
+}
+
+Color RenderThemeBlackBerry::platformInactiveTextSearchHighlightColor() const
+{
+    return Color(255, 255, 0); // Yellow.
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h
new file mode 100644
index 000000000..62cb739d8
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef RenderThemeBlackBerry_h
+#define RenderThemeBlackBerry_h
+
+#include "RenderTheme.h"
+
+namespace WebCore {
+
+class RenderThemeBlackBerry : public RenderTheme {
+public:
+    static PassRefPtr<RenderTheme> create();
+    virtual ~RenderThemeBlackBerry();
+
+    virtual String extraDefaultStyleSheet();
+
+#if ENABLE(VIDEO)
+    virtual String extraMediaControlsStyleSheet();
+    virtual String formatMediaControlsRemainingTime(float currentTime, float duration) const;
+#endif
+    virtual bool supportsHover(const RenderStyle*) const { return true; }
+
+    virtual double caretBlinkInterval() const;
+
+    virtual void systemFont(int cssValueId, FontDescription&) const;
+    virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual void setCheckboxSize(RenderStyle*) const;
+    virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual void setRadioSize(RenderStyle*) const;
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
+    void calculateButtonSize(RenderStyle*) const;
+    virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual void adjustSliderThumbSize(RenderStyle*) const;
+    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+
+#if ENABLE(TOUCH_EVENTS)
+    virtual Color platformTapHighlightColor() const;
+#endif
+
+    virtual Color platformFocusRingColor() const;
+    virtual bool supportsFocusRing(const RenderStyle* style) const { return style->hasAppearance(); }
+
+    virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustCheckboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustRadioStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual double animationRepeatIntervalForProgressBar(RenderProgress*) const;
+    virtual double animationDurationForProgressBar(RenderProgress*) const;
+
+    virtual Color platformActiveSelectionBackgroundColor() const;
+
+    // Highlighting colors for TextMatches.
+    virtual Color platformActiveTextSearchHighlightColor() const;
+    virtual Color platformInactiveTextSearchHighlightColor() const;
+
+private:
+    static const String& defaultGUIFont();
+
+    // The default variable-width font size. We use this as the default font
+    // size for the "system font", and as a base size (which we then shrink) for
+    // form control fonts.
+    static float defaultFontSize;
+
+    RenderThemeBlackBerry();
+    void setButtonStyle(RenderStyle*) const;
+
+    void paintMenuListButtonGradientAndArrow(GraphicsContext*, RenderObject*, IntRect buttonRect, const Path& clipPath);
+    bool paintTextFieldOrTextAreaOrSearchField(RenderObject*, const PaintInfo&, const IntRect&);
+    bool paintSliderTrackRect(RenderObject*, const PaintInfo&, const IntRect&);
+    bool paintSliderTrackRect(RenderObject*, const PaintInfo&, const IntRect&, RGBA32 strokeColorStart,
+                RGBA32 strokeColorEnd, RGBA32 fillColorStart, RGBA32 fillColorEnd);
+
+};
+
+} // namespace WebCore
+
+#endif // RenderThemeBlackBerry_h
diff --git a/Source/WebCore/platform/cf/SharedBufferCF.cpp b/Source/WebCore/platform/cf/SharedBufferCF.cpp
index 30a5e890c..d0b0ea9f0 100644
--- a/Source/WebCore/platform/cf/SharedBufferCF.cpp
+++ b/Source/WebCore/platform/cf/SharedBufferCF.cpp
@@ -115,6 +115,23 @@ void SharedBuffer::copyDataArrayAndClear(char *destination, unsigned bytesToCopy
     }
     m_dataArray.clear();
 }
+
+unsigned SharedBuffer::copySomeDataFromDataArray(const char*& someData, unsigned position) const
+{
+    Vector<RetainPtr<CFDataRef> >::const_iterator end = m_dataArray.end();
+    unsigned totalOffset = 0;
+    for (Vector<RetainPtr<CFDataRef> >::const_iterator it = m_dataArray.begin(); it != end; ++it) {
+        unsigned dataLen = static_cast<unsigned>(CFDataGetLength(it->get()));
+        ASSERT(totalOffset <= position);
+        unsigned localOffset = position - totalOffset;
+        if (localOffset < dataLen) {
+            someData = reinterpret_cast<const char *>(CFDataGetBytePtr(it->get())) + localOffset;
+            return dataLen - localOffset;
+        }
+        totalOffset += dataLen;
+    }
+    return 0;
+}
 #endif
 
 }
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
index 6ad10c7da..d6b73e5f0 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
@@ -101,33 +101,36 @@ bool ChromiumDataObject::hasData() const
         || m_fileContent;
 }
 
-HashSet<String> ChromiumDataObject::types() const
+PassRefPtr<DOMStringList> ChromiumDataObject::types() const
 {
+    RefPtr<DOMStringList> results = DOMStringList::create();
+
     if (m_storageMode == Pasteboard) {
         bool ignoredContainsFilenames;
-        return PlatformSupport::clipboardReadAvailableTypes(currentPasteboardBuffer(),
-                                                            &ignoredContainsFilenames);
+        HashSet<String> hashedResults = PlatformSupport::clipboardReadAvailableTypes(
+            currentPasteboardBuffer(), &ignoredContainsFilenames);
+        for (HashSet<String>::const_iterator it = hashedResults.begin(); it != hashedResults.end(); ++it)
+          results->append(*it);
+        return results.release();
     }
 
-    HashSet<String> results;
-
     if (!m_plainText.isEmpty()) {
-        results.add(mimeTypeText);
-        results.add(mimeTypeTextPlain);
+        results->append(mimeTypeText);
+        results->append(mimeTypeTextPlain);
     }
 
     if (!m_uriList.isEmpty())
-        results.add(mimeTypeTextURIList);
+        results->append(mimeTypeTextURIList);
 
     if (!m_textHtml.isEmpty())
-        results.add(mimeTypeTextHTML);
+        results->append(mimeTypeTextHTML);
 
     for (HashMap<String, String>::const_iterator::Keys it = m_customData.begin().keys();
          it != m_customData.end().keys(); ++it) {
-        results.add(*it);
+        results->append(*it);
     }
 
-    return results;
+    return results.release();
 }
 
 String ChromiumDataObject::getData(const String& type, bool& success) const
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.h b/Source/WebCore/platform/chromium/ChromiumDataObject.h
index 7e675bf93..9a6f562d1 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.h
@@ -31,11 +31,11 @@
 #ifndef ChromiumDataObject_h
 #define ChromiumDataObject_h
 
+#include "DOMStringList.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "SharedBuffer.h"
 #include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
@@ -75,7 +75,7 @@ public:
 
     bool hasData() const;
 
-    HashSet<String> types() const;
+    PassRefPtr<DOMStringList> types() const;
     String getData(const String& type, bool& success) const;
     bool setData(const String& type, const String& data);
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.cpp b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
index 75f8f630c..1b1536e35 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -31,6 +31,7 @@
 #include "ChromiumDataObject.h"
 #include "ClipboardMimeTypes.h"
 #include "ClipboardUtilitiesChromium.h"
+#include "DOMStringList.h"
 #include "DataTransferItemChromium.h"
 #include "DataTransferItemListChromium.h"
 #include "Document.h"
@@ -289,21 +290,20 @@ bool ClipboardChromium::platformClipboardChanged() const
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardChromium::types() const
+PassRefPtr<DOMStringList> ClipboardChromium::types() const
 {
-    HashSet<String> results;
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return results;
+        return DOMStringList::create();
 
     if (!m_dataObject)
-        return results;
+        return DOMStringList::create();
 
-    results = m_dataObject->types();
+    RefPtr<DOMStringList> results = m_dataObject->types();
 
     if (m_dataObject->containsFilenames())
-        results.add(mimeTypeFiles);
+        results->append(mimeTypeFiles);
 
-    return results;
+    return results.release();
 }
 
 PassRefPtr<FileList> ClipboardChromium::files() const
@@ -518,9 +518,9 @@ void ClipboardChromium::mayUpdateItems(Vector<RefPtr<DataTransferItem> >& items)
 
     if (isForCopyAndPaste() && policy() == ClipboardReadable) {
         // Iterate through the types and add them.
-        HashSet<String> types = m_dataObject->types();
-        for (HashSet<String>::const_iterator it = types.begin(); it != types.end(); ++it)
-            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, *it));
+        RefPtr<DOMStringList> types = m_dataObject->types();
+        for (size_t i = 0; i < types->length(); ++i)
+            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, types->item(i)));
         return;
     }
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.h b/Source/WebCore/platform/chromium/ClipboardChromium.h
index 924226df3..ae9eb711b 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.h
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.h
@@ -63,7 +63,7 @@ namespace WebCore {
         bool platformClipboardChanged() const;
 
         // extensions beyond IE's API
-        virtual HashSet<String> types() const;
+        virtual PassRefPtr<DOMStringList> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/chromium/DragDataChromium.cpp b/Source/WebCore/platform/chromium/DragDataChromium.cpp
index 3d94a19b2..a7a853559 100644
--- a/Source/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/Source/WebCore/platform/chromium/DragDataChromium.cpp
@@ -45,19 +45,19 @@ namespace WebCore {
 
 static bool containsHTML(const ChromiumDataObject* dropData)
 {
-    return dropData->types().contains(mimeTypeTextHTML);
+    return dropData->types()->contains(mimeTypeTextHTML);
 }
 
 bool DragData::containsURL(Frame*, FilenameConversionPolicy filenamePolicy) const
 {
-    return m_platformDragData->types().contains(mimeTypeTextURIList)
+    return m_platformDragData->types()->contains(mimeTypeTextURIList)
         || (filenamePolicy == ConvertFilenames && m_platformDragData->containsFilenames());
 }
 
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
     String url;
-    if (m_platformDragData->types().contains(mimeTypeTextURIList)) {
+    if (m_platformDragData->types()->contains(mimeTypeTextURIList)) {
         bool ignoredSuccess;
         url = m_platformDragData->getData(mimeTypeURL, ignoredSuccess);
         if (title)
@@ -87,7 +87,7 @@ void DragData::asFilenames(Vector<String>& result) const
 
 bool DragData::containsPlainText() const
 {
-    return m_platformDragData->types().contains(mimeTypeTextPlain);
+    return m_platformDragData->types()->contains(mimeTypeTextPlain);
 }
 
 String DragData::asPlainText(Frame*) const
@@ -108,8 +108,8 @@ bool DragData::canSmartReplace() const
     // This is allowed whenever the drag data contains a 'range' (ie.,
     // ClipboardWin::writeRange is called).  For example, dragging a link
     // should not result in a space being added.
-    return m_platformDragData->types().contains(mimeTypeTextPlain)
-        && !m_platformDragData->types().contains(mimeTypeTextURIList);
+    return m_platformDragData->types()->contains(mimeTypeTextPlain)
+        && !m_platformDragData->types()->contains(mimeTypeTextURIList);
 }
 
 bool DragData::containsCompatibleContent() const
@@ -141,7 +141,7 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range
         //    return fragment;
     }
 
-    if (m_platformDragData->types().contains(mimeTypeTextHTML)) {
+    if (m_platformDragData->types()->contains(mimeTypeTextHTML)) {
         bool ignoredSuccess;
         RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(),
             m_platformDragData->getData(mimeTypeTextHTML, ignoredSuccess), m_platformDragData->htmlBaseUrl(), FragmentScriptingNotAllowed);
diff --git a/Source/WebCore/platform/chromium/PlatformSupport.h b/Source/WebCore/platform/chromium/PlatformSupport.h
index 170177507..128d2a3e9 100644
--- a/Source/WebCore/platform/chromium/PlatformSupport.h
+++ b/Source/WebCore/platform/chromium/PlatformSupport.h
@@ -415,9 +415,18 @@ public:
 #endif
 
     // Trace Event --------------------------------------------------------
-    static bool isTraceEventEnabled();
-    static void traceEventBegin(const char* name, void*, const char* extra);
-    static void traceEventEnd(const char* name, void*, const char* extra);
+    static const unsigned char* getTraceCategoryEnabledFlag(const char* categoryName);
+    static int addTraceEvent(char phase,
+                             const unsigned char* categoryEnabledFlag,
+                             const char* name,
+                             unsigned long long id,
+                             int numArgs,
+                             const char** argNames,
+                             const unsigned char* argTypes,
+                             const unsigned long long* argValues,
+                             int thresholdBeginId,
+                             long long threshold,
+                             unsigned char flags);
 
     // Visited links ------------------------------------------------------
     static LinkHash visitedLinkHash(const UChar* url, unsigned length);
diff --git a/Source/WebCore/platform/chromium/PopupListBox.cpp b/Source/WebCore/platform/chromium/PopupListBox.cpp
index 11164ccc3..c980ad623 100644
--- a/Source/WebCore/platform/chromium/PopupListBox.cpp
+++ b/Source/WebCore/platform/chromium/PopupListBox.cpp
@@ -154,9 +154,7 @@ bool PopupListBox::handleWheelEvent(const PlatformWheelEvent& event)
         return true;
     }
 
-    // Pass it off to the scroll view.
-    // Sadly, WebCore devs don't understand the whole "const" thing.
-    wheelEvent(const_cast<PlatformWheelEvent&>(event));
+    ScrollableArea::handleWheelEvent(event);
     return true;
 }
 
diff --git a/Source/WebCore/platform/chromium/TraceEvent.h b/Source/WebCore/platform/chromium/TraceEvent.h
index 652f5407c..5bb600fb3 100644
--- a/Source/WebCore/platform/chromium/TraceEvent.h
+++ b/Source/WebCore/platform/chromium/TraceEvent.h
@@ -22,53 +22,843 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
+// Trace events are for tracking application performance and resource usage.
+// Macros are provided to track:
+//    Begin and end of function calls
+//    Counters
+//
+// Events are issued against categories. Whereas LOG's
+// categories are statically defined, TRACE categories are created
+// implicitly with a string. For example:
+//   TRACE_EVENT_INSTANT0("MY_SUBSYSTEM", "SomeImportantEvent")
+//
+// Events can be INSTANT, or can be pairs of BEGIN and END in the same scope:
+//   TRACE_EVENT_BEGIN0("MY_SUBSYSTEM", "SomethingCostly")
+//   doSomethingCostly()
+//   TRACE_EVENT_END0("MY_SUBSYSTEM", "SomethingCostly")
+// Note: our tools can't always determine the correct BEGIN/END pairs unless
+// these are used in the same scope. Use START/FINISH macros if you need them
+// to be in separate scopes.
+//
+// A common use case is to trace entire function scopes. This
+// issues a trace BEGIN and END automatically:
+//   void doSomethingCostly() {
+//     TRACE_EVENT0("MY_SUBSYSTEM", "doSomethingCostly");
+//     ...
+//   }
+//
+// Additional parameters can be associated with an event:
+//   void doSomethingCostly2(int howMuch) {
+//     TRACE_EVENT1("MY_SUBSYSTEM", "doSomethingCostly",
+//         "howMuch", howMuch);
+//     ...
+//   }
+//
+// The trace system will automatically add to this information the
+// current process id, thread id, and a timestamp in microseconds.
+//
+// To trace an asynchronous procedure such as an IPC send/receive, use START and
+// FINISH:
+//   [single threaded sender code]
+//     static int send_count = 0;
+//     ++send_count;
+//     TRACE_EVENT_START0("ipc", "message", send_count);
+//     Send(new MyMessage(send_count));
+//   [receive code]
+//     void OnMyMessage(send_count) {
+//       TRACE_EVENT_FINISH0("ipc", "message", send_count);
+//     }
+// The third parameter is a unique ID to match START/FINISH pairs.
+// START and FINISH can occur on any thread of any traced process. Pointers can
+// be used for the ID parameter, and they will be mangled internally so that
+// the same pointer on two different processes will not match. For example:
+//   class MyTracedClass {
+//    public:
+//     MyTracedClass() {
+//       TRACE_EVENT_START0("category", "MyTracedClass", this);
+//     }
+//     ~MyTracedClass() {
+//       TRACE_EVENT_FINISH0("category", "MyTracedClass", this);
+//     }
+//   }
+//
+// Trace event also supports counters, which is a way to track a quantity
+// as it varies over time. Counters are created with the following macro:
+//   TRACE_COUNTER1("MY_SUBSYSTEM", "myCounter", g_myCounterValue);
+//
+// Counters are process-specific. The macro itself can be issued from any
+// thread, however.
+//
+// Sometimes, you want to track two counters at once. You can do this with two
+// counter macros:
+//   TRACE_COUNTER1("MY_SUBSYSTEM", "myCounter0", g_myCounterValue[0]);
+//   TRACE_COUNTER1("MY_SUBSYSTEM", "myCounter1", g_myCounterValue[1]);
+// Or you can do it with a combined macro:
+//   TRACE_COUNTER2("MY_SUBSYSTEM", "myCounter",
+//       "bytesPinned", g_myCounterValue[0],
+//       "bytesAllocated", g_myCounterValue[1]);
+// This indicates to the tracing UI that these counters should be displayed
+// in a single graph, as a summed area chart.
+//
+// Since counters are in a global namespace, you may want to disembiguate with a
+// unique ID, by using the TRACE_COUNTER_ID* variations.
+//
+// By default, trace collection is compiled in, but turned off at runtime.
+// Collecting trace data is the responsibility of the embedding
+// application. In Chrome's case, navigating to about:tracing will turn on
+// tracing and display data collected across all active processes.
+//
+//
+// Memory scoping note:
+// Tracing copies the pointers, not the string content, of the strings passed
+// in for category, name, and arg_names. Thus, the following code will
+// cause problems:
+//     char* str = strdup("impprtantName");
+//     TRACE_EVENT_INSTANT0("SUBSYSTEM", str);  // BAD!
+//     free(str);                   // Trace system now has dangling pointer
+//
+// To avoid this issue with the |name| and |arg_name| parameters, use the
+// TRACE_EVENT_COPY_XXX overloads of the macros at additional runtime overhead.
+// Notes: The category must always be in a long-lived char* (i.e. static const).
+//        The |arg_values|, when used, are always deep copied with the _COPY
+//        macros.
+//
+// When are string argument values copied:
+// const char* arg_values are only referenced by default:
+//     TRACE_EVENT1("category", "name",
+//                  "arg1", "literal string is only referenced");
+// Use TRACE_STR_COPY to force copying of a const char*:
+//     TRACE_EVENT1("category", "name",
+//                  "arg1", TRACE_STR_COPY("string will be copied"));
+// std::string arg_values are always copied:
+//     TRACE_EVENT1("category", "name",
+//                  "arg1", std::string("string will be copied"));
+//
+//
+// Thread Safety:
+// A thread safe singleton and mutex are used for thread safety. Category
+// enabled flags are used to limit the performance impact when the system
+// is not enabled.
+//
+// TRACE_EVENT macros first cache a pointer to a category. The categories are
+// statically allocated and safe at all times, even after exit. Fetching a
+// category is protected by the TraceLog::lock_. Multiple threads initializing
+// the static variable is safe, as they will be serialized by the lock and
+// multiple calls will return the same pointer to the category.
+//
+// Then the category_enabled flag is checked. This is a unsigned char, and
+// not intended to be multithread safe. It optimizes access to addTraceEvent
+// which is threadsafe internally via TraceLog::lock_. The enabled flag may
+// cause some threads to incorrectly call or skip calling addTraceEvent near
+// the time of the system being enabled or disabled. This is acceptable as
+// we tolerate some data loss while the system is being enabled/disabled and
+// because addTraceEvent is threadsafe internally and checks the enabled state
+// again under lock.
+//
+// Without the use of these static category pointers and enabled flags all
+// trace points would carry a significant performance cost of aquiring a lock
+// and resolving the category.
+
 #ifndef TraceEvent_h
 #define TraceEvent_h
 
+#include "DynamicAnnotations.h"
 #include "PlatformSupport.h"
-#include <wtf/OwnArrayPtr.h>
+
+#include <wtf/text/CString.h>
+
+// Issues begin trace event here and end trace event when the current scope ends.
+#define TRACE_EVENT(name, id, extra) TRACE_EVENT2("webkit", name, "id", id, "extra", extra)
+
+// By default, const char* argument values are assumed to have long-lived scope
+// and will not be copied. Use this macro to force a const char* to be copied.
+#define TRACE_STR_COPY(str) \
+    WebCore::TraceEvent::TraceStringWithCopy(str)
+
+// Records a pair of begin and end events called "name" for the current
+// scope, with 0, 1 or 2 associated arguments. If the category is not
+// enabled, then this does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name)
+#define TRACE_EVENT1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name, arg1_name, arg1_val)
+#define TRACE_EVENT2(category, name, arg1_name, arg1_val, arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Records a single event called "name" immediately, with 0, 1 or 2
+// associated arguments. If the category is not enabled, then this
+// does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_INSTANT0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_INSTANT1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_INSTANT2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_INSTANT0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_INSTANT1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_INSTANT2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Records a single BEGIN event called "name" immediately, with 0, 1 or 2
+// associated arguments. If the category is not enabled, then this
+// does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_BEGIN0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_BEGIN1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_BEGIN2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_BEGIN0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_BEGIN1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_BEGIN2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Records a single END event for "name" immediately. If the category
+// is not enabled, then this does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_END0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_END1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_END2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_END0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_END1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_END2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Time threshold event:
+// Only record the event if the duration is greater than the specified
+// threshold_us (time in microseconds).
+// Records a pair of begin and end events called "name" for the current
+// scope, with 0, 1 or 2 associated arguments. If the category is not
+// enabled, then this does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_IF_LONGER_THAN0(threshold_us, category, name) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN(threshold_us, category, name)
+#define TRACE_EVENT_IF_LONGER_THAN1( \
+    threshold_us, category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN( \
+        threshold_us, category, name, arg1_name, arg1_val)
+#define TRACE_EVENT_IF_LONGER_THAN2( \
+    threshold_us, category, name, arg1_name, arg1_val, arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN( \
+        threshold_us, category, name, arg1_name, arg1_val, arg2_name, arg2_val)
+
+// Records the value of a counter called "name" immediately. Value
+// must be representable as a 32 bit integer.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_COUNTER1(category, name, value) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_NONE, \
+        "value", static_cast<int>(value))
+#define TRACE_COPY_COUNTER1(category, name, value) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_COPY, \
+        "value", static_cast<int>(value))
+
+// Records the values of a multi-parted counter called "name" immediately.
+// The UI will treat value1 and value2 as parts of a whole, displaying their
+// values as a stacked-bar chart.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_COUNTER2(category, name, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_NONE, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+#define TRACE_COPY_COUNTER2(category, name, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_COPY, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+
+// Records the value of a counter called "name" immediately. Value
+// must be representable as a 32 bit integer.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+// - |id| is used to disambiguate counters with the same name. It must either
+//   be a pointer or an integer value up to 64 bits. If it's a pointer, the bits
+//   will be xored with a hash of the process ID so that the same pointer on
+//   two different processes will not collide.
+#define TRACE_COUNTER_ID1(category, name, id, value) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        "value", static_cast<int>(value))
+#define TRACE_COPY_COUNTER_ID1(category, name, id, value) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        "value", static_cast<int>(value))
+
+// Records the values of a multi-parted counter called "name" immediately.
+// The UI will treat value1 and value2 as parts of a whole, displaying their
+// values as a stacked-bar chart.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+// - |id| is used to disambiguate counters with the same name. It must either
+//   be a pointer or an integer value up to 64 bits. If it's a pointer, the bits
+//   will be xored with a hash of the process ID so that the same pointer on
+//   two different processes will not collide.
+#define TRACE_COUNTER_ID2(category, name, id, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+#define TRACE_COPY_COUNTER_ID2(category, name, id, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+
+// Records a single START event called "name" immediately, with 0, 1 or 2
+// associated arguments. If the category is not enabled, then this
+// does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+// - |id| is used to match the START event with the FINISH event. It must either
+//   be a pointer or an integer value up to 64 bits. If it's a pointer, the bits
+//   will be xored with a hash of the process ID so that the same pointer on
+//   two different processes will not collide.
+#define TRACE_EVENT_START0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_START1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_START2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_START0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_START1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_START2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+
+// Records a single FINISH event for "name" immediately. If the category
+// is not enabled, then this does nothing.
+#define TRACE_EVENT_FINISH0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_FINISH1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_FINISH2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_FINISH0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_FINISH1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_FINISH2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+
+////////////////////////////////////////////////////////////////////////////////
+// Implementation specific tracing API definitions.
+
+// Get a pointer to the enabled state of the given trace category. Only
+// long-lived literal strings should be given as the category name. The returned
+// pointer can be held permanently in a local static for example. If the
+// unsigned char is non-zero, tracing is enabled. If tracing is enabled,
+// TRACE_EVENT_API_ADD_TRACE_EVENT can be called. It's OK if tracing is disabled
+// between the load of the tracing state and the call to
+// TRACE_EVENT_API_ADD_TRACE_EVENT, because this flag only provides an early out
+// for best performance when tracing is disabled.
+// const unsigned char*
+//     TRACE_EVENT_API_GET_CATEGORY_ENABLED(const char* category_name)
+#define TRACE_EVENT_API_GET_CATEGORY_ENABLED \
+    WebCore::PlatformSupport::getTraceCategoryEnabledFlag
+
+// Add a trace event to the platform tracing system. Returns thresholdBeginId
+// for use in a corresponding end TRACE_EVENT_API_ADD_TRACE_EVENT call.
+// int TRACE_EVENT_API_ADD_TRACE_EVENT(
+//                    char phase,
+//                    const unsigned char* category_enabled,
+//                    const char* name,
+//                    unsigned long long id,
+//                    int num_args,
+//                    const char** arg_names,
+//                    const unsigned char* arg_types,
+//                    const unsigned long long* arg_values,
+//                    int thresholdBeginID,
+//                    long long threshold,
+//                    unsigned char flags)
+#define TRACE_EVENT_API_ADD_TRACE_EVENT \
+    WebCore::PlatformSupport::addTraceEvent
+
+////////////////////////////////////////////////////////////////////////////////
 
 // Implementation detail: trace event macros create temporary variables
 // to keep instrumentation overhead low. These macros give each temporary
 // variable a unique name based on the line number to prevent name collissions.
-#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b) a##b
-#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(a, b) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b)
-#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(name_prefix) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(name_prefix, __LINE__)
+#define INTERNAL_TRACE_EVENT_UID3(a, b) \
+    trace_event_unique_##a##b
+#define INTERNAL_TRACE_EVENT_UID2(a, b) \
+    INTERNAL_TRACE_EVENT_UID3(a, b)
+#define INTERNALTRACEEVENTUID(name_prefix) \
+    INTERNAL_TRACE_EVENT_UID2(name_prefix, __LINE__)
+
+// Implementation detail: internal macro to create static category.
+// - WTF_ANNOTATE_BENIGN_RACE, see Thread Safety above.
+#define INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category) \
+    static const unsigned char* INTERNALTRACEEVENTUID(catstatic) = 0; \
+    WTF_ANNOTATE_BENIGN_RACE(&INTERNALTRACEEVENTUID(catstatic), \
+                             "trace_event category"); \
+    if (!INTERNALTRACEEVENTUID(catstatic)) \
+      INTERNALTRACEEVENTUID(catstatic) = \
+          TRACE_EVENT_API_GET_CATEGORY_ENABLED(category);
+
+// Implementation detail: internal macro to create static category and add
+// event if the category is enabled.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD(phase, category, name, flags, ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      WebCore::TraceEvent::addTraceEvent( \
+          phase, INTERNALTRACEEVENTUID(catstatic), name, \
+          WebCore::TraceEvent::noEventId, flags, ##__VA_ARGS__); \
+    }
+#endif
+
+// Implementation detail: internal macro to create static category and add begin
+// event if the category is enabled. Also adds the end event when the scope
+// ends.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name, ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    WebCore::TraceEvent::TraceEndOnScopeClose \
+        INTERNALTRACEEVENTUID(profileScope); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      WebCore::TraceEvent::addTraceEvent( \
+          TRACE_EVENT_PHASE_BEGIN, \
+          INTERNALTRACEEVENTUID(catstatic), \
+          name, WebCore::TraceEvent::noEventId, \
+          TRACE_EVENT_FLAG_NONE, ##__VA_ARGS__); \
+      INTERNALTRACEEVENTUID(profileScope).initialize( \
+          INTERNALTRACEEVENTUID(catstatic), name); \
+    }
+#endif
+
+// Implementation detail: internal macro to create static category and add begin
+// event if the category is enabled. Also adds the end event when the scope
+// ends. If the elapsed time is < threshold time, the begin/end pair is erased.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN(threshold, \
+        category, name, ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    WebCore::TraceEvent::TraceEndOnScopeCloseThreshold \
+        INTERNALTRACEEVENTUID(profileScope); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      int INTERNALTRACEEVENTUID(begin_event_id) = \
+        WebCore::TraceEvent::addTraceEvent( \
+            TRACE_EVENT_PHASE_BEGIN, \
+            INTERNALTRACEEVENTUID(catstatic), \
+            name, WebCore::TraceEvent::noEventId, \
+            TRACE_EVENT_FLAG_NONE, ##__VA_ARGS__); \
+      INTERNALTRACEEVENTUID(profileScope).initialize( \
+          INTERNALTRACEEVENTUID(catstatic), name, \
+          INTERNALTRACEEVENTUID(begin_event_id), threshold); \
+    }
+#endif
+
+// Implementation detail: internal macro to create static category and add
+// event if the category is enabled.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD_WITH_ID(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD_WITH_ID(phase, category, name, id, flags, \
+                                         ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      unsigned char traceEventFlags = flags | TRACE_EVENT_FLAG_HAS_ID; \
+      WebCore::TraceEvent::TraceID traceEventTraceID( \
+          id, &traceEventFlags); \
+      WebCore::TraceEvent::addTraceEvent( \
+          phase, INTERNALTRACEEVENTUID(catstatic), \
+          name, traceEventTraceID.data(), traceEventFlags, \
+          ##__VA_ARGS__); \
+    }
+#endif
+
+// Notes regarding the following definitions:
+// New values can be added and propagated to third party libraries, but existing
+// definitions must never be changed, because third party libraries may use old
+// definitions.
+
+// Phase indicates the nature of an event entry. E.g. part of a begin/end pair.
+#define TRACE_EVENT_PHASE_BEGIN    ('B')
+#define TRACE_EVENT_PHASE_END      ('E')
+#define TRACE_EVENT_PHASE_INSTANT  ('I')
+#define TRACE_EVENT_PHASE_START    ('S')
+#define TRACE_EVENT_PHASE_FINISH   ('F')
+#define TRACE_EVENT_PHASE_METADATA ('M')
+#define TRACE_EVENT_PHASE_COUNTER  ('C')
+
+// Flags for changing the behavior of TRACE_EVENT_API_ADD_TRACE_EVENT.
+#define TRACE_EVENT_FLAG_NONE        (static_cast<unsigned char>(0))
+#define TRACE_EVENT_FLAG_COPY        (static_cast<unsigned char>(1 << 0))
+#define TRACE_EVENT_FLAG_HAS_ID      (static_cast<unsigned char>(1 << 1))
+#define TRACE_EVENT_FLAG_MANGLE_ID   (static_cast<unsigned char>(1 << 2))
+
+// Type values for identifying types in the TraceValue union.
+#define TRACE_VALUE_TYPE_BOOL         (static_cast<unsigned char>(1))
+#define TRACE_VALUE_TYPE_UINT         (static_cast<unsigned char>(2))
+#define TRACE_VALUE_TYPE_INT          (static_cast<unsigned char>(3))
+#define TRACE_VALUE_TYPE_DOUBLE       (static_cast<unsigned char>(4))
+#define TRACE_VALUE_TYPE_POINTER      (static_cast<unsigned char>(5))
+#define TRACE_VALUE_TYPE_STRING       (static_cast<unsigned char>(6))
+#define TRACE_VALUE_TYPE_COPY_STRING  (static_cast<unsigned char>(7))
 
-// Issues PlatformSupport::traceEventBegin and traceEventEnd calls for the enclosing scope
-#define TRACE_EVENT(name, id, extra) WebCore::internal::ScopeTracer TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(__traceEventScope)(name, id, extra);
 
 namespace WebCore {
 
-namespace internal {
+namespace TraceEvent {
+
+// Specify these values when the corresponding argument of addTraceEvent is not
+// used.
+const int zeroNumArgs = 0;
+const int noThresholdBeginId = -1;
+const long long noThresholdValue = 0;
+const unsigned long long noEventId = 0;
 
-// Used by TRACE_EVENT macro. Do not use directly.
-class ScopeTracer {
+// TraceID encapsulates an ID that can either be an integer or pointer. Pointers
+// are mangled with the Process ID so that they are unlikely to collide when the
+// same pointer is used on different processes.
+class TraceID {
 public:
-    ScopeTracer(const char* name, void*, const char* extra);
-    ~ScopeTracer();
+    explicit TraceID(const void* id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(reinterpret_cast<unsigned long>(id)))
+    {
+        *flags |= TRACE_EVENT_FLAG_MANGLE_ID;
+    }
+    explicit TraceID(unsigned long long id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned long id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned int id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned short id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned char id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(long long id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(long id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(int id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(short id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(signed char id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+
+    unsigned long long data() const { return m_data; }
+
+private:
+    unsigned long long m_data;
+};
+
+// Simple union to store various types as unsigned long long.
+union TraceValueUnion {
+    bool m_bool;
+    unsigned long long m_uint;
+    long long m_int;
+    double m_double;
+    const void* m_pointer;
+    const char* m_string;
+};
 
+// Simple container for const char* that should be copied instead of retained.
+class TraceStringWithCopy {
+public:
+    explicit TraceStringWithCopy(const char* str) : m_str(str) { }
+    operator const char* () const { return m_str; }
 private:
-    const char* m_name;
-    void* m_id;
-    OwnArrayPtr<char> m_extra;
+    const char* m_str;
 };
 
-inline ScopeTracer::ScopeTracer(const char* name, void* id, const char* extra)
-    : m_name(name)
-    , m_id(id)
-{
-    PlatformSupport::traceEventBegin(name, id, extra); \
-    if (extra && PlatformSupport::isTraceEventEnabled())
-        m_extra = adoptArrayPtr(strdup(extra));
+// Define setTraceValue for each allowed type. It stores the type and
+// value in the return arguments. This allows this API to avoid declaring any
+// structures so that it is portable to third_party libraries.
+#define INTERNAL_DECLARE_SET_TRACE_VALUE(actual_type, \
+                                         union_member, \
+                                         value_type_id) \
+    static inline void setTraceValue(actual_type arg, \
+                                     unsigned char* type, \
+                                     unsigned long long* value) { \
+        TraceValueUnion typeValue; \
+        typeValue.union_member = arg; \
+        *type = value_type_id; \
+        *value = typeValue.m_uint; \
+    }
+// Simpler form for int types that can be safely casted.
+#define INTERNAL_DECLARE_SET_TRACE_VALUE_INT(actual_type, \
+                                             value_type_id) \
+    static inline void setTraceValue(actual_type arg, \
+                                     unsigned char* type, \
+                                     unsigned long long* value) { \
+        *type = value_type_id; \
+        *value = static_cast<unsigned long long>(arg); \
+    }
+
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned long long, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned int, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned short, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned char, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(long long, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(int, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(short, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(signed char, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE(bool, m_bool, TRACE_VALUE_TYPE_BOOL)
+INTERNAL_DECLARE_SET_TRACE_VALUE(double, m_double, TRACE_VALUE_TYPE_DOUBLE)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const void*, m_pointer,
+                                 TRACE_VALUE_TYPE_POINTER)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const char*, m_string,
+                                 TRACE_VALUE_TYPE_STRING)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const TraceStringWithCopy&, m_string,
+                                 TRACE_VALUE_TYPE_COPY_STRING)
+
+#undef INTERNAL_DECLARE_SET_TRACE_VALUE
+#undef INTERNAL_DECLARE_SET_TRACE_VALUE_INT
+
+// WTF::String version of setTraceValue so that trace arguments can be strings.
+static inline void setTraceValue(const WTF::CString& arg,
+                                 unsigned char* type,
+                                 unsigned long long* value) {
+    TraceValueUnion typeValue;
+    typeValue.m_string = arg.data();
+    *type = TRACE_VALUE_TYPE_COPY_STRING;
+    *value = typeValue.m_uint;
 }
 
-inline ScopeTracer::~ScopeTracer()
-{
-    PlatformSupport::traceEventEnd(m_name, m_id, m_extra.get());
+// These addTraceEvent template functions are defined here instead of in the
+// macro, because the arg values could be temporary string objects. In order to
+// store pointers to the internal c_str and pass through to the tracing API, the
+// arg values must live throughout these procedures.
+
+static inline int addTraceEvent(char phase,
+                                const unsigned char* categoryEnabled,
+                                const char* name,
+                                unsigned long long id,
+                                unsigned char flags) {
+    return TRACE_EVENT_API_ADD_TRACE_EVENT(
+        phase, categoryEnabled, name, id,
+        zeroNumArgs, 0, 0, 0,
+        noThresholdBeginId, noThresholdValue, flags);
+}
+
+template<class ARG1_TYPE>
+static inline int addTraceEvent(char phase,
+                                const unsigned char* categoryEnabled,
+                                const char* name,
+                                unsigned long long id,
+                                unsigned char flags,
+                                const char* arg1Name,
+                                const ARG1_TYPE& arg1Val) {
+    const int numArgs = 1;
+    unsigned char argTypes[1];
+    unsigned long long argValues[1];
+    setTraceValue(arg1Val, &argTypes[0], &argValues[0]);
+    return TRACE_EVENT_API_ADD_TRACE_EVENT(
+        phase, categoryEnabled, name, id,
+        numArgs, &arg1Name, argTypes, argValues,
+        noThresholdBeginId, noThresholdValue, flags);
 }
 
-} // namespace internal
+template<class ARG1_TYPE, class ARG2_TYPE>
+static inline int addTraceEvent(char phase,
+                                const unsigned char* categoryEnabled,
+                                const char* name,
+                                unsigned long long id,
+                                unsigned char flags,
+                                const char* arg1Name,
+                                const ARG1_TYPE& arg1Val,
+                                const char* arg2Name,
+                                const ARG2_TYPE& arg2Val) {
+    const int numArgs = 2;
+    const char* argNames[2] = { arg1Name, arg2Name };
+    unsigned char argTypes[2];
+    unsigned long long argValues[2];
+    setTraceValue(arg1Val, &argTypes[0], &argValues[0]);
+    setTraceValue(arg2Val, &argTypes[1], &argValues[1]);
+    return TRACE_EVENT_API_ADD_TRACE_EVENT(
+        phase, categoryEnabled, name, id,
+        numArgs, argNames, argTypes, argValues,
+        noThresholdBeginId, noThresholdValue, flags);
+}
+
+// Used by TRACE_EVENTx macro. Do not use directly.
+class TraceEndOnScopeClose {
+public:
+    // Note: members of m_data intentionally left uninitialized. See initialize.
+    TraceEndOnScopeClose() : m_pdata(0) { }
+    ~TraceEndOnScopeClose()
+    {
+        if (m_pdata)
+            addEventIfEnabled();
+    }
+
+    void initialize(const unsigned char* categoryEnabled,
+                    const char* name)
+    {
+        m_data.categoryEnabled = categoryEnabled;
+        m_data.name = name;
+        m_pdata = &m_data;
+    }
+
+private:
+    // Add the end event if the category is still enabled.
+    void addEventIfEnabled()
+    {
+        // Only called when m_pdata is non-null.
+        if (*m_pdata->categoryEnabled) {
+            TRACE_EVENT_API_ADD_TRACE_EVENT(
+                TRACE_EVENT_PHASE_END,
+                m_pdata->categoryEnabled,
+                m_pdata->name, noEventId,
+                zeroNumArgs, 0, 0, 0,
+                noThresholdBeginId, noThresholdValue, TRACE_EVENT_FLAG_NONE);
+        }
+    }
+
+    // This Data struct workaround is to avoid initializing all the members
+    // in Data during construction of this object, since this object is always
+    // constructed, even when tracing is disabled. If the members of Data were
+    // members of this class instead, compiler warnings occur about potential
+    // uninitialized accesses.
+    struct Data {
+        const unsigned char* categoryEnabled;
+        const char* name;
+    };
+    Data* m_pdata;
+    Data m_data;
+};
+
+// Used by TRACE_EVENTx macro. Do not use directly.
+class TraceEndOnScopeCloseThreshold {
+public:
+    // Note: members of m_data intentionally left uninitialized. See initialize.
+    TraceEndOnScopeCloseThreshold() : m_pdata(0) { }
+    ~TraceEndOnScopeCloseThreshold()
+    {
+        if (m_pdata)
+            addEventIfEnabled();
+    }
+
+    // Called by macros only when tracing is enabled at the point when the begin
+    // event is added.
+    void initialize(const unsigned char* categoryEnabled,
+                    const char* name,
+                    int thresholdBeginID,
+                    long long threshold)
+    {
+        m_data.categoryEnabled = categoryEnabled;
+        m_data.name = name;
+        m_data.thresholdBeginID = thresholdBeginID;
+        m_data.threshold = threshold;
+        m_pdata = &m_data;
+    }
+
+private:
+    // Add the end event if the category is still enabled.
+    void addEventIfEnabled()
+    {
+        // Only called when m_pdata is non-null.
+        if (*m_pdata->categoryEnabled) {
+            TRACE_EVENT_API_ADD_TRACE_EVENT(
+                TRACE_EVENT_PHASE_END,
+                m_pdata->categoryEnabled,
+                m_pdata->name, noEventId,
+                zeroNumArgs, 0, 0, 0,
+                m_pdata->thresholdBeginID, m_pdata->threshold,
+                TRACE_EVENT_FLAG_NONE);
+        }
+    }
+
+    // This Data struct workaround is to avoid initializing all the members
+    // in Data during construction of this object, since this object is always
+    // constructed, even when tracing is disabled. If the members of Data were
+    // members of this class instead, compiler warnings occur about potential
+    // uninitialized accesses.
+    struct Data {
+        long long threshold;
+        const unsigned char* categoryEnabled;
+        const char* name;
+        int thresholdBeginID;
+    };
+    Data* m_pdata;
+    Data m_data;
+};
+
+} // namespace TraceEvent
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.cpp b/Source/WebCore/platform/efl/ClipboardEfl.cpp
index 8dc95e865..60152726a 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.cpp
+++ b/Source/WebCore/platform/efl/ClipboardEfl.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ClipboardEfl.h"
 
+#include "DOMStringList.h"
 #include "DataTransferItemList.h"
 #include "Editor.h"
 #include "FileList.h"
@@ -77,10 +78,10 @@ bool ClipboardEfl::setData(const String&, const String&)
     return false;
 }
 
-HashSet<String> ClipboardEfl::types() const
+PassRefPtr<DOMStringList> ClipboardEfl::types() const
 {
     notImplemented();
-    return HashSet<String>();
+    return DOMStringList::create();
 }
 
 PassRefPtr<FileList> ClipboardEfl::files() const
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.h b/Source/WebCore/platform/efl/ClipboardEfl.h
index 575382f7f..56455190f 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.h
+++ b/Source/WebCore/platform/efl/ClipboardEfl.h
@@ -39,7 +39,7 @@ public:
     String getData(const String&, bool&) const;
     bool setData(const String&, const String&);
 
-    HashSet<String> types() const;
+    PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/efl/FileSystemEfl.cpp b/Source/WebCore/platform/efl/FileSystemEfl.cpp
index 01c6c6726..d521d5404 100644
--- a/Source/WebCore/platform/efl/FileSystemEfl.cpp
+++ b/Source/WebCore/platform/efl/FileSystemEfl.cpp
@@ -42,9 +42,7 @@
 #include <dlfcn.h>
 #include <errno.h>
 #include <fnmatch.h>
-#if ENABLE(GLIB_SUPPORT)
 #include <glib.h> // TODO: remove me after following TODO is solved.
-#endif
 #include <limits.h>
 #include <stdio.h>
 #include <sys/stat.h>
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp b/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
deleted file mode 100644
index 975c72098..000000000
--- a/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2011 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "GeolocationServiceEfl.h"
-
-#if ENABLE(GEOLOCATION)
-#include "NotImplemented.h"
-#include "PositionOptions.h"
-#include <wtf/text/CString.h>
-
-namespace WebCore {
-
-#if !ENABLE(CLIENT_BASED_GEOLOCATION)
-GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceEfl::create;
-#endif
-
-PassOwnPtr<GeolocationService> GeolocationServiceEfl::create(GeolocationServiceClient* client)
-{
-    return adoptPtr(new GeolocationServiceEfl(client));
-}
-
-GeolocationServiceEfl::GeolocationServiceEfl(GeolocationServiceClient* client)
-    : GeolocationService(client)
-{
-}
-
-GeolocationServiceEfl::~GeolocationServiceEfl()
-{
-    notImplemented();
-}
-
-bool GeolocationServiceEfl::startUpdating(PositionOptions* options)
-{
-    notImplemented();
-    return false;
-}
-
-void GeolocationServiceEfl::stopUpdating()
-{
-    notImplemented();
-}
-
-Geoposition* GeolocationServiceEfl::lastPosition() const
-{
-    return m_lastPosition.get();
-}
-
-PositionError* GeolocationServiceEfl::lastError() const
-{
-    return m_lastError.get();
-}
-
-}
-#endif // ENABLE(GEOLOCATION)
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.h b/Source/WebCore/platform/efl/GeolocationServiceEfl.h
deleted file mode 100644
index 0cd3e8be7..000000000
--- a/Source/WebCore/platform/efl/GeolocationServiceEfl.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2011 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef GeolocationServiceEfl_h
-#define GeolocationServiceEfl_h
-
-#if ENABLE(GEOLOCATION)
-#include "GeolocationService.h"
-#include "Geoposition.h"
-#include "PositionError.h"
-#include "RefPtr.h"
-
-namespace WebCore {
-
-class GeolocationServiceEfl : public GeolocationService {
-public:
-    static PassOwnPtr<GeolocationService> create(GeolocationServiceClient*);
-    ~GeolocationServiceEfl();
-
-    virtual bool startUpdating(PositionOptions*);
-    virtual void stopUpdating();
-
-    virtual Geoposition* lastPosition() const;
-    virtual PositionError* lastError() const;
-
-private:
-    GeolocationServiceEfl(GeolocationServiceClient*);
-
-    RefPtr<Geoposition> m_lastPosition;
-    RefPtr<PositionError> m_lastError;
-
-};
-
-}
-#endif // ENABLE(GEOLOCATION)
-#endif
diff --git a/Source/WebCore/platform/graphics/FloatPoint.cpp b/Source/WebCore/platform/graphics/FloatPoint.cpp
index abe9b86d9..d3ccc80c4 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.cpp
+++ b/Source/WebCore/platform/graphics/FloatPoint.cpp
@@ -28,9 +28,11 @@
 #include "FloatPoint.h"
 
 #include "AffineTransform.h"
-#include "TransformationMatrix.h"
+#include "FractionalLayoutPoint.h"
 #include "FloatConversion.h"
+#include "FractionalLayoutSize.h"
 #include "IntPoint.h"
+#include "TransformationMatrix.h"
 #include <limits>
 #include <math.h>
 
@@ -40,6 +42,10 @@ FloatPoint::FloatPoint(const IntPoint& p) : m_x(p.x()), m_y(p.y())
 {
 }
 
+FloatPoint::FloatPoint(const FractionalLayoutPoint& p) : m_x(p.x()), m_y(p.y())
+{
+}
+
 void FloatPoint::normalize()
 {
     float tempLength = length();
@@ -55,6 +61,18 @@ float FloatPoint::length() const
     return sqrtf(lengthSquared());
 }
 
+void FloatPoint::move(const FractionalLayoutSize& size)
+{
+    m_x += size.width();
+    m_y += size.height();
+}
+
+void FloatPoint::moveBy(const FractionalLayoutPoint& point)
+{
+    m_x += point.x();
+    m_y += point.y();
+}
+
 FloatPoint FloatPoint::matrixTransform(const AffineTransform& transform) const
 {
     double newX, newY;
diff --git a/Source/WebCore/platform/graphics/FloatPoint.h b/Source/WebCore/platform/graphics/FloatPoint.h
index ea4bdf4fd..094304d83 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.h
+++ b/Source/WebCore/platform/graphics/FloatPoint.h
@@ -60,13 +60,15 @@ class AffineTransform;
 class TransformationMatrix;
 class IntPoint;
 class IntSize;
+class FractionalLayoutPoint;
+class FractionalLayoutSize;
 
 class FloatPoint {
 public:
     FloatPoint() : m_x(0), m_y(0) { }
     FloatPoint(float x, float y) : m_x(x), m_y(y) { }
     FloatPoint(const IntPoint&);
-
+    FloatPoint(const FractionalLayoutPoint&);
 
     static FloatPoint zero() { return FloatPoint(); }
 
@@ -92,6 +94,7 @@ public:
         m_x += a.width();
         m_y += a.height();
     }
+    void move(const FractionalLayoutSize&);
     void move(const FloatSize& a)
     {
         m_x += a.width();
@@ -102,6 +105,7 @@ public:
         m_x += a.x();
         m_y += a.y();
     }
+    void moveBy(const FractionalLayoutPoint&);
     void moveBy(const FloatPoint& a)
     {
         m_x += a.x();
diff --git a/Source/WebCore/platform/graphics/FloatRect.cpp b/Source/WebCore/platform/graphics/FloatRect.cpp
index 595af2a32..737473c3f 100644
--- a/Source/WebCore/platform/graphics/FloatRect.cpp
+++ b/Source/WebCore/platform/graphics/FloatRect.cpp
@@ -28,6 +28,7 @@
 #include "FloatRect.h"
 
 #include "FloatConversion.h"
+#include "FractionalLayoutRect.h"
 #include "IntRect.h"
 #include <algorithm>
 #include <math.h>
@@ -42,6 +43,10 @@ FloatRect::FloatRect(const IntRect& r) : m_location(r.location()), m_size(r.size
 {
 }
 
+FloatRect::FloatRect(const FractionalLayoutRect& r) : m_location(r.location()), m_size(r.size())
+{
+}
+
 FloatRect FloatRect::narrowPrecision(double x, double y, double width, double height)
 {
     return FloatRect(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y), narrowPrecisionToFloat(width), narrowPrecisionToFloat(height));
diff --git a/Source/WebCore/platform/graphics/FloatRect.h b/Source/WebCore/platform/graphics/FloatRect.h
index 22c171c5a..4d4eadfd0 100644
--- a/Source/WebCore/platform/graphics/FloatRect.h
+++ b/Source/WebCore/platform/graphics/FloatRect.h
@@ -66,6 +66,7 @@ namespace WebCore {
 class VGRect;
 #endif
 
+class FractionalLayoutRect;
 class IntRect;
 class IntPoint;
 
@@ -82,6 +83,7 @@ public:
     FloatRect(float x, float y, float width, float height)
         : m_location(FloatPoint(x, y)), m_size(FloatSize(width, height)) { }
     FloatRect(const IntRect&);
+    FloatRect(const FractionalLayoutRect&);
 
     static FloatRect narrowPrecision(double x, double y, double width, double height);
 
diff --git a/Source/WebCore/platform/graphics/FloatSize.cpp b/Source/WebCore/platform/graphics/FloatSize.cpp
index 25512a7f8..2b62a9d17 100644
--- a/Source/WebCore/platform/graphics/FloatSize.cpp
+++ b/Source/WebCore/platform/graphics/FloatSize.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "FloatSize.h"
 
+#include "FractionalLayoutSize.h"
 #include "FloatConversion.h"
 #include "IntSize.h"
 #include <limits>
@@ -40,6 +41,10 @@ FloatSize::FloatSize(const IntSize& size) : m_width(size.width()), m_height(size
 {
 }
 
+FloatSize::FloatSize(const FractionalLayoutSize& size) : m_width(size.width()), m_height(size.height())
+{
+}
+
 float FloatSize::diagonalLength() const
 {
     return sqrtf(diagonalLengthSquared());
diff --git a/Source/WebCore/platform/graphics/FloatSize.h b/Source/WebCore/platform/graphics/FloatSize.h
index 1cee681c2..2b5545030 100644
--- a/Source/WebCore/platform/graphics/FloatSize.h
+++ b/Source/WebCore/platform/graphics/FloatSize.h
@@ -46,12 +46,14 @@ typedef struct _NSSize NSSize;
 namespace WebCore {
 
 class IntSize;
+class FractionalLayoutSize;
 
 class FloatSize {
 public:
     FloatSize() : m_width(0), m_height(0) { }
     FloatSize(float width, float height) : m_width(width), m_height(height) { }
     FloatSize(const IntSize&);
+    FloatSize(const FractionalLayoutSize&);
 
     static FloatSize narrowPrecision(double width, double height);
 
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index c2d9c58c3..50eee53a7 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -120,11 +120,12 @@ bool Font::operator==(const Font& other) const
     
     FontSelector* first = m_fontList ? m_fontList->fontSelector() : 0;
     FontSelector* second = other.m_fontList ? other.m_fontList->fontSelector() : 0;
-    
+
     return first == second
            && m_fontDescription == other.m_fontDescription
            && m_letterSpacing == other.m_letterSpacing
            && m_wordSpacing == other.m_wordSpacing
+           && (m_fontList ? m_fontList->fontSelectorVersion() : 0) == (other.m_fontList ? other.m_fontList->fontSelectorVersion() : 0)
            && (m_fontList ? m_fontList->generation() : 0) == (other.m_fontList ? other.m_fontList->generation() : 0);
 }
 
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index 870c649ed..47f251c84 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -252,7 +252,7 @@ typedef HashMap<FontPlatformData, pair<SimpleFontData*, unsigned>, FontDataCache
 
 static FontDataCache* gFontDataCache = 0;
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) && !OS(ANDROID)
 const int cMaxInactiveFontData = 250;
 const int cTargetInactiveFontData = 200;
 #else
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.cpp b/Source/WebCore/platform/graphics/FontFallbackList.cpp
index 2f1b68f8b..6d11c09e3 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.cpp
+++ b/Source/WebCore/platform/graphics/FontFallbackList.cpp
@@ -39,6 +39,7 @@ FontFallbackList::FontFallbackList()
     : m_pageZero(0)
     , m_cachedPrimarySimpleFontData(0)
     , m_fontSelector(0)
+    , m_fontSelectorVersion(0)
     , m_familyIndex(0)
     , m_generation(fontCache()->generation())
     , m_pitch(UnknownPitch)
@@ -57,6 +58,7 @@ void FontFallbackList::invalidate(PassRefPtr<FontSelector> fontSelector)
     m_pitch = UnknownPitch;
     m_loadingCustomFonts = false;
     m_fontSelector = fontSelector;
+    m_fontSelectorVersion = m_fontSelector ? m_fontSelector->version() : 0;
     m_generation = fontCache()->generation();
 }
 
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.h b/Source/WebCore/platform/graphics/FontFallbackList.h
index 10251a4eb..12479b2c9 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.h
+++ b/Source/WebCore/platform/graphics/FontFallbackList.h
@@ -51,6 +51,8 @@ public:
     bool loadingCustomFonts() const { return m_loadingCustomFonts; }
 
     FontSelector* fontSelector() const { return m_fontSelector.get(); }
+    // FIXME: It should be possible to combine fontSelectorVersion and generation.
+    unsigned fontSelectorVersion() const { return m_fontSelectorVersion; }
     unsigned generation() const { return m_generation; }
 
     struct GlyphPagesHashTraits : HashTraits<int> {
@@ -87,6 +89,7 @@ private:
     mutable GlyphPageTreeNode* m_pageZero;
     mutable const SimpleFontData* m_cachedPrimarySimpleFontData;
     RefPtr<FontSelector> m_fontSelector;
+    unsigned m_fontSelectorVersion;
     mutable int m_familyIndex;
     unsigned short m_generation;
     mutable unsigned m_pitch : 3; // Pitch
diff --git a/Source/WebCore/platform/graphics/FontSelector.h b/Source/WebCore/platform/graphics/FontSelector.h
index e18161bb8..2c7d1494e 100644
--- a/Source/WebCore/platform/graphics/FontSelector.h
+++ b/Source/WebCore/platform/graphics/FontSelector.h
@@ -44,6 +44,8 @@ public:
 
     virtual void registerForInvalidationCallbacks(FontSelectorClient*) = 0;
     virtual void unregisterForInvalidationCallbacks(FontSelectorClient*) = 0;
+    
+    virtual unsigned version() const = 0;
 };
 
 class FontSelectorClient {
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutPoint.h b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
new file mode 100644
index 000000000..c9863fa5b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutPoint_h
+#define FractionalLayoutPoint_h
+
+#include "FloatPoint.h"
+#include "FractionalLayoutSize.h"
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+class FractionalLayoutPoint {
+public:
+    FractionalLayoutPoint() : m_x(0), m_y(0) { }
+    FractionalLayoutPoint(FractionalLayoutUnit x, FractionalLayoutUnit y) : m_x(x), m_y(y) { }
+    FractionalLayoutPoint(const IntPoint& point) : m_x(point.x()), m_y(point.y()) { }
+    explicit FractionalLayoutPoint(const FloatPoint& size) : m_x(size.x()), m_y(size.y()) { }
+
+    static FractionalLayoutPoint zero() { return FractionalLayoutPoint(); }
+
+    FractionalLayoutUnit x() const { return m_x; }
+    FractionalLayoutUnit y() const { return m_y; }
+
+    void setX(FractionalLayoutUnit x) { m_x = x; }
+    void setY(FractionalLayoutUnit y) { m_y = y; }
+
+    void move(const FractionalLayoutSize& s) { move(s.width(), s.height()); } 
+    void moveBy(const FractionalLayoutPoint& offset) { move(offset.x(), offset.y()); }
+    void move(FractionalLayoutUnit dx, FractionalLayoutUnit dy) { m_x += dx; m_y += dy; }
+    void scale(float sx, float sy)
+    {
+        m_x *= sx;
+        m_y *= sy;
+    }
+    
+    FractionalLayoutPoint expandedTo(const FractionalLayoutPoint& other) const
+    {
+        return FractionalLayoutPoint(std::max(m_x, other.m_x), std::max(m_y, other.m_y));
+    }
+
+    FractionalLayoutPoint shrunkTo(const FractionalLayoutPoint& other) const
+    {
+        return FractionalLayoutPoint(std::min(m_x, other.m_x), std::min(m_y, other.m_y));
+    }
+
+    void clampNegativeToZero()
+    {
+        *this = expandedTo(zero());
+    }
+
+    FractionalLayoutPoint transposedPoint() const
+    {
+        return FractionalLayoutPoint(m_y, m_x);
+    }
+
+private:
+    FractionalLayoutUnit m_x, m_y;
+};
+
+inline FractionalLayoutPoint& operator+=(FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    a.move(b.width(), b.height());
+    return a;
+}
+
+inline FractionalLayoutPoint& operator-=(FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    a.move(-b.width(), -b.height());
+    return a;
+}
+
+inline FractionalLayoutPoint operator+(const FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutPoint(a.x() + b.width(), a.y() + b.height());
+}
+
+inline FractionalLayoutPoint operator+(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return FractionalLayoutPoint(a.x() + b.x(), a.y() + b.y());
+}
+
+inline FractionalLayoutSize operator-(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return FractionalLayoutSize(a.x() - b.x(), a.y() - b.y());
+}
+
+inline FractionalLayoutPoint operator-(const FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutPoint(a.x() - b.width(), a.y() - b.height());
+}
+
+inline FractionalLayoutPoint operator-(const FractionalLayoutPoint& point)
+{
+    return FractionalLayoutPoint(-point.x(), -point.y());
+}
+
+inline bool operator==(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return a.x() == b.x() && a.y() == b.y();
+}
+
+inline bool operator!=(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return a.x() != b.x() || a.y() != b.y();
+}
+
+inline FractionalLayoutPoint toPoint(const FractionalLayoutSize& size)
+{
+    return FractionalLayoutPoint(size.width(), size.height());
+}
+
+inline FractionalLayoutSize toSize(const FractionalLayoutPoint& a)
+{
+    return FractionalLayoutSize(a.x(), a.y());
+}
+
+inline IntPoint flooredIntPoint(const FractionalLayoutPoint& point)
+{
+    return IntPoint(point.x().toInt(), point.y().toInt());
+}
+
+inline IntPoint roundedIntPoint(const FractionalLayoutPoint& point)
+{
+    return IntPoint(point.x().round(), point.y().round());
+}
+
+inline IntPoint ceiledIntPoint(const FractionalLayoutPoint& point)
+{
+    return IntPoint(point.x().ceil(), point.y().ceil());
+}
+
+
+} // namespace WebCore
+
+#endif // FractionalLayoutPoint_h
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp b/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp
new file mode 100644
index 000000000..62986e977
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FractionalLayoutRect.h"
+
+#include "FloatRect.h"
+#include "FractionalLayoutUnit.h"
+#include <algorithm>
+
+using std::max;
+using std::min;
+
+namespace WebCore {
+
+FractionalLayoutRect::FractionalLayoutRect(const FloatRect& r)
+    : m_location(FractionalLayoutPoint(r.location()))
+    , m_size(FractionalLayoutSize(r.size()))
+{
+}
+
+bool FractionalLayoutRect::intersects(const FractionalLayoutRect& other) const
+{
+    // Checking emptiness handles negative widths as well as zero.
+    return !isEmpty() && !other.isEmpty()
+        && x() < other.maxX() && other.x() < maxX()
+        && y() < other.maxY() && other.y() < maxY();
+}
+
+bool FractionalLayoutRect::contains(const FractionalLayoutRect& other) const
+{
+    return x() <= other.x() && maxX() >= other.maxX()
+        && y() <= other.y() && maxY() >= other.maxY();
+}
+
+void FractionalLayoutRect::intersect(const FractionalLayoutRect& other)
+{
+    FractionalLayoutPoint newLocation(max(x(), other.x()), max(y(), other.y()));
+    FractionalLayoutPoint newMaxPoint(min(maxX(), other.maxX()), min(maxY(), other.maxY()));
+
+    // Return a clean empty rectangle for non-intersecting cases.
+    if (newLocation.x() >= newMaxPoint.x() || newLocation.y() >= newMaxPoint.y()) {
+        newLocation = FractionalLayoutPoint(0, 0);
+        newMaxPoint = FractionalLayoutPoint(0, 0);
+    }
+
+    m_location = newLocation;
+    m_size = newMaxPoint - newLocation;
+}
+
+void FractionalLayoutRect::unite(const FractionalLayoutRect& other)
+{
+    // Handle empty special cases first.
+    if (other.isEmpty())
+        return;
+    if (isEmpty()) {
+        *this = other;
+        return;
+    }
+
+    FractionalLayoutPoint newLocation(min(x(), other.x()), min(y(), other.y()));
+    FractionalLayoutPoint newMaxPoint(max(maxX(), other.maxX()), max(maxY(), other.maxY()));
+
+    m_location = newLocation;
+    m_size = newMaxPoint - newLocation;
+}
+
+void FractionalLayoutRect::uniteIfNonZero(const FractionalLayoutRect& other)
+{
+    // Handle empty special cases first.
+    if (!other.width() && !other.height())
+        return;
+    if (!width() && !height()) {
+        *this = other;
+        return;
+    }
+
+    FractionalLayoutPoint newLocation(min(x(), other.x()), min(y(), other.y()));
+    FractionalLayoutPoint newMaxPoint(max(maxX(), other.maxX()), max(maxY(), other.maxY()));
+
+    m_location = newLocation;
+    m_size = newMaxPoint - newLocation;
+}
+
+void FractionalLayoutRect::scale(float s)
+{
+    m_location.scale(s, s);
+    m_size.scale(s);
+}
+
+FractionalLayoutRect unionRect(const Vector<FractionalLayoutRect>& rects)
+{
+    FractionalLayoutRect result;
+
+    size_t count = rects.size();
+    for (size_t i = 0; i < count; ++i)
+        result.unite(rects[i]);
+
+    return result;
+}
+
+IntRect enclosingIntRect(const FractionalLayoutRect& rect)
+{
+    float x = floorf(rect.x().toFloat());
+    float y = floorf(rect.y().toFloat());
+    float width = ceilf(rect.maxX().toFloat()) - x;
+    float height = ceilf(rect.maxY().toFloat()) - y;
+
+    return IntRect(clampToInteger(x), clampToInteger(y), 
+                   clampToInteger(width), clampToInteger(height));
+}
+
+FractionalLayoutRect enclosingFractionalLayoutRect(const FloatRect& rect)
+{
+    return FractionalLayoutRect(rect.x(), rect.y(),
+                     rect.maxX() - rect.x() + FractionalLayoutUnit::epsilon(),
+                     rect.maxY() - rect.y() + FractionalLayoutUnit::epsilon());
+}
+
+IntRect pixelSnappedIntRect(const FractionalLayoutRect& rect)
+{
+    IntPoint roundedLocation = roundedIntPoint(rect.location());
+    return IntRect(roundedLocation, IntSize((rect.x() + rect.width()).round() - roundedLocation.x(),
+                                            (rect.y() + rect.height()).round() - roundedLocation.y()));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.h b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
new file mode 100644
index 000000000..e16655517
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
@@ -0,0 +1,183 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutRect_h
+#define FractionalLayoutRect_h
+
+#include "FractionalLayoutPoint.h"
+#include "IntRect.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class FloatRect;
+
+class FractionalLayoutRect {
+public:
+    FractionalLayoutRect() { }
+    FractionalLayoutRect(const FractionalLayoutPoint& location, const FractionalLayoutSize& size)
+        : m_location(location), m_size(size) { }
+    FractionalLayoutRect(FractionalLayoutUnit x, FractionalLayoutUnit y, FractionalLayoutUnit width, FractionalLayoutUnit height)
+        : m_location(FractionalLayoutPoint(x, y)), m_size(FractionalLayoutSize(width, height)) { }
+    FractionalLayoutRect(const FloatPoint& location, const FloatSize& size)
+        : m_location(location), m_size(size) { }
+    FractionalLayoutRect(const IntRect& rect) : m_location(rect.location()), m_size(rect.size()) { }
+
+    explicit FractionalLayoutRect(const FloatRect&); // don't do this implicitly since it's lossy
+        
+    FractionalLayoutPoint location() const { return m_location; }
+    FractionalLayoutSize size() const { return m_size; }
+
+    void setLocation(const FractionalLayoutPoint& location) { m_location = location; }
+    void setSize(const FractionalLayoutSize& size) { m_size = size; }
+
+    FractionalLayoutUnit x() const { return m_location.x(); }
+    FractionalLayoutUnit y() const { return m_location.y(); }
+    FractionalLayoutUnit maxX() const { return x() + width(); }
+    FractionalLayoutUnit maxY() const { return y() + height(); }
+    FractionalLayoutUnit width() const { return m_size.width(); }
+    FractionalLayoutUnit height() const { return m_size.height(); }
+
+    void setX(FractionalLayoutUnit x) { m_location.setX(x); }
+    void setY(FractionalLayoutUnit y) { m_location.setY(y); }
+    void setWidth(FractionalLayoutUnit width) { m_size.setWidth(width); }
+    void setHeight(FractionalLayoutUnit height) { m_size.setHeight(height); }
+
+    bool isEmpty() const { return m_size.isEmpty(); }
+
+    // NOTE: The result is rounded to integer values, and thus may be not the exact
+    // center point.
+    FractionalLayoutPoint center() const { return FractionalLayoutPoint(x() + width() / 2, y() + height() / 2); }
+
+    void move(const FractionalLayoutSize& size) { m_location += size; } 
+    void moveBy(const FractionalLayoutPoint& offset) { m_location.move(offset.x(), offset.y()); }
+    void move(FractionalLayoutUnit dx, FractionalLayoutUnit dy) { m_location.move(dx, dy); } 
+
+    void expand(const FractionalLayoutSize& size) { m_size += size; }
+    void expand(FractionalLayoutUnit dw, FractionalLayoutUnit dh) { m_size.expand(dw, dh); }
+    void contract(const FractionalLayoutSize& size) { m_size -= size; }
+    void contract(FractionalLayoutUnit dw, FractionalLayoutUnit dh) { m_size.expand(-dw, -dh); }
+
+    void shiftXEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - x();
+        setX(edge);
+        setWidth(std::max<FractionalLayoutUnit>(0, width() - delta));
+    }
+    void shiftMaxXEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - maxX();
+        setWidth(std::max<FractionalLayoutUnit>(0, width() + delta));
+    }
+    void shiftYEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - y();
+        setY(edge);
+        setHeight(std::max<FractionalLayoutUnit>(0, height() - delta));
+    }
+    void shiftMaxYEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - maxY();
+        setHeight(std::max<FractionalLayoutUnit>(0, height() + delta));
+    }
+
+    FractionalLayoutPoint minXMinYCorner() const { return m_location; } // typically topLeft
+    FractionalLayoutPoint maxXMinYCorner() const { return FractionalLayoutPoint(m_location.x() + m_size.width(), m_location.y()); } // typically topRight
+    FractionalLayoutPoint minXMaxYCorner() const { return FractionalLayoutPoint(m_location.x(), m_location.y() + m_size.height()); } // typically bottomLeft
+    FractionalLayoutPoint maxXMaxYCorner() const { return FractionalLayoutPoint(m_location.x() + m_size.width(), m_location.y() + m_size.height()); } // typically bottomRight
+    
+    bool intersects(const FractionalLayoutRect&) const;
+    bool contains(const FractionalLayoutRect&) const;
+
+    // This checks to see if the rect contains x,y in the traditional sense.
+    // Equivalent to checking if the rect contains a 1x1 rect below and to the right of (px,py).
+    bool contains(FractionalLayoutUnit px, FractionalLayoutUnit py) const
+        { return px >= x() && px < maxX() && py >= y() && py < maxY(); }
+    bool contains(const FractionalLayoutPoint& point) const { return contains(point.x(), point.y()); }
+
+    void intersect(const FractionalLayoutRect&);
+    void unite(const FractionalLayoutRect&);
+    void uniteIfNonZero(const FractionalLayoutRect&);
+
+    void inflateX(FractionalLayoutUnit dx)
+    {
+        m_location.setX(m_location.x() - dx);
+        m_size.setWidth(m_size.width() + dx + dx);
+    }
+    void inflateY(FractionalLayoutUnit dy)
+    {
+        m_location.setY(m_location.y() - dy);
+        m_size.setHeight(m_size.height() + dy + dy);
+    }
+    void inflate(FractionalLayoutUnit d) { inflateX(d); inflateY(d); }
+    void scale(float s);
+
+    FractionalLayoutRect transposedRect() const { return FractionalLayoutRect(m_location.transposedPoint(), m_size.transposedSize()); }
+
+    static FractionalLayoutRect infiniteRect() {return FractionalLayoutRect(FractionalLayoutUnit::min() / 2, FractionalLayoutUnit::min() / 2, FractionalLayoutUnit::max(), FractionalLayoutUnit::max()); }
+
+private:
+    FractionalLayoutPoint m_location;
+    FractionalLayoutSize m_size;
+};
+
+inline FractionalLayoutRect intersection(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    FractionalLayoutRect c = a;
+    c.intersect(b);
+    return c;
+}
+
+inline FractionalLayoutRect unionRect(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    FractionalLayoutRect c = a;
+    c.unite(b);
+    return c;
+}
+
+FractionalLayoutRect unionRect(const Vector<FractionalLayoutRect>&);
+
+inline bool operator==(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    return a.location() == b.location() && a.size() == b.size();
+}
+
+inline bool operator!=(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    return a.location() != b.location() || a.size() != b.size();
+}
+
+IntRect enclosingIntRect(const FractionalLayoutRect&);
+FractionalLayoutRect enclosingFractionalLayoutRect(const FloatRect&);
+IntRect pixelSnappedIntRect(const FractionalLayoutRect&);
+
+} // namespace WebCore
+
+#endif // FractionalLayoutRect_h
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutSize.cpp b/Source/WebCore/platform/graphics/FractionalLayoutSize.cpp
new file mode 100644
index 000000000..b10152227
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutSize.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FractionalLayoutSize.h"
+
+#include "FractionalLayoutPoint.h"
+
+namespace WebCore {
+
+IntSize pixelSnappedIntSize(const FractionalLayoutSize& s, const FractionalLayoutPoint& p)
+{
+    return IntSize(snapSizeToPixel(s.width(), p.x()), snapSizeToPixel(s.height(), p.y()));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutSize.h b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
new file mode 100644
index 000000000..1b9e942ff
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutSize_h
+#define FractionalLayoutSize_h
+
+#include "FloatSize.h"
+#include "FractionalLayoutUnit.h"
+#include "IntSize.h"
+
+namespace WebCore {
+
+class FractionalLayoutPoint;
+
+class FractionalLayoutSize {
+public:
+    FractionalLayoutSize() : m_width(0), m_height(0) { }
+    FractionalLayoutSize(const IntSize& size) : m_width(size.width()), m_height(size.height()) { }
+    FractionalLayoutSize(FractionalLayoutUnit width, FractionalLayoutUnit height) : m_width(width), m_height(height) { }
+
+    explicit FractionalLayoutSize(const FloatSize& size) : m_width(size.width()), m_height(size.height()) { }
+    
+    FractionalLayoutUnit width() const { return m_width; }
+    FractionalLayoutUnit height() const { return m_height; }
+
+    void setWidth(FractionalLayoutUnit width) { m_width = width; }
+    void setHeight(FractionalLayoutUnit height) { m_height = height; }
+
+    bool isEmpty() const { return m_width <= 0 || m_height <= 0; }
+    bool isZero() const { return !m_width && !m_height; }
+
+    float aspectRatio() const { return static_cast<float>(m_width) / static_cast<float>(m_height); }
+    
+    void expand(FractionalLayoutUnit width, FractionalLayoutUnit height)
+    {
+        m_width += width;
+        m_height += height;
+    }
+    
+    void scale(float scale)
+    {
+        m_width = static_cast<int>(static_cast<float>(m_width) * scale);
+        m_height = static_cast<int>(static_cast<float>(m_height) * scale);
+    }
+    
+    FractionalLayoutSize expandedTo(const FractionalLayoutSize& other) const
+    {
+        return FractionalLayoutSize(m_width > other.m_width ? m_width : other.m_width,
+            m_height > other.m_height ? m_height : other.m_height);
+    }
+
+    FractionalLayoutSize shrunkTo(const FractionalLayoutSize& other) const
+    {
+        return FractionalLayoutSize(m_width < other.m_width ? m_width : other.m_width,
+            m_height < other.m_height ? m_height : other.m_height);
+    }
+
+    void clampNegativeToZero()
+    {
+        *this = expandedTo(FractionalLayoutSize());
+    }
+
+    FractionalLayoutSize transposedSize() const
+    {
+        return FractionalLayoutSize(m_height, m_width);
+    }
+
+private:
+    FractionalLayoutUnit m_width, m_height;
+};
+
+inline FractionalLayoutSize& operator+=(FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    a.setWidth(a.width() + b.width());
+    a.setHeight(a.height() + b.height());
+    return a;
+}
+
+inline FractionalLayoutSize& operator-=(FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    a.setWidth(a.width() - b.width());
+    a.setHeight(a.height() - b.height());
+    return a;
+}
+
+inline FractionalLayoutSize operator+(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutSize(a.width() + b.width(), a.height() + b.height());
+}
+
+inline FractionalLayoutSize operator-(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutSize(a.width() - b.width(), a.height() - b.height());
+}
+
+inline FractionalLayoutSize operator-(const FractionalLayoutSize& size)
+{
+    return FractionalLayoutSize(-size.width(), -size.height());
+}
+
+inline bool operator==(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return a.width() == b.width() && a.height() == b.height();
+}
+
+inline bool operator!=(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return a.width() != b.width() || a.height() != b.height();
+}
+
+inline IntSize flooredIntSize(const FractionalLayoutSize& s)
+{
+    return IntSize(s.width().toInt(), s.height().toInt());
+}
+
+inline IntSize roundedIntSize(const FractionalLayoutSize& s)
+{
+    return IntSize(s.width().round(), s.height().round());
+}
+
+IntSize pixelSnappedIntSize(const FractionalLayoutSize&, const FractionalLayoutPoint&);
+
+} // namespace WebCore
+
+#endif // FractionalLayoutSize_h
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 96e66ca33..17ae9845f 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -55,6 +55,10 @@ OBJC_CLASS WebGLLayer;
 QT_BEGIN_NAMESPACE
 class QPainter;
 class QRect;
+class QGLWidget;
+class QGLContext;
+class QOpenGLContext;
+class QSurface;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK) || PLATFORM(EFL)
 typedef unsigned int GLuint;
@@ -62,6 +66,14 @@ typedef unsigned int GLuint;
 
 #if PLATFORM(MAC)
 typedef CGLContextObj PlatformGraphicsContext3D;
+#elif PLATFORM(QT)
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+typedef QOpenGLContext* PlatformGraphicsContext3D;
+typedef QSurface* PlatformGraphicsSurface3D;
+#else
+typedef QGLContext* PlatformGraphicsContext3D;
+typedef QGLWidget* PlatformGraphicsSurface3D;
+#endif
 #else
 typedef void* PlatformGraphicsContext3D;
 #endif
@@ -789,6 +801,9 @@ public:
 #elif PLATFORM(GTK) || PLATFORM(EFL)
     void paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
                        int canvasWidth, int canvasHeight, PlatformContextCairo* context);
+#elif PLATFORM(QT)
+    void paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
+                       int canvasWidth, int canvasHeight, QPainter* context);
 #endif
 
     void markContextChanged();
@@ -799,18 +814,6 @@ public:
     PassRefPtr<ImageData> paintRenderingResultsToImageData(DrawingBuffer*);
     bool paintCompositedResultsToCanvas(CanvasRenderingContext*);
 
-#if PLATFORM(QT)
-    bool paintsIntoCanvasBuffer() const { return true; }
-#elif PLATFORM(CHROMIUM)
-    bool paintsIntoCanvasBuffer() const;
-#elif PLATFORM(GTK)
-    bool paintsIntoCanvasBuffer() const { return true; }
-#elif PLATFORM(EFL)
-    bool paintsIntoCanvasBuffer() const { return true; }
-#else
-    bool paintsIntoCanvasBuffer() const { return false; }
-#endif
-
     // Support for buffer creation and deletion
     Platform3DObject createBuffer();
     Platform3DObject createFramebuffer();
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.cpp b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
index c7a22755b..30eb41da1 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -298,7 +298,7 @@ void GraphicsLayer::paintGraphicsLayerContents(GraphicsContext& context, const I
         LayoutRect clipRect(clip);
         clipRect.move(offset);
 
-        m_client->paintContents(this, context, m_paintingPhase, clipRect);
+        m_client->paintContents(this, context, m_paintingPhase, pixelSnappedIntRect(clipRect));
     }
 #ifndef NDEBUG
     s_inPaintContents = false;
@@ -380,6 +380,46 @@ void GraphicsLayer::setGraphicsLayerFactory(GraphicsLayer::GraphicsLayerFactory
 }
 #endif
 
+#if ENABLE(CSS_FILTERS)
+static inline const FilterOperations* filterOperationsAt(const KeyframeValueList& valueList, size_t index)
+{
+    return static_cast<const FilterAnimationValue*>(valueList.at(index))->value();
+}
+
+int GraphicsLayer::validateFilterOperations(const KeyframeValueList& valueList)
+{
+    ASSERT(valueList.property() == AnimatedPropertyWebkitFilter);
+
+    if (valueList.size() < 2)
+        return -1;
+
+    // Empty filters match anything, so find the first non-empty entry as the reference
+    size_t firstIndex = 0;
+    for ( ; firstIndex < valueList.size(); ++firstIndex) {
+        if (filterOperationsAt(valueList, firstIndex)->operations().size() > 0)
+            break;
+    }
+
+    if (firstIndex >= valueList.size())
+        return -1;
+
+    const FilterOperations* firstVal = filterOperationsAt(valueList, firstIndex);
+    
+    for (size_t i = firstIndex + 1; i < valueList.size(); ++i) {
+        const FilterOperations* val = filterOperationsAt(valueList, i);
+        
+        // An emtpy filter list matches anything.
+        if (val->operations().isEmpty())
+            continue;
+        
+        if (!firstVal->operationsMatch(*val))
+            return -1;
+    }
+    
+    return firstIndex;
+}
+#endif
+
 // An "invalid" list is one whose functions don't match, and therefore has to be animated as a Matrix
 // The hasBigRotation flag will always return false if isValid is false. Otherwise hasBigRotation is 
 // true if the rotation between any two keyframes is >= 180 degrees.
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index 9f75624ff..dabbdaf1e 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -153,6 +153,25 @@ private:
     TransformOperations m_value;
 };
 
+#if ENABLE(CSS_FILTERS)
+// Used to store one filter value in a keyframe list.
+class FilterAnimationValue : public AnimationValue {
+public:
+    FilterAnimationValue(float keyTime, const FilterOperations* value = 0, PassRefPtr<TimingFunction> timingFunction = 0)
+        : AnimationValue(keyTime, timingFunction)
+    {
+        if (value)
+            m_value = *value;
+    }
+    virtual AnimationValue* clone() const { return new FilterAnimationValue(*this); }
+
+    const FilterOperations* value() const { return &m_value; }
+
+private:
+    FilterOperations m_value;
+};
+#endif
+
 // Used to store a series of values in a keyframe list. Values will all be of the same type,
 // which can be inferred from the property.
 class KeyframeValueList {
@@ -424,6 +443,9 @@ protected:
     // when compositing is not done in hardware. It is not virtual, so the caller
     // needs to notifiy the change to the platform layer as needed.
     void clearFilters() { m_filters.clear(); }
+
+    // Given a KeyframeValueList containing filterOperations, return true if the operations are valid.
+    static int validateFilterOperations(const KeyframeValueList&);
 #endif
 
     // Given a list of TransformAnimationValues, see if all the operations for each keyframe match. If so
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerClient.h b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
index 81272ddbe..4058b65f0 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -47,7 +47,8 @@ enum AnimatedPropertyID {
     AnimatedPropertyInvalid,
     AnimatedPropertyWebkitTransform,
     AnimatedPropertyOpacity,
-    AnimatedPropertyBackgroundColor
+    AnimatedPropertyBackgroundColor,
+    AnimatedPropertyWebkitFilter
 };
 
 class GraphicsLayerClient {
diff --git a/Source/WebCore/platform/graphics/Icon.h b/Source/WebCore/platform/graphics/Icon.h
index 781a08cb2..b703c7141 100644
--- a/Source/WebCore/platform/graphics/Icon.h
+++ b/Source/WebCore/platform/graphics/Icon.h
@@ -32,7 +32,7 @@ OBJC_CLASS NSImage;
 #elif PLATFORM(WIN)
 typedef struct HICON__* HICON;
 #elif PLATFORM(QT)
-#include <QIcon>
+#include <QImage>
 #elif PLATFORM(GTK)
 typedef struct _GdkPixbuf GdkPixbuf;
 #elif PLATFORM(EFL)
@@ -70,7 +70,7 @@ private:
     HICON m_hIcon;
 #elif PLATFORM(QT)
     Icon();
-    QIcon m_icon;
+    QImage m_image;
 #elif PLATFORM(GTK)
     Icon();
     GdkPixbuf* m_icon;
diff --git a/Source/WebCore/platform/graphics/IntPoint.h b/Source/WebCore/platform/graphics/IntPoint.h
index 8d7fd7ffe..ddc41b423 100644
--- a/Source/WebCore/platform/graphics/IntPoint.h
+++ b/Source/WebCore/platform/graphics/IntPoint.h
@@ -55,6 +55,12 @@ class QPoint;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkPoint GdkPoint;
+#elif PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class IntPoint;
+}
+}
 #elif PLATFORM(EFL)
 typedef struct _Evas_Point Evas_Point;
 #endif
@@ -136,6 +142,9 @@ public:
 #elif PLATFORM(GTK)
     IntPoint(const GdkPoint&);
     operator GdkPoint() const;
+#elif PLATFORM(BLACKBERRY)
+    IntPoint(const BlackBerry::Platform::IntPoint&);
+    operator BlackBerry::Platform::IntPoint() const;
 #elif PLATFORM(EFL)
     explicit IntPoint(const Evas_Point&);
     operator Evas_Point() const;
diff --git a/Source/WebCore/platform/graphics/IntRect.cpp b/Source/WebCore/platform/graphics/IntRect.cpp
index 9507406d8..03c35e83b 100644
--- a/Source/WebCore/platform/graphics/IntRect.cpp
+++ b/Source/WebCore/platform/graphics/IntRect.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "IntRect.h"
 
+#include "FractionalLayoutRect.h"
 #include "FloatRect.h"
 #include <algorithm>
 
@@ -40,6 +41,12 @@ IntRect::IntRect(const FloatRect& r)
 {
 }
 
+IntRect::IntRect(const FractionalLayoutRect& r)
+    : m_location(flooredIntPoint(r.location()))
+    , m_size(flooredIntSize(r.size()))
+{
+}
+
 bool IntRect::intersects(const IntRect& other) const
 {
     // Checking emptiness handles negative widths as well as zero.
diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h
index 2e2ff0bb9..3ea8229f4 100644
--- a/Source/WebCore/platform/graphics/IntRect.h
+++ b/Source/WebCore/platform/graphics/IntRect.h
@@ -71,6 +71,7 @@ struct SkIRect;
 namespace WebCore {
 
 class FloatRect;
+class FractionalLayoutRect;
 
 class IntRect {
 public:
@@ -80,7 +81,8 @@ public:
     IntRect(int x, int y, int width, int height)
         : m_location(IntPoint(x, y)), m_size(IntSize(width, height)) { }
 
-    explicit IntRect(const FloatRect& rect); // don't do this implicitly since it's lossy
+    explicit IntRect(const FloatRect&); // don't do this implicitly since it's lossy
+    explicit IntRect(const FractionalLayoutRect&); // don't do this implicitly since it's lossy
         
     IntPoint location() const { return m_location; }
     IntSize size() const { return m_size; }
diff --git a/Source/WebCore/platform/graphics/IntSize.h b/Source/WebCore/platform/graphics/IntSize.h
index 625db3ce5..163984766 100644
--- a/Source/WebCore/platform/graphics/IntSize.h
+++ b/Source/WebCore/platform/graphics/IntSize.h
@@ -45,6 +45,12 @@ typedef struct tagSIZE SIZE;
 QT_BEGIN_NAMESPACE
 class QSize;
 QT_END_NAMESPACE
+#elif PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class IntSize;
+}
+}
 #endif
 
 #if PLATFORM(WX)
@@ -128,6 +134,11 @@ public:
     operator wxSize() const;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+    IntSize(const BlackBerry::Platform::IntSize&);
+    operator BlackBerry::Platform::IntSize() const;
+#endif
+
 private:
     int m_width, m_height;
 };
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 54d7d7527..9813eeee1 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -46,6 +46,7 @@
 
 #if USE(GSTREAMER)
 #include "MediaPlayerPrivateGStreamer.h"
+#define PlatformMediaEngineClassName MediaPlayerPrivateGStreamer
 #endif
 
 #if PLATFORM(MAC) || (PLATFORM(QT) && USE(QTKIT))
@@ -193,10 +194,6 @@ static Vector<MediaPlayerFactory*>& installedMediaEngines()
     if (!enginesQueried) {
         enginesQueried = true;
 
-#if USE(GSTREAMER)
-        MediaPlayerPrivateGStreamer::registerMediaEngine(addMediaEngine);
-#endif
-
 #if USE(AVFOUNDATION)
         if (Settings::isAVFoundationEnabled()) {
 #if PLATFORM(MAC)
@@ -207,7 +204,7 @@ static Vector<MediaPlayerFactory*>& installedMediaEngines()
         }
 #endif
 
-#if !PLATFORM(GTK) && !PLATFORM(EFL) && !(PLATFORM(QT) && USE(GSTREAMER))
+#if defined(PlatformMediaEngineClassName)
         PlatformMediaEngineClassName::registerMediaEngine(addMediaEngine);
 #endif
     }
@@ -931,6 +928,14 @@ AudioSourceProvider* MediaPlayer::audioSourceProvider()
     return m_private->audioSourceProvider();
 }
 #endif // WEB_AUDIO
+    
+String MediaPlayer::referrer() const
+{
+    if (!m_mediaPlayerClient)
+        return String();
+
+    return m_mediaPlayerClient->mediaPlayerReferrer();
+}
 
 }
 
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index 26ca3aada..2ccfb72ac 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -167,6 +167,8 @@ public:
     virtual void mediaPlayerSourceOpened() { }
     virtual String mediaPlayerSourceURL() const { return "x-media-source-unsupported:"; }
 #endif
+
+    virtual String mediaPlayerReferrer() const { return String(); }
 };
 
 class MediaPlayer {
@@ -286,7 +288,6 @@ public:
     void firstVideoFrameAvailable();
     void characteristicChanged();
 
-
     void repaint();
 
     MediaPlayerClient* mediaPlayerClient() const { return m_mediaPlayerClient; }
@@ -334,6 +335,8 @@ public:
     String sourceURL() const;
 #endif
 
+    String referrer() const;
+
 private:
     MediaPlayer(MediaPlayerClient*);
     void loadWithNextMediaEngine(MediaPlayerFactory*);
diff --git a/Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp b/Source/WebCore/platform/graphics/OpenGLShims.cpp
index 2994cd2c9..f59f26c60 100644
--- a/Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp
+++ b/Source/WebCore/platform/graphics/OpenGLShims.cpp
@@ -42,7 +42,11 @@ OpenGLFunctionTable* openGLFunctionTable()
 #if PLATFORM(QT)
 static void* getProcAddress(const char* procName)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    return reinterpret_cast<void*>(QOpenGLContext::currentContext()->getProcAddress(procName));
+#else
     return reinterpret_cast<void*>(QGLContext::currentContext()->getProcAddress(QString::fromLatin1(procName)));
+#endif
 }
 #else
 typedef void* (*glGetProcAddressType) (const char* procName);
diff --git a/Source/WebCore/platform/graphics/cairo/OpenGLShims.h b/Source/WebCore/platform/graphics/OpenGLShims.h
index a5c3c7779..1d5f37d9e 100644
--- a/Source/WebCore/platform/graphics/cairo/OpenGLShims.h
+++ b/Source/WebCore/platform/graphics/OpenGLShims.h
@@ -17,8 +17,18 @@
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#ifndef OpenGLShims_h
+#define OpenGLShims_h
+
 #if PLATFORM(QT)
+#include <qglobal.h>
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+#include <qopenglfunctions.h>
+#include <QOpenGLContext>
+#include <QSurface>
+#else
 #include <QGLContext>
+#endif
 #else
 #include <GL/gl.h>
 #endif
@@ -339,3 +349,5 @@ typedef struct _OpenGLFunctionTable {
 #define glVertexAttrib4fv                      LOOKUP_GL_FUNCTION(glVertexAttrib4fv)
 #define glVertexAttribPointer                  LOOKUP_GL_FUNCTION(glVertexAttribPointer)
 #endif
+
+#endif
diff --git a/Source/WebCore/platform/graphics/Region.cpp b/Source/WebCore/platform/graphics/Region.cpp
index 584a3a5fd..789556496 100644
--- a/Source/WebCore/platform/graphics/Region.cpp
+++ b/Source/WebCore/platform/graphics/Region.cpp
@@ -443,6 +443,9 @@ void Region::intersect(const Region& region)
 
 void Region::unite(const Region& region)
 {
+    if (region.isEmpty())
+        return;
+
     Shape unitedShape = Shape::unionShapes(m_shape, region.m_shape);
 
     m_shape.swap(unitedShape);
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.cpp b/Source/WebCore/platform/graphics/ShadowBlur.cpp
index b00231215..0f207f83d 100644
--- a/Source/WebCore/platform/graphics/ShadowBlur.cpp
+++ b/Source/WebCore/platform/graphics/ShadowBlur.cpp
@@ -79,22 +79,32 @@ public:
         // Round to the nearest 32 pixels so we do not grow the buffer for similar sized requests.
         IntSize roundedSize(roundUpToMultipleOf32(size.width()), roundUpToMultipleOf32(size.height()));
 
+        clearScratchBuffer();
         m_imageBuffer = ImageBuffer::create(roundedSize);
         return m_imageBuffer.get();
     }
 
-    void setLastShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedRect::Radii& radii)
+    bool setCachedShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedRect::Radii& radii, const FloatSize& layerSize)
     {
+        if (!m_lastWasInset && m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && m_lastShadowRect == shadowRect &&  m_lastRadii == radii && m_lastLayerSize == layerSize)
+            return false;
+
         m_lastWasInset = false;
         m_lastRadius = radius;
         m_lastColor = color;
         m_lastColorSpace = colorSpace;
         m_lastShadowRect = shadowRect;
         m_lastRadii = radii;
+        m_lastLayerSize = layerSize;
+
+        return true;
     }
 
-    void setLastInsetShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedRect::Radii& radii)
+    bool setCachedInsetShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedRect::Radii& radii)
     {
+        if (m_lastWasInset && m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && m_lastInsetBounds == bounds && shadowRect == m_lastShadowRect && radii == m_lastRadii)
+            return false;
+
         m_lastWasInset = true;
         m_lastInsetBounds = bounds;
         m_lastRadius = radius;
@@ -102,20 +112,8 @@ public:
         m_lastColorSpace = colorSpace;
         m_lastShadowRect = shadowRect;
         m_lastRadii = radii;
-    }
-    
-    bool matchesLastShadow(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedRect::Radii& radii) const
-    {
-        if (m_lastWasInset)
-            return false;
-        return m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && shadowRect == m_lastShadowRect && radii == m_lastRadii;
-    }
 
-    bool matchesLastInsetShadow(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedRect::Radii& radii) const
-    {
-        if (!m_lastWasInset)
-            return false;
-        return m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && m_lastInsetBounds == bounds && shadowRect == m_lastShadowRect && radii == m_lastRadii;
+        return true;
     }
 
     void scheduleScratchBufferPurge()
@@ -154,6 +152,7 @@ private:
     ColorSpace m_lastColorSpace;
     FloatSize m_lastRadius;
     bool m_lastWasInset;
+    FloatSize m_lastLayerSize;
     
 #if !ASSERT_DISABLED
     bool m_bufferInUse;
@@ -543,7 +542,10 @@ void ShadowBlur::drawRectShadowWithoutTiling(GraphicsContext* graphicsContext, c
 
     FloatRect bufferRelativeShadowedRect = shadowedRect;
     bufferRelativeShadowedRect.move(m_layerContextTranslation);
-    if (!ScratchBuffer::shared().matchesLastShadow(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii)) {
+
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii, m_layerSize);
+    if (redrawNeeded) {
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver stateSaver(*shadowContext);
 
@@ -560,8 +562,6 @@ void ShadowBlur::drawRectShadowWithoutTiling(GraphicsContext* graphicsContext, c
         }
 
         blurShadowBuffer(expandedIntSize(m_layerSize));
-        
-        ScratchBuffer::shared().setLastShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii);
     }
     
     drawShadowBuffer(graphicsContext);
@@ -581,7 +581,9 @@ void ShadowBlur::drawInsetShadowWithoutTiling(GraphicsContext* graphicsContext,
     FloatRect bufferRelativeHoleRect = holeRect;
     bufferRelativeHoleRect.move(m_layerContextTranslation);
 
-    if (!ScratchBuffer::shared().matchesLastInsetShadow(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii)) {
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedInsetShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii);
+    if (redrawNeeded) {
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver stateSaver(*shadowContext);
 
@@ -601,8 +603,6 @@ void ShadowBlur::drawInsetShadowWithoutTiling(GraphicsContext* graphicsContext,
         shadowContext->fillPath(path);
 
         blurShadowBuffer(expandedIntSize(m_layerSize));
-
-        ScratchBuffer::shared().setLastInsetShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii);
     }
     
     drawShadowBuffer(graphicsContext);
@@ -652,7 +652,9 @@ void ShadowBlur::drawInsetShadowWithTiling(GraphicsContext* graphicsContext, con
     FloatRect templateBounds(0, 0, templateSize.width(), templateSize.height());
     FloatRect templateHole = FloatRect(edgeSize.width(), edgeSize.height(), templateSize.width() - 2 * edgeSize.width(), templateSize.height() - 2 * edgeSize.height());
 
-    if (!ScratchBuffer::shared().matchesLastInsetShadow(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii)) {
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedInsetShadowValues(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii);
+    if (redrawNeeded) {
         // Draw shadow into a new ImageBuffer.
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver shadowStateSaver(*shadowContext);
@@ -670,8 +672,6 @@ void ShadowBlur::drawInsetShadowWithTiling(GraphicsContext* graphicsContext, con
         shadowContext->fillPath(path);
 
         blurAndColorShadowBuffer(templateSize);
-    
-        ScratchBuffer::shared().setLastInsetShadowValues(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii);
     }
 
     FloatRect boundingRect = rect;
@@ -710,7 +710,9 @@ void ShadowBlur::drawRectShadowWithTiling(GraphicsContext* graphicsContext, cons
 
     FloatRect templateShadow = FloatRect(edgeSize.width(), edgeSize.height(), templateSize.width() - 2 * edgeSize.width(), templateSize.height() - 2 * edgeSize.height());
 
-    if (!ScratchBuffer::shared().matchesLastShadow(m_blurRadius, m_color, m_colorSpace, templateShadow, radii)) {
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedShadowValues(m_blurRadius, m_color, m_colorSpace, templateShadow, radii, m_layerSize);
+    if (redrawNeeded) {
         // Draw shadow into the ImageBuffer.
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver shadowStateSaver(*shadowContext);
@@ -727,8 +729,6 @@ void ShadowBlur::drawRectShadowWithTiling(GraphicsContext* graphicsContext, cons
         }
 
         blurAndColorShadowBuffer(templateSize);
-
-        ScratchBuffer::shared().setLastShadowValues(m_blurRadius, m_color, m_colorSpace, templateShadow, radii);
     }
 
     FloatRect shadowBounds = shadowedRect;
@@ -854,7 +854,7 @@ GraphicsContext* ShadowBlur::beginShadowLayer(GraphicsContext *context, const Fl
 
     // We reset the scratch buffer values here, because the buffer will no longer contain
     // data from any previous rectangle or inset shadows drawn via the tiling path.
-    ScratchBuffer::shared().setLastShadowValues(FloatSize(), Color::black, ColorSpaceDeviceRGB, IntRect(), RoundedRect::Radii());
+    ScratchBuffer::shared().setCachedShadowValues(FloatSize(), Color::black, ColorSpaceDeviceRGB, IntRect(), RoundedRect::Radii(), m_layerSize);
     m_layerImage = ScratchBuffer::shared().getScratchBuffer(layerRect.size());
 
     GraphicsContext* shadowContext = m_layerImage->context();
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index ceb489e60..acf4c8957 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -27,8 +27,7 @@
 
 namespace WebCore {
     
-static const int defaultTileWidth = 512;
-static const int defaultTileHeight = 512;
+static const int defaultTileDimension = 512;
 
 static IntPoint innerBottomRight(const IntRect& rect)
 {
@@ -41,15 +40,14 @@ TiledBackingStore::TiledBackingStore(TiledBackingStoreClient* client, PassOwnPtr
     , m_backend(backend)
     , m_tileBufferUpdateTimer(new TileTimer(this, &TiledBackingStore::tileBufferUpdateTimerFired))
     , m_tileCreationTimer(new TileTimer(this, &TiledBackingStore::tileCreationTimerFired))
-    , m_tileSize(defaultTileWidth, defaultTileHeight)
+    , m_tileSize(defaultTileDimension, defaultTileDimension)
     , m_tileCreationDelay(0.01)
-    , m_keepAreaMultiplier(3.5f)
-    , m_coverAreaMultiplier(2.5f)
+    , m_coverAreaMultiplier(2.0f)
     , m_contentsScale(1.f)
     , m_pendingScale(0)
     , m_contentsFrozen(false)
+    , m_supportsAlpha(false)
 {
-    ASSERT(m_coverAreaMultiplier <= m_keepAreaMultiplier);
 }
 
 TiledBackingStore::~TiledBackingStore()
@@ -57,7 +55,7 @@ TiledBackingStore::~TiledBackingStore()
     delete m_tileBufferUpdateTimer;
     delete m_tileCreationTimer;
 }
-    
+
 void TiledBackingStore::setTileSize(const IntSize& size)
 {
     m_tileSize = size;
@@ -70,20 +68,15 @@ void TiledBackingStore::setTileCreationDelay(double delay)
     m_tileCreationDelay = delay;
 }
 
-void TiledBackingStore::setKeepAndCoverAreaMultipliers(float keepMultiplier, float coverMultiplier)
-{
-    ASSERT(coverMultiplier <= keepMultiplier);
-    m_keepAreaMultiplier = keepMultiplier;
-    m_coverAreaMultiplier = coverMultiplier;
-    startTileCreationTimer();
-}
-
-void TiledBackingStore::setVisibleRectTrajectoryVector(const FloatPoint& vector)
+void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& panningTrajectoryVector)
 {
-    if (m_visibleRectTrajectoryVector == vector)
+    IntRect visibleRect = visibleContentsRect();
+    if (m_visibleRectTrajectoryVector == panningTrajectoryVector && m_previousVisibleRect == visibleRect)
         return;
 
-    m_visibleRectTrajectoryVector = vector;
+    m_visibleRectTrajectoryVector = panningTrajectoryVector;
+    m_previousVisibleRect = visibleRect;
+
     startTileCreationTimer();
 }
 
@@ -171,17 +164,7 @@ void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
     context->restore();
 }
 
-void TiledBackingStore::adjustVisibleRect()
-{
-    IntRect visibleRect = visibleContentsRect();
-    if (m_previousVisibleRect == visibleRect)
-        return;
-    m_previousVisibleRect = visibleRect;
-
-    startTileCreationTimer();
-}
-
-IntRect TiledBackingStore::visibleContentsRect()
+IntRect TiledBackingStore::visibleContentsRect() const
 {
     return mapFromContents(intersection(m_client->tiledBackingStoreVisibleRect(), m_client->tiledBackingStoreContentsRect()));
 }
@@ -220,7 +203,7 @@ double TiledBackingStore::tileDistance(const IntRect& viewport, const Tile::Coor
 }
 
 // Returns a ratio between 0.0f and 1.0f of the surface of contentsRect covered by rendered tiles.
-float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect)
+float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect) const
 {
     IntRect dirtyRect = mapFromContents(contentsRect);
     float rectArea = dirtyRect.width() * dirtyRect.height();
@@ -242,6 +225,11 @@ float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect)
     return coverArea / rectArea;
 }
 
+bool TiledBackingStore::visibleAreaIsCovered() const
+{
+    return coverageRatio(visibleContentsRect()) == 1.0f;
+}
+
 void TiledBackingStore::createTiles()
 {
     if (m_contentsFrozen)
@@ -256,18 +244,18 @@ void TiledBackingStore::createTiles()
     // Resize tiles on edges in case the contents size has changed.
     bool didResizeTiles = resizeEdgeTiles();
 
-    IntRect keepRect = computeKeepRect(visibleRect);
-    
+    IntRect keepRect;
+    IntRect coverRect;
+    computeCoverAndKeepRect(visibleRect, coverRect, keepRect);
+
     dropTilesOutsideRect(keepRect);
     
-    IntRect coverRect = computeCoverRect(visibleRect);
-    ASSERT(keepRect.contains(coverRect));
-    
     // Search for the tile position closest to the viewport center that does not yet contain a tile. 
     // Which position is considered the closest depends on the tileDistance function.
     double shortestDistance = std::numeric_limits<double>::infinity();
     Vector<Tile::Coordinate> tilesToCreate;
     unsigned requiredTileCount = 0;
+
     Tile::Coordinate topLeft = tileCoordinateForPoint(coverRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(coverRect));
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
@@ -276,7 +264,7 @@ void TiledBackingStore::createTiles()
             if (tileAt(currentCoordinate))
                 continue;
             ++requiredTileCount;
-            // Distance is 0 for all currently visible tiles.
+            // Distance is 0 for all tiles inside the visibleRect.
             double distance = tileDistance(visibleRect, currentCoordinate);
             if (distance > shortestDistance)
                 continue;
@@ -287,60 +275,96 @@ void TiledBackingStore::createTiles()
             tilesToCreate.append(currentCoordinate);
         }
     }
-    
-    // Now construct the tile(s)
+
+    // Now construct the tile(s) within the shortest distance.
     unsigned tilesToCreateCount = tilesToCreate.size();
     for (unsigned n = 0; n < tilesToCreateCount; ++n) {
         Tile::Coordinate coordinate = tilesToCreate[n];
         setTile(coordinate, m_backend->createTile(this, coordinate));
     }
     requiredTileCount -= tilesToCreateCount;
-    
-    // Paint the content of the newly created tiles
+
+    // Paint the content of the newly created tiles.
     if (tilesToCreateCount || didResizeTiles)
         updateTileBuffers();
 
-    // Keep creating tiles until the whole coverRect is covered.
+    // Re-call createTiles on a timer to cover the visible area with the newest shortest distance.
     if (requiredTileCount)
         m_tileCreationTimer->startOneShot(m_tileCreationDelay);
 }
 
-IntRect TiledBackingStore::computeKeepRect(const IntRect& visibleRect) const
-{
-    IntRect result = visibleRect;
-    // Inflates to both sides, so divide the inflate delta by 2.
-    result.inflateX(visibleRect.width() * (m_keepAreaMultiplier - 1) / 2);
-    result.inflateY(visibleRect.height() * (m_keepAreaMultiplier - 1) / 2);
-    result.intersect(contentsRect());
-
-    return result;
-}
-
-// A null trajectory vector means that tiles intersecting all the coverArea (i.e. visibleRect * coverMultiplier) will be created.
-// A non-null trajectory vector will shrink the intersection rect to visibleRect plus its expansion from its
-// center toward the cover area edges in the direction of the given vector.
-// E.g. if visibleRect == (10,10)5x5 and coverMultiplier == 3.0:
-// a (0,0) trajectory vector will create tiles intersecting (5,5)15x15,
-// a (1,0) trajectory vector will create tiles intersecting (10,10)10x5,
-// and a (1,1) trajectory vector will create tiles intersecting (10,10)10x10.
-IntRect TiledBackingStore::computeCoverRect(const IntRect& visibleRect) const
-{
-    IntRect result = visibleRect;
-    float trajectoryVectorNorm = sqrt(pow(m_visibleRectTrajectoryVector.x(), 2) + pow(m_visibleRectTrajectoryVector.y(), 2));
-    if (trajectoryVectorNorm > 0) {
-        // Multiply the vector by the distance to the edge of the cover area.
-        float trajectoryVectorMultiplier = (m_coverAreaMultiplier - 1) / 2;
-        // Unite the visible rect with a "ghost" of the visible rect moved in the direction of the trajectory vector.
-        result.move(result.width() * m_visibleRectTrajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
-                    result.height() * m_visibleRectTrajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
-        result.unite(visibleRect);
-    } else {
-        result.inflateX(visibleRect.width() * (m_coverAreaMultiplier - 1) / 2);
-        result.inflateY(visibleRect.height() * (m_coverAreaMultiplier - 1) / 2);
+void TiledBackingStore::adjustForContentsRect(IntRect& rect) const
+{
+    IntRect bounds = contentsRect();
+    IntSize candidateSize = rect.size();
+
+    // We will try to keep the cover and keep rect the same size at all time, which
+    // might not be the case when at the content edges.
+
+    // We start by moving when at the edges.
+    rect.move(std::max(0, bounds.x() - rect.x()), std::max(0, bounds.y() - rect.y()));
+    rect.move(std::min(0, bounds.maxX() - rect.maxX()), std::min(0, bounds.maxY() - rect.maxY()));
+
+    rect.intersect(bounds);
+
+    if (rect.size() == candidateSize)
+        return;
+
+    // Even now we might cover more than the content area so let's inflate in the
+    // opposite directions.
+    int pixelsCovered = candidateSize.width() * candidateSize.height();
+
+    if (rect.width() != candidateSize.width())
+        rect.inflateY(((pixelsCovered / rect.width()) - rect.height()) / 2);
+    if (rect.height() != candidateSize.height())
+        rect.inflateX(((pixelsCovered / rect.height()) - rect.width()) / 2);
+
+    rect.intersect(bounds);
+}
+
+void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntRect& coverRect, IntRect& keepRect) const
+{
+    coverRect = visibleRect;
+    keepRect = visibleRect;
+
+    // If we cover more that the actual viewport we can be smart about which tiles we choose to render.
+    if (m_coverAreaMultiplier > 1) {
+        // The initial cover area covers equally in each direction, according to the coverAreaMultiplier.
+        coverRect.inflateX(visibleRect.width() * (m_coverAreaMultiplier - 1) / 2);
+        coverRect.inflateY(visibleRect.height() * (m_coverAreaMultiplier - 1) / 2);
+        keepRect = coverRect;
+
+        float trajectoryVectorNorm = sqrt(pow(m_visibleRectTrajectoryVector.x(), 2) + pow(m_visibleRectTrajectoryVector.y(), 2));
+        if (trajectoryVectorNorm) {
+            // A null trajectory vector (no motion) means that tiles for the coverArea will be created.
+            // A non-null trajectory vector will shrink the covered rect to visibleRect plus its expansion from its
+            // center toward the cover area edges in the direction of the given vector.
+
+            // E.g. if visibleRect == (10,10)5x5 and coverAreaMultiplier == 3.0:
+            // a (0,0) trajectory vector will create tiles intersecting (5,5)15x15,
+            // a (1,0) trajectory vector will create tiles intersecting (10,10)10x5,
+            // and a (1,1) trajectory vector will create tiles intersecting (10,10)10x10.
+
+            // Multiply the vector by the distance to the edge of the cover area.
+            float trajectoryVectorMultiplier = (m_coverAreaMultiplier - 1) / 2;
+
+            // Unite the visible rect with a "ghost" of the visible rect moved in the direction of the trajectory vector.
+            coverRect = visibleRect;
+            coverRect.move(coverRect.width() * m_visibleRectTrajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
+                           coverRect.height() * m_visibleRectTrajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
+
+            coverRect.unite(visibleRect);
+        }
     }
-    result.intersect(contentsRect());
 
-    return result;
+    ASSERT(keepRect.contains(coverRect));
+
+    // The keep rect is an inflated version of the cover rect, inflated in tile dimensions.
+    keepRect.inflateX(m_tileSize.width() / 2);
+    keepRect.inflateY(m_tileSize.height() / 2);
+
+    adjustForContentsRect(coverRect);
+    adjustForContentsRect(keepRect);
 }
 
 bool TiledBackingStore::resizeEdgeTiles()
@@ -383,6 +407,11 @@ void TiledBackingStore::dropTilesOutsideRect(const IntRect& keepRect)
         removeTile(toRemove[n]);
 }
 
+void TiledBackingStore::removeAllNonVisibleTiles()
+{
+    dropTilesOutsideRect(visibleContentsRect());
+}
+
 PassRefPtr<Tile> TiledBackingStore::tileAt(const Tile::Coordinate& coordinate) const
 {
     return m_tiles.get(coordinate);
@@ -422,9 +451,9 @@ IntRect TiledBackingStore::contentsRect() const
 IntRect TiledBackingStore::tileRectForCoordinate(const Tile::Coordinate& coordinate) const
 {
     IntRect rect(coordinate.x() * m_tileSize.width(),
-        coordinate.y() * m_tileSize.height(),
-        m_tileSize.width(),
-        m_tileSize.height());
+                 coordinate.y() * m_tileSize.height(),
+                 m_tileSize.width(),
+                 m_tileSize.height());
 
     rect.intersect(contentsRect());
     return rect;
@@ -482,6 +511,14 @@ void TiledBackingStore::setContentsFrozen(bool freeze)
     }
 }
 
+void TiledBackingStore::setSupportsAlpha(bool a)
+{
+    if (a == supportsAlpha())
+        return;
+    m_supportsAlpha = a;
+    invalidate(contentsRect());
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.h b/Source/WebCore/platform/graphics/TiledBackingStore.h
index 0a02ac562..ea5607b16 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.h
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.h
@@ -44,33 +44,26 @@ public:
     TiledBackingStore(TiledBackingStoreClient*, PassOwnPtr<TiledBackingStoreBackend> = TiledBackingStoreBackend::create());
     ~TiledBackingStore();
 
-    void adjustVisibleRect();
-    
     TiledBackingStoreClient* client() { return m_client; }
+
+    void coverWithTilesIfNeeded(const FloatPoint& panningTrajectoryVector = FloatPoint());
+
     float contentsScale() { return m_contentsScale; }
     void setContentsScale(float);
-    
+
     bool contentsFrozen() const { return m_contentsFrozen; }
     void setContentsFrozen(bool);
+
     void updateTileBuffers();
 
     void invalidate(const IntRect& dirtyRect);
     void paint(GraphicsContext*, const IntRect&);
-    
+
     IntSize tileSize() { return m_tileSize; }
     void setTileSize(const IntSize&);
-    
+
     double tileCreationDelay() const { return m_tileCreationDelay; }
     void setTileCreationDelay(double delay);
-    
-    // Tiled are dropped outside the keep area, and created for cover area. The values a relative to the viewport size.
-    void getKeepAndCoverAreaMultipliers(float& keepMultiplier, float& coverMultiplier)
-    {
-        keepMultiplier = m_keepAreaMultiplier;
-        coverMultiplier = m_coverAreaMultiplier;
-    }
-    void setKeepAndCoverAreaMultipliers(float keepMultiplier, float coverMultiplier);
-    void setVisibleRectTrajectoryVector(const FloatPoint&);
 
     IntRect mapToContents(const IntRect&) const;
     IntRect mapFromContents(const IntRect&) const;
@@ -78,34 +71,41 @@ public:
     IntRect tileRectForCoordinate(const Tile::Coordinate&) const;
     Tile::Coordinate tileCoordinateForPoint(const IntPoint&) const;
     double tileDistance(const IntRect& viewport, const Tile::Coordinate&) const;
-    float coverageRatio(const WebCore::IntRect& contentsRect);
+
+    bool visibleAreaIsCovered() const;
+    void removeAllNonVisibleTiles();
+
+    void setSupportsAlpha(bool);
+    bool supportsAlpha() const { return m_supportsAlpha; }
 
 private:
     void startTileBufferUpdateTimer();
     void startTileCreationTimer();
-    
+
     typedef Timer<TiledBackingStore> TileTimer;
 
     void tileBufferUpdateTimerFired(TileTimer*);
     void tileCreationTimerFired(TileTimer*);
-    
+
     void createTiles();
-    IntRect computeKeepRect(const IntRect& visibleRect) const;
-    IntRect computeCoverRect(const IntRect& visibleRect) const;
-    
+    void computeCoverAndKeepRect(const IntRect& visibleRect, IntRect& coverRect, IntRect& keepRect) const;
+
     void commitScaleChange();
 
     bool resizeEdgeTiles();
     void dropTilesOutsideRect(const IntRect&);
-    
+
     PassRefPtr<Tile> tileAt(const Tile::Coordinate&) const;
     void setTile(const Tile::Coordinate& coordinate, PassRefPtr<Tile> tile);
     void removeTile(const Tile::Coordinate& coordinate);
 
     IntRect contentsRect() const;
-    
+    IntRect visibleContentsRect() const;
+
+    float coverageRatio(const IntRect&) const;
+    void adjustForContentsRect(IntRect&) const;
+
     void paintCheckerPattern(GraphicsContext*, const IntRect&, const Tile::Coordinate&);
-    IntRect visibleContentsRect();
 
 private:
     TiledBackingStoreClient* m_client;
@@ -119,7 +119,6 @@ private:
 
     IntSize m_tileSize;
     double m_tileCreationDelay;
-    float m_keepAreaMultiplier;
     float m_coverAreaMultiplier;
     FloatPoint m_visibleRectTrajectoryVector;
     
@@ -128,6 +127,7 @@ private:
     float m_pendingScale;
 
     bool m_contentsFrozen;
+    bool m_supportsAlpha;
 
     friend class Tile;
 };
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
index b49791e24..72302346f 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
@@ -242,6 +242,8 @@ protected:
 
     const String& assetURL() const { return m_assetURL; }
 
+    MediaPlayer* player() { return m_player; }
+
 private:
     MediaPlayer* m_player;
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index bd28dd33b..0b30b2ec9 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -256,11 +256,21 @@ void MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL(const String& url)
 
     setDelayCallbacks(true);
 
-    NSDictionary *options = [NSDictionary dictionaryWithObjectsAndKeys:
-                        [NSNumber numberWithInt:AVAssetReferenceRestrictionForbidRemoteReferenceToLocal | AVAssetReferenceRestrictionForbidLocalReferenceToRemote], AVURLAssetReferenceRestrictionsKey, 
-                        nil];
+    RetainPtr<NSMutableDictionary> options(AdoptNS, [[NSMutableDictionary alloc] init]);    
+
+    [options.get() setObject:[NSNumber numberWithInt:AVAssetReferenceRestrictionForbidRemoteReferenceToLocal | AVAssetReferenceRestrictionForbidLocalReferenceToRemote] forKey:AVURLAssetReferenceRestrictionsKey];
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    String referrer = player()->referrer();
+    if (!referrer.isEmpty()) {
+        RetainPtr<NSMutableDictionary> headerFields(AdoptNS, [[NSMutableDictionary alloc] init]);
+        [headerFields.get() setObject:referrer forKey:@"Referer"];
+        [options.get() setObject:headerFields.get() forKey:@"AVURLAssetHTTPHeaderFieldsKey"];
+    }
+#endif
+
     NSURL *cocoaURL = KURL(ParsedURLString, url);
-    m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:cocoaURL options:options]);
+    m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:cocoaURL options:options.get()]);
 
     m_haveCheckedPlayability = false;
 
diff --git a/Source/WebCore/platform/graphics/blackberry/FloatPointBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/FloatPointBlackBerry.cpp
new file mode 100644
index 000000000..3dca04325
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/FloatPointBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FloatPoint.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+FloatPoint::FloatPoint(const BlackBerry::Platform::FloatPoint& p)
+    : m_x(p.x())
+    , m_y(p.y())
+{
+}
+
+FloatPoint::operator BlackBerry::Platform::FloatPoint() const
+{
+    return BlackBerry::Platform::FloatPoint(m_x, m_y);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/FloatRectBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/FloatRectBlackBerry.cpp
new file mode 100644
index 000000000..d41139720
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/FloatRectBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FloatRect.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+FloatRect::FloatRect(const BlackBerry::Platform::FloatRect& rect)
+    : m_location(rect.x(), rect.y())
+    , m_size(rect.width(), rect.height())
+{
+}
+
+FloatRect::operator BlackBerry::Platform::FloatRect() const
+{
+    return BlackBerry::Platform::FloatRect(x(), y(), width(), height());
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/FloatSizeBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/FloatSizeBlackBerry.cpp
new file mode 100644
index 000000000..c2bd9e81c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/FloatSizeBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FloatSize.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+FloatSize::FloatSize(const BlackBerry::Platform::FloatSize& size)
+    : m_width(size.width())
+    , m_height(size.height())
+{
+}
+
+FloatSize::operator BlackBerry::Platform::FloatSize() const
+{
+    return BlackBerry::Platform::FloatSize(m_width, m_height);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IconBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IconBlackBerry.cpp
new file mode 100644
index 000000000..93a4b0faa
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IconBlackBerry.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "Icon.h"
+
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+Icon::~Icon()
+{
+    notImplemented();
+}
+
+void Icon::paint(GraphicsContext*, IntRect const&)
+{
+    notImplemented();
+}
+
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
+{
+    // FIXME: remove 0 template param when this is implemented
+    notImplemented();
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp
new file mode 100644
index 000000000..7a80d98c7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "Image.h"
+
+#include "BitmapImage.h"
+#include "ImageBuffer.h"
+#include "SharedBuffer.h"
+
+namespace WebCore {
+
+PassRefPtr<Image> Image::loadPlatformResource(const char *name)
+{
+    if (!strcmp(name, "searchCancel") || !strcmp(name, "searchCancelPressed")) {
+        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(IntSize(16, 16));
+        if (!imageBuffer)
+            return 0;
+
+        // Draw a more subtle, gray x-shaped icon.
+        GraphicsContext* context = imageBuffer->context();
+        context->save();
+
+        context->fillRect(FloatRect(0, 0, 16, 16), Color::white, ColorSpaceDeviceRGB);
+
+        if (!strcmp(name, "searchCancel"))
+            context->setFillColor(Color(128, 128, 128), ColorSpaceDeviceRGB);
+        else
+            context->setFillColor(Color(64, 64, 64), ColorSpaceDeviceRGB);
+
+        context->translate(8, 8);
+
+        context->rotate(piDouble / 4.0);
+        context->fillRect(FloatRect(-1, -7, 2, 14));
+
+        context->rotate(-piDouble / 2.0);
+        context->fillRect(FloatRect(-1, -7, 2, 14));
+
+        context->restore();
+        return imageBuffer->copyImage();
+    }
+
+    // RESOURCE_PATH is set by CMake in OptionsBlackBerry.cmake
+    String fullPath(RESOURCE_PATH);
+    String extension(".png");
+
+    fullPath += name;
+    fullPath += extension;
+
+    RefPtr<SharedBuffer> buffer = SharedBuffer::createWithContentsOfFile(fullPath);
+    if (!buffer)
+        return BitmapImage::nullImage();
+
+    RefPtr<BitmapImage> img = BitmapImage::create();
+    img->setData(buffer.release(), true /* allDataReceived */);
+    return img.release();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IntPointBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IntPointBlackBerry.cpp
new file mode 100644
index 000000000..4f60a053e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IntPointBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "IntPoint.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+IntPoint::IntPoint(const BlackBerry::Platform::IntPoint& p)
+    : m_x(p.x())
+    , m_y(p.y())
+{
+}
+
+IntPoint::operator BlackBerry::Platform::IntPoint() const
+{
+    return BlackBerry::Platform::IntPoint(m_x, m_y);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IntRectBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IntRectBlackBerry.cpp
new file mode 100644
index 000000000..979ceaf6d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IntRectBlackBerry.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "IntRect.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+IntRect::IntRect(const BlackBerry::Platform::IntRect& rect)
+        : m_location(rect.x(), rect.y()), m_size(rect.width(), rect.height())
+{
+}
+
+IntRect::operator BlackBerry::Platform::IntRect() const
+{
+    return BlackBerry::Platform::IntRect(x(), y(), width(), height());
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IntSizeBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IntSizeBlackBerry.cpp
new file mode 100644
index 000000000..f1b678da1
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IntSizeBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "IntSize.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+IntSize::IntSize(const BlackBerry::Platform::IntSize& size)
+    : m_width(size.width())
+    , m_height(size.height())
+{
+}
+
+IntSize::operator BlackBerry::Platform::IntSize() const
+{
+    return BlackBerry::Platform::IntSize(m_width, m_height);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/skia/ImageBufferData.h b/Source/WebCore/platform/graphics/blackberry/skia/ImageBufferData.h
new file mode 100644
index 000000000..409197ea6
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/skia/ImageBufferData.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * Copyright (c) 2011, Research In Motion. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ImageBufferData_h
+#define ImageBufferData_h
+
+#include "BlackBerryPlatformGraphics.h"
+#include "PlatformContextSkia.h"
+
+#include "skia/ext/platform_canvas.h"
+
+namespace WebCore {
+
+class ImageBufferData {
+public:
+    ImageBufferData(const IntSize&);
+
+    OwnPtr<SkCanvas> m_canvas;
+    PlatformContextSkia m_platformContext;
+    BlackBerry::Platform::Graphics::Buffer* m_buffer;
+};
+
+} // namespace WebCore
+
+#endif // ImageBufferData_h
diff --git a/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.cpp b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.cpp
new file mode 100644
index 000000000..408fe453b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.cpp
@@ -0,0 +1,214 @@
+/*
+ * Copyright (c) 2009-2010, Google Inc. All rights reserved.
+ * Copyright (c) 2011, Research In Motion. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformSupport.h"
+
+#include "FontRenderStyle.h"
+
+#include <fontconfig/fontconfig.h>
+#include <string.h>
+#include <unicode/utf16.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+static void setFontRenderStyleDefaults(FontRenderStyle* style)
+{
+    style->useBitmaps = 2;
+    style->useAutoHint = 2;
+    style->useHinting = 2;
+    style->hintStyle = 0;
+    style->useAntiAlias = 2;
+    style->useSubpixel = 2;
+}
+
+void PlatformSupport::getRenderStyleForStrike(const char* family, int sizeAndStyle, FontRenderStyle* out)
+{
+    bool isBold = sizeAndStyle & 1;
+    bool isItalic = sizeAndStyle & 2;
+    int pixelSize = sizeAndStyle >> 2;
+
+    FcPattern* pattern = FcPatternCreate();
+    FcValue fcvalue;
+
+    fcvalue.type = FcTypeString;
+    fcvalue.u.s = reinterpret_cast<const FcChar8 *>(family);
+    FcPatternAdd(pattern, FC_FAMILY, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeInteger;
+    fcvalue.u.i = isBold ? FC_WEIGHT_BOLD : FC_WEIGHT_NORMAL;
+    FcPatternAdd(pattern, FC_WEIGHT, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeInteger;
+    fcvalue.u.i = isItalic ? FC_SLANT_ITALIC : FC_SLANT_ROMAN;
+    FcPatternAdd(pattern, FC_SLANT, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeBool;
+    fcvalue.u.b = FcTrue;
+    FcPatternAdd(pattern, FC_SCALABLE, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeDouble;
+    fcvalue.u.d = pixelSize;
+    FcPatternAdd(pattern, FC_SIZE, fcvalue, FcFalse);
+
+    FcConfigSubstitute(0, pattern, FcMatchPattern);
+    FcDefaultSubstitute(pattern);
+
+    FcResult result;
+    // Some versions of fontconfig don't actually write a value into result.
+    // However, it's not clear from the documentation if result should be a
+    // non-0 pointer: future versions might expect to be able to write to
+    // it. So we pass in a valid pointer and ignore it.
+    FcPattern* match = FcFontMatch(0, pattern, &result);
+    FcPatternDestroy(pattern);
+
+    setFontRenderStyleDefaults(out);
+
+    if (!match)
+        return;
+
+    FcBool boolValue;
+    int intValue;
+
+    if (FcPatternGetBool(match, FC_ANTIALIAS, 0, &boolValue) == FcResultMatch)
+        out->useAntiAlias = boolValue;
+    if (FcPatternGetBool(match, FC_EMBEDDED_BITMAP, 0, &boolValue) == FcResultMatch)
+        out->useBitmaps = boolValue;
+    if (FcPatternGetBool(match, FC_AUTOHINT, 0, &boolValue) == FcResultMatch)
+        out->useAutoHint = boolValue;
+    if (FcPatternGetBool(match, FC_HINTING, 0, &boolValue) == FcResultMatch)
+        out->useHinting = boolValue;
+
+    if (FcPatternGetInteger(match, FC_RGBA, 0, &intValue) == FcResultMatch) {
+        switch (intValue) {
+        case FC_RGBA_NONE:
+            out->useSubpixel = 0;
+            break;
+        case FC_RGBA_RGB:
+        case FC_RGBA_BGR:
+        case FC_RGBA_VRGB:
+        case FC_RGBA_VBGR:
+            out->useSubpixel = 1;
+            break;
+        default:
+            // This includes FC_RGBA_UNKNOWN.
+            out->useSubpixel = 2;
+            break;
+        }
+    }
+
+    FcPatternDestroy(match);
+}
+
+void PlatformSupport::getFontFamilyForCharacters(const UChar* characters, size_t numCharacters, const char*, FontFamily* family)
+{
+    FcCharSet* cset = FcCharSetCreate();
+    for (size_t i = 0; i < numCharacters; ++i) {
+        if (U16_IS_SURROGATE(characters[i])
+            && U16_IS_SURROGATE_LEAD(characters[i])
+            && i != numCharacters - 1
+            && U16_IS_TRAIL(characters[i + 1])) {
+            FcCharSetAddChar(cset, U16_GET_SUPPLEMENTARY(characters[i], characters[i+1]));
+            i++;
+        } else
+              FcCharSetAddChar(cset, characters[i]);
+    }
+    FcPattern* pattern = FcPatternCreate();
+
+    FcValue fcvalue;
+    fcvalue.type = FcTypeCharSet;
+    fcvalue.u.c = cset;
+    FcPatternAdd(pattern, FC_CHARSET, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeBool;
+    fcvalue.u.b = FcTrue;
+    FcPatternAdd(pattern, FC_SCALABLE, fcvalue, FcFalse);
+
+    FcConfigSubstitute(0, pattern, FcMatchPattern);
+    FcDefaultSubstitute(pattern);
+
+    FcResult result;
+    FcFontSet* fontSet = FcFontSort(0, pattern, 0, 0, &result);
+    FcPatternDestroy(pattern);
+    FcCharSetDestroy(cset);
+
+    if (!fontSet) {
+        family->name = String();
+        family->isBold = false;
+        family->isItalic = false;
+        return;
+    }
+
+    // Older versions of fontconfig have a bug where they cannot select
+    // only scalable fonts so we have to manually filter the results.
+    for (int i = 0; i < fontSet->nfont; ++i) {
+        FcPattern* current = fontSet->fonts[i];
+        FcBool isScalable;
+
+        if (FcPatternGetBool(current, FC_SCALABLE, 0, &isScalable) != FcResultMatch
+            || !isScalable)
+            continue;
+
+        // fontconfig can also return fonts which are unreadable
+        FcChar8* cFilename;
+        if (FcPatternGetString(current, FC_FILE, 0, &cFilename) != FcResultMatch)
+            continue;
+
+        if (access(reinterpret_cast<char*>(cFilename), R_OK))
+            continue;
+
+        FcChar8* familyName;
+        if (FcPatternGetString(current, FC_FAMILY, 0, &familyName) == FcResultMatch) {
+            const char* charFamily = reinterpret_cast<char*>(familyName);
+            family->name = String::fromUTF8(charFamily, strlen(charFamily));
+        }
+
+        int weight;
+        if (FcPatternGetInteger(current, FC_WEIGHT, 0, &weight) == FcResultMatch)
+            family->isBold = weight >= FC_WEIGHT_BOLD;
+        else
+            family->isBold = false;
+
+        int slant;
+        if (FcPatternGetInteger(current, FC_SLANT, 0, &slant) == FcResultMatch)
+            family->isItalic = slant != FC_SLANT_ROMAN;
+        else
+            family->isItalic = false;
+
+        FcFontSetDestroy(fontSet);
+        return;
+    }
+
+    FcFontSetDestroy(fontSet);
+}
+
+}; // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.h b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.h
new file mode 100644
index 000000000..bd22d86d7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ * Copyright (c) 2011, Research In Motion. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformSupport_h
+#define PlatformSupport_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+struct FontRenderStyle;
+
+// This is a minimal version of the Chromium PlatformSupport/WebFontInfo classes used for font support.
+class PlatformSupport {
+public:
+    static void getRenderStyleForStrike(const char* family, int sizeAndStyle, FontRenderStyle* result);
+    struct FontFamily {
+        String name;
+        bool isBold;
+        bool isItalic;
+    };
+    static void getFontFamilyForCharacters(const UChar*, size_t numCharacters, const char* preferredLocale, FontFamily*);
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index ad3ac04a2..f6e714b2a 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -211,6 +211,12 @@ static String propertyIdToString(AnimatedPropertyID property)
         return "opacity";
     case AnimatedPropertyBackgroundColor:
         return "backgroundColor";
+    case AnimatedPropertyWebkitFilter:
+#if ENABLE(CSS_FILTERS)
+        return "filters";
+#else
+        ASSERT_NOT_REACHED();
+#endif
     case AnimatedPropertyInvalid:
         ASSERT_NOT_REACHED();
     }
@@ -444,7 +450,7 @@ void GraphicsLayerCA::moveOrCopyLayerAnimation(MoveOrCopy operation, const Strin
     }
 }
 
-void GraphicsLayerCA::moveOrCopyAnimationsForProperty(MoveOrCopy operation, AnimatedPropertyID property, PlatformCALayer *fromLayer, PlatformCALayer *toLayer)
+void GraphicsLayerCA::moveOrCopyAnimations(MoveOrCopy operation, PlatformCALayer *fromLayer, PlatformCALayer *toLayer)
 {
     // Look for running animations affecting this property.
     AnimationsMap::const_iterator end = m_runningAnimations.end();
@@ -453,7 +459,13 @@ void GraphicsLayerCA::moveOrCopyAnimationsForProperty(MoveOrCopy operation, Anim
         size_t numAnimations = propertyAnimations.size();
         for (size_t i = 0; i < numAnimations; ++i) {
             const LayerPropertyAnimation& currAnimation = propertyAnimations[i];
-            if (currAnimation.m_property == property)
+            
+            if (currAnimation.m_property == AnimatedPropertyWebkitTransform || currAnimation.m_property == AnimatedPropertyOpacity
+                    || currAnimation.m_property == AnimatedPropertyBackgroundColor
+#if ENABLE(CSS_FILTERS)
+                    || currAnimation.m_property == AnimatedPropertyWebkitFilter
+#endif
+                )
                 moveOrCopyLayerAnimation(operation, animationIdentifier(currAnimation.m_name, currAnimation.m_property, currAnimation.m_index), fromLayer, toLayer);
         }
     }
@@ -648,6 +660,10 @@ bool GraphicsLayerCA::addAnimation(const KeyframeValueList& valueList, const Int
     bool createdAnimations = false;
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         createdAnimations = createTransformAnimationsFromKeyframes(valueList, anim, animationName, timeOffset, boxSize);
+#if ENABLE(CSS_FILTERS)
+    else if (valueList.property() == AnimatedPropertyWebkitFilter)
+        createdAnimations = createFilterAnimationsFromKeyframes(valueList, anim, animationName, timeOffset);
+#endif
     else
         createdAnimations = createAnimationFromKeyframes(valueList, anim, animationName, timeOffset);
 
@@ -1299,8 +1315,7 @@ void GraphicsLayerCA::ensureStructuralLayer(StructuralLayerPurpose purpose, floa
             ASSERT(m_structuralLayer->superlayer());
             m_structuralLayer->superlayer()->replaceSublayer(m_structuralLayer.get(), m_layer.get());
 
-            moveOrCopyAnimationsForProperty(Move, AnimatedPropertyWebkitTransform, m_structuralLayer.get(), m_layer.get());
-            moveOrCopyAnimationsForProperty(Move, AnimatedPropertyOpacity, m_structuralLayer.get(), m_layer.get());
+            moveOrCopyAnimations(Move, m_structuralLayer.get(), m_layer.get());
 
             // Release the structural layer.
             m_structuralLayer = 0;
@@ -1380,8 +1395,7 @@ void GraphicsLayerCA::ensureStructuralLayer(StructuralLayerPurpose purpose, floa
     m_layer->superlayer()->replaceSublayer(m_layer.get(), m_structuralLayer.get());
     m_structuralLayer->appendSublayer(m_layer.get());
 
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyWebkitTransform, m_layer.get(), m_structuralLayer.get());
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyOpacity, m_layer.get(), m_structuralLayer.get());
+    moveOrCopyAnimations(Move, m_layer.get(), m_structuralLayer.get());
     
     updateSublayerList();
     updateOpacityOnLayer();
@@ -1424,6 +1438,11 @@ void GraphicsLayerCA::updateAcceleratesDrawing()
     
 void GraphicsLayerCA::updateLayerBackgroundColor()
 {
+    if (m_layer->layerType() == PlatformCALayer::LayerTypeTileCacheLayer) {
+        m_layer->setBackgroundColor(m_backgroundColor);
+        return;
+    }
+
     if (!m_contentsLayer)
         return;
 
@@ -1744,7 +1763,7 @@ void GraphicsLayerCA::updateContentsNeedsDisplay()
 
 bool GraphicsLayerCA::createAnimationFromKeyframes(const KeyframeValueList& valueList, const Animation* animation, const String& animationName, double timeOffset)
 {
-    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform);
+    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform && valueList.property() != AnimatedPropertyWebkitFilter);
     
     bool isKeyframe = valueList.size() > 2;
     bool valuesOK;
@@ -1755,10 +1774,10 @@ bool GraphicsLayerCA::createAnimationFromKeyframes(const KeyframeValueList& valu
     RefPtr<PlatformCAAnimation> caAnimation;
     
     if (isKeyframe) {
-        caAnimation = createKeyframeAnimation(animation, valueList.property(), additive);
+        caAnimation = createKeyframeAnimation(animation, propertyIdToString(valueList.property()), additive);
         valuesOK = setAnimationKeyframes(valueList, animation, caAnimation.get());
     } else {
-        caAnimation = createBasicAnimation(animation, valueList.property(), additive);
+        caAnimation = createBasicAnimation(animation, propertyIdToString(valueList.property()), additive);
         valuesOK = setAnimationEndpoints(valueList, animation, caAnimation.get());
     }
     
@@ -1779,10 +1798,10 @@ bool GraphicsLayerCA::appendToUncommittedAnimations(const KeyframeValueList& val
     RefPtr<PlatformCAAnimation> caAnimation;
     bool validMatrices = true;
     if (isKeyframe) {
-        caAnimation = createKeyframeAnimation(animation, valueList.property(), additive);
+        caAnimation = createKeyframeAnimation(animation, propertyIdToString(valueList.property()), additive);
         validMatrices = setTransformAnimationKeyframes(valueList, animation, caAnimation.get(), animationIndex, transformOp, isMatrixAnimation, boxSize);
     } else {
-        caAnimation = createBasicAnimation(animation, valueList.property(), additive);
+        caAnimation = createBasicAnimation(animation, propertyIdToString(valueList.property()), additive);
         validMatrices = setTransformAnimationEndpoints(valueList, animation, caAnimation.get(), animationIndex, transformOp, isMatrixAnimation, boxSize);
     }
     
@@ -1845,16 +1864,79 @@ bool GraphicsLayerCA::createTransformAnimationsFromKeyframes(const KeyframeValue
     return validMatrices;
 }
 
-PassRefPtr<PlatformCAAnimation> GraphicsLayerCA::createBasicAnimation(const Animation* anim, AnimatedPropertyID property, bool additive)
+#if ENABLE(CSS_FILTERS)
+bool GraphicsLayerCA::appendToUncommittedAnimations(const KeyframeValueList& valueList, const FilterOperation* operation, const Animation* animation, const String& animationName, int animationIndex, double timeOffset)
+{
+    bool isKeyframe = valueList.size() > 2;
+    
+    FilterOperation::OperationType filterOp = operation->getOperationType();
+    int numAnimatedProperties = PlatformCAAnimation::numAnimatedFilterProperties(filterOp);
+    
+    // Each filter might need to animate multiple properties, each with their own keyPath. The keyPath is always of the form:
+    //
+    //      filter.filter_<animationIndex>.<filterPropertyName>
+    //
+    // PlatformCAAnimation tells us how many properties each filter has and we iterate that many times and create an animation
+    // for each. This internalFilterPropertyIndex gets passed to PlatformCAAnimation so it can properly create the property animation
+    // values.
+    for (int internalFilterPropertyIndex = 0; internalFilterPropertyIndex < numAnimatedProperties; ++internalFilterPropertyIndex) {
+        bool valuesOK;
+        RefPtr<PlatformCAAnimation> caAnimation;
+        String keyPath = String::format("filters.filter_%d.%s", animationIndex, PlatformCAAnimation::animatedFilterPropertyName(filterOp, internalFilterPropertyIndex));
+        
+        if (isKeyframe) {
+            caAnimation = createKeyframeAnimation(animation, keyPath, false);
+            valuesOK = setFilterAnimationKeyframes(valueList, animation, caAnimation.get(), animationIndex, internalFilterPropertyIndex, filterOp);
+        } else {
+            caAnimation = createBasicAnimation(animation, keyPath, false);
+            valuesOK = setFilterAnimationEndpoints(valueList, animation, caAnimation.get(), animationIndex, internalFilterPropertyIndex);
+        }
+        
+        ASSERT(valuesOK);
+
+        m_uncomittedAnimations.append(LayerPropertyAnimation(caAnimation, animationName, valueList.property(), animationIndex, timeOffset));
+    }
+
+    return true;
+}
+
+bool GraphicsLayerCA::createFilterAnimationsFromKeyframes(const KeyframeValueList& valueList, const Animation* animation, const String& animationName, double timeOffset)
+{
+    ASSERT(valueList.property() == AnimatedPropertyWebkitFilter);
+
+    int listIndex = validateFilterOperations(valueList);
+    if (listIndex < 0)
+        return false;
+        
+    const FilterOperations* operations = static_cast<const FilterAnimationValue*>(valueList.at(listIndex))->value();
+    int numAnimations = operations->size();
+
+    // FIXME: We can't currently hardware animate shadows. There is an open question about removing shadows from filters 
+    // entirely, in which case this issue is moot.
+    for (int i = 0; i < numAnimations; ++i) {
+        if (operations->at(i)->getOperationType() == FilterOperation::DROP_SHADOW)
+            return false;
+    }
+
+    for (int animationIndex = 0; animationIndex < numAnimations; ++animationIndex) {
+        if (!appendToUncommittedAnimations(valueList, operations->operations().at(animationIndex).get(), animation, animationName, animationIndex, timeOffset))
+            return false;
+    }
+
+    return true;
+}
+#endif
+
+PassRefPtr<PlatformCAAnimation> GraphicsLayerCA::createBasicAnimation(const Animation* anim, const String& keyPath, bool additive)
 {
-    RefPtr<PlatformCAAnimation> basicAnim = PlatformCAAnimation::create(PlatformCAAnimation::Basic, propertyIdToString(property));
+    RefPtr<PlatformCAAnimation> basicAnim = PlatformCAAnimation::create(PlatformCAAnimation::Basic, keyPath);
     setupAnimation(basicAnim.get(), anim, additive);
     return basicAnim;
 }
 
-PassRefPtr<PlatformCAAnimation>GraphicsLayerCA::createKeyframeAnimation(const Animation* anim, AnimatedPropertyID property, bool additive)
+PassRefPtr<PlatformCAAnimation>GraphicsLayerCA::createKeyframeAnimation(const Animation* anim, const String& keyPath, bool additive)
 {
-    RefPtr<PlatformCAAnimation> keyframeAnim = PlatformCAAnimation::create(PlatformCAAnimation::Keyframe, propertyIdToString(property));
+    RefPtr<PlatformCAAnimation> keyframeAnim = PlatformCAAnimation::create(PlatformCAAnimation::Keyframe, keyPath);
     setupAnimation(keyframeAnim.get(), anim, additive);
     return keyframeAnim;
 }
@@ -2081,6 +2163,76 @@ bool GraphicsLayerCA::setTransformAnimationKeyframes(const KeyframeValueList& va
     return true;
 }
 
+#if ENABLE(CSS_FILTERS)
+bool GraphicsLayerCA::setFilterAnimationEndpoints(const KeyframeValueList& valueList, const Animation* animation, PlatformCAAnimation* basicAnim, int functionIndex, int internalFilterPropertyIndex)
+{
+    ASSERT(valueList.size() == 2);
+    
+    const FilterAnimationValue* fromValue = static_cast<const FilterAnimationValue*>(valueList.at(0));
+    const FilterAnimationValue* toValue = static_cast<const FilterAnimationValue*>(valueList.at(1));
+    
+    const FilterOperation* fromOperation = fromValue->value()->at(functionIndex);
+    const FilterOperation* toOperation = toValue->value()->at(functionIndex);
+    
+    RefPtr<DefaultFilterOperation> defaultFromOperation;
+    RefPtr<DefaultFilterOperation> defaultToOperation;
+    
+    ASSERT(fromOperation || toOperation);
+    
+    if (!fromOperation) {
+        defaultFromOperation = DefaultFilterOperation::create(toOperation->getOperationType());
+        fromOperation = defaultFromOperation.get();
+    }
+    
+    if (!toOperation) {
+        defaultToOperation = DefaultFilterOperation::create(fromOperation->getOperationType());
+        toOperation = defaultToOperation.get();
+    }
+    
+    basicAnim->setFromValue(fromOperation, internalFilterPropertyIndex);
+    basicAnim->setToValue(toOperation, internalFilterPropertyIndex);
+    
+    // This codepath is used for 2-keyframe animations, so we still need to look in the start for a timing function.
+    const TimingFunction* timingFunction = timingFunctionForAnimationValue(valueList.at(0), animation);
+    basicAnim->setTimingFunction(timingFunction);
+
+    return true;
+}
+
+bool GraphicsLayerCA::setFilterAnimationKeyframes(const KeyframeValueList& valueList, const Animation* animation, PlatformCAAnimation* keyframeAnim, int functionIndex, int internalFilterPropertyIndex, FilterOperation::OperationType filterOp)
+{
+    Vector<float> keyTimes;
+    Vector<RefPtr<FilterOperation> > values;
+    Vector<const TimingFunction*> timingFunctions;
+    RefPtr<DefaultFilterOperation> defaultOperation;
+
+    for (unsigned i = 0; i < valueList.size(); ++i) {
+        const FilterAnimationValue* curValue = static_cast<const FilterAnimationValue*>(valueList.at(i));
+        keyTimes.append(curValue->keyTime());
+
+        if (curValue->value()->operations().size() > static_cast<size_t>(functionIndex))
+            values.append(curValue->value()->operations()[functionIndex]);
+        else {
+            if (!defaultOperation)
+                defaultOperation = DefaultFilterOperation::create(filterOp);
+            values.append(defaultOperation);
+        }
+
+        const TimingFunction* timingFunction = timingFunctionForAnimationValue(curValue, animation);
+        timingFunctions.append(timingFunction);
+    }
+    
+    // We toss the last timing function because it has to be one shorter than the others.
+    timingFunctions.removeLast();
+
+    keyframeAnim->setKeyTimes(keyTimes);
+    keyframeAnim->setValues(values, internalFilterPropertyIndex);
+    keyframeAnim->setTimingFunctions(timingFunctions);
+
+    return true;
+}
+#endif
+
 void GraphicsLayerCA::suspendAnimations(double time)
 {
     double t = PlatformCALayer::currentTimeToMediaTime(time ? time : currentTime());
@@ -2269,9 +2421,7 @@ void GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer, float pageScale
 #endif
 
     // move over animations
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyWebkitTransform, oldLayer.get(), m_layer.get());
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyOpacity, oldLayer.get(), m_layer.get());
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyBackgroundColor, oldLayer.get(), m_layer.get());
+    moveOrCopyAnimations(Move, oldLayer.get(), m_layer.get());
     
     // need to tell new layer to draw itself
     setNeedsDisplay();
@@ -2491,8 +2641,7 @@ PassRefPtr<PlatformCALayer> GraphicsLayerCA::cloneLayer(PlatformCALayer *layer,
 
     if (cloneLevel == IntermediateCloneLevel) {
         newLayer->setOpacity(layer->opacity());
-        moveOrCopyAnimationsForProperty(Copy, AnimatedPropertyWebkitTransform, layer, newLayer.get());
-        moveOrCopyAnimationsForProperty(Copy, AnimatedPropertyOpacity, layer, newLayer.get());
+        moveOrCopyAnimations(Copy, layer, newLayer.get());
     }
     
     if (showDebugBorders()) {
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index 80b237641..77dafc523 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -179,10 +179,13 @@ private:
 
     bool createAnimationFromKeyframes(const KeyframeValueList&, const Animation*, const String& animationName, double timeOffset);
     bool createTransformAnimationsFromKeyframes(const KeyframeValueList&, const Animation*, const String& animationName, double timeOffset, const IntSize& boxSize);
+#if ENABLE(CSS_FILTERS)
+    bool createFilterAnimationsFromKeyframes(const KeyframeValueList&, const Animation*, const String& animationName, double timeOffset);
+#endif
 
     // Return autoreleased animation (use RetainPtr?)
-    PassRefPtr<PlatformCAAnimation> createBasicAnimation(const Animation*, AnimatedPropertyID, bool additive);
-    PassRefPtr<PlatformCAAnimation> createKeyframeAnimation(const Animation*, AnimatedPropertyID, bool additive);
+    PassRefPtr<PlatformCAAnimation> createBasicAnimation(const Animation*, const String& keyPath, bool additive);
+    PassRefPtr<PlatformCAAnimation> createKeyframeAnimation(const Animation*, const String&, bool additive);
     void setupAnimation(PlatformCAAnimation*, const Animation*, bool additive);
     
     const TimingFunction* timingFunctionForAnimationValue(const AnimationValue*, const Animation*);
@@ -193,6 +196,11 @@ private:
     bool setTransformAnimationEndpoints(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, TransformOperation::OperationType, bool isMatrixAnimation, const IntSize& boxSize);
     bool setTransformAnimationKeyframes(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, TransformOperation::OperationType, bool isMatrixAnimation, const IntSize& boxSize);
     
+#if ENABLE(CSS_FILTERS)
+    bool setFilterAnimationEndpoints(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, int internalFilterPropertyIndex);
+    bool setFilterAnimationKeyframes(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, int internalFilterPropertyIndex, FilterOperation::OperationType);
+#endif
+
     bool animationIsRunning(const String& animationName) const
     {
         return m_runningAnimations.find(animationName) != m_runningAnimations.end();
@@ -322,9 +330,12 @@ private:
 
     enum MoveOrCopy { Move, Copy };
     static void moveOrCopyLayerAnimation(MoveOrCopy, const String& animationIdentifier, PlatformCALayer *fromLayer, PlatformCALayer *toLayer);
-    void moveOrCopyAnimationsForProperty(MoveOrCopy, AnimatedPropertyID, PlatformCALayer * fromLayer, PlatformCALayer * toLayer);
+    void moveOrCopyAnimations(MoveOrCopy, PlatformCALayer * fromLayer, PlatformCALayer * toLayer);
     
     bool appendToUncommittedAnimations(const KeyframeValueList&, const TransformOperations*, const Animation*, const String& animationName, const IntSize& boxSize, int animationIndex, double timeOffset, bool isMatrixAnimation);
+#if ENABLE(CSS_FILTERS)
+    bool appendToUncommittedAnimations(const KeyframeValueList&, const FilterOperation*, const Animation*, const String& animationName, int animationIndex, double timeOffset);
+#endif
     
     enum LayerChange {
         NoChange = 0,
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
index b2d325956..280d763b3 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
@@ -29,6 +29,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "Color.h"
+#include "FilterOperation.h"
 #include "FloatPoint3D.h"
 #include "TransformationMatrix.h"
 #include <wtf/RefCounted.h>
@@ -109,12 +110,18 @@ public:
     void setFromValue(const WebCore::TransformationMatrix&);
     void setFromValue(const FloatPoint3D&);
     void setFromValue(const WebCore::Color&);
+#if ENABLE(CSS_FILTERS)
+    void setFromValue(const FilterOperation*, int internalFilterPropertyIndex);
+#endif
     void copyFromValueFrom(const PlatformCAAnimation*);
 
     void setToValue(float);
     void setToValue(const WebCore::TransformationMatrix&);
     void setToValue(const FloatPoint3D&);
     void setToValue(const WebCore::Color&);
+#if ENABLE(CSS_FILTERS)
+    void setToValue(const FilterOperation*, int internalFilterPropertyIndex);
+#endif
     void copyToValueFrom(const PlatformCAAnimation*);
 
     // Keyframe-animation properties.
@@ -122,6 +129,9 @@ public:
     void setValues(const Vector<WebCore::TransformationMatrix>&);
     void setValues(const Vector<FloatPoint3D>&);
     void setValues(const Vector<WebCore::Color>&);
+#if ENABLE(CSS_FILTERS)
+    void setValues(const Vector<RefPtr<FilterOperation> >&, int internalFilterPropertyIndex);
+#endif
     void copyValuesFrom(const PlatformCAAnimation*);
 
     void setKeyTimes(const Vector<float>&);
@@ -130,6 +140,11 @@ public:
     void setTimingFunctions(const Vector<const TimingFunction*>&);
     void copyTimingFunctionsFrom(const PlatformCAAnimation*);
     
+#if ENABLE(CSS_FILTERS)
+    static int numAnimatedFilterProperties(FilterOperation::OperationType);
+    static const char* animatedFilterPropertyName(FilterOperation::OperationType, int internalFilterPropertyIndex);
+#endif
+
 protected:
     PlatformCAAnimation(AnimationType, const String& keyPath);
     PlatformCAAnimation(PlatformAnimationRef);
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
index f14232590..11be28883 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
@@ -396,6 +396,131 @@ void PlatformCAAnimation::setFromValue(const WebCore::Color& value)
     [static_cast<CABasicAnimation*>(m_animation.get()) setFromValue:array];
 }
 
+#if ENABLE(CSS_FILTERS)
+static double sepiaFullConstants[3][3] = {
+    { 0.393, 0.769, 0.189 },
+    { 0.349, 0.686, 0.168 },
+    { 0.272, 0.534, 0.131 }
+};
+
+static double sepiaNoneConstants[3][3] = {
+    { 1, 0, 0 },
+    { 0, 1, 0 },
+    { 0, 0, 1 }
+};
+
+static double invertConstants[3][3] = {
+    { 1, 0, 0 },
+    { 0, 1, 0 },
+    { 0, 0, 1 }
+};
+
+static RetainPtr<id> filterValueForOperation(const FilterOperation* operation, int internalFilterPropertyIndex)
+{
+    FilterOperation::OperationType type = operation->getOperationType();
+    RetainPtr<id> value;
+    
+    switch(type) {
+    case FilterOperation::GRAYSCALE:
+    case FilterOperation::SATURATE:
+    case FilterOperation::HUE_ROTATE: {
+        double amount = 0;
+        
+        if (!operation->isDefault()) {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        if (type == FilterOperation::HUE_ROTATE)
+            amount = deg2rad(amount);
+
+        value.adoptNS([[NSNumber numberWithDouble:amount] retain]);
+        break;
+    }
+    case FilterOperation::SEPIA: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        value.adoptNS([[NSArray arrayWithObjects:
+            [NSNumber numberWithDouble:WebCore::blend(sepiaNoneConstants[internalFilterPropertyIndex][0], sepiaFullConstants[0][internalFilterPropertyIndex], amount)],
+            [NSNumber numberWithDouble:WebCore::blend(sepiaNoneConstants[internalFilterPropertyIndex][1], sepiaFullConstants[1][internalFilterPropertyIndex], amount)],
+            [NSNumber numberWithDouble:WebCore::blend(sepiaNoneConstants[internalFilterPropertyIndex][2], sepiaFullConstants[2][internalFilterPropertyIndex], amount)],
+            [NSNumber numberWithDouble:0],
+            nil] retain]);
+        break;
+    }
+    case FilterOperation::INVERT: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BasicComponentTransferFilterOperation* op = static_cast<const BasicComponentTransferFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        // The color matrix animation for invert does a scale of each color component by a value that goes from 
+        // 1 (when amount is 0) to -1 (when amount is 1). Then the color values are offset by amount. This has the
+        // effect of performing the operation: c' = c * -1 + 1, which inverts the color.
+        if (internalFilterPropertyIndex < 3) {
+            // the first 3 properties are the red, green and blue multipliers
+            double multiplier = 1 - amount * 2;
+            value.adoptNS([[NSArray arrayWithObjects:
+                [NSNumber numberWithDouble:invertConstants[internalFilterPropertyIndex][0] * multiplier],
+                [NSNumber numberWithDouble:invertConstants[internalFilterPropertyIndex][1] * multiplier],
+                [NSNumber numberWithDouble:invertConstants[internalFilterPropertyIndex][2] * multiplier],
+                [NSNumber numberWithDouble:0],
+                nil] retain]);
+        } else {
+            // the last property is the color offset
+            value.adoptNS([[NSArray arrayWithObjects:
+                [NSNumber numberWithDouble:amount],
+                [NSNumber numberWithDouble:amount],
+                [NSNumber numberWithDouble:amount],
+                [NSNumber numberWithDouble:0],
+                nil] retain]);
+        }
+        break;
+    }
+    case FilterOperation::OPACITY:
+    case FilterOperation::CONTRAST:
+    case FilterOperation::BRIGHTNESS: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BasicComponentTransferFilterOperation* op = static_cast<const BasicComponentTransferFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        value.adoptNS([[NSNumber numberWithDouble:amount] retain]);
+        break;
+    }
+    case FilterOperation::BLUR: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BlurFilterOperation* op = static_cast<const BlurFilterOperation*>(operation);
+            amount = op->stdDeviation().calcFloatValue(0);
+        }
+        
+        value.adoptNS([[NSNumber numberWithDouble:amount] retain]);
+        break;
+    }
+    default: break;
+    }
+    
+    return value;
+}
+
+void PlatformCAAnimation::setFromValue(const FilterOperation* operation, int internalFilterPropertyIndex)
+{
+    RetainPtr<id> value = filterValueForOperation(operation, internalFilterPropertyIndex);
+    [static_cast<CABasicAnimation*>(m_animation.get()) setFromValue:value.get()];
+}
+#endif
+
 void PlatformCAAnimation::copyFromValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -447,6 +572,14 @@ void PlatformCAAnimation::setToValue(const WebCore::Color& value)
     [static_cast<CABasicAnimation*>(m_animation.get()) setToValue:array];
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setToValue(const FilterOperation* operation, int internalFilterPropertyIndex)
+{
+    RetainPtr<id> value = filterValueForOperation(operation, internalFilterPropertyIndex);
+    [static_cast<CABasicAnimation*>(m_animation.get()) setToValue:value.get()];
+}
+#endif
+
 void PlatformCAAnimation::copyToValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -519,6 +652,22 @@ void PlatformCAAnimation::setValues(const Vector<WebCore::Color>& value)
     [static_cast<CAKeyframeAnimation*>(m_animation.get()) setValues:array];
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setValues(const Vector<RefPtr<FilterOperation> >& values, int internalFilterPropertyIndex)
+{
+    if (animationType() != Keyframe)
+        return;
+        
+    NSMutableArray* array = [NSMutableArray array];
+
+    for (size_t i = 0; i < values.size(); ++i) {
+        RetainPtr<id> value = filterValueForOperation(values[i].get(), internalFilterPropertyIndex);
+        [array addObject:value.get()];
+    }
+    [static_cast<CAKeyframeAnimation*>(m_animation.get()) setValues:array];
+}
+#endif
+
 void PlatformCAAnimation::copyValuesFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Keyframe || value->animationType() != Keyframe)
@@ -560,4 +709,51 @@ void PlatformCAAnimation::copyTimingFunctionsFrom(const PlatformCAAnimation* val
     [static_cast<CAKeyframeAnimation*>(m_animation.get()) setTimingFunctions:[other timingFunctions]];
 }
 
+#if ENABLE(CSS_FILTERS)
+int PlatformCAAnimation::numAnimatedFilterProperties(FilterOperation::OperationType type)
+{
+    switch(type) {
+    case FilterOperation::GRAYSCALE: return 1;
+    case FilterOperation::SEPIA: return 3;
+    case FilterOperation::SATURATE: return 1;
+    case FilterOperation::HUE_ROTATE: return 1;
+    case FilterOperation::INVERT: return 4;
+    case FilterOperation::OPACITY: return 1;
+    case FilterOperation::BLUR: return 1;
+    case FilterOperation::CONTRAST: return 1;
+    case FilterOperation::BRIGHTNESS: return 1;
+    default: return 0;
+    }
+}
+
+const char* PlatformCAAnimation::animatedFilterPropertyName(FilterOperation::OperationType type, int internalFilterPropertyIndex)
+{
+    switch(type) {
+    case FilterOperation::GRAYSCALE: return "inputIntensity";
+    case FilterOperation::SEPIA:
+        switch(internalFilterPropertyIndex) {
+        case 0: return "inputRVector";
+        case 1: return "inputGVector";
+        case 2: return "inputBVector";
+        default: return "";
+        }
+    case FilterOperation::SATURATE: return "inputSaturation";
+    case FilterOperation::HUE_ROTATE: return "inputAngle";
+    case FilterOperation::INVERT:
+        switch(internalFilterPropertyIndex) {
+        case 0: return "inputRVector";
+        case 1: return "inputGVector";
+        case 2: return "inputBVector";
+        case 3: return "inputBiasVector";
+        default: return "";
+        }
+    case FilterOperation::OPACITY: return "inputAVector";
+    case FilterOperation::BLUR: return "inputRadius";
+    case FilterOperation::CONTRAST: return "inputContrast";
+    case FilterOperation::BRIGHTNESS: return "inputBrightness";
+    default: return "";
+    }
+}
+#endif
+
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.h b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
index 2c290e500..675b85af6 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.h
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
@@ -27,7 +27,7 @@
 #define TileCache_h
 
 #include "IntPointHash.h"
-#include "IntSize.h"
+#include "IntRect.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
@@ -49,12 +49,14 @@ class TileCache {
 
 public:
     static PassOwnPtr<TileCache> create(WebTileCacheLayer*, const IntSize& tileSize);
+    ~TileCache();
 
     void tileCacheLayerBoundsChanged();
 
     void setNeedsDisplay();
     void setNeedsDisplayInRect(const IntRect&);
     void drawLayer(WebTileLayer*, CGContextRef);
+    void setContentsScale(CGFloat);
 
     bool acceleratesDrawing() const { return m_acceleratesDrawing; }
     void setAcceleratesDrawing(bool);
@@ -95,6 +97,7 @@ private:
     typedef HashMap<TileIndex, RetainPtr<WebTileLayer> > TileMap;
     TileMap m_tiles;
     Timer<TileCache> m_tileRevalidationTimer;
+    IntRect m_tileCoverageRect;
 
     bool m_acceleratesDrawing;
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index 2550b3dd6..a74ff7215 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -31,6 +31,7 @@
 #import "WebLayer.h"
 #import "WebTileCacheLayer.h"
 #import "WebTileLayer.h"
+#import <wtf/MainThread.h>
 #import <utility>
 
 using namespace std;
@@ -62,6 +63,11 @@ TileCache::TileCache(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
     [CATransaction commit];
 }
 
+TileCache::~TileCache()
+{
+    ASSERT(isMainThread());
+}
+
 void TileCache::tileCacheLayerBoundsChanged()
 {
     if (m_tiles.isEmpty()) {
@@ -87,7 +93,7 @@ void TileCache::setNeedsDisplayInRect(const IntRect& rect)
     // Find the tiles that need to be invalidated.
     TileIndex topLeft;
     TileIndex bottomRight;
-    getTileIndexRangeForRect(rect, topLeft, bottomRight);
+    getTileIndexRangeForRect(intersection(rect, m_tileCoverageRect), topLeft, bottomRight);
 
     for (int y = topLeft.y(); y <= bottomRight.y(); ++y) {
         for (int x = topLeft.x(); x <= bottomRight.x(); ++x) {
@@ -156,6 +162,22 @@ void TileCache::drawLayer(WebTileLayer* layer, CGContextRef context)
     CGContextRestoreGState(context);
 }
 
+void TileCache::setContentsScale(CGFloat contentsScale)
+{
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    for (TileMap::const_iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it) {
+        [it->second.get() setContentsScale:contentsScale];
+        [it->second.get() setNeedsDisplay];
+    }
+
+    PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
+    platformLayer->owner()->platformCALayerDidCreateTiles();
+    revalidateTiles();
+#else
+    UNUSED_PARAM(contentsScale);
+#endif
+}
+
 void TileCache::setAcceleratesDrawing(bool acceleratesDrawing)
 {
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
@@ -311,6 +333,13 @@ void TileCache::revalidateTiles()
         }
     }
 
+    m_tileCoverageRect = IntRect();
+    for (TileMap::iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it) {
+        const TileIndex& tileIndex = it->first;
+
+        m_tileCoverageRect.unite(rectForTileIndex(tileIndex));
+    }
+
     if (!didCreateNewTiles)
         return;
 
@@ -331,8 +360,10 @@ RetainPtr<WebTileLayer> TileCache::createTileLayer()
     [layer.get() setTileCache:this];
     [layer.get() setBorderColor:m_tileDebugBorderColor.get()];
     [layer.get() setBorderWidth:m_tileDebugBorderWidth];
+    [layer.get() setEdgeAntialiasingMask:0];
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    [layer.get() setContentsScale:[m_tileCacheLayer contentsScale]];
     [layer.get() setAcceleratesDrawing:m_acceleratesDrawing];
 #endif
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
index 059f1777c..f992c270c 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
@@ -28,6 +28,7 @@
 
 #import "IntRect.h"
 #import "TileCache.h"
+#import <wtf/MainThread.h>
 
 using namespace WebCore;
 
@@ -45,6 +46,18 @@ using namespace WebCore;
     return self;
 }
 
+- (void)dealloc
+{
+    if (!isMainThread()) {
+        TileCache* tileCache = _tileCache.leakPtr();
+        dispatch_async(dispatch_get_main_queue(), ^{
+            delete tileCache;
+        });
+    }
+
+    [super dealloc];
+}
+
 - (void)setBounds:(CGRect)bounds
 {
     [super setBounds:bounds];
@@ -72,6 +85,20 @@ using namespace WebCore;
     return _tileCache->acceleratesDrawing();
 }
 
+- (void)setContentsScale:(CGFloat)contentsScale
+{
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    CGFloat oldContentsScale = [self contentsScale];
+
+    [super setContentsScale:contentsScale];
+
+    if (contentsScale != oldContentsScale)
+        _tileCache->setContentsScale(contentsScale);
+#else
+    UNUSED_PARAM(contentsScale);
+#endif
+}
+
 - (CALayer *)tileContainerLayer
 {
     return _tileCache->tileContainerLayer();
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
index e7d2dd19e..2e4ec5ed6 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
@@ -274,6 +274,10 @@ void CACFLayerTreeHost::flushPendingGraphicsLayerChangesSoon()
     LayerChangesFlusher::shared().flushPendingLayerChangesSoon(this);
 }
 
+void CACFLayerTreeHost::setShouldInvertColors(bool)
+{
+}
+
 void CACFLayerTreeHost::flushPendingLayerChangesNow()
 {
     // Calling out to the client could cause our last reference to go away.
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
index 507af0fab..2b82377d8 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
@@ -65,6 +65,7 @@ public:
     virtual void paint();
     virtual void resize() = 0;
     void flushPendingGraphicsLayerChangesSoon();
+    virtual void setShouldInvertColors(bool);
 
     // AbstractCACFLayerTreeHost
     virtual void flushPendingLayerChangesNow();
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
index 683d70353..944288ca7 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
@@ -368,6 +368,13 @@ void PlatformCAAnimation::setFromValue(const WebCore::Color& value)
     CACFAnimationSetFromValue(m_animation.get(), v.get());
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setFromValue(const FilterOperation*, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+}
+#endif
+
 void PlatformCAAnimation::copyFromValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -414,6 +421,13 @@ void PlatformCAAnimation::setToValue(const WebCore::Color& value)
     CACFAnimationSetToValue(m_animation.get(), v.get());
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setToValue(const FilterOperation*, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+}
+#endif
+
 void PlatformCAAnimation::copyToValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -482,6 +496,13 @@ void PlatformCAAnimation::setValues(const Vector<WebCore::Color>& value)
     CACFAnimationSetValues(m_animation.get(), array.get());
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setValues(const Vector<RefPtr<FilterOperation> >&, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+}
+#endif
+
 void PlatformCAAnimation::copyValuesFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Keyframe || value->animationType() != Keyframe)
@@ -531,4 +552,18 @@ void PlatformCAAnimation::copyTimingFunctionsFrom(const PlatformCAAnimation* val
     CACFAnimationSetTimingFunctions(m_animation.get(), CACFAnimationGetTimingFunctions(value->platformAnimation()));
 }
 
+#if ENABLE(CSS_FILTERS)
+int PlatformCAAnimation::numAnimatedFilterProperties(FilterOperation::OperationType)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+    return 0;
+}
+
+const char* PlatformCAAnimation::animatedFilterPropertyName(FilterOperation::OperationType, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+    return "";
+}
+#endif
+
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
index 47de3f871..633d4e321 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
@@ -566,6 +566,8 @@ void PlatformCALayer::setOpacity(float value)
     setNeedsCommit();
 }
 
+#if ENABLE(CSS_FILTERS)
+
 void PlatformCALayer::setFilters(const FilterOperations&)
 {
 }
@@ -575,6 +577,8 @@ bool PlatformCALayer::filtersCanBeComposited(const FilterOperations&)
     return false;
 }
 
+#endif // ENABLE(CSS_FILTERS)
+
 String PlatformCALayer::name() const
 {
     return CACFLayerGetName(m_layer.get());
diff --git a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
index f3cf39e74..2b47a3e1d 100644
--- a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
@@ -60,6 +60,7 @@ typedef void (*WKCACFViewContextDidChangeCallback)(WKCACFViewRef view, void* inf
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetContextDidChangeCallback, void, __cdecl, (WKCACFViewRef view, WKCACFViewContextDidChangeCallback callback, void* info), (view, callback, info))
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewGetLastCommitTime, CFTimeInterval, __cdecl, (WKCACFViewRef view), (view))
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetContextUserData, void, __cdecl, (WKCACFViewRef view, void* userData), (view, userData))
+SOFT_LINK_OPTIONAL(WebKitQuartzCoreAdditions, WKCACFViewSetShouldInvertColors, void, _cdecl, (WKCACFViewRef view, bool shouldInvertColors))
 
 PassRefPtr<WKCACFViewLayerTreeHost> WKCACFViewLayerTreeHost::create()
 {
@@ -168,6 +169,12 @@ void WKCACFViewLayerTreeHost::render(const Vector<CGRect>& dirtyRects)
     WKCACFViewDraw(m_view.get());
 }
 
+void WKCACFViewLayerTreeHost::setShouldInvertColors(bool shouldInvertColors)
+{
+    if (WKCACFViewSetShouldInvertColorsPtr())
+        WKCACFViewSetShouldInvertColorsPtr()(m_view.get(), shouldInvertColors);
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
index af09f76d1..2660e43d1 100644
--- a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
@@ -53,6 +53,7 @@ private:
     virtual void paint();
     virtual void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
     virtual CFTimeInterval lastCommitTime() const;
+    virtual void setShouldInvertColors(bool);
 
     RetainPtr<WKCACFViewRef> m_view;
     bool m_viewNeedsUpdate;
diff --git a/Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
index 067b9c7b3..067b9c7b3 100644
--- a/Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp
+++ b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index c85aab416..f542fb9ed 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -31,13 +31,116 @@
 
 #if ENABLE(WEBGL)
 
+#include "Extensions3DOpenGL.h"
+#include "GraphicsContext3DPrivate.h"
 #include "Image.h"
+#include "OpenGLShims.h"
 #include "RefPtrCairo.h"
+#include "ShaderLang.h"
 #include <cairo.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
+{
+    // This implementation doesn't currently support rendering directly to the HostWindow.
+    if (renderStyle == RenderDirectlyToHostWindow)
+        return 0;
+
+    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
+    if (!priv)
+        return 0;
+
+    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, false));
+    context->m_private = priv.release();
+    return context.release();
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow*, bool)
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+    , m_attrs(attributes)
+    , m_texture(0)
+    , m_fbo(0)
+    , m_depthStencilBuffer(0)
+    , m_boundFBO(0)
+    , m_multisampleFBO(0)
+    , m_multisampleDepthStencilBuffer(0)
+    , m_multisampleColorBuffer(0)
+{
+    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
+
+    validateAttributes();
+
+    // Create a texture to render into.
+    ::glGenTextures(1, &m_texture);
+    ::glBindTexture(GL_TEXTURE_2D, m_texture);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
+    ::glBindTexture(GL_TEXTURE_2D, 0);
+
+    // Create an FBO.
+    ::glGenFramebuffersEXT(1, &m_fbo);
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+
+    m_boundFBO = m_fbo;
+    if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth))
+        ::glGenRenderbuffersEXT(1, &m_depthStencilBuffer);
+    
+    // Create a multisample FBO.
+    if (m_attrs.antialias) {
+        ::glGenFramebuffersEXT(1, &m_multisampleFBO);
+        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_multisampleFBO);
+        m_boundFBO = m_multisampleFBO;
+        ::glGenRenderbuffersEXT(1, &m_multisampleColorBuffer);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glGenRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
+    }
+
+    // ANGLE initialization.
+    ShBuiltInResources ANGLEResources;
+    ShInitBuiltInResources(&ANGLEResources);
+
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &ANGLEResources.MaxVertexAttribs);
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS, &ANGLEResources.MaxVertexUniformVectors);
+    getIntegerv(GraphicsContext3D::MAX_VARYING_VECTORS, &ANGLEResources.MaxVaryingVectors);
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxVertexTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxCombinedTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS, &ANGLEResources.MaxFragmentUniformVectors);
+
+    // Always set to 1 for OpenGL ES.
+    ANGLEResources.MaxDrawBuffers = 1;
+    m_compiler.setResources(ANGLEResources);
+
+    ::glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
+    ::glEnable(GL_POINT_SPRITE);
+    ::glClearColor(0, 0, 0, 0);
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
+    if (!m_private->m_context)
+        return;
+
+    makeContextCurrent();
+    ::glDeleteTextures(1, &m_texture);
+    if (m_attrs.antialias) {
+        ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
+        ::glDeleteFramebuffersEXT(1, &m_multisampleFBO);
+    } else {
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
+    }
+    ::glDeleteFramebuffersEXT(1, &m_fbo);
+}
+
 bool GraphicsContext3D::getImageData(Image* image, unsigned int format, unsigned int type, bool premultiplyAlpha, bool ignoreGammaAndColorProfile, Vector<uint8_t>& outputVector)
 {
     if (!image)
@@ -119,6 +222,23 @@ void GraphicsContext3D::setErrorMessageCallback(PassOwnPtr<ErrorMessageCallback>
 {
 }
 
+bool GraphicsContext3D::makeContextCurrent()
+{
+    if (!m_private)
+        return false;
+    return m_private->makeContextCurrent();
+}
+
+PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
+{
+    return m_private->m_context;
+}
+
+bool GraphicsContext3D::isGLES2Compliant() const
+{
+    return false;
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 PlatformLayer* GraphicsContext3D::platformLayer() const
 {
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
index 4cc6bcc90..9b912a44f 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
@@ -45,21 +45,22 @@ BitmapSkPictureCanvasLayerTextureUpdater::Texture::Texture(BitmapSkPictureCanvas
 
 void BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect(const IntRect& sourceRect)
 {
-    m_device = adoptPtr(new SkDevice(SkBitmap::kARGB_8888_Config, sourceRect.width(), sourceRect.height()));
-    OwnPtr<SkCanvas> canvas = adoptPtr(new SkCanvas(m_device.get()));
-    textureUpdater()->paintContentsRect(canvas.get(), sourceRect);
+    m_bitmap.setConfig(SkBitmap::kARGB_8888_Config, sourceRect.width(), sourceRect.height());
+    m_bitmap.allocPixels();
+    m_bitmap.setIsOpaque(m_textureUpdater->layerIsOpaque());
+    SkDevice device(m_bitmap);
+    SkCanvas canvas(&device);
+    textureUpdater()->paintContentsRect(&canvas, sourceRect);
 }
 
 void BitmapSkPictureCanvasLayerTextureUpdater::Texture::updateRect(GraphicsContext3D* context, TextureAllocator* allocator, const IntRect& sourceRect, const IntRect& destRect)
 {
     texture()->bindTexture(context, allocator);
 
-    ASSERT(m_device);
-    const SkBitmap* bitmap = &m_device->accessBitmap(false);
-    bitmap->lockPixels();
-    textureUpdater()->updateTextureRect(context, texture()->format(), destRect, static_cast<uint8_t*>(bitmap->getPixels()));
-    bitmap->unlockPixels();
-    m_device.clear();
+    m_bitmap.lockPixels();
+    textureUpdater()->updateTextureRect(context, texture()->format(), destRect, static_cast<uint8_t*>(m_bitmap.getPixels()));
+    m_bitmap.unlockPixels();
+    m_bitmap.reset();
 }
 
 PassRefPtr<BitmapSkPictureCanvasLayerTextureUpdater> BitmapSkPictureCanvasLayerTextureUpdater::create(PassOwnPtr<LayerPainterChromium> painter, bool useMapTexSubImage)
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
index 8d52433d0..838b4b3e7 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
@@ -32,10 +32,9 @@
 
 #include "LayerTextureSubImage.h"
 #include "PlatformColor.h"
+#include "SkBitmap.h"
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
-class SkDevice;
-
 namespace WebCore {
 
 // This class records the contentRect into an SkPicture, then software rasterizes
@@ -52,7 +51,7 @@ public:
     private:
         BitmapSkPictureCanvasLayerTextureUpdater* textureUpdater() { return m_textureUpdater; }
 
-        OwnPtr<SkDevice> m_device;
+        SkBitmap m_bitmap;
         BitmapSkPictureCanvasLayerTextureUpdater* m_textureUpdater;
     };
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
index 14fe35a58..d8b4bbe08 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
@@ -97,6 +97,7 @@ void Canvas2DLayerChromium::setCanvas(SkCanvas* canvas)
 
 void Canvas2DLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpace */)
 {
+    TRACE_EVENT("Canvas2DLayerChromium::paintContentsIfDirty", this, 0);
     if (!drawsContent())
         return;
 
@@ -111,9 +112,12 @@ void Canvas2DLayerChromium::paintContentsIfDirty(const Region& /* occludedScreen
     bool success = m_context->makeContextCurrent();
     ASSERT_UNUSED(success, success);
 
-    if (m_canvas)
+    if (m_canvas) {
+        TRACE_EVENT("SkDeferredCanvas::flush", m_canvas, 0);
         m_canvas->flush();
+    }
 
+    TRACE_EVENT("GrContext::flush", m_context, 0);
     m_context->flush();
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index e164609ae..53322f0f2 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -63,6 +63,9 @@ public:
     virtual String getTranslatedShaderSourceANGLE(Platform3DObject);
 
     enum {
+        // GL_OES_EGL_image_external
+        GL_TEXTURE_EXTERNAL_OES = 0x8D65,
+
         // GL_CHROMIUM_map_sub (enums inherited from GL_ARB_vertex_buffer_object)
         READ_ONLY = 0x88B8,
         WRITE_ONLY = 0x88B9,
@@ -87,6 +90,14 @@ public:
     // GL_CHROMIUM_set_visibility
     void setVisibilityCHROMIUM(bool);
 
+    // GL_CHROMIUM_gpu_memory_manager
+    class GpuMemoryAllocationChangedCallbackCHROMIUM {
+    public:
+        virtual void onGpuMemoryAllocationChanged(size_t gpuResourceSizeInBytes) = 0;
+        virtual ~GpuMemoryAllocationChangedCallbackCHROMIUM() { }
+    };
+    void setGpuMemoryAllocationChangedCallbackCHROMIUM(PassOwnPtr<GpuMemoryAllocationChangedCallbackCHROMIUM>);
+
     // GL_CHROMIUM_swapbuffers_complete_callback
     class SwapBuffersCompleteCallbackCHROMIUM {
     public:
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 31a5118ff..cdecf5917 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -61,6 +61,10 @@
 
 using namespace std;
 
+namespace {
+static int s_nextGroupId = 0;
+}
+
 namespace WebCore {
 
 PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
@@ -124,7 +128,7 @@ bool GraphicsLayerChromium::setChildren(const Vector<GraphicsLayer*>& children)
 void GraphicsLayerChromium::addChild(GraphicsLayer* childLayer)
 {
     GraphicsLayer::addChild(childLayer);
-    if (!m_inSetChildren) 
+    if (!m_inSetChildren)
         updateChildList();
 }
 
@@ -175,10 +179,17 @@ void GraphicsLayerChromium::setAnchorPoint(const FloatPoint3D& point)
 
 void GraphicsLayerChromium::setSize(const FloatSize& size)
 {
-    if (size == m_size)
+    // We are receiving negative sizes here that cause assertions to fail in the compositor. Clamp them to 0 to
+    // avoid those assertions.
+    // FIXME: This should be an ASSERT instead, as negative sizes should not exist in WebCore.
+    FloatSize clampedSize = size;
+    if (clampedSize.width() < 0 || clampedSize.height() < 0)
+        clampedSize = FloatSize();
+
+    if (clampedSize == m_size)
         return;
 
-    GraphicsLayer::setSize(size);
+    GraphicsLayer::setSize(clampedSize);
     updateLayerSize();
 }
 
@@ -254,6 +265,12 @@ void GraphicsLayerChromium::setContentsOpaque(bool opaque)
     m_layer->setOpaque(m_contentsOpaque);
 }
 
+bool GraphicsLayerChromium::setFilters(const FilterOperations& filters)
+{
+    m_layer->setFilters(filters);
+    return GraphicsLayer::setFilters(filters);
+}
+
 void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
 {
     if (maskLayer == m_maskLayer)
@@ -369,6 +386,31 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
         updateChildList();
 }
 
+bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
+{
+    return m_layer->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), s_nextGroupId++, timeOffset);
+}
+
+void GraphicsLayerChromium::pauseAnimation(const String& animationName, double timeOffset)
+{
+    m_layer->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
+}
+
+void GraphicsLayerChromium::removeAnimation(const String& animationName)
+{
+    m_layer->removeAnimation(mapAnimationNameToId(animationName));
+}
+
+void GraphicsLayerChromium::suspendAnimations(double time)
+{
+    m_layer->suspendAnimations(time);
+}
+
+void GraphicsLayerChromium::resumeAnimations()
+{
+    m_layer->resumeAnimations();
+}
+
 void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
 {
     bool childrenChanged = false;
@@ -383,12 +425,12 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
     } else {
         if (m_contentsLayer) {
             childrenChanged = true;
-  
+
             // The old contents layer will be removed via updateChildList.
             m_contentsLayer = 0;
         }
     }
-  
+
     if (childrenChanged)
         updateChildList();
 }
@@ -537,7 +579,7 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         m_layer->setAnchorPoint(FloatPoint(0.5f, 0.5f));
         TransformationMatrix identity;
         m_layer->setTransform(identity);
-        
+
         // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
         m_layer->setOpacity(1);
 
@@ -676,6 +718,12 @@ void GraphicsLayerChromium::paintContents(GraphicsContext& context, const IntRec
     paintGraphicsLayerContents(context, clip);
 }
 
+int GraphicsLayerChromium::mapAnimationNameToId(const String& animationName)
+{
+    // FIXME: need to maintain a name to id mapping in this class.
+    return 0;
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index 39b367b9d..eb3146bbd 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -82,6 +82,9 @@ public:
 
     virtual void setOpacity(float);
 
+    // Returns true if filter can be rendered by the compositor
+    virtual bool setFilters(const FilterOperations&);
+
     virtual void setNeedsDisplay();
     virtual void setNeedsDisplayInRect(const FloatRect&);
     virtual void setContentsNeedsDisplay();
@@ -92,6 +95,12 @@ public:
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsToCanvas(PlatformLayer*);
 
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String&, double timeOffset);
+    virtual void pauseAnimation(const String& animationName, double timeOffset);
+    virtual void removeAnimation(const String& animationName);
+    virtual void suspendAnimations(double time);
+    virtual void resumeAnimations();
+
     virtual PlatformLayer* platformLayer() const;
 
     virtual void setDebugBackgroundColor(const Color&);
@@ -129,6 +138,8 @@ private:
     void setupContentsLayer(LayerChromium*);
     float contentsScale() const;
 
+    int mapAnimationNameToId(const String& animationName);
+
     String m_nameBase;
 
     RefPtr<ContentLayerChromium> m_layer;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 8d0fe03b6..8eeda68a4 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -33,6 +33,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerChromium.h"
 
+#include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #if USE(SKIA)
@@ -59,7 +60,9 @@ LayerChromium::LayerChromium()
     : m_needsDisplay(false)
     , m_layerId(s_nextLayerId++)
     , m_parent(0)
+    , m_layerAnimationController(CCLayerAnimationController::create())
     , m_scrollable(false)
+    , m_haveWheelEventHandlers(false)
     , m_anchorPoint(0.5, 0.5)
     , m_backgroundColor(0, 0, 0, 0)
     , m_backgroundCoversViewport(false)
@@ -92,6 +95,52 @@ LayerChromium::~LayerChromium()
     removeAllChildren();
 }
 
+bool LayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, int animationId, int groupId, double timeOffset)
+{
+    if (!m_layerTreeHost || !m_layerTreeHost->settings().threadedAnimationEnabled)
+        return false;
+
+    bool addedAnimation = m_layerAnimationController->addAnimation(values, boxSize, animation, animationId, groupId, timeOffset);
+    if (addedAnimation)
+        setNeedsCommit();
+    return addedAnimation;
+}
+
+void LayerChromium::pauseAnimation(int animationId, double timeOffset)
+{
+    m_layerAnimationController->pauseAnimation(animationId, timeOffset);
+    setNeedsCommit();
+}
+
+void LayerChromium::removeAnimation(int animationId)
+{
+    m_layerAnimationController->removeAnimation(animationId);
+    setNeedsCommit();
+}
+
+void LayerChromium::suspendAnimations(double time)
+{
+    m_layerAnimationController->suspendAnimations(time);
+    setNeedsCommit();
+}
+
+void LayerChromium::resumeAnimations()
+{
+    m_layerAnimationController->resumeAnimations();
+    setNeedsCommit();
+}
+
+void LayerChromium::setLayerAnimationController(PassOwnPtr<CCLayerAnimationController> layerAnimationController)
+{
+    m_layerAnimationController = layerAnimationController;
+    setNeedsCommit();
+}
+
+bool LayerChromium::hasActiveAnimation() const
+{
+    return m_layerAnimationController->hasActiveAnimation();
+}
+
 void LayerChromium::setIsNonCompositedContent(bool isNonCompositedContent)
 {
     m_isNonCompositedContent = isNonCompositedContent;
@@ -305,6 +354,14 @@ void LayerChromium::setReplicaLayer(LayerChromium* layer)
     setNeedsCommit();
 }
 
+void LayerChromium::setFilters(const FilterOperations& filters)
+{
+    if (m_filters == filters)
+        return;
+    m_filters = filters;
+    setNeedsCommit();
+}
+
 void LayerChromium::setOpacity(float opacity)
 {
     if (m_opacity == opacity)
@@ -361,6 +418,14 @@ void LayerChromium::setScrollable(bool scrollable)
     setNeedsCommit();
 }
 
+void LayerChromium::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
+{
+    if (m_haveWheelEventHandlers == haveWheelEventHandlers)
+        return;
+    m_haveWheelEventHandlers = haveWheelEventHandlers;
+    setNeedsCommit();
+}
+
 void LayerChromium::setDoubleSided(bool doubleSided)
 {
     if (m_doubleSided == doubleSided)
@@ -411,9 +476,11 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     layer->setDebugBorderWidth(m_debugBorderWidth);
     layer->setDoubleSided(m_doubleSided);
     layer->setDrawsContent(drawsContent());
+    layer->setFilters(filters());
     layer->setIsNonCompositedContent(m_isNonCompositedContent);
     layer->setMasksToBounds(m_masksToBounds);
     layer->setScrollable(m_scrollable);
+    layer->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
     layer->setName(m_name);
     layer->setOpaque(m_opaque);
     layer->setOpacity(m_opacity);
@@ -432,6 +499,8 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     if (replicaLayer())
         replicaLayer()->pushPropertiesTo(layer->replicaLayer());
 
+    m_layerAnimationController->synchronizeAnimations(layer->layerAnimationController());
+
     // Reset any state that should be cleared for the next update.
     m_updateRect = FloatRect();
 }
@@ -494,6 +563,7 @@ void LayerChromium::createRenderSurface()
 {
     ASSERT(!m_renderSurface);
     m_renderSurface = adoptPtr(new RenderSurfaceChromium(this));
+    setTargetRenderSurface(m_renderSurface.get());
 }
 
 bool LayerChromium::descendantDrawsContent()
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index a0758131f..897647d2d 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -34,6 +34,7 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "FilterOperations.h"
 #include "FloatPoint.h"
 #include "GraphicsContext.h"
 #include "PlatformString.h"
@@ -51,6 +52,7 @@
 
 namespace WebCore {
 
+class CCLayerAnimationController;
 class CCLayerImpl;
 class CCLayerTreeHost;
 class CCTextureUpdater;
@@ -60,7 +62,6 @@ class Region;
 // Base class for composited layers. Special layer types are derived from
 // this class.
 class LayerChromium : public RefCounted<LayerChromium> {
-    friend class LayerTilerChromium;
 public:
     static PassRefPtr<LayerChromium> create();
 
@@ -102,12 +103,15 @@ public:
     LayerChromium* maskLayer() const { return m_maskLayer.get(); }
 
     virtual void setNeedsDisplayRect(const FloatRect& dirtyRect);
-    void setNeedsDisplay() { setNeedsDisplayRect(FloatRect(FloatPoint(), contentBounds())); }
+    void setNeedsDisplay() { setNeedsDisplayRect(FloatRect(FloatPoint(), bounds())); }
     virtual bool needsDisplay() const { return m_needsDisplay; }
 
     void setOpacity(float);
     float opacity() const { return m_opacity; }
 
+    void setFilters(const FilterOperations&);
+    const FilterOperations& filters() const { return m_filters; }
+
     virtual void setOpaque(bool);
     bool opaque() const { return m_opaque; }
 
@@ -127,7 +131,7 @@ public:
     const IntPoint& scrollPosition() const { return m_scrollPosition; }
 
     void setScrollable(bool);
-    bool scrollable() const { return m_scrollable; }
+    void setHaveWheelEventHandlers(bool);
 
     IntSize scrollDelta() const { return IntSize(); }
 
@@ -211,7 +215,22 @@ public:
     void setAlwaysReserveTextures(bool alwaysReserveTextures) { m_alwaysReserveTextures = alwaysReserveTextures; }
     bool alwaysReserveTextures() const { return m_alwaysReserveTextures; }
 
+    bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, int animationId, int groupId, double timeOffset);
+    void pauseAnimation(int animationId, double timeOffset);
+    void removeAnimation(int animationId);
+
+    void suspendAnimations(double time);
+    void resumeAnimations();
+
+    CCLayerAnimationController* layerAnimationController() { return m_layerAnimationController.get(); }
+    void setLayerAnimationController(PassOwnPtr<CCLayerAnimationController>);
+    bool hasActiveAnimation() const;
+
 protected:
+    friend class CCLayerImpl;
+    friend class LayerTilerChromium;
+    friend class TreeSynchronizer;
+
     LayerChromium();
 
     bool isPaintedAxisAlignedInScreen() const;
@@ -229,8 +248,6 @@ protected:
 
     RefPtr<LayerChromium> m_maskLayer;
 
-    friend class TreeSynchronizer;
-    friend class CCLayerImpl;
     // Constructs a CCLayerImpl of the correct runtime type for this LayerChromium type.
     virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
     int m_layerId;
@@ -239,10 +256,7 @@ private:
     void setParent(LayerChromium*);
     bool hasAncestor(LayerChromium*) const;
 
-    size_t numChildren() const
-    {
-        return m_children.size();
-    }
+    size_t numChildren() const { return m_children.size(); }
 
     // Returns the index of the child or -1 if not found.
     int indexOfChild(const LayerChromium*);
@@ -255,11 +269,14 @@ private:
 
     RefPtr<CCLayerTreeHost> m_layerTreeHost;
 
+    OwnPtr<CCLayerAnimationController> m_layerAnimationController;
+
     // Layer properties.
     IntSize m_bounds;
     IntRect m_visibleLayerRect;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_haveWheelEventHandlers;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
     Color m_backgroundColor;
@@ -267,6 +284,7 @@ private:
     Color m_debugBorderColor;
     float m_debugBorderWidth;
     float m_opacity;
+    FilterOperations m_filters;
     float m_anchorPointZ;
     bool m_isDrawable;
     bool m_masksToBounds;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 1e5ee563f..542b3ad1c 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -477,7 +477,7 @@ void LayerRendererChromium::drawSolidColorQuad(const CCSolidColorDrawQuad* quad)
 
     const Color& color = quad->color();
 
-    GLC(context(), context()->uniform4f(solidColorProgram->fragmentShader().colorLocation(), color.red(), color.green(), color.blue(), color.alpha()));
+    GLC(context(), context()->uniform4f(solidColorProgram->fragmentShader().colorLocation(), color.red() / 255.0, color.green() / 255.0, color.blue() / 255.0, color.alpha() / 255.0));
 
     float opacity = quad->opacity();
     drawTexturedQuad(tileTransform,
@@ -694,10 +694,154 @@ void LayerRendererChromium::drawCanvasQuad(const CCCanvasDrawQuad* quad)
     GLC(m_context.get(), m_context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
 }
 
+void LayerRendererChromium::drawYUV(const CCVideoDrawQuad* quad)
+{
+    const CCVideoLayerImpl::YUVProgram* program = videoLayerYUVProgram();
+    ASSERT(program && program->initialized());
+
+    const CCVideoLayerImpl::Texture& yTexture = quad->textures()[VideoFrameChromium::yPlane];
+    const CCVideoLayerImpl::Texture& uTexture = quad->textures()[VideoFrameChromium::uPlane];
+    const CCVideoLayerImpl::Texture& vTexture = quad->textures()[VideoFrameChromium::vPlane];
+
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE1));
+    GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, yTexture.m_texture->textureId()));
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE2));
+    GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, uTexture.m_texture->textureId()));
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE3));
+    GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, vTexture.m_texture->textureId()));
+
+    GLC(context(), context()->useProgram(program->program()));
+
+    float yWidthScaleFactor = static_cast<float>(yTexture.m_visibleSize.width()) / yTexture.m_texture->size().width();
+    // Arbitrarily take the u sizes because u and v dimensions are identical.
+    float uvWidthScaleFactor = static_cast<float>(uTexture.m_visibleSize.width()) / uTexture.m_texture->size().width();
+    GLC(context(), context()->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
+    GLC(context(), context()->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
+
+    GLC(context(), context()->uniform1i(program->fragmentShader().yTextureLocation(), 1));
+    GLC(context(), context()->uniform1i(program->fragmentShader().uTextureLocation(), 2));
+    GLC(context(), context()->uniform1i(program->fragmentShader().vTextureLocation(), 3));
+
+    GLC(context(), context()->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(CCVideoLayerImpl::yuv2RGB), 1));
+    GLC(context(), context()->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(CCVideoLayerImpl::yuvAdjust), 1));
+
+    const IntSize& bounds = quad->quadRect().size();
+    drawTexturedQuad(quad->layerTransform(), bounds.width(), bounds.height(), quad->opacity(), FloatQuad(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation(),
+                                    -1);
+
+    // Reset active texture back to texture 0.
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE0));
+}
+
+template<class Program>
+void LayerRendererChromium::drawSingleTextureVideoQuad(const CCVideoDrawQuad* quad, Program* program, float widthScaleFactor, Platform3DObject textureId, GC3Denum target)
+{
+    ASSERT(program && program->initialized());
+
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context(), context()->bindTexture(target, textureId));
+
+    GLC(context(), context()->useProgram(program->program()));
+    GLC(context(), context()->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
+    GLC(context(), context()->uniform1i(program->fragmentShader().samplerLocation(), 0));
+
+    const IntSize& bounds = quad->quadRect().size();
+    drawTexturedQuad(quad->layerTransform(), bounds.width(), bounds.height(), quad->opacity(), sharedGeometryQuad(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation(),
+                                    -1);
+}
+
+void LayerRendererChromium::drawRGBA(const CCVideoDrawQuad* quad)
+{
+    const CCVideoLayerImpl::RGBAProgram* program = videoLayerRGBAProgram();
+    const CCVideoLayerImpl::Texture& texture = quad->textures()[VideoFrameChromium::rgbPlane];
+    float widthScaleFactor = static_cast<float>(texture.m_visibleSize.width()) / texture.m_texture->size().width();
+    drawSingleTextureVideoQuad(quad, program, widthScaleFactor, texture.m_texture->textureId(), GraphicsContext3D::TEXTURE_2D);
+}
+
+void LayerRendererChromium::drawNativeTexture2D(const CCVideoDrawQuad* quad)
+{
+    const CCVideoLayerImpl::NativeTextureProgram* program = videoLayerNativeTextureProgram();
+    drawSingleTextureVideoQuad(quad, program, 1, quad->frame()->textureId(), GraphicsContext3D::TEXTURE_2D);
+}
+
+void LayerRendererChromium::drawStreamTexture(const CCVideoDrawQuad* quad)
+{
+    ASSERT(context()->getExtensions()->supports("GL_OES_EGL_image_external") && context()->getExtensions()->isEnabled("GL_OES_EGL_image_external"));
+
+    const CCVideoLayerImpl::StreamTextureProgram* program = streamTextureLayerProgram();
+    GLC(context(), context()->useProgram(program->program()));
+    ASSERT(quad->matrix());
+    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().texMatrixLocation(), false, const_cast<float*>(quad->matrix()), 1));
+
+    drawSingleTextureVideoQuad(quad, program, 1, quad->frame()->textureId(), Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES);
+}
+
+bool LayerRendererChromium::copyFrameToTextures(const CCVideoDrawQuad* quad)
+{
+    const VideoFrameChromium* frame = quad->frame();
+
+    for (unsigned plane = 0; plane < frame->planes(); ++plane) {
+        ASSERT(quad->frame()->requiredTextureSize(plane) == quad->textures()[plane].m_texture->size());
+        copyPlaneToTexture(quad, frame->data(plane), plane);
+    }
+    for (unsigned plane = frame->planes(); plane < CCVideoLayerImpl::MaxPlanes; ++plane) {
+        CCVideoLayerImpl::Texture* texture = &quad->textures()[plane];
+        texture->m_texture.clear();
+        texture->m_visibleSize = IntSize();
+    }
+    return true;
+}
+
+void LayerRendererChromium::copyPlaneToTexture(const CCVideoDrawQuad* quad, const void* plane, int index)
+{
+    CCVideoLayerImpl::Texture& texture = quad->textures()[index];
+    TextureAllocator* allocator = renderSurfaceTextureAllocator();
+    texture.m_texture->bindTexture(context(), allocator);
+    GC3Denum format = texture.m_texture->format();
+    IntSize dimensions = texture.m_texture->size();
+
+    void* mem = static_cast<Extensions3DChromium*>(context()->getExtensions())->mapTexSubImage2DCHROMIUM(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, Extensions3DChromium::WRITE_ONLY);
+    if (mem) {
+        memcpy(mem, plane, dimensions.width() * dimensions.height());
+        GLC(context(), static_cast<Extensions3DChromium*>(context()->getExtensions())->unmapTexSubImage2DCHROMIUM(mem));
+    } else {
+        // If mapTexSubImage2DCHROMIUM fails, then do the slower texSubImage2D
+        // upload. This does twice the copies as mapTexSubImage2DCHROMIUM, one
+        // in the command buffer and another to the texture.
+        GLC(context(), context()->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, plane));
+    }
+}
+
 void LayerRendererChromium::drawVideoQuad(const CCVideoDrawQuad* quad)
 {
-    CCLayerImpl* layer = quad->layer();
-    layer->draw(this);
+    ASSERT(CCProxy::isImplThread());
+
+    if (!quad->frame())
+        return;
+
+    if (!copyFrameToTextures(quad))
+        return;
+
+    switch (quad->format()) {
+    case GraphicsContext3D::LUMINANCE:
+        drawYUV(quad);
+        break;
+    case GraphicsContext3D::RGBA:
+        drawRGBA(quad);
+        break;
+    case GraphicsContext3D::TEXTURE_2D:
+        drawNativeTexture2D(quad);
+        break;
+    case Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES:
+        drawStreamTexture(quad);
+        break;
+    default:
+        CRASH(); // Someone updated convertVFCFormatToGC3DFormat above but update this!
+    }
 }
 
 struct PluginProgramBinding {
@@ -1255,6 +1399,16 @@ const CCVideoLayerImpl::NativeTextureProgram* LayerRendererChromium::videoLayerN
     return m_videoLayerNativeTextureProgram.get();
 }
 
+const CCVideoLayerImpl::StreamTextureProgram* LayerRendererChromium::streamTextureLayerProgram()
+{
+    if (!m_streamTextureLayerProgram)
+        m_streamTextureLayerProgram = adoptPtr(new CCVideoLayerImpl::StreamTextureProgram(m_context.get()));
+    if (!m_streamTextureLayerProgram->initialized()) {
+        TRACE_EVENT("LayerRendererChromium::streamTextureLayerProgram::initialize", this, 0);
+        m_streamTextureLayerProgram->initialize(m_context.get());
+    }
+    return m_streamTextureLayerProgram.get();
+}
 
 void LayerRendererChromium::cleanupSharedObjects()
 {
@@ -1296,6 +1450,8 @@ void LayerRendererChromium::cleanupSharedObjects()
         m_videoLayerRGBAProgram->cleanup(m_context.get());
     if (m_videoLayerYUVProgram)
         m_videoLayerYUVProgram->cleanup(m_context.get());
+    if (m_streamTextureLayerProgram)
+        m_streamTextureLayerProgram->cleanup(m_context.get());
 
     m_borderProgram.clear();
     m_headsUpDisplayProgram.clear();
@@ -1314,6 +1470,7 @@ void LayerRendererChromium::cleanupSharedObjects()
     m_renderSurfaceProgramAA.clear();
     m_videoLayerRGBAProgram.clear();
     m_videoLayerYUVProgram.clear();
+    m_streamTextureLayerProgram.clear();
     if (m_offscreenFramebufferId)
         GLC(m_context.get(), m_context->deleteFramebuffer(m_offscreenFramebufferId));
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index bea4baa41..ee9895ae1 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -130,6 +130,7 @@ public:
     const CCVideoLayerImpl::RGBAProgram* videoLayerRGBAProgram();
     const CCVideoLayerImpl::YUVProgram* videoLayerYUVProgram();
     const CCVideoLayerImpl::NativeTextureProgram* videoLayerNativeTextureProgram();
+    const CCVideoLayerImpl::StreamTextureProgram* streamTextureLayerProgram();
 
     void getFramebufferPixels(void *pixels, const IntRect&);
 
@@ -168,6 +169,14 @@ private:
     void drawPluginQuad(const CCPluginDrawQuad*);
 
     ManagedTexture* getOffscreenLayerTexture();
+    void copyPlaneToTexture(const CCVideoDrawQuad*, const void* plane, int index);
+    bool copyFrameToTextures(const CCVideoDrawQuad*);
+    template<class Program> void drawSingleTextureVideoQuad(const CCVideoDrawQuad*, Program*, float widthScaleFactor, Platform3DObject textureId, GC3Denum target);
+    void drawNativeTexture2D(const CCVideoDrawQuad*);
+    void drawStreamTexture(const CCVideoDrawQuad*);
+    void drawRGBA(const CCVideoDrawQuad*);
+    void drawYUV(const CCVideoDrawQuad*);
+
     void copyOffscreenTextureToDisplay();
 
     void setDrawViewportRect(const IntRect&, bool flipY);
@@ -226,6 +235,7 @@ private:
     OwnPtr<CCVideoLayerImpl::RGBAProgram> m_videoLayerRGBAProgram;
     OwnPtr<CCVideoLayerImpl::YUVProgram> m_videoLayerYUVProgram;
     OwnPtr<CCVideoLayerImpl::NativeTextureProgram> m_videoLayerNativeTextureProgram;
+    OwnPtr<CCVideoLayerImpl::StreamTextureProgram> m_streamTextureLayerProgram;
 
     OwnPtr<TextureManager> m_renderSurfaceTextureManager;
     OwnPtr<TrackingTextureAllocator> m_contentsTextureAllocator;
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index 73f3ab27a..69ce9526c 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -29,6 +29,7 @@
 
 #include "RenderSurfaceChromium.h"
 
+#include "FilterOperations.h"
 #include "GraphicsContext3D.h"
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
@@ -41,6 +42,7 @@ RenderSurfaceChromium::RenderSurfaceChromium(LayerChromium* owningLayer)
     , m_maskLayer(0)
     , m_skipsDraw(false)
     , m_drawOpacity(1)
+    , m_nearestAncestorThatMovesPixels(0)
 {
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index 3c6f1649a..9045425bc 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -39,6 +39,7 @@
 
 namespace WebCore {
 
+class FilterOperations;
 class LayerChromium;
 class LayerRendererChromium;
 class ManagedTexture;
@@ -76,6 +77,9 @@ public:
     const IntRect& clipRect() const { return m_clipRect; }
     void setClipRect(const IntRect& clipRect) { m_clipRect = clipRect; }
 
+    void setFilters(const FilterOperations& filters) { m_filters = filters; }
+    const FilterOperations& filters() const { return m_filters; }
+
     bool skipsDraw() const { return m_skipsDraw; }
     void setSkipsDraw(bool skipsDraw) { m_skipsDraw = skipsDraw; }
 
@@ -84,6 +88,9 @@ public:
 
     void setMaskLayer(LayerChromium* maskLayer) { m_maskLayer = maskLayer; }
 
+    void setNearestAncestorThatMovesPixels(RenderSurfaceChromium* surface) { m_nearestAncestorThatMovesPixels = surface; }
+    const RenderSurfaceChromium* nearestAncestorThatMovesPixels() const { return m_nearestAncestorThatMovesPixels; }
+
 private:
     LayerChromium* m_owningLayer;
     LayerChromium* m_maskLayer;
@@ -95,9 +102,14 @@ private:
     TransformationMatrix m_drawTransform;
     TransformationMatrix m_replicaDrawTransform;
     TransformationMatrix m_originTransform;
+    FilterOperations m_filters;
     IntRect m_clipRect;
     Vector<RefPtr<LayerChromium> > m_layerList;
 
+    // The nearest ancestor target surface that will contain the contents of this surface, and that is going
+    // to move pixels within the surface (such as with a blur). This can point to itself.
+    RenderSurfaceChromium* m_nearestAncestorThatMovesPixels;
+
     // For CCLayerIteratorActions
     int m_targetRenderSurfaceLayerIndexHistory;
     int m_currentLayerIndexHistory;
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
index f69b6b18a..71d4d1fd1 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
@@ -255,6 +255,39 @@ String VertexShaderTile::getShaderString() const
     );
 }
 
+VertexShaderVideoTransform::VertexShaderVideoTransform()
+    : m_matrixLocation(-1)
+    , m_texTransformLocation(-1)
+    , m_texMatrixLocation(-1)
+{
+}
+
+bool VertexShaderVideoTransform::init(GraphicsContext3D* context, unsigned program)
+{
+    m_matrixLocation = context->getUniformLocation(program, "matrix");
+    m_texTransformLocation = context->getUniformLocation(program, "texTransform");
+    m_texMatrixLocation = context->getUniformLocation(program, "texMatrix");
+    return m_matrixLocation != -1 && m_texTransformLocation != -1 && m_texMatrixLocation != -1;
+}
+
+String VertexShaderVideoTransform::getShaderString() const
+{
+    return SHADER(
+        attribute vec4 a_position;
+        attribute vec2 a_texCoord;
+        uniform mat4 matrix;
+        uniform vec4 texTransform;
+        uniform mat4 texMatrix;
+        varying vec2 v_texCoord;
+        void main()
+        {
+            gl_Position = matrix * a_position;
+            vec2 texCoord = vec2(texMatrix * vec4(a_texCoord.x, 1.0 - a_texCoord.y, 0.0, 1.0));
+            v_texCoord = texCoord * texTransform.zw + texTransform.xy;
+        }
+    );
+}
+
 FragmentTexAlphaBinding::FragmentTexAlphaBinding()
     : m_samplerLocation(-1)
     , m_alphaLocation(-1)
@@ -296,6 +329,27 @@ String FragmentShaderRGBATexFlipAlpha::getShaderString() const
     );
 }
 
+bool FragmentShaderOESImageExternal::init(GraphicsContext3D* context, unsigned program)
+{
+    m_samplerLocation = context->getUniformLocation(program, "s_texture");
+
+    return m_samplerLocation != -1;
+}
+
+String FragmentShaderOESImageExternal::getShaderString() const
+{
+    // Cannot use the SHADER() macro because of the '#' char
+    return "#extension GL_OES_EGL_image_external : require \n"
+           "precision mediump float;\n"
+           "varying vec2 v_texCoord;\n"
+           "uniform samplerExternalOES s_texture;\n"
+           "void main()\n"
+           "{\n"
+           "    vec4 texColor = texture2D(s_texture, v_texCoord);\n"
+           "    gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w);\n"
+           "}\n";
+}
+
 String FragmentShaderRGBATexAlpha::getShaderString() const
 {
     return SHADER(
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 34323e6d3..9499ac7fd 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -145,6 +145,23 @@ private:
     int m_vertexTexTransformLocation;
 };
 
+class VertexShaderVideoTransform {
+public:
+    VertexShaderVideoTransform();
+
+    bool init(GraphicsContext3D*, unsigned program);
+    String getShaderString() const;
+
+    int matrixLocation() const { return m_matrixLocation; }
+    int texTransformLocation() const { return m_texTransformLocation; }
+    int texMatrixLocation() const { return m_texMatrixLocation; }
+
+private:
+    int m_matrixLocation;
+    int m_texTransformLocation;
+    int m_texMatrixLocation;
+};
+
 class FragmentTexAlphaBinding {
 public:
     FragmentTexAlphaBinding();
@@ -211,6 +228,15 @@ public:
     String getShaderString() const;
 };
 
+// Fragment shader for external textures.
+class FragmentShaderOESImageExternal : public FragmentTexAlphaBinding {
+public:
+    String getShaderString() const;
+    bool init(GraphicsContext3D*, unsigned program);
+private:
+    int m_samplerLocation;
+};
+
 class FragmentShaderRGBATexAlphaAA {
 public:
     FragmentShaderRGBATexAlphaAA();
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
index 7fcc6059f..ecdefa411 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
@@ -48,13 +48,15 @@ class SkPictureCanvasLayerTextureUpdater : public CanvasLayerTextureUpdater {
 public:
     virtual ~SkPictureCanvasLayerTextureUpdater();
 
+    virtual void setOpaque(bool);
+
 protected:
     explicit SkPictureCanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
 
     virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, int borderTexels, float contentsScale, IntRect* resultingOpaqueRect);
     void drawPicture(SkCanvas*);
 
-    virtual void setOpaque(bool);
+    bool layerIsOpaque() const { return m_layerIsOpaque; }
 
 private:
     // Recording canvas.
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
index 131a9c70e..0c6fe14f9 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
@@ -184,6 +184,12 @@ void TextureManager::unprotectAllTextures()
         it->second.isProtected = false;
 }
 
+void TextureManager::evictTexture(TextureToken token, TextureInfo info)
+{
+    TRACE_EVENT("TextureManager::evictTexture", this, 0);
+    removeTexture(token, info);
+}
+
 void TextureManager::reduceMemoryToLimit(size_t limit)
 {
     while (m_memoryUseBytes > limit) {
@@ -194,7 +200,7 @@ void TextureManager::reduceMemoryToLimit(size_t limit)
             TextureInfo info = m_textures.get(token);
             if (info.isProtected)
                 continue;
-            removeTexture(token, info);
+            evictTexture(token, info);
             foundCandidate = true;
             break;
         }
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.h b/Source/WebCore/platform/graphics/chromium/TextureManager.h
index 8259adb10..e4d6d38b8 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.h
@@ -109,6 +109,7 @@ private:
 
     void addTexture(TextureToken, TextureInfo);
     void removeTexture(TextureToken, TextureInfo);
+    void evictTexture(TextureToken, TextureInfo);
 
     HashSet<ManagedTexture*> m_registeredTextures;
 
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index d9e2487d8..a9cf7d6fd 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -53,10 +53,9 @@ namespace WebCore {
 class UpdatableTile : public CCLayerTilingData::Tile {
     WTF_MAKE_NONCOPYABLE(UpdatableTile);
 public:
-    explicit UpdatableTile(PassOwnPtr<LayerTextureUpdater::Texture> texture)
-        : m_partialUpdate(false)
-        , m_texture(texture)
+    static PassOwnPtr<UpdatableTile> create(PassOwnPtr<LayerTextureUpdater::Texture> texture)
     {
+        return adoptPtr(new UpdatableTile(texture));
     }
 
     LayerTextureUpdater::Texture* texture() { return m_texture.get(); }
@@ -74,6 +73,12 @@ public:
     IntRect m_opaqueRect;
     bool m_partialUpdate;
 private:
+    explicit UpdatableTile(PassOwnPtr<LayerTextureUpdater::Texture> texture)
+        : m_partialUpdate(false)
+        , m_texture(texture)
+    {
+    }
+
     OwnPtr<LayerTextureUpdater::Texture> m_texture;
 };
 
@@ -292,16 +297,19 @@ UpdatableTile* TiledLayerChromium::tileAt(int i, int j) const
 
 UpdatableTile* TiledLayerChromium::createTile(int i, int j)
 {
-    RefPtr<UpdatableTile> tile = adoptRef(new UpdatableTile(textureUpdater()->createTexture(textureManager())));
-    m_tiler->addTile(tile, i, j);
-    tile->m_dirtyRect = m_tiler->tileRect(tile.get());
+    OwnPtr<UpdatableTile> tile(UpdatableTile::create(textureUpdater()->createTexture(textureManager())));
+    UpdatableTile* addedTile = tile.get();
+    m_tiler->addTile(tile.release(), i, j);
 
-    return tile.get();
+    addedTile->m_dirtyRect = m_tiler->tileRect(addedTile);
+    return addedTile;
 }
 
 void TiledLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
-    IntRect dirty = enclosingIntRect(dirtyRect);
+    FloatRect scaledDirtyRect(dirtyRect);
+    scaledDirtyRect.scale(contentsScale());
+    IntRect dirty = enclosingIntRect(scaledDirtyRect);
     invalidateRect(dirty);
     LayerChromium::setNeedsDisplayRect(dirtyRect);
 }
@@ -337,7 +345,7 @@ void TiledLayerChromium::invalidateRect(const IntRect& layerRect)
 
 void TiledLayerChromium::protectVisibleTileTextures()
 {
-    protectTileTextures(IntRect(IntPoint::zero(), contentBounds()));
+    protectTileTextures(visibleLayerRect());
 }
 
 void TiledLayerChromium::protectTileTextures(const IntRect& layerRect)
@@ -466,12 +474,18 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
 
             IntRect tileRect = m_tiler->tileBounds(i, j);
 
-            // Save what was painted opaque in the tile. If everything painted in the tile was opaque, and the area is a subset of an
-            // already opaque area, keep the old area.
+            // Save what was painted opaque in the tile. Keep the old area if the paint didn't touch it, and didn't paint some
+            // other part of the tile opaque.
             IntRect tilePaintedRect = intersection(tileRect, m_paintRect);
             IntRect tilePaintedOpaqueRect = intersection(tileRect, paintedOpaqueRect);
-            if (tilePaintedOpaqueRect != tilePaintedRect || !tile->m_opaqueRect.contains(tilePaintedOpaqueRect))
-                tile->m_opaqueRect = tilePaintedOpaqueRect;
+            if (!tilePaintedRect.isEmpty()) {
+                IntRect paintInsideTileOpaqueRect = intersection(tile->m_opaqueRect, tilePaintedRect);
+                bool paintInsideTileOpaqueRectIsNonOpaque = !tilePaintedOpaqueRect.contains(paintInsideTileOpaqueRect);
+                bool opaquePaintNotInsideTileOpaqueRect = !tilePaintedOpaqueRect.isEmpty() && !tile->m_opaqueRect.contains(tilePaintedOpaqueRect);
+
+                if (paintInsideTileOpaqueRectIsNonOpaque || opaquePaintNotInsideTileOpaqueRect)
+                    tile->m_opaqueRect = tilePaintedOpaqueRect;
+            }
 
             // Use m_updateRect as copyAndClearDirty above moved the existing dirty rect to m_updateRect.
             const IntRect& dirtyRect = tile->m_updateRect;
@@ -544,7 +558,9 @@ void TiledLayerChromium::addSelfToOccludedScreenSpace(Region& occludedScreenSpac
             if (tile) {
                 IntRect visibleTileOpaqueRect = intersection(visibleRect, tile->m_opaqueRect);
                 FloatRect screenRect = contentTransform.mapRect(FloatRect(visibleTileOpaqueRect));
-                occludedScreenSpace.unite(enclosedIntRect(screenRect));
+                IntRect screenIntRect = enclosedIntRect(screenRect);
+                if (!screenIntRect.isEmpty())
+                    occludedScreenSpace.unite(screenIntRect);
             }
         }
     }
diff --git a/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h b/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h
index c4abd969d..2d76c4755 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h
@@ -75,6 +75,7 @@ public:
     virtual const IntSize requiredTextureSize(unsigned plane) const = 0;
     virtual bool hasPaddingBytes(unsigned plane) const = 0;
     virtual unsigned textureId() const = 0;
+    virtual unsigned textureTarget() const = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h b/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h
index 3d43a90c3..9794794a7 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h
@@ -43,6 +43,8 @@ public:
     public:
         // Provider will call this method to tell the client to stop using it.
         virtual void stopUsingProvider() = 0;
+        virtual void didReceiveFrame() = 0;
+        virtual void didUpdateMatrix(const float*) = 0;
     };
 
     virtual void setVideoFrameProviderClient(Client*) = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index ae2ae8c80..3b44eda38 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -57,6 +57,12 @@ PassRefPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
     return CCVideoLayerImpl::create(m_layerId, m_provider);
 }
 
+void VideoLayerChromium::contentChanged()
+{
+    m_updateRect = FloatRect(FloatPoint(), contentBounds());
+    setNeedsDisplay();
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 878806e26..65cf5c668 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -50,6 +50,8 @@ public:
 
     virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
 
+    void contentChanged();
+
 private:
     explicit VideoLayerChromium(VideoFrameProvider*);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp
index 21e6cc7a9..8c0303ed6 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp
@@ -32,9 +32,15 @@
 
 namespace WebCore {
 
-CCActiveAnimation::CCActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, GroupID group, TargetProperty targetProperty)
-    : m_animationCurve(curve)
-    , m_group(group)
+PassOwnPtr<CCActiveAnimation> CCActiveAnimation::create(PassOwnPtr<CCAnimationCurve> curve, int animationId, int groupId, TargetProperty targetProperty)
+{
+    return adoptPtr(new CCActiveAnimation(curve, animationId, groupId, targetProperty));
+}
+
+CCActiveAnimation::CCActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, int animationId, int groupId, TargetProperty targetProperty)
+    : m_curve(curve)
+    , m_id(animationId)
+    , m_group(groupId)
     , m_targetProperty(targetProperty)
     , m_runState(WaitingForTargetAvailability)
     , m_iterations(1)
@@ -44,6 +50,10 @@ CCActiveAnimation::CCActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, GroupID
 {
 }
 
+CCActiveAnimation::~CCActiveAnimation()
+{
+}
+
 void CCActiveAnimation::setRunState(RunState runState, double now)
 {
     if (runState == Running && m_runState == Paused)
@@ -60,7 +70,22 @@ bool CCActiveAnimation::isFinishedAt(double time) const
 
     return m_runState == Running
         && m_iterations >= 0
-        && m_iterations * m_animationCurve->duration() <= time - startTime() - m_totalPausedTime;
+        && m_iterations * m_curve->duration() <= time - startTime() - m_totalPausedTime;
+}
+
+bool CCActiveAnimation::isWaiting() const
+{
+    return m_runState == WaitingForNextTick
+        || m_runState == WaitingForTargetAvailability
+        || m_runState == WaitingForStartTime;
+}
+
+bool CCActiveAnimation::isRunningOrHasRun() const
+{
+    return m_runState == Running
+        || m_runState == Finished
+        || m_runState == Aborted
+        || m_runState == Paused;
 }
 
 double CCActiveAnimation::trimTimeToCurrentIteration(double now) const
@@ -84,15 +109,47 @@ double CCActiveAnimation::trimTimeToCurrentIteration(double now) const
         return 0;
 
     // If less than an iteration duration, just return trimmed.
-    if (trimmed < m_animationCurve->duration())
+    if (trimmed < m_curve->duration())
         return trimmed;
 
     // If greater than or equal to the total duration, return iteration duration.
-    if (m_iterations >= 0 && trimmed >= m_animationCurve->duration() * m_iterations)
-        return m_animationCurve->duration();
+    if (m_iterations >= 0 && trimmed >= m_curve->duration() * m_iterations)
+        return m_curve->duration();
 
     // Finally, return x where trimmed = x + n * m_animation->duration() for some positive integer n.
-    return fmod(trimmed, m_animationCurve->duration());
+    return fmod(trimmed, m_curve->duration());
+}
+
+PassOwnPtr<CCActiveAnimation> CCActiveAnimation::cloneForImplThread() const
+{
+    OwnPtr<CCActiveAnimation> toReturn(adoptPtr(new CCActiveAnimation(m_curve->clone(), m_id, m_group, m_targetProperty)));
+    toReturn->m_runState = m_runState;
+    toReturn->m_iterations = m_iterations;
+    toReturn->m_startTime = m_startTime;
+    toReturn->m_pauseTime = m_pauseTime;
+    toReturn->m_totalPausedTime = m_totalPausedTime;
+    return toReturn.release();
+}
+
+void CCActiveAnimation::synchronizeProperties(CCActiveAnimation* other)
+{
+    // It is possible for the impl thread to initiate a run state change.
+    // This happens when the animation was waiting for a future event to take
+    // place, and the event has happened. In that case, we want 'this' to
+    // assume the impl thread's run state and start time.
+    if (isWaiting() && other->isRunningOrHasRun()) {
+        m_runState = other->m_runState;
+        m_startTime = other->m_startTime;
+    } else {
+        other->m_runState = m_runState;
+        other->m_startTime = m_startTime;
+    }
+
+    // Change in state related to iterations and pause is always initiated from
+    // the main thread, so it is safe to push properties in that direction.
+    other->m_iterations = m_iterations;
+    other->m_pauseTime = m_pauseTime;
+    other->m_totalPausedTime = m_totalPausedTime;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
index c22227941..2093421a7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
@@ -25,25 +25,20 @@
 #ifndef CCActiveAnimation_h
 #define CCActiveAnimation_h
 
+#include "cc/CCAnimationCurve.h"
+
+#include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class CCAnimationCurve;
-
 // A CCActiveAnimation, contains all the state required to play a CCAnimationCurve.
 // Specifically, the affected property, the run state (paused, finished, etc.),
 // loop count, last pause time, and the total time spent paused.
 class CCActiveAnimation {
+    WTF_MAKE_NONCOPYABLE(CCActiveAnimation);
 public:
-    // Animations that must be run together are called 'grouped' and have the same GroupID
-    // Grouped animations are guaranteed to start at the same time and no other animations
-    // may animate any of the group's target properties until all animations in the
-    // group have finished animating. Note: an active animation's group id and target
-    // property uniquely identify that animation.
-    typedef int GroupID;
-
     // Animations begin in one of the 'waiting' states. Animations waiting for the next tick
     // will start the next time the controller animates. Animations waiting for target
     // availibility will run as soon as their target property is free (and all the animations
@@ -68,14 +63,20 @@ public:
         Opacity
     };
 
-    static PassOwnPtr<CCActiveAnimation> create(PassOwnPtr<CCAnimationCurve> curve, GroupID group, TargetProperty targetProperty)
-    {
-        return adoptPtr(new CCActiveAnimation(curve, group, targetProperty));
-    }
+    struct AnimationSignature {
+        AnimationSignature(int groupId, TargetProperty targetProperty)
+            : groupId(groupId)
+            , targetProperty(targetProperty) { }
+        int groupId;
+        TargetProperty targetProperty;
+    };
 
-    virtual ~CCActiveAnimation() { }
+    static PassOwnPtr<CCActiveAnimation> create(PassOwnPtr<CCAnimationCurve>, int animationId, int groupId, TargetProperty);
 
-    GroupID group() const { return m_group; }
+    virtual ~CCActiveAnimation();
+
+    int id() const { return m_id; }
+    int group() const { return m_group; }
     TargetProperty targetProperty() const { return m_targetProperty; }
 
     RunState runState() const { return m_runState; }
@@ -93,18 +94,37 @@ public:
     bool isFinishedAt(double time) const;
     bool isFinished() const { return m_runState == Finished || m_runState == Aborted; }
 
-    CCAnimationCurve* animationCurve() { return m_animationCurve.get(); }
-    const CCAnimationCurve* animationCurve() const { return m_animationCurve.get(); }
+    bool isWaiting() const;
+    bool isRunningOrHasRun() const;
+
+    CCAnimationCurve* curve() { return m_curve.get(); }
+    const CCAnimationCurve* curve() const { return m_curve.get(); }
 
     // Takes the given absolute time, and using the start time and the number
     // of iterations, returns the relative time in the current iteration.
     double trimTimeToCurrentIteration(double now) const;
 
+    AnimationSignature signature() const { return AnimationSignature(m_group, m_targetProperty); }
+
+    PassOwnPtr<CCActiveAnimation> cloneForImplThread() const;
+
+    void synchronizeProperties(CCActiveAnimation*);
+
 private:
-    CCActiveAnimation(PassOwnPtr<CCAnimationCurve>, GroupID, TargetProperty);
+    CCActiveAnimation(PassOwnPtr<CCAnimationCurve>, int animationId, int groupId, TargetProperty);
+
+    OwnPtr<CCAnimationCurve> m_curve;
+
+    // IDs are not necessarily unique.
+    int m_id;
+
+    // Animations that must be run together are called 'grouped' and have the same group id
+    // Grouped animations are guaranteed to start at the same time and no other animations
+    // may animate any of the group's target properties until all animations in the
+    // group have finished animating. Note: an active animation's group id and target
+    // property uniquely identify that animation.
+    int m_group;
 
-    OwnPtr<CCAnimationCurve> m_animationCurve;
-    GroupID m_group;
     TargetProperty m_targetProperty;
     RunState m_runState;
     int m_iterations;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h
index de97e38c0..533abafef 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h
@@ -25,6 +25,10 @@
 #ifndef CCAnimationCurve_h
 #define CCAnimationCurve_h
 
+#include "TransformationMatrix.h"
+
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 
 class CCFloatAnimationCurve;
@@ -41,6 +45,7 @@ public:
 
     virtual double duration() const = 0;
     virtual Type type() const = 0;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const = 0;
 
     const CCFloatAnimationCurve* toFloatAnimationCurve() const;
     const CCTransformAnimationCurve* toTransformAnimationCurve() const;
@@ -60,7 +65,7 @@ class CCTransformAnimationCurve : public CCAnimationCurve {
 public:
     virtual ~CCTransformAnimationCurve() { }
 
-    virtual TransformOperations getValue(double t) const = 0;
+    virtual TransformationMatrix getValue(double t, const IntSize& layerSize) const = 0;
 
     // Partial CCAnimation implementation.
     virtual Type type() const { return Transform; }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
new file mode 100644
index 000000000..b21a79e31
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCAnimationEvents_h
+#define CCAnimationEvents_h
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+// Indicates that an animation has started on a particular layer.
+struct CCAnimationStartedEvent {
+    CCAnimationStartedEvent(int layerID, double time)
+        : layerID(layerID)
+        , time(time) { }
+    int layerID;
+    double time;
+};
+
+typedef Vector<CCAnimationStartedEvent> CCAnimationEventsVector;
+
+} // namespace WebCore
+
+#endif // CCAnimationEvents_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index 708bcff88..3ddc123c0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -32,6 +32,7 @@
 #include "FontCache.h"
 #include "FontDescription.h"
 #include "GraphicsContext3D.h"
+#include "InspectorController.h"
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
 #include "ManagedTexture.h"
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
index 057d79b1a..6c055994c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
@@ -46,13 +46,14 @@ public:
     virtual void setNeedsRedraw() = 0;
 
     enum ScrollStatus { ScrollFailed, ScrollStarted, ScrollIgnored };
+    enum ScrollInputType { Gesture, Wheel };
 
     // Attempt to start scrolling a layer at a given point in window
     // coordinates. Returns ScrollStarted if the layer at the coordinates can
     // be scrolled, ScrollFailed if the scroll event should instead be
     // delegated to the main thread, or ScrollIgnored if there is nothing to
     // be scrolled at the given coordinates.
-    virtual ScrollStatus scrollBegin(const IntPoint&) = 0;
+    virtual ScrollStatus scrollBegin(const IntPoint&, ScrollInputType) = 0;
 
     // Scroll the layer selected with scrollBegin(). If there is no room to
     // move the layer in the requested direction, its first ancestor layer that
@@ -64,7 +65,6 @@ public:
     // called if scrollBegin() returned ScrollStarted.
     virtual void scrollEnd() = 0;
 
-    virtual bool haveWheelEventHandlers() = 0;
     virtual void pinchGestureBegin() = 0;
     virtual void pinchGestureUpdate(float magnifyDelta, const IntPoint& anchor) = 0;
     virtual void pinchGestureEnd() = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
new file mode 100644
index 000000000..b615c736c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCKeyframedAnimationCurve.h"
+
+#include "IdentityTransformOperation.h"
+#include "Matrix3DTransformOperation.h"
+#include "MatrixTransformOperation.h"
+#include "PerspectiveTransformOperation.h"
+#include "RotateTransformOperation.h"
+#include "ScaleTransformOperation.h"
+#include "SkewTransformOperation.h"
+#include "TranslateTransformOperation.h"
+
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+namespace {
+
+template <class Keyframe>
+bool keyframesAreSorted(const Vector<Keyframe>& keyframes)
+{
+    if (!keyframes.size())
+        return true;
+
+    for (size_t i = 0; i < keyframes.size() - 1; ++i) {
+        if (keyframes[i].time > keyframes[i+1].time)
+            return false;
+    }
+
+    return true;
+}
+
+} // namespace
+
+PassOwnPtr<CCKeyframedFloatAnimationCurve> CCKeyframedFloatAnimationCurve::create(const Vector<CCFloatKeyframe>& keyframes)
+{
+    if (!keyframes.size() || !keyframesAreSorted(keyframes))
+        return nullptr;
+
+    return adoptPtr(new CCKeyframedFloatAnimationCurve(keyframes));
+}
+
+CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>& keyframes)
+    : m_keyframes(keyframes)
+{
+}
+
+CCKeyframedFloatAnimationCurve::~CCKeyframedFloatAnimationCurve()
+{
+}
+
+double CCKeyframedFloatAnimationCurve::duration() const
+{
+    return m_keyframes.last().time - m_keyframes.first().time;
+}
+
+PassOwnPtr<CCAnimationCurve> CCKeyframedFloatAnimationCurve::clone() const
+{
+    return adoptPtr(new CCKeyframedFloatAnimationCurve(*this));
+}
+
+float CCKeyframedFloatAnimationCurve::getValue(double t) const
+{
+    if (t <= m_keyframes.first().time)
+        return m_keyframes.first().value;
+
+    if (t >= m_keyframes.last().time)
+        return m_keyframes.last().value;
+
+    size_t i = 0;
+    for (; i < m_keyframes.size() - 1; ++i) {
+        if (t < m_keyframes[i+1].time)
+            break;
+    }
+
+    float progress = static_cast<float>((t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time));
+    // FIXME: apply timing function here.
+    return m_keyframes[i].value + (m_keyframes[i+1].value - m_keyframes[i].value) * progress;
+}
+
+PassOwnPtr<CCKeyframedTransformAnimationCurve> CCKeyframedTransformAnimationCurve::create(const Vector<CCTransformKeyframe>& keyframes)
+{
+    if (!keyframes.size() || !keyframesAreSorted(keyframes))
+        return nullptr;
+
+    return adoptPtr(new CCKeyframedTransformAnimationCurve(keyframes));
+}
+
+CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>& keyframes)
+    : m_keyframes(keyframes)
+{
+}
+
+CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve() { }
+
+double CCKeyframedTransformAnimationCurve::duration() const
+{
+    return m_keyframes.last().time - m_keyframes.first().time;
+}
+
+PassOwnPtr<CCAnimationCurve> CCKeyframedTransformAnimationCurve::clone() const
+{
+    Vector<CCTransformKeyframe> keyframes;
+    // We need to do a deep copy of all of the keyframes since they contain ref
+    // pointers to TransformOperation objects.
+    for (size_t i = 0; i < m_keyframes.size(); ++i) {
+        CCTransformKeyframe keyframe(m_keyframes[i].time);
+        for (size_t j = 0; j < m_keyframes[i].value.size(); ++j) {
+            TransformOperation::OperationType operationType = m_keyframes[i].value.operations()[j]->getOperationType();
+            switch (operationType) {
+            case TransformOperation::SCALE_X:
+            case TransformOperation::SCALE_Y:
+            case TransformOperation::SCALE_Z:
+            case TransformOperation::SCALE_3D:
+            case TransformOperation::SCALE: {
+                ScaleTransformOperation* transform = static_cast<ScaleTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(ScaleTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+                break;
+            }
+            case TransformOperation::TRANSLATE_X:
+            case TransformOperation::TRANSLATE_Y:
+            case TransformOperation::TRANSLATE_Z:
+            case TransformOperation::TRANSLATE_3D:
+            case TransformOperation::TRANSLATE: {
+                TranslateTransformOperation* transform = static_cast<TranslateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(TranslateTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+                break;
+            }
+            case TransformOperation::ROTATE_X:
+            case TransformOperation::ROTATE_Y:
+            case TransformOperation::ROTATE_3D:
+            case TransformOperation::ROTATE: {
+                RotateTransformOperation* transform = static_cast<RotateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(RotateTransformOperation::create(transform->x(), transform->y(), transform->z(), transform->angle(), operationType));
+                break;
+            }
+            case TransformOperation::SKEW_X:
+            case TransformOperation::SKEW_Y:
+            case TransformOperation::SKEW: {
+                SkewTransformOperation* transform = static_cast<SkewTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(SkewTransformOperation::create(transform->angleX(), transform->angleY(), operationType));
+                break;
+            }
+            case TransformOperation::MATRIX: {
+                MatrixTransformOperation* transform = static_cast<MatrixTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                TransformationMatrix m = transform->matrix();
+                keyframe.value.operations().append(MatrixTransformOperation::create(m.a(), m.b(), m.c(), m.d(), m.e(), m.f()));
+                break;
+            }
+            case TransformOperation::MATRIX_3D: {
+                Matrix3DTransformOperation* transform = static_cast<Matrix3DTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(Matrix3DTransformOperation::create(transform->matrix()));
+                break;
+            }
+            case TransformOperation::PERSPECTIVE: {
+                PerspectiveTransformOperation* transform = static_cast<PerspectiveTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(PerspectiveTransformOperation::create(transform->perspective()));
+                break;
+            }
+            case TransformOperation::IDENTITY: {
+                keyframe.value.operations().append(IdentityTransformOperation::create());
+                break;
+            }
+            case TransformOperation::NONE:
+                // Do nothing.
+                break;
+            } // switch
+        } // for each operation
+        keyframes.append(keyframe);
+    }
+    return CCKeyframedTransformAnimationCurve::create(keyframes);
+}
+
+TransformationMatrix CCKeyframedTransformAnimationCurve::getValue(double t, const IntSize& layerSize) const
+{
+    TransformationMatrix transformMatrix;
+
+    if (t <= m_keyframes.first().time) {
+        m_keyframes.first().value.apply(layerSize, transformMatrix);
+        return transformMatrix;
+    }
+
+    if (t >= m_keyframes.last().time) {
+        m_keyframes.last().value.apply(layerSize, transformMatrix);
+        return transformMatrix;
+    }
+
+    size_t i = 0;
+    for (; i < m_keyframes.size() - 1; ++i) {
+        if (t < m_keyframes[i+1].time)
+            break;
+    }
+
+    // FIXME: apply timing function here.
+    double progress = (t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time);
+
+    if (m_keyframes[i].value.operationsMatch(m_keyframes[i+1].value)) {
+        for (size_t j = 0; j < m_keyframes[i+1].value.size(); ++j)
+            m_keyframes[i+1].value.operations()[j]->blend(m_keyframes[i].value.at(j), progress)->apply(transformMatrix, layerSize);
+    } else {
+        TransformationMatrix source;
+
+        m_keyframes[i].value.apply(layerSize, source);
+        m_keyframes[i+1].value.apply(layerSize, transformMatrix);
+
+        transformMatrix.blend(source, progress);
+    }
+
+    return transformMatrix;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
new file mode 100644
index 000000000..1c4d64adb
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCKeyframedAnimationCurve_h
+#define CCKeyframedAnimationCurve_h
+
+#include "TransformOperations.h"
+#include "cc/CCAnimationCurve.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+struct CCFloatKeyframe {
+    CCFloatKeyframe(double time, float value)
+        : time(time)
+        , value(value)
+    {
+    }
+
+    double time;
+    float value;
+};
+
+struct CCTransformKeyframe {
+    explicit CCTransformKeyframe(double time)
+        : time(time)
+    {
+    }
+
+    CCTransformKeyframe(double time, const TransformOperations& value)
+        : time(time)
+        , value(value)
+    {
+    }
+
+    double time;
+    TransformOperations value;
+};
+
+class CCKeyframedFloatAnimationCurve : public CCFloatAnimationCurve {
+public:
+    // It is required that the keyframes be sorted by time.
+    static PassOwnPtr<CCKeyframedFloatAnimationCurve> create(const Vector<CCFloatKeyframe>& keyframes);
+
+    virtual ~CCKeyframedFloatAnimationCurve();
+
+    // CCAnimationCurve implementation
+    virtual double duration() const;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const;
+
+    // CCFloatAnimationCurve implementation
+    virtual float getValue(double t) const;
+
+private:
+    explicit CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>&);
+
+    // Always sorted in order of increasing time. No two keyframes have the
+    // same time.
+    Vector<CCFloatKeyframe> m_keyframes;
+};
+
+class CCKeyframedTransformAnimationCurve : public CCTransformAnimationCurve {
+public:
+    // It is required that the keyframes be sorted by time.
+    static PassOwnPtr<CCKeyframedTransformAnimationCurve> create(const Vector<CCTransformKeyframe>& keyframes);
+
+    virtual ~CCKeyframedTransformAnimationCurve();
+
+    // CCAnimationCurve implementation
+    virtual double duration() const;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const;
+
+    // CCTransformAnimationCurve implementation
+    virtual TransformationMatrix getValue(double t, const IntSize&) const;
+
+private:
+    explicit CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>&);
+
+    // Always sorted in order of increasing time. No two keyframes have the
+    // same time.
+    Vector<CCTransformKeyframe> m_keyframes;
+};
+
+} // namespace WebCore
+
+#endif // CCKeyframedAnimationCurve_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
new file mode 100644
index 000000000..d9e72efc4
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCLayerAnimationController.h"
+
+#include "GraphicsLayer.h" // for KeyframeValueList
+#include "cc/CCActiveAnimation.h"
+#include "cc/CCKeyframedAnimationCurve.h"
+#include "cc/CCLayerAnimationControllerImpl.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+namespace {
+
+template <typename Keyframe, typename Value>
+void appendKeyframe(Vector<Keyframe>& keyframes, double keyTime, const Value* value)
+{
+    keyframes.append(Keyframe(keyTime, value->value()));
+}
+
+template <>
+void appendKeyframe<CCTransformKeyframe, TransformAnimationValue>(Vector<CCTransformKeyframe>& keyframes, double keyTime, const TransformAnimationValue* value)
+{
+    keyframes.append(CCTransformKeyframe(keyTime, *value->value()));
+}
+
+template <class Value, class Keyframe, class Curve>
+PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& valueList, const Animation* animation, size_t animationId, size_t groupId, double timeOffset, CCActiveAnimation::TargetProperty targetProperty)
+{
+    // FIXME: add support for different directions.
+    if (animation && animation->isDirectionSet() && animation->direction() == Animation::AnimationDirectionAlternate)
+        return nullptr;
+
+    // FIXME: add support for delay
+    if (animation && animation->isDelaySet() && animation->delay() > 0)
+        return nullptr;
+
+    // FIXME: add support for fills forwards and fills backwards
+    if (animation && animation->isFillModeSet() && (animation->fillsForwards() || animation->fillsBackwards()))
+        return nullptr;
+
+    Vector<Keyframe> keyframes;
+
+    for (size_t i = 0; i < valueList.size(); i++) {
+        const Value* originalValue = static_cast<const Value*>(valueList.at(i));
+
+        // FIXME: add support for timing functions.
+        if (originalValue->timingFunction() && originalValue->timingFunction()->type() != TimingFunction::LinearFunction)
+            return nullptr;
+
+        double duration = (animation && animation->isDurationSet()) ? animation->duration() : 1;
+        appendKeyframe(keyframes, originalValue->keyTime() * duration, originalValue);
+    }
+
+    OwnPtr<Curve> curve = Curve::create(keyframes);
+
+    OwnPtr<CCActiveAnimation> anim = CCActiveAnimation::create(curve.release(), animationId, groupId, targetProperty);
+
+    ASSERT(anim.get());
+
+    if (anim.get()) {
+        int iterations = (animation && animation->isIterationCountSet()) ? animation->iterationCount() : 1;
+        anim->setIterations(iterations);
+    }
+
+    return anim.release();
+}
+
+} // namepace
+
+CCLayerAnimationController::CCLayerAnimationController()
+{
+}
+
+CCLayerAnimationController::~CCLayerAnimationController()
+{
+}
+
+PassOwnPtr<CCLayerAnimationController> CCLayerAnimationController::create()
+{
+    return adoptPtr(new CCLayerAnimationController);
+}
+
+bool CCLayerAnimationController::addAnimation(const KeyframeValueList& valueList, const IntSize&, const Animation* animation, int animationId, int groupId, double timeOffset)
+{
+    if (!animation)
+        return false;
+
+    OwnPtr<CCActiveAnimation> toAdd;
+    if (valueList.property() == AnimatedPropertyWebkitTransform)
+        toAdd = createActiveAnimation<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(valueList, animation, animationId, groupId, timeOffset, CCActiveAnimation::Transform);
+    else if (valueList.property() == AnimatedPropertyOpacity)
+        toAdd = createActiveAnimation<FloatAnimationValue, CCFloatKeyframe, CCKeyframedFloatAnimationCurve>(valueList, animation, animationId, groupId, timeOffset, CCActiveAnimation::Opacity);
+
+    if (toAdd.get()) {
+        m_activeAnimations.append(toAdd.release());
+        return true;
+    }
+
+    return false;
+}
+
+void CCLayerAnimationController::pauseAnimation(int animationId, double timeOffset)
+{
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
+        if (m_activeAnimations[i]->id() == animationId)
+            m_activeAnimations[i]->setRunState(CCActiveAnimation::Paused, timeOffset);
+    }
+}
+
+void CCLayerAnimationController::removeAnimation(int animationId)
+{
+    for (size_t i = 0; i < m_activeAnimations.size();) {
+        if (m_activeAnimations[i]->id() == animationId)
+            m_activeAnimations.remove(i);
+        else
+            i++;
+    }
+}
+
+// According to render layer backing, these are for testing only.
+void CCLayerAnimationController::suspendAnimations(double time)
+{
+}
+
+// Looking at GraphicsLayerCA, this appears to be the analog to suspendAnimations, which is for testing.
+void CCLayerAnimationController::resumeAnimations()
+{
+}
+
+// Ensures that the list of active animations on the main thread and the impl thread
+// are kept in sync.
+void CCLayerAnimationController::synchronizeAnimations(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    removeCompletedAnimations(controllerImpl);
+    pushNewAnimationsToImplThread(controllerImpl);
+    removeAnimationsCompletedOnMainThread(controllerImpl);
+    pushAnimationProperties(controllerImpl);
+}
+
+void CCLayerAnimationController::removeCompletedAnimations(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Any animations finished on the impl thread are removed from the main thread's collection.
+    for (size_t i = 0; i < controllerImpl->m_finishedAnimations.size(); ++i)
+        remove(controllerImpl->m_finishedAnimations[i].groupId, controllerImpl->m_finishedAnimations[i].targetProperty);
+    controllerImpl->m_finishedAnimations.clear();
+}
+
+void CCLayerAnimationController::pushNewAnimationsToImplThread(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Any new animations owned by the main thread's controller are cloned and adde to the impl thread's controller.
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
+        if (!controllerImpl->getActiveAnimation(m_activeAnimations[i]->group(), m_activeAnimations[i]->targetProperty()))
+            controllerImpl->add(m_activeAnimations[i]->cloneForImplThread());
+    }
+}
+
+void CCLayerAnimationController::removeAnimationsCompletedOnMainThread(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Delete all impl thread animations for which there is no corresponding main thread animation.
+    // Each iteration, controller->m_activeAnimations.size() is decremented or i is incremented
+    // guaranteeing progress towards loop termination.
+    for (size_t i = 0; i < controllerImpl->m_activeAnimations.size();) {
+        CCActiveAnimation* current = getActiveAnimation(controllerImpl->m_activeAnimations[i]->group(), controllerImpl->m_activeAnimations[i]->targetProperty());
+        if (!current)
+            controllerImpl->m_activeAnimations.remove(i);
+        else
+            i++;
+    }
+}
+
+void CCLayerAnimationController::pushAnimationProperties(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Delete all impl thread animations for which there is no corresponding main thread animation.
+    // Each iteration, controller->m_activeAnimations.size() is decremented or i is incremented
+    // guaranteeing progress towards loop termination.
+    for (size_t i = 0; i < controllerImpl->m_activeAnimations.size(); ++i) {
+        CCActiveAnimation* currentImpl = controllerImpl->m_activeAnimations[i].get();
+        CCActiveAnimation* current = getActiveAnimation(currentImpl->group(), currentImpl->targetProperty());
+        ASSERT(current);
+        if (current)
+            current->synchronizeProperties(currentImpl);
+    }
+}
+
+CCActiveAnimation* CCLayerAnimationController::getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty targetProperty)
+{
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i)
+        if (m_activeAnimations[i]->group() == groupId && m_activeAnimations[i]->targetProperty() == targetProperty)
+            return m_activeAnimations[i].get();
+    return 0;
+}
+
+void CCLayerAnimationController::remove(int groupId, CCActiveAnimation::TargetProperty targetProperty)
+{
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
+        if (m_activeAnimations[i]->group() == groupId && m_activeAnimations[i]->targetProperty() == targetProperty) {
+            m_activeAnimations.remove(i);
+            return;
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
new file mode 100644
index 000000000..068213047
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCLayerAnimationController_h
+#define CCLayerAnimationController_h
+
+#include "cc/CCActiveAnimation.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Animation;
+class CCLayerAnimationControllerImpl;
+class IntSize;
+class KeyframeValueList;
+
+class CCLayerAnimationController {
+    WTF_MAKE_NONCOPYABLE(CCLayerAnimationController);
+public:
+    static PassOwnPtr<CCLayerAnimationController> create();
+
+    virtual ~CCLayerAnimationController();
+
+    // These are virtual for testing.
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, int animationId, int groupId, double timeOffset);
+    virtual void pauseAnimation(int animationId, double timeOffset);
+    virtual void removeAnimation(int animationId);
+    virtual void suspendAnimations(double time);
+    virtual void resumeAnimations();
+
+    // Ensures that the list of active animations on the main thread and the impl thread
+    // are kept in sync. This function does not take ownership of the impl thread controller.
+    virtual void synchronizeAnimations(CCLayerAnimationControllerImpl*);
+
+    bool hasActiveAnimation() const { return m_activeAnimations.size(); }
+    CCActiveAnimation* getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty);
+
+protected:
+    CCLayerAnimationController();
+
+private:
+    void removeCompletedAnimations(CCLayerAnimationControllerImpl*);
+    void pushNewAnimationsToImplThread(CCLayerAnimationControllerImpl*);
+    void removeAnimationsCompletedOnMainThread(CCLayerAnimationControllerImpl*);
+    void pushAnimationProperties(CCLayerAnimationControllerImpl*);
+
+    void remove(int groupId, CCActiveAnimation::TargetProperty);
+
+    Vector<OwnPtr<CCActiveAnimation> > m_activeAnimations;
+};
+
+} // namespace WebCore
+
+#endif // CCLayerAnimationController_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
index bbca9cbd9..2096ce398 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
@@ -26,6 +26,7 @@
 
 #include "cc/CCLayerAnimationControllerImpl.h"
 
+#include "TransformationMatrix.h"
 #include "TransformOperations.h"
 
 namespace WebCore {
@@ -44,28 +45,30 @@ CCLayerAnimationControllerImpl::CCLayerAnimationControllerImpl(CCLayerAnimationC
 {
 }
 
-void CCLayerAnimationControllerImpl::animate(double frameBeginTimeSecs)
+CCLayerAnimationControllerImpl::~CCLayerAnimationControllerImpl()
 {
-    startAnimationsWaitingForNextTick(frameBeginTimeSecs);
-    startAnimationsWaitingForStartTime(frameBeginTimeSecs);
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs);
+}
+
+void CCLayerAnimationControllerImpl::animate(double frameBeginTimeSecs, CCAnimationEventsVector& events)
+{
+    startAnimationsWaitingForNextTick(frameBeginTimeSecs, events);
+    startAnimationsWaitingForStartTime(frameBeginTimeSecs, events);
+    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
     resolveConflicts(frameBeginTimeSecs);
     tickAnimations(frameBeginTimeSecs);
     purgeFinishedAnimations();
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs);
+    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
 }
 
 void CCLayerAnimationControllerImpl::add(PassOwnPtr<CCActiveAnimation> anim)
 {
     m_activeAnimations.append(anim);
-    if (m_client)
-        m_client->animationControllerImplDidActivate(this);
 }
 
-CCActiveAnimation* CCLayerAnimationControllerImpl::getActiveAnimation(CCActiveAnimation::GroupID group, CCActiveAnimation::TargetProperty property)
+CCActiveAnimation* CCLayerAnimationControllerImpl::getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty property)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
-        if (m_activeAnimations[i]->group() == group && m_activeAnimations[i]->targetProperty() == property)
+        if (m_activeAnimations[i]->group() == groupId && m_activeAnimations[i]->targetProperty() == property)
             return m_activeAnimations[i].get();
     }
     return 0;
@@ -80,25 +83,28 @@ bool CCLayerAnimationControllerImpl::hasActiveAnimation() const
     return false;
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double now)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
         if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForNextTick) {
             m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
             m_activeAnimations[i]->setStartTime(now);
+            events.append(CCAnimationStartedEvent(m_client->id(), now));
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double now)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
-        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= now)
+        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= now) {
             m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
+            events.append(CCAnimationStartedEvent(m_client->id(), now));
+        }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double now)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector& events)
 {
     // First collect running properties.
     TargetProperties blockedProperties;
@@ -130,6 +136,7 @@ void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability
             if (nullIntersection) {
                 m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
                 m_activeAnimations[i]->setStartTime(now);
+                events.append(CCAnimationStartedEvent(m_client->id(), now));
                 for (size_t j = i + 1; j < m_activeAnimations.size(); ++j) {
                     if (m_activeAnimations[i]->group() == m_activeAnimations[j]->group()) {
                         m_activeAnimations[j]->setRunState(CCActiveAnimation::Running, now);
@@ -178,9 +185,10 @@ void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
                 }
             }
         }
-        if (allAnimsWithSameIdAreFinished)
+        if (allAnimsWithSameIdAreFinished) {
+            m_finishedAnimations.append(m_activeAnimations[i]->signature());
             m_activeAnimations.remove(i);
-        else
+        } else
             i++;
     }
 }
@@ -193,20 +201,17 @@ void CCLayerAnimationControllerImpl::tickAnimations(double now)
             switch (m_activeAnimations[i]->targetProperty()) {
 
             case CCActiveAnimation::Transform: {
-                const CCTransformAnimationCurve* transformAnimationCurve = m_activeAnimations[i]->animationCurve()->toTransformAnimationCurve();
-                const TransformOperations operations = transformAnimationCurve->getValue(trimmed);
+                const CCTransformAnimationCurve* transformAnimationCurve = m_activeAnimations[i]->curve()->toTransformAnimationCurve();
+                const TransformationMatrix matrix = transformAnimationCurve->getValue(trimmed, m_client->bounds());
                 if (m_activeAnimations[i]->isFinishedAt(now))
                     m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
 
-                // Decide here if absolute or relative. Absolute for now.
-                TransformationMatrix toApply;
-                operations.apply(FloatSize(), toApply);
-                m_client->setTransform(toApply);
+                m_client->setTransform(matrix);
                 break;
             }
 
             case CCActiveAnimation::Opacity: {
-                const CCFloatAnimationCurve* floatAnimationCurve = m_activeAnimations[i]->animationCurve()->toFloatAnimationCurve();
+                const CCFloatAnimationCurve* floatAnimationCurve = m_activeAnimations[i]->curve()->toFloatAnimationCurve();
                 const float opacity = floatAnimationCurve->getValue(trimmed);
                 if (m_activeAnimations[i]->isFinishedAt(now))
                     m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
index 1ad223dba..296066de0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
@@ -27,8 +27,10 @@
 
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCAnimationCurve.h"
+#include "cc/CCAnimationEvents.h"
 
 #include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
@@ -44,35 +46,41 @@ class CCLayerAnimationControllerImplClient {
 public:
     virtual ~CCLayerAnimationControllerImplClient() { }
 
+    virtual int id() const = 0;
     virtual float opacity() const = 0;
     virtual void setOpacity(float) = 0;
     virtual const TransformationMatrix& transform() const = 0;
     virtual void setTransform(const TransformationMatrix&) = 0;
-    virtual void animationControllerImplDidActivate(CCLayerAnimationControllerImpl*) = 0;
+    virtual const IntSize& bounds() const = 0;
 };
 
 class CCLayerAnimationControllerImpl {
+    WTF_MAKE_NONCOPYABLE(CCLayerAnimationControllerImpl);
 public:
     static PassOwnPtr<CCLayerAnimationControllerImpl> create(CCLayerAnimationControllerImplClient*);
 
-    void animate(double frameBeginTimeSecs);
+    virtual ~CCLayerAnimationControllerImpl();
+
+    void animate(double frameBeginTimeSecs, CCAnimationEventsVector&);
 
     void add(PassOwnPtr<CCActiveAnimation>);
 
     // Returns the active animation in the given group, animating the given property if such an
     // animation exists.
-    CCActiveAnimation* getActiveAnimation(CCActiveAnimation::GroupID, CCActiveAnimation::TargetProperty);
+    CCActiveAnimation* getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty);
 
     // Returns true if there are any animations that are neither finished nor aborted.
     bool hasActiveAnimation() const;
 
 private:
+    friend class CCLayerAnimationController;
+
     // The animator is owned by the layer.
     explicit CCLayerAnimationControllerImpl(CCLayerAnimationControllerImplClient*);
 
-    void startAnimationsWaitingForNextTick(double now);
-    void startAnimationsWaitingForStartTime(double now);
-    void startAnimationsWaitingForTargetAvailability(double now);
+    void startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector&);
+    void startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector&);
+    void startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector&);
     void resolveConflicts(double now);
     void purgeFinishedAnimations();
 
@@ -80,6 +88,7 @@ private:
 
     CCLayerAnimationControllerImplClient* m_client;
     Vector<OwnPtr<CCActiveAnimation> > m_activeAnimations;
+    Vector<CCActiveAnimation::AnimationSignature> m_finishedAnimations;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 81f9712e0..0589dca8a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -33,6 +33,7 @@
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
 #include "cc/CCDebugBorderDrawQuad.h"
+#include "cc/CCLayerAnimationControllerImpl.h"
 #include "cc/CCLayerSorter.h"
 #include "cc/CCSolidColorDrawQuad.h"
 #include <wtf/text/WTFString.h>
@@ -45,6 +46,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_anchorPoint(0.5, 0.5)
     , m_anchorPointZ(0)
     , m_scrollable(false)
+    , m_haveWheelEventHandlers(false)
     , m_backgroundCoversViewport(false)
     , m_doubleSided(true)
     , m_layerPropertyChanged(false)
@@ -61,6 +63,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_drawOpacity(0)
     , m_debugBorderColor(0, 0, 0, 0)
     , m_debugBorderWidth(0)
+    , m_layerAnimationController(CCLayerAnimationControllerImpl::create(this))
 {
     ASSERT(CCProxy::isImplThread());
 }
@@ -104,6 +107,7 @@ void CCLayerImpl::createRenderSurface()
 {
     ASSERT(!m_renderSurface);
     m_renderSurface = adoptPtr(new CCRenderSurface(this));
+    setTargetRenderSurface(m_renderSurface.get());
 }
 
 bool CCLayerImpl::descendantDrawsContent()
@@ -115,11 +119,6 @@ bool CCLayerImpl::descendantDrawsContent()
     return false;
 }
 
-void CCLayerImpl::draw(LayerRendererChromium*)
-{
-    ASSERT_NOT_REACHED();
-}
-
 PassOwnPtr<CCSharedQuadState> CCLayerImpl::createSharedQuadState() const
 {
     IntRect layerClipRect;
@@ -383,6 +382,15 @@ void CCLayerImpl::setBackgroundCoversViewport(bool backgroundCoversViewport)
     m_layerPropertyChanged = true;
 }
 
+void CCLayerImpl::setFilters(const FilterOperations& filters)
+{
+    if (m_filters == filters)
+        return;
+
+    m_filters = filters;
+    noteLayerPropertyChangedForSubtree();
+}
+
 void CCLayerImpl::setMasksToBounds(bool masksToBounds)
 {
     if (m_masksToBounds == masksToBounds)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 7bae20174..c7a4f0856 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -27,10 +27,12 @@
 #define CCLayerImpl_h
 
 #include "Color.h"
+#include "FilterOperations.h"
 #include "FloatRect.h"
 #include "IntRect.h"
 #include "TextStream.h"
 #include "TransformationMatrix.h"
+#include "cc/CCLayerAnimationControllerImpl.h"
 #include "cc/CCRenderPass.h"
 #include "cc/CCRenderSurface.h"
 #include <wtf/OwnPtr.h>
@@ -44,12 +46,21 @@ class CCLayerSorter;
 class LayerChromium;
 class LayerRendererChromium;
 
-class CCLayerImpl : public RefCounted<CCLayerImpl> {
+class CCLayerImpl : public RefCounted<CCLayerImpl>, public CCLayerAnimationControllerImplClient {
 public:
     static PassRefPtr<CCLayerImpl> create(int id)
     {
         return adoptRef(new CCLayerImpl(id));
     }
+
+    // CCLayerAnimationControllerImplClient implementation.
+    virtual int id() const { return m_layerId; }
+    virtual void setOpacity(float);
+    virtual float opacity() const { return m_opacity; }
+    virtual void setTransform(const TransformationMatrix&);
+    virtual const TransformationMatrix& transform() const { return m_transform; }
+    virtual const IntSize& bounds() const { return m_bounds; }
+
     virtual ~CCLayerImpl();
 
     // Tree structure.
@@ -65,8 +76,6 @@ public:
     void setReplicaLayer(PassRefPtr<CCLayerImpl>);
     CCLayerImpl* replicaLayer() const { return m_replicaLayer.get(); }
 
-    int id() const { return m_layerId; }
-
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
 #endif
@@ -74,9 +83,9 @@ public:
     PassOwnPtr<CCSharedQuadState> createSharedQuadState() const;
     virtual void willDraw(LayerRendererChromium*) { }
     virtual void appendQuads(CCQuadList&, const CCSharedQuadState*);
+    virtual void didDraw() { }
     void appendDebugBorderQuad(CCQuadList&, const CCSharedQuadState*) const;
 
-    virtual void draw(LayerRendererChromium*);
     void unreserveContentsTexture();
     virtual void bindContentsTexture(LayerRendererChromium*);
 
@@ -101,15 +110,15 @@ public:
     void setBackgroundCoversViewport(bool);
     bool backgroundCoversViewport() const { return m_backgroundCoversViewport; }
 
+    void setFilters(const FilterOperations&);
+    const FilterOperations& filters() const { return m_filters; }
+
     void setMasksToBounds(bool);
     bool masksToBounds() const { return m_masksToBounds; }
 
     void setOpaque(bool);
     bool opaque() const { return m_opaque; }
 
-    void setOpacity(float);
-    float opacity() const { return m_opacity; }
-
     void setPosition(const FloatPoint&);
     const FloatPoint& position() const { return m_position; }
 
@@ -125,9 +134,6 @@ public:
     void setSublayerTransform(const TransformationMatrix&);
     const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
 
-    void setTransform(const TransformationMatrix&);
-    const TransformationMatrix& transform() const { return m_transform; }
-
     void setName(const String& name) { m_name = name; }
     const String& name() const { return m_name; }
 
@@ -150,7 +156,6 @@ public:
     CCRenderSurface* targetRenderSurface() const { return m_targetRenderSurface; }
     void setTargetRenderSurface(CCRenderSurface* surface) { m_targetRenderSurface = surface; }
 
-    const IntSize& bounds() const { return m_bounds; }
     void setBounds(const IntSize&);
 
     const IntSize& contentBounds() const { return m_contentBounds; }
@@ -176,6 +181,9 @@ public:
     bool scrollable() const { return m_scrollable; }
     void setScrollable(bool scrollable) { m_scrollable = scrollable; }
 
+    bool haveWheelEventHandlers() const { return m_haveWheelEventHandlers; }
+    void setHaveWheelEventHandlers(bool haveWheelEventHandlers) { m_haveWheelEventHandlers = haveWheelEventHandlers; }
+
     const IntRect& visibleLayerRect() const { return m_visibleLayerRect; }
     void setVisibleLayerRect(const IntRect& visibleLayerRect) { m_visibleLayerRect = visibleLayerRect; }
 
@@ -199,6 +207,8 @@ public:
     bool layerPropertyChanged() const { return m_layerPropertyChanged; }
     void resetAllChangeTrackingForSubtree();
 
+    CCLayerAnimationControllerImpl* layerAnimationController() { return m_layerAnimationController.get(); }
+
 protected:
     explicit CCLayerImpl(int);
 
@@ -238,6 +248,7 @@ private:
     IntSize m_contentBounds;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_haveWheelEventHandlers;
     Color m_backgroundColor;
     bool m_backgroundCoversViewport;
 
@@ -288,6 +299,8 @@ private:
     Color m_debugBorderColor;
     float m_debugBorderWidth;
 
+    FilterOperations m_filters;
+
     TransformationMatrix m_drawTransform;
     TransformationMatrix m_screenSpaceTransform;
 
@@ -306,6 +319,9 @@ private:
     // Rect indicating what was repainted/updated during update.
     // Note that plugin layers bypass this and leave it empty.
     FloatRect m_updateRect;
+
+    // Manages animations for this layer.
+    OwnPtr<CCLayerAnimationControllerImpl> m_layerAnimationController;
 };
 
 void sortLayers(Vector<RefPtr<CCLayerImpl> >::iterator first, Vector<RefPtr<CCLayerImpl> >::iterator end, CCLayerSorter*);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
index 0767ff0e7..97d6d185a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
@@ -35,73 +35,73 @@
 
 namespace WebCore {
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::BackToFront::begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = 0;
-    pos.currentLayerIndex = CCLayerIteratorPositionValue::LayerIndexRepresentingTargetRenderSurface;
+    it.m_targetRenderSurfaceLayerIndex = 0;
+    it.m_currentLayerIndex = CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface;
 
     m_highestTargetRenderSurfaceLayer = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::BackToFront::end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-    pos.currentLayerIndex = 0;
+    it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+    it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::BackToFront::next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
     // If the current layer has a RS, move to its layer list. Otherwise, visit the next layer in the current RS layer list.
-    if (pos.currentLayerRepresentsContributingRenderSurface()) {
+    if (it.currentLayerRepresentsContributingRenderSurface()) {
         // Save our position in the childLayer list for the RenderSurface, then jump to the next RenderSurface. Save where we
         // came from in the next RenderSurface so we can get back to it.
-        pos.targetRenderSurface()->m_currentLayerIndexHistory = pos.currentLayerIndex;
-        int previousTargetRenderSurfaceLayer = pos.targetRenderSurfaceLayerIndex;
+        it.targetRenderSurface()->m_currentLayerIndexHistory = it.m_currentLayerIndex;
+        int previousTargetRenderSurfaceLayer = it.m_targetRenderSurfaceLayerIndex;
 
-        pos.targetRenderSurfaceLayerIndex = ++m_highestTargetRenderSurfaceLayer;
-        pos.currentLayerIndex = CCLayerIteratorPositionValue::LayerIndexRepresentingTargetRenderSurface;
+        it.m_targetRenderSurfaceLayerIndex = ++m_highestTargetRenderSurfaceLayer;
+        it.m_currentLayerIndex = CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface;
 
-        pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
+        it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
     } else {
-        ++pos.currentLayerIndex;
+        ++it.m_currentLayerIndex;
 
-        int targetRenderSurfaceNumChildren = pos.targetRenderSurfaceChildren().size();
-        while (pos.currentLayerIndex == targetRenderSurfaceNumChildren) {
+        int targetRenderSurfaceNumChildren = it.targetRenderSurfaceChildren().size();
+        while (it.m_currentLayerIndex == targetRenderSurfaceNumChildren) {
             // Jump back to the previous RenderSurface, and get back the position where we were in that list, and move to the next position there.
-            if (!pos.targetRenderSurfaceLayerIndex) {
+            if (!it.m_targetRenderSurfaceLayerIndex) {
                 // End of the list
-                pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-                pos.currentLayerIndex = 0;
+                it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+                it.m_currentLayerIndex = 0;
                 return;
             }
-            pos.targetRenderSurfaceLayerIndex = pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
-            pos.currentLayerIndex = pos.targetRenderSurface()->m_currentLayerIndexHistory + 1;
+            it.m_targetRenderSurfaceLayerIndex = it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
+            it.m_currentLayerIndex = it.targetRenderSurface()->m_currentLayerIndexHistory + 1;
 
-            targetRenderSurfaceNumChildren = pos.targetRenderSurfaceChildren().size();
+            targetRenderSurfaceNumChildren = it.targetRenderSurfaceChildren().size();
         }
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = 0;
-    pos.currentLayerIndex = pos.targetRenderSurfaceChildren().size() - 1;
-    goToHighestInSubtree(pos);
+    it.m_targetRenderSurfaceLayerIndex = 0;
+    it.m_currentLayerIndex = it.targetRenderSurfaceChildren().size() - 1;
+    goToHighestInSubtree(it);
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-    pos.currentLayerIndex = 0;
+    it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+    it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
     // Moves to the previous layer in the current RS layer list. Then we check if the
     // new current layer has its own RS, in which case there are things in that RS layer list that are higher, so
@@ -109,61 +109,61 @@ void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<LayerType
     // If we move back past the front of the list, we jump up to the previous RS layer list, picking up again where we
     // had previously recursed into the current RS layer list.
 
-    if (!pos.currentLayerRepresentsTargetRenderSurface()) {
+    if (!it.currentLayerRepresentsTargetRenderSurface()) {
         // Subtracting one here will eventually cause the current layer to become that layer
         // representing the target render surface.
-        --pos.currentLayerIndex;
-        goToHighestInSubtree(pos);
+        --it.m_currentLayerIndex;
+        goToHighestInSubtree(it);
     } else {
-        while (pos.currentLayerRepresentsTargetRenderSurface()) {
-            if (!pos.targetRenderSurfaceLayerIndex) {
+        while (it.currentLayerRepresentsTargetRenderSurface()) {
+            if (!it.m_targetRenderSurfaceLayerIndex) {
                 // End of the list
-                pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-                pos.currentLayerIndex = 0;
+                it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+                it.m_currentLayerIndex = 0;
                 return;
             }
-            pos.targetRenderSurfaceLayerIndex = pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
-            pos.currentLayerIndex = pos.targetRenderSurface()->m_currentLayerIndexHistory;
+            it.m_targetRenderSurfaceLayerIndex = it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
+            it.m_currentLayerIndex = it.targetRenderSurface()->m_currentLayerIndexHistory;
         }
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    if (pos.currentLayerRepresentsTargetRenderSurface())
+    if (it.currentLayerRepresentsTargetRenderSurface())
         return;
-    while (pos.currentLayerRepresentsContributingRenderSurface()) {
+    while (it.currentLayerRepresentsContributingRenderSurface()) {
         // Save where we were in the current target surface, move to the next one, and save the target surface that we
         // came from there so we can go back to it.
-        pos.targetRenderSurface()->m_currentLayerIndexHistory = pos.currentLayerIndex;
-        int previousTargetRenderSurfaceLayer = pos.targetRenderSurfaceLayerIndex;
+        it.targetRenderSurface()->m_currentLayerIndexHistory = it.m_currentLayerIndex;
+        int previousTargetRenderSurfaceLayer = it.m_targetRenderSurfaceLayerIndex;
 
-        for (LayerType* layer = pos.currentLayer(); pos.targetRenderSurfaceLayer() != layer; ++pos.targetRenderSurfaceLayerIndex) { }
-        pos.currentLayerIndex = pos.targetRenderSurfaceChildren().size() - 1;
+        for (LayerType* layer = it.currentLayer(); it.targetRenderSurfaceLayer() != layer; ++it.m_targetRenderSurfaceLayerIndex) { }
+        it.m_currentLayerIndex = it.targetRenderSurfaceChildren().size() - 1;
 
-        pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
+        it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
     }
 }
 
 // Declare each of the above functions for LayerChromium and CCLayerImpl classes so that they are linked.
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront> &);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
+
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
index 8f412c44d..be985e153 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
@@ -25,7 +25,7 @@
 #ifndef CCLayerIterator_h
 #define CCLayerIterator_h
 
-#include "cc/CCLayerIteratorPosition.h"
+#include "cc/CCLayerTreeHostCommon.h"
 
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
@@ -82,43 +82,78 @@ namespace WebCore {
 
 //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 
+// Non-templated constants
+struct CCLayerIteratorValue {
+    static const int InvalidTargetRenderSurfaceLayerIndex = -1;
+    // This must be -1 since the iterator action code assumes that this value can be
+    // reached by subtracting one from the position of the first layer in the current
+    // target surface's child layer list, which is 0.
+    static const int LayerIndexRepresentingTargetRenderSurface = -1;
+};
+
 // An iterator class for walking over layers in the RenderSurface-Layer tree.
 template <typename LayerType, typename RenderSurfaceType, typename IteratorActionType>
 class CCLayerIterator {
     typedef CCLayerIterator<LayerType, RenderSurfaceType, IteratorActionType> CCLayerIteratorType;
 
 public:
-    CCLayerIterator() { }
+    CCLayerIterator() : m_renderSurfaceLayerList(0) { }
 
     static CCLayerIteratorType begin(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, true); }
     static CCLayerIteratorType end(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, false); }
 
-    CCLayerIteratorType& operator++() { ASSERT(m_actions); m_actions->next(m_position); return *this; }
-    bool operator==(const CCLayerIteratorType& other) const { return m_position == other.m_position; }
+    CCLayerIteratorType& operator++() { m_actions.next(*this); return *this; }
+    bool operator==(const CCLayerIterator& other) const
+    {
+        return m_targetRenderSurfaceLayerIndex == other.m_targetRenderSurfaceLayerIndex
+            && m_currentLayerIndex == other.m_currentLayerIndex;
+    }
     bool operator!=(const CCLayerIteratorType& other) const { return !(*this == other); }
 
-    LayerType* operator->() const { return m_position.currentLayer(); }
-    LayerType* operator*() const { return m_position.currentLayer(); }
+    LayerType* operator->() const { return currentLayer(); }
+    LayerType* operator*() const { return currentLayer(); }
 
-    bool representsTargetRenderSurface() const { return m_position.currentLayerRepresentsTargetRenderSurface(); }
-    bool representsContributingRenderSurface() const { return !representsTargetRenderSurface() && m_position.currentLayerRepresentsContributingRenderSurface(); }
+    bool representsTargetRenderSurface() const { return currentLayerRepresentsTargetRenderSurface(); }
+    bool representsContributingRenderSurface() const { return !representsTargetRenderSurface() && currentLayerRepresentsContributingRenderSurface(); }
     bool representsItself() const { return !representsTargetRenderSurface() && !representsContributingRenderSurface(); }
 
-    LayerType* targetRenderSurfaceLayer() const { return m_position.targetRenderSurfaceLayer(); }
+    LayerType* targetRenderSurfaceLayer() const { return (*m_renderSurfaceLayerList)[m_targetRenderSurfaceLayerIndex].get(); }
 
 private:
     CCLayerIterator(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList, bool start)
-        : m_position(renderSurfaceLayerList)
-        , m_actions(adoptPtr(new IteratorActionType()))
+        : m_renderSurfaceLayerList(renderSurfaceLayerList)
     {
         if (start && !renderSurfaceLayerList->isEmpty())
-            m_actions->begin(m_position);
+            m_actions.begin(*this);
         else
-            m_actions->end(m_position);
+            m_actions.end(*this);
     }
 
-    CCLayerIteratorPosition<LayerType, RenderSurfaceType> m_position;
-    OwnPtr<IteratorActionType> m_actions;
+    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : targetRenderSurfaceChildren()[m_currentLayerIndex].get(); }
+
+    inline bool currentLayerRepresentsContributingRenderSurface() const { return CCLayerTreeHostCommon::renderSurfaceContributesToTarget<LayerType>(currentLayer(), targetRenderSurfaceLayer()->id()); }
+    inline bool currentLayerRepresentsTargetRenderSurface() const { return m_currentLayerIndex == CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface; }
+
+    inline RenderSurfaceType* targetRenderSurface() const { return targetRenderSurfaceLayer()->renderSurface(); }
+    inline const Vector<RefPtr<LayerType> >& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
+
+    IteratorActionType m_actions;
+    const Vector<RefPtr<LayerType> >* m_renderSurfaceLayerList;
+
+    // The iterator's current position.
+
+    // A position in the renderSurfaceLayerList. This points to a layer which owns the current target surface.
+    // This is a value from 0 to n-1 (n = size of renderSurfaceLayerList = number of surfaces). A value outside of
+    // this range (for example, CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex) is used to
+    // indicate a position outside the bounds of the tree.
+    int m_targetRenderSurfaceLayerIndex;
+    // A position in the list of layers that are children of the current target surface. When pointing to one of
+    // these layers, this is a value from 0 to n-1 (n = number of children). Since the iterator must also stop at
+    // the layers representing the target surface, this is done by setting the currentLayerIndex to a value of
+    // CCLayerIteratorValue::LayerRepresentingTargetRenderSurface.
+    int m_currentLayerIndex;
+
+    friend struct CCLayerIteratorActions;
 };
 
 // Orderings for iterating over the RenderSurface-Layer tree.
@@ -126,14 +161,14 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from back to front.
     class BackToFront {
     public:
-        template <typename LayerType, typename RenderSurfaceType>
-        void begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
     private:
         int m_highestTargetRenderSurfaceLayer;
@@ -142,18 +177,18 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from front to back
     class FrontToBack {
     public:
-        template <typename LayerType, typename RenderSurfaceType>
-        void begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
     private:
-        template <typename LayerType, typename RenderSurfaceType>
-        void goToHighestInSubtree(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
     };
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIteratorPosition.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIteratorPosition.h
deleted file mode 100644
index b1f63c45f..000000000
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIteratorPosition.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CCLayerIteratorPosition_h
-#define CCLayerIteratorPosition_h
-
-#include "cc/CCLayerTreeHostCommon.h"
-
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-// Non-templated constants
-struct CCLayerIteratorPositionValue {
-    static const int InvalidTargetRenderSurfaceLayerIndex = -1;
-    // This must be -1 since the iterator action code assumes that this value can be
-    // reached by subtracting one from the position of the first layer in the current
-    // target surface's child layer list, which is 0.
-    static const int LayerIndexRepresentingTargetRenderSurface = -1;
-};
-
-// A struct to hold the iterator's current position, which is passed to the various CCLayerIteratorAction functions, for them to
-// read and update. This struct exists so the templated action functions don't need to access the CCLayerIterator class.
-//
-// There is a 1:1 relationship between an instance of the CCLayerIteratorPosition class and a CCLayerIteratorActions::Foo class,
-// so an iterator action class can hold extra position data, if required, in its own class instance.
-//
-// The current position of the iterator is held in two integer variables.
-// - The targetRenderSurfaceLayerIndex is a position in the renderSurfaceLayerList. This points to a layer which owns the current
-// target surface. This is a value from 0 to n-1 (n = size of renderSurfaceLayerList = number of surfaces). A value outside of
-// this range (for example, CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex) is used to indicate a position
-// outside the bounds of the tree.
-// - The currentLayerIndex is a position in the list of layers that are children of the current target surface. When pointing to
-// one of these layers, this is a value from 0 to n-1 (n = number of children). Since the iterator must also stop at the layers
-// representing the target surface, this is done by setting the currentLayerIndex to a value of
-// CCLayerIteratorPositionValue::LayerRepresentingTargetRenderSurface.
-template<typename LayerType, typename RenderSurfaceType>
-struct CCLayerIteratorPosition {
-    CCLayerIteratorPosition() : renderSurfaceLayerList(0) { }
-    explicit CCLayerIteratorPosition(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) : renderSurfaceLayerList(renderSurfaceLayerList) { }
-
-    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : targetRenderSurfaceChildren()[currentLayerIndex].get(); }
-
-    inline bool currentLayerRepresentsContributingRenderSurface() const { return CCLayerTreeHostCommon::renderSurfaceContributesToTarget<LayerType>(currentLayer(), targetRenderSurfaceLayer()->id()); }
-    inline bool currentLayerRepresentsTargetRenderSurface() const { return currentLayerIndex == CCLayerIteratorPositionValue::LayerIndexRepresentingTargetRenderSurface; }
-
-    inline LayerType* targetRenderSurfaceLayer() const { return (*renderSurfaceLayerList)[targetRenderSurfaceLayerIndex].get(); }
-    inline RenderSurfaceType* targetRenderSurface() const { return targetRenderSurfaceLayer()->renderSurface(); }
-    inline const Vector<RefPtr<LayerType> >& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
-
-    inline bool operator==(const CCLayerIteratorPosition& other) const
-    {
-        return targetRenderSurfaceLayerIndex == other.targetRenderSurfaceLayerIndex
-            && currentLayerIndex == other.currentLayerIndex;
-    }
-
-    const Vector<RefPtr<LayerType> >* renderSurfaceLayerList;
-    int targetRenderSurfaceLayerIndex;
-    int currentLayerIndex;
-};
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
index 27705f324..cfefbd2b8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
@@ -74,23 +74,21 @@ const CCLayerTilingData& CCLayerTilingData::operator=(const CCLayerTilingData& t
     return *this;
 }
 
-void CCLayerTilingData::addTile(PassRefPtr<Tile> tile, int i, int j)
+void CCLayerTilingData::addTile(PassOwnPtr<Tile> tile, int i, int j)
 {
     ASSERT(!tileAt(i, j));
     tile->moveTo(i, j);
     m_tiles.add(make_pair(i, j), tile);
 }
 
-PassRefPtr<CCLayerTilingData::Tile> CCLayerTilingData::takeTile(int i, int j)
+PassOwnPtr<CCLayerTilingData::Tile> CCLayerTilingData::takeTile(int i, int j)
 {
     return m_tiles.take(make_pair(i, j));
 }
 
 CCLayerTilingData::Tile* CCLayerTilingData::tileAt(int i, int j) const
 {
-    Tile* tile = m_tiles.get(make_pair(i, j)).get();
-    ASSERT(!tile || tile->refCount() == 1);
-    return tile;
+    return m_tiles.get(make_pair(i, j));
 }
 
 void CCLayerTilingData::reset()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
index 46ae88117..869d42e15 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
@@ -34,7 +34,6 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
 #include <wtf/PassOwnPtr.h>
-#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -61,7 +60,7 @@ public:
 
     const CCLayerTilingData& operator=(const CCLayerTilingData&);
 
-    class Tile: public RefCounted<Tile> {
+    class Tile {
         WTF_MAKE_NONCOPYABLE(Tile);
     public:
         Tile() : m_i(-1), m_j(-1) { }
@@ -84,13 +83,10 @@ public:
         static void constructDeletedValue(TileMapKey& slot) { slot = std::make_pair(-2, -2); }
         static bool isDeletedValue(TileMapKey value) { return value.first == -2 && value.second == -2; }
     };
-    // FIXME: The mapped value in TileMap should really be an OwnPtr, as the
-    // refcount of a Tile should never be more than 1. However, HashMap
-    // doesn't easily support OwnPtr as a value.
-    typedef HashMap<TileMapKey, RefPtr<Tile>, DefaultHash<TileMapKey>::Hash, TileMapKeyTraits> TileMap;
+    typedef HashMap<TileMapKey, OwnPtr<Tile>, DefaultHash<TileMapKey>::Hash, TileMapKeyTraits> TileMap;
 
-    void addTile(PassRefPtr<Tile>, int, int);
-    PassRefPtr<Tile> takeTile(int, int);
+    void addTile(PassOwnPtr<Tile>, int, int);
+    PassOwnPtr<Tile> takeTile(int, int);
     Tile* tileAt(int, int) const;
     const TileMap& tiles() const { return m_tiles; }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 15a3074eb..501ee17de 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -68,10 +68,9 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCSettings
     , m_layerRendererInitialized(false)
     , m_settings(settings)
     , m_visible(true)
-    , m_haveWheelEventHandlers(false)
-    , m_pageScale(1)
-    , m_minPageScale(1)
-    , m_maxPageScale(1)
+    , m_pageScaleFactor(1)
+    , m_minPageScaleFactor(1)
+    , m_maxPageScaleFactor(1)
     , m_triggerIdlePaints(true)
     , m_partialTextureUpdateRequests(0)
 {
@@ -171,15 +170,16 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
     ASSERT(CCProxy::isImplThread());
 
     // Synchronize trees, if one exists at all...
-    if (rootLayer())
+    if (rootLayer()) {
         hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-    else
+        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+        hostImpl->setNeedsAnimateLayers();
+    } else
         hostImpl->setRootLayer(0);
 
     hostImpl->setSourceFrameNumber(frameNumber());
-    hostImpl->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
     hostImpl->setViewportSize(viewportSize());
-    hostImpl->setPageScaleFactorAndLimits(pageScale(), m_minPageScale, m_maxPageScale);
+    hostImpl->setPageScaleFactorAndLimits(m_pageScaleFactor, m_minPageScaleFactor, m_maxPageScaleFactor);
 
     m_frameNumber++;
 }
@@ -254,12 +254,17 @@ void CCLayerTreeHost::setNeedsCommit()
 
 void CCLayerTreeHost::setNeedsRedraw()
 {
-    if (CCThreadProxy::implThread())
-        m_proxy->setNeedsRedraw();
-    else
+    m_proxy->setNeedsRedraw();
+    if (!CCThreadProxy::implThread())
         m_client->scheduleComposite();
 }
 
+void CCLayerTreeHost::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(CCThreadProxy::isMainThread());
+    // FIXME: need to walk the tree.
+}
+
 void CCLayerTreeHost::setRootLayer(PassRefPtr<LayerChromium> rootLayer)
 {
     if (m_rootLayer == rootLayer)
@@ -286,22 +291,14 @@ void CCLayerTreeHost::setViewportSize(const IntSize& viewportSize)
     setNeedsCommit();
 }
 
-void CCLayerTreeHost::setPageScale(float pageScale)
+void CCLayerTreeHost::setPageScaleFactorAndLimits(float pageScaleFactor, float minPageScaleFactor, float maxPageScaleFactor)
 {
-    if (pageScale == m_pageScale)
+    if (pageScaleFactor == m_pageScaleFactor && minPageScaleFactor == m_minPageScaleFactor && maxPageScaleFactor == m_maxPageScaleFactor)
         return;
 
-    m_pageScale = pageScale;
-    setNeedsCommit();
-}
-
-void CCLayerTreeHost::setPageScaleFactorLimits(float minScale, float maxScale)
-{
-    if (minScale == m_minPageScale && maxScale == m_maxPageScale)
-        return;
-
-    m_minPageScale = minScale;
-    m_maxPageScale = maxScale;
+    m_pageScaleFactor = pageScaleFactor;
+    m_minPageScaleFactor = minPageScaleFactor;
+    m_maxPageScaleFactor = maxPageScaleFactor;
     setNeedsCommit();
 }
 
@@ -343,21 +340,20 @@ void CCLayerTreeHost::didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl* hostIm
         hostImpl->setRootLayer(0);
         return;
     }
-    if (rootLayer())
+
+    if (rootLayer()) {
         hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-    else
+        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+        hostImpl->setNeedsAnimateLayers();
+    } else
         hostImpl->setRootLayer(0);
 }
 
-void CCLayerTreeHost::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
+void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
 {
-    if (m_haveWheelEventHandlers == haveWheelEventHandlers)
-        return;
-    m_haveWheelEventHandlers = haveWheelEventHandlers;
-    m_proxy->setNeedsCommit();
+    m_proxy->startPageScaleAnimation(targetPosition, useAnchor, scale, durationSec);
 }
 
-
 void CCLayerTreeHost::loseCompositorContext(int numTimes)
 {
     m_proxy->loseCompositorContext(numTimes);
@@ -448,7 +444,7 @@ void CCLayerTreeHost::reserveTextures()
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&m_updateList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&m_updateList); it != end; ++it) {
-        if (it.representsTargetRenderSurface() || !it->alwaysReserveTextures())
+        if (!it.representsItself() || !it->alwaysReserveTextures())
             continue;
         it->reserveTextures();
     }
@@ -502,10 +498,18 @@ static void enterTargetRenderSurface(Vector<RenderSurfaceRegion>& stack, RenderS
         stack.append(RenderSurfaceRegion());
         stack.last().surface = newTarget;
     } else if (stack.last().surface != newTarget) {
+        // If we are entering a subtree that is going to move pixels around, then the occlusion we've computed
+        // so far won't apply to the pixels we're drawing here in the same way. We discard the occlusion thus
+        // far to be safe, and ensure we don't cull any pixels that are moved such that they become visible.
+        const RenderSurfaceChromium* oldAncestorThatMovesPixels = stack.last().surface->nearestAncestorThatMovesPixels();
+        const RenderSurfaceChromium* newAncestorThatMovesPixels = newTarget->nearestAncestorThatMovesPixels();
+        bool enteringSubtreeThatMovesPixels = newAncestorThatMovesPixels && newAncestorThatMovesPixels != oldAncestorThatMovesPixels;
+
         stack.append(RenderSurfaceRegion());
         stack.last().surface = newTarget;
         int lastIndex = stack.size() - 1;
-        stack[lastIndex].occludedInScreen = stack[lastIndex - 1].occludedInScreen;
+        if (!enteringSubtreeThatMovesPixels)
+            stack[lastIndex].occludedInScreen = stack[lastIndex - 1].occludedInScreen;
     }
 }
 
@@ -548,7 +552,7 @@ void CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList
             paintMaskAndReplicaForRenderSurface(*it, paintType);
             // FIXME: add the replica layer to the current occlusion
 
-            if (it->maskLayer() || it->renderSurface()->drawOpacity() < 1)
+            if (it->maskLayer() || it->renderSurface()->drawOpacity() < 1 || it->renderSurface()->filters().hasFilterThatAffectsOpacity())
                 targetSurfaceStack.last().occludedInScreen = Region();
         } else if (it.representsItself()) {
             ASSERT(!it->bounds().isEmpty());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index e82f29830..1662f50c3 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -30,6 +30,7 @@
 #include "LayerChromium.h"
 #include "RateLimiter.h"
 #include "TransformationMatrix.h"
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCProxy.h"
 
@@ -75,6 +76,7 @@ struct CCSettings {
             , refreshRate(0)
             , perTilePainting(false)
             , partialSwapEnabled(false)
+            , threadedAnimationEnabled(false)
             , maxPartialTextureUpdates(std::numeric_limits<size_t>::max()) { }
 
     bool acceleratePainting;
@@ -84,6 +86,7 @@ struct CCSettings {
     double refreshRate;
     bool perTilePainting;
     bool partialSwapEnabled;
+    bool threadedAnimationEnabled;
     size_t maxPartialTextureUpdates;
 };
 
@@ -163,6 +166,8 @@ public:
     virtual void setNeedsCommit();
     void setNeedsRedraw();
 
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
+
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
     const LayerChromium* rootLayer() const { return m_rootLayer.get(); }
     void setRootLayer(PassRefPtr<LayerChromium>);
@@ -173,21 +178,18 @@ public:
 
     const IntSize& viewportSize() const { return m_viewportSize; }
 
-    void setPageScale(float);
-    float pageScale() const { return m_pageScale; }
-
-    void setPageScaleFactorLimits(float minScale, float maxScale);
+    void setPageScaleFactorAndLimits(float pageScaleFactor, float minPageScaleFactor, float maxPageScaleFactor);
 
     TextureManager* contentsTextureManager() const;
 
     bool visible() const { return m_visible; }
     void setVisible(bool);
 
-    void setHaveWheelEventHandlers(bool);
-
     // Returns false if we should abort this frame due to initialization failure.
     bool updateLayers();
 
+    void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
+
     void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
     void applyScrollAndScale(const CCScrollAndScaleSet&);
     void startRateLimiter(GraphicsContext3D*);
@@ -236,12 +238,11 @@ private:
 
     IntSize m_viewportSize;
     bool m_visible;
-    bool m_haveWheelEventHandlers;
     typedef HashMap<GraphicsContext3D*, RefPtr<RateLimiter> > RateLimiterMap;
     RateLimiterMap m_rateLimiters;
 
-    float m_pageScale;
-    float m_minPageScale, m_maxPageScale;
+    float m_pageScaleFactor;
+    float m_minPageScaleFactor, m_maxPageScaleFactor;
     bool m_triggerIdlePaints;
 
     TextureList m_deleteTextureAfterCommitList;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index b4e7be415..4fc869400 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -72,7 +72,7 @@ static bool isScaleOrTranslation(const TransformationMatrix& m)
 }
 
 template<typename LayerType>
-bool layerShouldBeSkipped(LayerType* layer)
+static bool layerShouldBeSkipped(LayerType* layer)
 {
     // Layers can be skipped if any of these conditions are met.
     //   - does not draw content.
@@ -104,10 +104,53 @@ bool layerShouldBeSkipped(LayerType* layer)
     return false;
 }
 
+template<typename LayerType>
+static bool subtreeShouldRenderToSeparateSurface(LayerType* layer, bool axisAlignedWithRespectToParent)
+{
+    // FIXME: If we decide to create a render surface here while this layer does
+    //        preserve-3d, then we may be sorting incorrectly because we will not be
+    //        sorting the individual layers of this subtree with other layers outside of
+    //        this subtree.
+
+    // Cache this value, because otherwise it walks the entire subtree several times.
+    bool descendantDrawsContent = layer->descendantDrawsContent();
+
+    //
+    // A layer and its descendants should render onto a new RenderSurface if any of these rules hold:
+    //
+
+    // If the layer uses a mask.
+    if (layer->maskLayer())
+        return true;
+
+    // If the layer has a reflection.
+    if (layer->replicaLayer())
+        return true;
+
+    // If the layer uses a CSS filter.
+    if (!layer->filters().isEmpty())
+        return true;
+
+    // If the layer flattens its subtree (i.e. the layer doesn't preserve-3d), but it is
+    // treated as a 3D object by its parent (i.e. parent does preserve-3d).
+    if (layer->parent() && layer->parent()->preserves3D() && !layer->preserves3D() && descendantDrawsContent)
+        return true;
+
+    // If the layer clips its descendants but it is not axis-aligned with respect to its parent.
+    if (layer->masksToBounds() && !axisAlignedWithRespectToParent && descendantDrawsContent)
+        return true;
+
+    // If the layer has opacity != 1 and does not have a preserves-3d transform style.
+    if (layer->opacity() != 1 && !layer->preserves3D() && descendantDrawsContent)
+        return true;
+
+    return false;
+}
+
 // Recursively walks the layer tree starting at the given node and computes all the
 // necessary transformations, clipRects, render surfaces, etc.
 template<typename LayerType, typename RenderSurfaceType, typename LayerSorter>
-static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerType> >& renderSurfaceLayerList, Vector<RefPtr<LayerType> >& layerList, LayerSorter* layerSorter, int maxTextureSize)
+static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, RenderSurfaceType* nearestAncestorThatMovesPixels, Vector<RefPtr<LayerType> >& renderSurfaceLayerList, Vector<RefPtr<LayerType> >& layerList, LayerSorter* layerSorter, int maxTextureSize)
 {
     typedef Vector<RefPtr<LayerType> > LayerList;
 
@@ -229,22 +272,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
     // FIXME: This seems like the wrong place to set this
     layer->setUsesLayerClipping(false);
 
-    // The layer and its descendants render on a new RenderSurface if any of
-    // these conditions hold:
-    // 1. The layer clips its descendants and its transform is not a simple translation.
-    // 2. If the layer has opacity != 1 and does not have a preserves-3d transform style.
-    // 3. The layer uses a mask
-    // 4. The layer has a replica (used for reflections)
-    // 5. The layer doesn't preserve-3d but is the child of a layer which does.
-    // If a layer preserves-3d then we don't create a RenderSurface for it to avoid flattening
-    // out its children. The opacity value of the children layers is multiplied by the opacity
-    // of their parent.
-    bool useSurfaceForClipping = layer->masksToBounds() && !isScaleOrTranslation(combinedTransform);
-    bool useSurfaceForOpacity = layer->opacity() != 1 && !layer->preserves3D();
-    bool useSurfaceForMasking = layer->maskLayer();
-    bool useSurfaceForReflection = layer->replicaLayer();
-    bool useSurfaceForFlatDescendants = layer->parent() && layer->parent()->preserves3D() && !layer->preserves3D() && layer->descendantDrawsContent();
-    if (useSurfaceForMasking || useSurfaceForReflection || useSurfaceForFlatDescendants || ((useSurfaceForClipping || useSurfaceForOpacity) && layer->descendantDrawsContent())) {
+    if (subtreeShouldRenderToSeparateSurface(layer, isScaleOrTranslation(combinedTransform))) {
         if (!layer->renderSurface())
             layer->createRenderSurface();
 
@@ -258,6 +286,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
         transformedLayerRect = IntRect(0, 0, bounds.width(), bounds.height());
 
+        // The opacity value is moved from the layer to its surface, so that the entire subtree properly inherits opacity.
         renderSurface->setDrawOpacity(drawOpacity);
         layer->setDrawOpacity(1);
 
@@ -282,6 +311,11 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
         if (layer->replicaLayer() && layer->replicaLayer()->maskLayer())
             layer->replicaLayer()->maskLayer()->setTargetRenderSurface(renderSurface);
 
+        renderSurface->setFilters(layer->filters());
+        if (renderSurface->filters().hasFilterThatMovesPixels())
+            nearestAncestorThatMovesPixels = renderSurface;
+        renderSurface->setNearestAncestorThatMovesPixels(nearestAncestorThatMovesPixels);
+
         renderSurfaceLayerList.append(layer);
     } else {
         layer->setDrawTransform(combinedTransform);
@@ -289,18 +323,19 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
         layer->setDrawOpacity(drawOpacity);
 
-        if (layer->parent()) {
+        if (layer != rootLayer) {
+            ASSERT(layer->parent());
+            layer->clearRenderSurface();
+
             // Layers inherit the clip rect from their parent.
             layer->setClipRect(layer->parent()->clipRect());
             if (layer->parent()->usesLayerClipping())
                 layer->setUsesLayerClipping(true);
 
+            // Layers without their own renderSurface will render into the nearest ancestor surface.
             layer->setTargetRenderSurface(layer->parent()->targetRenderSurface());
         }
 
-        if (layer != rootLayer)
-            layer->clearRenderSurface();
-
         if (layer->masksToBounds()) {
             IntRect clipRect = transformedLayerRect;
             clipRect.intersect(layer->clipRect());
@@ -316,13 +351,6 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
     layerScreenSpaceTransform.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
     layer->setScreenSpaceTransform(layerScreenSpaceTransform);
 
-    if (layer->renderSurface())
-        layer->setTargetRenderSurface(layer->renderSurface());
-    else {
-        ASSERT(layer->parent());
-        layer->setTargetRenderSurface(layer->parent()->targetRenderSurface());
-    }
-
     // drawableContentRect() is always stored in the coordinate system of the
     // RenderSurface the layer draws into.
     if (layer->drawsContent()) {
@@ -362,7 +390,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
     for (size_t i = 0; i < layer->children().size(); ++i) {
         LayerType* child = layer->children()[i].get();
-        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
+        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
 
         if (drawsContent) {
             if (child->renderSurface()) {
@@ -379,7 +407,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
         }
     }
 
-    if (layer->masksToBounds() || useSurfaceForMasking) {
+    if (layer->masksToBounds() || layer->maskLayer()) {
         IntRect drawableContentRect = layer->drawableContentRect();
         drawableContentRect.intersect(transformedLayerRect);
         layer->setDrawableContentRect(drawableContentRect);
@@ -484,13 +512,13 @@ static void walkLayersAndCalculateVisibleLayerRects(const Vector<RefPtr<LayerTyp
 
 void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(LayerChromium* layer, LayerChromium* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize)
 {
-    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, RenderSurfaceChromium, void*>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, renderSurfaceLayerList, layerList, 0, maxTextureSize);
+    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, RenderSurfaceChromium, void*>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
     walkLayersAndCalculateVisibleLayerRects<LayerChromium, RenderSurfaceChromium>(renderSurfaceLayerList);
 }
 
 void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(CCLayerImpl* layer, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<CCLayerImpl> >& renderSurfaceLayerList, Vector<RefPtr<CCLayerImpl> >& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
 {
-    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
+    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
     walkLayersAndCalculateVisibleLayerRects<CCLayerImpl, CCRenderSurface>(renderSurfaceLayerList);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index 088377cdd..d30c68c37 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -31,6 +31,7 @@
 #include "LayerRendererChromium.h"
 #include "TraceEvent.h"
 #include "cc/CCDamageTracker.h"
+#include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCPageScaleAnimation.h"
@@ -51,12 +52,12 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCSettings& settings, CCLayerTree
     , m_frameNumber(0)
     , m_settings(settings)
     , m_visible(true)
-    , m_haveWheelEventHandlers(false)
     , m_pageScale(1)
     , m_pageScaleDelta(1)
     , m_sentPageScaleDelta(1)
     , m_minPageScale(0)
     , m_maxPageScale(0)
+    , m_needsAnimateLayers(false)
     , m_pinchGestureActive(false)
 {
     ASSERT(CCProxy::isImplThread());
@@ -97,21 +98,8 @@ GraphicsContext3D* CCLayerTreeHostImpl::context()
 
 void CCLayerTreeHostImpl::animate(double frameBeginTimeMs)
 {
-    if (!m_pageScaleAnimation)
-        return;
-
-    IntSize scrollTotal = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
-
-    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(frameBeginTimeMs) / m_pageScale);
-    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(frameBeginTimeMs);
-    nextScroll.scale(1 / m_pageScaleDelta);
-    m_scrollLayerImpl->scrollBy(nextScroll - scrollTotal);
-    m_client->setNeedsRedrawOnImplThread();
-
-    if (m_pageScaleAnimation->isAnimationCompleteAtTime(frameBeginTimeMs)) {
-        m_pageScaleAnimation.clear();
-        m_client->setNeedsCommitOnImplThread();
-    }
+    animatePageScale(frameBeginTimeMs);
+    animateLayers(frameBeginTimeMs);
 }
 
 void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs)
@@ -136,6 +124,7 @@ void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition,
         m_pageScaleAnimation->zoomTo(targetPosition, pageScale, durationMs);
 
     m_client->setNeedsRedrawOnImplThread();
+    m_client->setNeedsCommitOnImplThread();
 }
 
 void CCLayerTreeHostImpl::trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer, const CCLayerList& renderSurfaceLayerList)
@@ -187,9 +176,8 @@ static FloatRect damageInSurfaceSpace(CCLayerImpl* renderSurfaceLayer, const Flo
     return surfaceDamageRect;
 }
 
-void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes)
+void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes, CCLayerList& renderSurfaceLayerList)
 {
-    CCLayerList renderSurfaceLayerList;
     renderSurfaceLayerList.append(rootLayer());
 
     if (!rootLayer()->renderSurface())
@@ -241,8 +229,42 @@ void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes)
 
 void CCLayerTreeHostImpl::optimizeRenderPasses(CCRenderPassList& passes)
 {
-    for (unsigned i = 0; i < passes.size(); ++i)
-        passes[i]->optimizeQuads();
+    TRACE_EVENT1("webkit", "CCLayerTreeHostImpl::optimizeRenderPasses", "passes.size()", static_cast<long long unsigned>(passes.size()));
+
+    bool haveDamageRect = layerRendererCapabilities().usingPartialSwap;
+
+    for (unsigned i = 0; i < passes.size(); ++i) {
+        FloatRect damageRect = passes[i]->targetSurface()->damageTracker()->currentDamageRect();
+        passes[i]->optimizeQuads(haveDamageRect, damageRect);
+    }
+}
+
+void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double frameBeginTimeSecs, CCAnimationEventsVector& events, bool& didAnimate, bool& needsAnimateLayers)
+{
+    bool subtreeNeedsAnimateLayers = false;
+
+    CCLayerAnimationControllerImpl* currentController = current->layerAnimationController();
+
+    bool hadActiveAnimation = currentController->hasActiveAnimation();
+    currentController->animate(frameBeginTimeSecs, events);
+    bool startedAnimation = events.size() > 0;
+
+    // We animated if we either ticked a running animation, or started a new animation.
+    if (hadActiveAnimation || startedAnimation)
+        didAnimate = true;
+
+    // If the current controller still has an active animation, we must continue animating layers.
+    if (currentController->hasActiveAnimation())
+         subtreeNeedsAnimateLayers = true;
+
+    for (size_t i = 0; i < current->children().size(); ++i) {
+        bool childNeedsAnimateLayers = false;
+        animateLayersRecursive(current->children()[i].get(), frameBeginTimeSecs, events, didAnimate, childNeedsAnimateLayers);
+        if (childNeedsAnimateLayers)
+            subtreeNeedsAnimateLayers = true;
+    }
+
+    needsAnimateLayers = subtreeNeedsAnimateLayers;
 }
 
 IntSize CCLayerTreeHostImpl::contentSize() const
@@ -263,13 +285,22 @@ void CCLayerTreeHostImpl::drawLayers()
         return;
 
     CCRenderPassList passes;
-    calculateRenderPasses(passes);
+    CCLayerList renderSurfaceLayerList;
+    calculateRenderPasses(passes, renderSurfaceLayerList);
 
     optimizeRenderPasses(passes);
 
     m_layerRenderer->beginDrawingFrame();
     for (size_t i = 0; i < passes.size(); ++i)
         m_layerRenderer->drawRenderPass(passes[i].get());
+
+    typedef CCLayerIterator<CCLayerImpl, CCRenderSurface, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+
+    CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
+    for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
+        if (it.representsItself() && !it->visibleLayerRect().isEmpty())
+            it->didDraw();
+    }
     m_layerRenderer->finishDrawingFrame();
 
     ++m_frameNumber;
@@ -456,11 +487,18 @@ void CCLayerTreeHostImpl::setNeedsRedraw()
     m_client->setNeedsRedrawOnImplThread();
 }
 
-CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint&)
+CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint& point, CCInputHandlerClient::ScrollInputType type)
 {
     // TODO: Check for scrollable sublayers.
-    if (!m_scrollLayerImpl || !m_scrollLayerImpl->scrollable())
+    if (!m_scrollLayerImpl || !m_scrollLayerImpl->scrollable()) {
+        TRACE_EVENT("scrollBegin Ignored no scrollable", this, 0);
         return ScrollIgnored;
+    }
+
+    if (type == CCInputHandlerClient::Wheel && m_scrollLayerImpl->haveWheelEventHandlers()) {
+        TRACE_EVENT("scrollBegin Failed wheelEventHandlers", this, 0);
+        return ScrollFailed;
+    }
 
     return ScrollStarted;
 }
@@ -480,14 +518,10 @@ void CCLayerTreeHostImpl::scrollEnd()
 {
 }
 
-bool CCLayerTreeHostImpl::haveWheelEventHandlers()
-{
-    return m_haveWheelEventHandlers;
-}
-
 void CCLayerTreeHostImpl::pinchGestureBegin()
 {
     m_pinchGestureActive = true;
+    m_previousPinchAnchor = IntPoint();
 }
 
 void CCLayerTreeHostImpl::pinchGestureUpdate(float magnifyDelta,
@@ -495,18 +529,20 @@ void CCLayerTreeHostImpl::pinchGestureUpdate(float magnifyDelta,
 {
     TRACE_EVENT("CCLayerTreeHostImpl::pinchGestureUpdate", this, 0);
 
-    if (magnifyDelta == 1.0)
-        return;
     if (!m_scrollLayerImpl)
         return;
 
+    if (m_previousPinchAnchor == IntPoint::zero())
+        m_previousPinchAnchor = anchor;
+
     // Keep the center-of-pinch anchor specified by (x, y) in a stable
     // position over the course of the magnify.
-    FloatPoint prevScaleAnchor(anchor.x() / m_pageScaleDelta, anchor.y() / m_pageScaleDelta);
+    FloatPoint previousScaleAnchor(m_previousPinchAnchor.x() / m_pageScaleDelta, m_previousPinchAnchor.y() / m_pageScaleDelta);
     setPageScaleDelta(m_pageScaleDelta * magnifyDelta);
     FloatPoint newScaleAnchor(anchor.x() / m_pageScaleDelta, anchor.y() / m_pageScaleDelta);
+    FloatSize move = previousScaleAnchor - newScaleAnchor;
 
-    FloatSize move = prevScaleAnchor - newScaleAnchor;
+    m_previousPinchAnchor = anchor;
 
     m_scrollLayerImpl->scrollBy(roundedIntSize(move));
     m_client->setNeedsCommitOnImplThread();
@@ -520,12 +556,68 @@ void CCLayerTreeHostImpl::pinchGestureEnd()
     m_client->setNeedsCommitOnImplThread();
 }
 
+void CCLayerTreeHostImpl::computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo)
+{
+    float pageScale = m_pageScaleAnimation->finalPageScale();
+    IntSize scrollOffset = m_pageScaleAnimation->finalScrollOffset();
+    scrollOffset.scale(m_pageScale / pageScale);
+    makeScrollAndScaleSet(scrollInfo, scrollOffset, pageScale);
+}
+
+void CCLayerTreeHostImpl::computePinchZoomDeltas(CCScrollAndScaleSet* scrollInfo)
+{
+    if (!m_scrollLayerImpl)
+        return;
+
+    // Only send fake scroll/zoom deltas if we're pinch zooming out by a
+    // significant amount. This also ensures only one fake delta set will be
+    // sent.
+    const float pinchZoomOutSensitivity = 0.95;
+    if (m_pageScaleDelta > pinchZoomOutSensitivity)
+        return;
+
+    // Compute where the scroll offset/page scale would be if fully pinch-zoomed
+    // out from the anchor point.
+    FloatSize scrollBegin = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
+    scrollBegin.scale(m_pageScaleDelta);
+    float scaleBegin = m_pageScale * m_pageScaleDelta;
+    float pageScaleDeltaToSend = m_minPageScale / m_pageScale;
+    FloatSize scaledContentsSize = contentSize();
+    scaledContentsSize.scale(pageScaleDeltaToSend);
+
+    FloatSize anchor = toSize(m_previousPinchAnchor);
+    FloatSize scrollEnd = scrollBegin + anchor;
+    scrollEnd.scale(m_minPageScale / scaleBegin);
+    scrollEnd -= anchor;
+    scrollEnd = scrollEnd.shrunkTo(roundedIntSize(scaledContentsSize - m_viewportSize)).expandedTo(FloatSize(0, 0));
+    scrollEnd.scale(1 / pageScaleDeltaToSend);
+
+    makeScrollAndScaleSet(scrollInfo, roundedIntSize(scrollEnd), m_minPageScale);
+}
+
+void CCLayerTreeHostImpl::makeScrollAndScaleSet(CCScrollAndScaleSet* scrollInfo, const IntSize& scrollOffset, float pageScale)
+{
+    if (!m_scrollLayerImpl)
+        return;
+
+    CCLayerTreeHostCommon::ScrollUpdateInfo scroll;
+    scroll.layerId = m_scrollLayerImpl->id();
+    scroll.scrollDelta = scrollOffset - toSize(m_scrollLayerImpl->scrollPosition());
+    scrollInfo->scrolls.append(scroll);
+    m_scrollLayerImpl->setSentScrollDelta(scroll.scrollDelta);
+    m_sentPageScaleDelta = scrollInfo->pageScaleDelta = pageScale / m_pageScale;
+}
+
 PassOwnPtr<CCScrollAndScaleSet> CCLayerTreeHostImpl::processScrollDeltas()
 {
     OwnPtr<CCScrollAndScaleSet> scrollInfo = adoptPtr(new CCScrollAndScaleSet());
     bool didMove = m_scrollLayerImpl && (!m_scrollLayerImpl->scrollDelta().isZero() || m_pageScaleDelta != 1.0f);
     if (!didMove || m_pinchGestureActive || m_pageScaleAnimation) {
         m_sentPageScaleDelta = scrollInfo->pageScaleDelta = 1;
+        if (m_pinchGestureActive)
+            computePinchZoomDeltas(scrollInfo.get());
+        else if (m_pageScaleAnimation.get())
+            computeDoubleTapZoomDeltas(scrollInfo.get());
         return scrollInfo.release();
     }
 
@@ -542,4 +634,51 @@ PassOwnPtr<CCScrollAndScaleSet> CCLayerTreeHostImpl::processScrollDeltas()
     return scrollInfo.release();
 }
 
+void CCLayerTreeHostImpl::setFullRootLayerDamage()
+{
+    if (rootLayer()) {
+        CCRenderSurface* renderSurface = rootLayer()->renderSurface();
+        if (renderSurface)
+            renderSurface->damageTracker()->forceFullDamageNextUpdate();
+    }
 }
+
+void CCLayerTreeHostImpl::animatePageScale(double frameBeginTimeMs)
+{
+    if (!m_pageScaleAnimation)
+        return;
+
+    IntSize scrollTotal = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
+
+    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(frameBeginTimeMs) / m_pageScale);
+    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(frameBeginTimeMs);
+    nextScroll.scale(1 / m_pageScaleDelta);
+    m_scrollLayerImpl->scrollBy(nextScroll - scrollTotal);
+    m_client->setNeedsRedrawOnImplThread();
+
+    if (m_pageScaleAnimation->isAnimationCompleteAtTime(frameBeginTimeMs)) {
+        m_pageScaleAnimation.clear();
+        m_client->setNeedsCommitOnImplThread();
+    }
+}
+
+void CCLayerTreeHostImpl::animateLayers(double frameBeginTimeMs)
+{
+    if (!m_settings.threadedAnimationEnabled || !m_needsAnimateLayers || !m_rootLayerImpl)
+        return;
+
+    TRACE_EVENT("CCLayerTreeHostImpl::animateLayers", this, 0);
+
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+
+    bool didAnimate = false;
+    animateLayersRecursive(m_rootLayerImpl.get(), frameBeginTimeMs / 1000, *events, didAnimate, m_needsAnimateLayers);
+
+    if (!events->isEmpty())
+        m_client->postAnimationEventsToMainThreadOnImplThread(events.release());
+
+    if (didAnimate)
+        m_client->setNeedsRedrawOnImplThread();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index 569d69fa3..e438db0c4 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -25,11 +25,13 @@
 #ifndef CCLayerTreeHostImpl_h
 #define CCLayerTreeHostImpl_h
 
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerSorter.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCRenderPass.h"
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -48,6 +50,7 @@ public:
     virtual void onSwapBuffersCompleteOnImplThread() = 0;
     virtual void setNeedsRedrawOnImplThread() = 0;
     virtual void setNeedsCommitOnImplThread() = 0;
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>) = 0;
 };
 
 // CCLayerTreeHostImpl owns the CCLayerImpl tree as well as associated rendering state
@@ -59,16 +62,15 @@ public:
 
     // CCInputHandlerClient implementation
     virtual void setNeedsRedraw();
-    virtual CCInputHandlerClient::ScrollStatus scrollBegin(const IntPoint&);
+    virtual CCInputHandlerClient::ScrollStatus scrollBegin(const IntPoint&, CCInputHandlerClient::ScrollInputType);
     virtual void scrollBy(const IntSize&);
     virtual void scrollEnd();
-    virtual bool haveWheelEventHandlers();
     virtual void pinchGestureBegin();
     virtual void pinchGestureUpdate(float, const IntPoint&);
     virtual void pinchGestureEnd();
     virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs);
 
-    // Virtual for testing
+    // Virtual for testing.
     virtual void beginCommit();
     virtual void commitComplete();
     virtual void animate(double frameDisplayTimeMs);
@@ -98,7 +100,6 @@ public:
 
     bool visible() const { return m_visible; }
     void setVisible(bool);
-    void setHaveWheelEventHandlers(bool haveWheelEventHandlers) { m_haveWheelEventHandlers = haveWheelEventHandlers; }
 
     int sourceFrameNumber() const { return m_sourceFrameNumber; }
     void setSourceFrameNumber(int frameNumber) { m_sourceFrameNumber = frameNumber; }
@@ -113,8 +114,23 @@ public:
 
     PassOwnPtr<CCScrollAndScaleSet> processScrollDeltas();
 
+    // Where possible, redraws are scissored to a damage region calculated from changes to
+    // layer properties. This function overrides the damage region for the next draw cycle.
+    void setFullRootLayerDamage();
+
+    void startPageScaleAnimation(const IntSize& tragetPosition, bool useAnchor, float scale, double durationSec);
+
+    bool needsAnimateLayers() const { return m_needsAnimateLayers; }
+    void setNeedsAnimateLayers() { m_needsAnimateLayers = true; }
+
 protected:
     CCLayerTreeHostImpl(const CCSettings&, CCLayerTreeHostImplClient*);
+
+    void animatePageScale(double frameBeginTimeMs);
+
+    // Virtual for testing.
+    virtual void animateLayers(double frameBeginTimeMs);
+
     CCLayerTreeHostImplClient* m_client;
     int m_sourceFrameNumber;
     int m_frameNumber;
@@ -122,13 +138,18 @@ protected:
 private:
     typedef Vector<RefPtr<CCLayerImpl> > CCLayerList;
 
+    void computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo);
+    void computePinchZoomDeltas(CCScrollAndScaleSet* scrollInfo);
+    void makeScrollAndScaleSet(CCScrollAndScaleSet* scrollInfo, const IntSize& scrollOffset, float pageScale);
+
     void setPageScaleDelta(float);
     void applyPageScaleDeltaToScrollLayer();
     void adjustScrollsForPageScaleChange(float);
     void updateMaxScrollPosition();
     void trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer, const CCLayerList& renderSurfaceLayerList);
-    void calculateRenderPasses(CCRenderPassList&);
+    void calculateRenderPasses(CCRenderPassList&, CCLayerList& renderSurfaceLayerList);
     void optimizeRenderPasses(CCRenderPassList&);
+    void animateLayersRecursive(CCLayerImpl*, double frameBeginTimeSecs, CCAnimationEventsVector&, bool& didAnimate, bool& needsAnimateLayers);
     IntSize contentSize() const;
 
     OwnPtr<LayerRendererChromium> m_layerRenderer;
@@ -137,14 +158,16 @@ private:
     CCSettings m_settings;
     IntSize m_viewportSize;
     bool m_visible;
-    bool m_haveWheelEventHandlers;
 
     float m_pageScale;
     float m_pageScaleDelta;
     float m_sentPageScaleDelta;
     float m_minPageScale, m_maxPageScale;
 
+    // If this is true, it is necessary to traverse the layer tree ticking the animators.
+    bool m_needsAnimateLayers;
     bool m_pinchGestureActive;
+    IntPoint m_previousPinchAnchor;
 
     OwnPtr<CCPageScaleAnimation> m_pageScaleAnimation;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
new file mode 100644
index 000000000..c5611ac27
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -0,0 +1,351 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCOcclusionTracker.h"
+
+#include "LayerChromium.h"
+#include "cc/CCLayerImpl.h"
+
+#include <algorithm>
+
+using namespace std;
+
+namespace WebCore {
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::enterTargetRenderSurface(const RenderSurfaceType* newTarget)
+{
+    if (!m_stack.isEmpty() && m_stack.last().surface == newTarget)
+        return;
+
+    const RenderSurfaceType* oldTarget = m_stack.isEmpty() ? 0 : m_stack.last().surface;
+    const RenderSurfaceType* oldAncestorThatMovesPixels = !oldTarget ? 0 : oldTarget->nearestAncestorThatMovesPixels();
+    const RenderSurfaceType* newAncestorThatMovesPixels = newTarget->nearestAncestorThatMovesPixels();
+
+    m_stack.append(StackObject());
+    m_stack.last().surface = newTarget;
+
+    // We copy the screen occlusion into the new RenderSurface subtree, but we never copy in the
+    // target occlusion, since we are looking at a new RenderSurface target.
+
+    // If we are entering a subtree that is going to move pixels around, then the occlusion we've computed
+    // so far won't apply to the pixels we're drawing here in the same way. We discard the occlusion thus
+    // far to be safe, and ensure we don't cull any pixels that are moved such that they become visible.
+    bool enteringSubtreeThatMovesPixels = newAncestorThatMovesPixels && newAncestorThatMovesPixels != oldAncestorThatMovesPixels;
+
+    bool copyScreenOcclusionForward = m_stack.size() > 1 && !enteringSubtreeThatMovesPixels;
+    if (copyScreenOcclusionForward) {
+        int lastIndex = m_stack.size() - 1;
+        m_stack[lastIndex].occlusionInScreen = m_stack[lastIndex - 1].occlusionInScreen;
+    }
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::finishedTargetRenderSurface(const LayerType* owningLayer, const RenderSurfaceType* finishedTarget)
+{
+    // FIXME: Remove the owningLayer parameter when we can get all the info from the surface.
+    ASSERT(owningLayer->renderSurface() == finishedTarget);
+
+    // Make sure we know about the target surface.
+    enterTargetRenderSurface(finishedTarget);
+
+    if (owningLayer->maskLayer() || finishedTarget->drawOpacity() < 1 || finishedTarget->filters().hasFilterThatAffectsOpacity()) {
+        m_stack.last().occlusionInScreen = Region();
+        m_stack.last().occlusionInTarget = Region();
+    }
+}
+
+template<typename RenderSurfaceType>
+static inline Region transformSurfaceOpaqueRegion(const RenderSurfaceType* surface, const Region& region, const TransformationMatrix& transform)
+{
+    // Verify that rects within the |surface| will remain rects in its target surface after applying |transform|. If this is true, then
+    // apply |transform| to each rect within |region| in order to transform the entire Region.
+
+    IntRect bounds = region.bounds();
+    FloatRect centeredBounds(-bounds.width() / 2.0, -bounds.height() / 2.0, bounds.width(), bounds.height());
+    FloatQuad transformedBoundsQuad = transform.mapQuad(FloatQuad(centeredBounds));
+    if (!transformedBoundsQuad.isRectilinear())
+        return Region();
+
+    Region transformedRegion;
+
+    IntRect surfaceBounds = surface->contentRect();
+    Vector<IntRect> rects = region.rects();
+    Vector<IntRect>::const_iterator end = rects.end();
+    for (Vector<IntRect>::const_iterator i = rects.begin(); i != end; ++i) {
+        FloatRect centeredOriginRect(-i->width() / 2.0 + i->x() - surfaceBounds.x(), -i->height() / 2.0 + i->y() - surfaceBounds.y(), i->width(), i->height());
+        FloatRect transformedRect = transform.mapRect(FloatRect(centeredOriginRect));
+        transformedRegion.unite(enclosedIntRect(transformedRect));
+    }
+    return transformedRegion;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::leaveToTargetRenderSurface(const RenderSurfaceType* newTarget)
+{
+    int lastIndex = m_stack.size() - 1;
+    bool surfaceWillBeAtTopAfterPop = m_stack.size() > 1 && m_stack[lastIndex - 1].surface == newTarget;
+
+    // We merge the screen occlusion from the current RenderSurface subtree out to its parent target RenderSurface.
+    // The target occlusion can be merged out as well but needs to be transformed to the new target.
+
+    const RenderSurfaceType* oldTarget = m_stack[lastIndex].surface;
+    Region oldTargetOcclusionInNewTarget = transformSurfaceOpaqueRegion<RenderSurfaceType>(oldTarget, m_stack[lastIndex].occlusionInTarget, oldTarget->drawTransform());
+
+    if (surfaceWillBeAtTopAfterPop) {
+        // Merge the top of the stack down.
+
+        m_stack[lastIndex - 1].occlusionInScreen.unite(m_stack[lastIndex].occlusionInScreen);
+        m_stack[lastIndex - 1].occlusionInTarget.unite(oldTargetOcclusionInNewTarget);
+        m_stack.removeLast();
+    } else {
+        // Replace the top of the stack with the new pushed surface. Copy the occluded screen region to the top.
+        m_stack.last().surface = newTarget;
+        m_stack.last().occlusionInTarget = oldTargetOcclusionInNewTarget;
+    }
+}
+
+template<typename LayerType>
+static inline TransformationMatrix contentToScreenSpaceTransform(const LayerType* layer)
+{
+    IntSize boundsInLayerSpace = layer->bounds();
+    IntSize boundsInContentSpace = layer->contentBounds();
+
+    TransformationMatrix transform = layer->screenSpaceTransform();
+
+    if (boundsInContentSpace.isEmpty())
+        return transform;
+
+    // Scale from content space to layer space
+    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
+                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
+
+    return transform;
+}
+
+template<typename LayerType>
+static inline TransformationMatrix contentToTargetSurfaceTransform(const LayerType* layer)
+{
+    IntSize boundsInLayerSpace = layer->bounds();
+    IntSize boundsInContentSpace = layer->contentBounds();
+
+    TransformationMatrix transform = layer->drawTransform();
+
+    if (boundsInContentSpace.isEmpty())
+        return transform;
+
+    // Scale from content space to layer space
+    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
+                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
+
+    // The draw transform expects the origin to be in the middle of the layer.
+    transform.translate(-boundsInContentSpace.width() / 2.0, -boundsInContentSpace.height() / 2.0);
+
+    return transform;
+}
+
+template<typename LayerType>
+static inline Region computeOcclusionBehindLayer(const LayerType* layer, const TransformationMatrix& transform)
+{
+    Region opaqueRegion;
+
+    FloatQuad unoccludedQuad = transform.mapQuad(FloatQuad(layer->visibleLayerRect()));
+    bool isPaintedAxisAligned = unoccludedQuad.isRectilinear();
+    if (!isPaintedAxisAligned)
+        return opaqueRegion;
+
+    if (layer->opaque())
+        opaqueRegion = enclosedIntRect(unoccludedQuad.boundingBox());
+    // FIXME: Capture opaque paints: else opaqueRegion = layer->opaqueContentsRegion(transform);
+    return opaqueRegion;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLayer(const LayerType* layer)
+{
+    ASSERT(!m_stack.isEmpty());
+    ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
+
+    if (layer->drawOpacity() != 1)
+        return;
+
+    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+    TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
+
+    m_stack.last().occlusionInScreen.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToScreenSpace));
+    m_stack.last().occlusionInTarget.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToTargetSurface));
+}
+
+static inline bool testContentRectOccluded(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+{
+    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
+    return occlusion.contains(transformedQuad.enclosingBoundingBox());
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::occluded(const LayerType* layer, const IntRect& contentRect) const
+{
+    if (m_stack.isEmpty())
+        return false;
+
+    ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
+
+    if (testContentRectOccluded(contentRect, contentToScreenSpaceTransform<LayerType>(layer), m_stack.last().occlusionInScreen))
+        return true;
+    if (testContentRectOccluded(contentRect, contentToTargetSurfaceTransform<LayerType>(layer), m_stack.last().occlusionInTarget))
+        return true;
+    return false;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceOccluded(const LayerType* layer, const IntRect& surfaceContentRect) const
+{
+    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
+    if (m_stack.size() < 2)
+        return false;
+
+    ASSERT(layer->renderSurface());
+    ASSERT(layer->renderSurface() == m_stack.last().surface);
+
+    TransformationMatrix surfaceContentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+
+    const StackObject& secondLast = m_stack[m_stack.size()-2];
+    if (testContentRectOccluded(surfaceContentRect, surfaceContentToScreenSpace, secondLast.occlusionInScreen))
+        return true;
+    return false;
+}
+
+// Determines what portion of rect, if any, is unoccluded (not occluded by region). If
+// the resulting unoccluded region is not rectangular, we return a rect containing it.
+static inline IntRect rectSubtractRegion(const IntRect& rect, const Region& region)
+{
+    Region rectRegion(rect);
+    Region intersectRegion(intersect(region, rectRegion));
+
+    if (intersectRegion.isEmpty())
+        return rect;
+
+    rectRegion.subtract(intersectRegion);
+    IntRect boundsRect = rectRegion.bounds();
+    return boundsRect;
+}
+
+static IntRect computeUnoccludedContentRect(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+{
+    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
+    if (!transformedQuad.isRectilinear())
+        return contentRect;
+    // Take the enclosingIntRect at each step here, as we want to contain any unoccluded partial pixels in the resulting IntRect.
+    IntRect shrunkRect = rectSubtractRegion(enclosingIntRect(transformedQuad.boundingBox()), occlusion);
+    IntRect unoccludedRect = enclosingIntRect(contentSpaceTransform.inverse().mapRect(FloatRect(shrunkRect)));
+    // The use of enclosingIntRect, with floating point rounding, can give us a result that is not a sub-rect of contentRect, but our
+    // return value should be a sub-rect.
+    return intersection(unoccludedRect, contentRect);
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContentRect(const LayerType* layer, const IntRect& contentRect) const
+{
+    if (m_stack.isEmpty())
+        return contentRect;
+
+    // We want to return a rect that contains all the visible parts of |contentRect| in both screen space and in the target surface.
+    // So we find the visible parts of |contentRect| in each space, and take the intersection.
+
+    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+    TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
+
+    IntRect unoccludedInScreen = computeUnoccludedContentRect(contentRect, contentToScreenSpace, m_stack.last().occlusionInScreen);
+    IntRect unoccludedInTarget = computeUnoccludedContentRect(contentRect, contentToTargetSurface, m_stack.last().occlusionInTarget);
+
+    return intersection(unoccludedInScreen, unoccludedInTarget);
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceUnoccludedContentRect(const LayerType* layer, const IntRect& surfaceContentRect) const
+{
+    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
+    if (m_stack.size() < 2)
+        return surfaceContentRect;
+
+    ASSERT(layer->renderSurface());
+    ASSERT(layer->renderSurface() == m_stack.last().surface);
+
+    // We want to return a rect that contains all the visible parts of |contentRect| in both screen space and in the target surface.
+    // So we find the visible parts of |contentRect| in each space, and take the intersection.
+
+    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+
+    const StackObject& secondLast = m_stack[m_stack.size()-2];
+    IntRect unoccludedInScreen = computeUnoccludedContentRect(surfaceContentRect, contentToScreenSpace, secondLast.occlusionInScreen);
+
+    return unoccludedInScreen;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+const Region& CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::currentOcclusionInScreenSpace() const
+{
+    ASSERT(!m_stack.isEmpty());
+    return m_stack.last().occlusionInScreen;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+const Region& CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::currentOcclusionInTargetSurface() const
+{
+    ASSERT(!m_stack.isEmpty());
+    return m_stack.last().occlusionInTarget;
+}
+
+
+// Declare the possible functions here for the linker.
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::enterTargetRenderSurface(const RenderSurfaceChromium* newTarget);
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::finishedTargetRenderSurface(const LayerChromium* owningLayer, const RenderSurfaceChromium* finishedTarget);
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::leaveToTargetRenderSurface(const RenderSurfaceChromium* newTarget);
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::markOccludedBehindLayer(const LayerChromium*);
+template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::occluded(const LayerChromium*, const IntRect& contentRect) const;
+template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceOccluded(const LayerChromium*, const IntRect& surfaceContentRect) const;
+template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::unoccludedContentRect(const LayerChromium*, const IntRect& contentRect) const;
+template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceUnoccludedContentRect(const LayerChromium*, const IntRect& surfaceContentRect) const;
+template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInScreenSpace() const;
+template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInTargetSurface() const;
+
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::enterTargetRenderSurface(const CCRenderSurface* newTarget);
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::finishedTargetRenderSurface(const CCLayerImpl* owningLayer, const CCRenderSurface* finishedTarget);
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::leaveToTargetRenderSurface(const CCRenderSurface* newTarget);
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::markOccludedBehindLayer(const CCLayerImpl*);
+template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::occluded(const CCLayerImpl*, const IntRect& contentRect) const;
+template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceOccluded(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
+template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::unoccludedContentRect(const CCLayerImpl*, const IntRect& contentRect) const;
+template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceUnoccludedContentRect(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
+template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInScreenSpace() const;
+template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInTargetSurface() const;
+
+
+} // namespace WebCore
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
new file mode 100644
index 000000000..d1c833e1a
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCOcclusionTracker_h
+#define CCOcclusionTracker_h
+
+#include "FloatQuad.h"
+#include "Region.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+class CCLayerImpl;
+class CCRenderSurface;
+class LayerChromium;
+class RenderSurfaceChromium;
+
+// This class is used to track occlusion of layers while traversing them in a front-to-back order. As each layer is visited, one of the
+// methods in this class is called to notify it about the current target surface.
+// Then, occlusion in the content space of the current layer may be queried, via methods such as occluded() and unoccludedContentRect().
+// If the current layer owns a RenderSurface, then occlusion on that RenderSurface may also be queried via surfaceOccluded() and surfaceUnoccludedContentRect().
+// Finally, once finished with the layer, occlusion behind the layer should be marked by calling markOccludedBehindLayer().
+template<typename LayerType, typename RenderSurfaceType>
+class CCOcclusionTrackerBase {
+public:
+    CCOcclusionTrackerBase() { }
+
+    // Called when visiting a layer representing itself. If the target was not already current, then this indicates we have entered a new surface subtree.
+    void enterTargetRenderSurface(const RenderSurfaceType* newTarget);
+
+    // Called when visiting a layer representing a target surface. This indicates we have visited all the layers within the surface, and we may
+    // perform any surface-wide operations.
+    void finishedTargetRenderSurface(const LayerType*, const RenderSurfaceType* finishedTarget);
+
+    // Called when visiting a layer representing a contributing surface. This  indicates that we are leaving our current surface, and
+    // entering the new one. We then perform any operations required for merging results from the child subtree into its parent.
+    void leaveToTargetRenderSurface(const RenderSurfaceType* newTarget);
+
+    // Add the layer's occlusion to the tracked state.
+    void markOccludedBehindLayer(const LayerType*);
+
+    // Returns true if the given rect in content space for the layer is fully occluded in either screen space or the layer's target surface.
+    bool occluded(const LayerType*, const IntRect& contentRect) const;
+    // Gives an unoccluded sub-rect of |contentRect| in the content space of the layer. Used when considering occlusion for a layer that paints/draws something.
+    IntRect unoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
+
+    // Returns true if the given rect in content space for the RenderSurface owned by the layer is fully occluded in either screen space or the layer's target surface.
+    bool surfaceOccluded(const LayerType*, const IntRect& contentRect) const;
+    // Gives an unoccluded sub-rect of |contentRect| in the content space of the RenderSurface owned by the layer. Used when considering occlusion for a target surface.
+    IntRect surfaceUnoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
+
+    // FIXME: Remove these in future, they are to make CLs for transitioning to this easier.
+    const Region& currentOcclusionInScreenSpace() const;
+    const Region& currentOcclusionInTargetSurface() const;
+
+protected:
+    struct StackObject {
+        const RenderSurfaceType* surface;
+        Region occlusionInScreen;
+        Region occlusionInTarget;
+    };
+
+    // The stack holds occluded regions for subtrees in the RenderSurface-Layer tree, so that when we leave a subtree we may
+    // apply a mask to it, but not to the parts outside the subtree.
+    // - The first time we see a new subtree under a target, we add that target to the top of the stack. This can happen as a layer representing itself, or as a target surface.
+    // - When we visit a target surface, we apply its mask to its subtree, which is at the top of the stack.
+    // - When we visit a layer representing itself, we add its occlusion to the current subtree, which is at the top of the stack.
+    // - When we visit a layer representing a contributing surface, the current target will never be the top of the stack since we just came from the contributing surface.
+    // We merge the occlusion at the top of the stack with the new current subtree. This new target is pushed onto the stack if not already there.
+    Vector<StackObject, 1> m_stack;
+
+private:
+    WTF_MAKE_NONCOPYABLE(CCOcclusionTrackerBase);
+};
+
+typedef CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium> CCOcclusionTracker;
+typedef CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface> CCOcclusionTrackerImpl;
+
+}
+#endif // CCOcclusionTracker_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
index 44aacceb0..b4358aadd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
@@ -57,6 +57,8 @@ public:
 
     virtual bool compositeAndReadback(void *pixels, const IntRect&) = 0;
 
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec) = 0;
+
     virtual void finishAllRendering() = 0;
 
     virtual bool isStarted() const = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
index c8bd9b0f3..4f6435dc0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
@@ -75,7 +75,7 @@ static IntRect rectSubtractRegion(const Region& region, const IntRect& rect)
     return rect;
 }
 
-void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList)
+void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect, const FloatRect& damageRect)
 {
     if (!quadList.size())
         return;
@@ -89,25 +89,28 @@ void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList)
         CCDrawQuad* drawQuad = quadList[i].get();
 
         FloatRect floatTransformedRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->quadRect()));
+        if (haveDamageRect)
+            floatTransformedRect.intersect(damageRect);
         // Inflate rect to be tested to stay conservative.
         IntRect transformedQuadRect(enclosingIntRect(floatTransformedRect));
 
         IntRect transformedVisibleQuadRect = rectSubtractRegion(opaqueCoverageThusFar, transformedQuadRect);
         bool keepQuad = !transformedVisibleQuadRect.isEmpty();
+        if (!keepQuad)
+            continue;
 
         // See if we can reduce the number of pixels to draw by reducing the size of the draw
         // quad - we do this by changing its visible rect.
-        if (keepQuad && transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect())
+        if (transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect())
             drawQuad->setQuadVisibleRect(drawQuad->quadTransform().inverse().mapRect(transformedVisibleQuadRect));
 
         // When adding rect to opaque region, deflate it to stay conservative.
-        if (keepQuad && drawQuad->isLayerAxisAlignedIntRect()) {
+        if (drawQuad->isLayerAxisAlignedIntRect() && !drawQuad->opaqueRect().isEmpty()) {
             FloatRect floatOpaqueRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->opaqueRect()));
             opaqueCoverageThusFar.unite(Region(enclosedIntRect(floatOpaqueRect)));
         }
 
-        if (keepQuad)
-            culledList.append(quadList[i].release());
+        culledList.append(quadList[i].release());
     }
     quadList.clear(); // Release anything that remains.
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
index 7179285ac..3cc315ec4 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
 class CCQuadCuller {
 public:
-    static void cullOccludedQuads(CCQuadList&);
+    static void cullOccludedQuads(CCQuadList&, bool haveDamageRect, const FloatRect& damageRect);
 
 private:
     // Make non-instantiable.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
index 6f51fbcde..da4b2222c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
@@ -27,6 +27,7 @@
 
 #include "cc/CCRenderPass.h"
 
+#include "cc/CCDamageTracker.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCQuadCuller.h"
 #include "cc/CCRenderSurfaceDrawQuad.h"
@@ -64,9 +65,9 @@ void CCRenderPass::appendQuadsForRenderSurfaceLayer(CCLayerImpl* layer)
     m_sharedQuadStateList.append(sharedQuadState.release());
 }
 
-void CCRenderPass::optimizeQuads()
+void CCRenderPass::optimizeQuads(bool haveDamageRect, const FloatRect& damageRect)
 {
-    CCQuadCuller::cullOccludedQuads(m_quadList);
+    CCQuadCuller::cullOccludedQuads(m_quadList, haveDamageRect, damageRect);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
index 9fb77166c..11fbd4016 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
@@ -46,7 +46,7 @@ public:
     void appendQuadsForLayer(CCLayerImpl*);
     void appendQuadsForRenderSurfaceLayer(CCLayerImpl*);
 
-    void optimizeQuads();
+    void optimizeQuads(bool haveDamageRect, const FloatRect& damageRect);
 
     const CCQuadList& quadList() const { return m_quadList; }
     CCRenderSurface* targetSurface() const { return m_targetSurface; }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
index a4c92569d..169999808 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
@@ -29,13 +29,18 @@
 
 #include "cc/CCRenderSurface.h"
 
+#include "GeometryBinding.h"
+#include "GrTexture.h"
 #include "GraphicsContext3D.h"
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
 #include "ManagedTexture.h"
+#include "SharedGraphicsContext3D.h"
 #include "TextStream.h"
 #include "cc/CCDamageTracker.h"
 #include "cc/CCLayerImpl.h"
+#include "cc/CCProxy.h"
+#include "cc/CCRenderSurfaceFilters.h"
 #include <wtf/text/CString.h>
 
 namespace WebCore {
@@ -46,6 +51,7 @@ CCRenderSurface::CCRenderSurface(CCLayerImpl* owningLayer)
     , m_skipsDraw(false)
     , m_surfacePropertyChanged(false)
     , m_drawOpacity(1)
+    , m_nearestAncestorThatMovesPixels(0)
 {
     m_damageTracker = CCDamageTracker::create();
 }
@@ -105,6 +111,8 @@ void CCRenderSurface::draw(LayerRendererChromium* layerRenderer, const FloatRect
 {
     if (m_skipsDraw || !m_contentsTexture)
         return;
+
+    SkBitmap filterBitmap = applyFilters(layerRenderer);
     // FIXME: By using the same RenderSurface for both the content and its reflection,
     // it's currently not possible to apply a separate mask to the reflection layer
     // or correctly handle opacity in reflections (opacity must be applied after drawing
@@ -128,12 +136,12 @@ void CCRenderSurface::draw(LayerRendererChromium* layerRenderer, const FloatRect
 
     // Reflection draws before the layer.
     if (m_owningLayer->replicaLayer())
-        drawLayer(layerRenderer, replicaMaskLayer, m_replicaDrawTransform);
+        drawLayer(layerRenderer, replicaMaskLayer, m_replicaDrawTransform, filterBitmap);
 
-    drawLayer(layerRenderer, m_maskLayer, m_drawTransform);
+    drawLayer(layerRenderer, m_maskLayer, m_drawTransform, filterBitmap);
 }
 
-void CCRenderSurface::drawLayer(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform)
+void CCRenderSurface::drawLayer(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform, const SkBitmap& filterBitmap)
 {
     TransformationMatrix renderMatrix = drawTransform;
     // Apply a scaling factor to size the quad from 1x1 to its intended size.
@@ -165,24 +173,24 @@ void CCRenderSurface::drawLayer(LayerRendererChromium* layerRenderer, CCLayerImp
     if (useMask) {
         if (useAA) {
             const MaskProgramAA* program = layerRenderer->renderSurfaceMaskProgramAA();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation());
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation(), filterBitmap);
         } else {
             const MaskProgram* program = layerRenderer->renderSurfaceMaskProgram();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), -1, -1);
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), -1, -1, filterBitmap);
         }
     } else {
         if (useAA) {
             const ProgramAA* program = layerRenderer->renderSurfaceProgramAA();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation());
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation(), filterBitmap);
         } else {
             const Program* program = layerRenderer->renderSurfaceProgram();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, -1, -1);
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, -1, -1, filterBitmap);
         }
     }
 }
 
 template <class T>
-void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad& layerQuad, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation)
+void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad& layerQuad, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation, const SkBitmap& filterBitmap)
 {
     GraphicsContext3D* context3D = layerRenderer->context();
 
@@ -191,7 +199,11 @@ void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerI
 
     GLC(context3D, context3D->activeTexture(GraphicsContext3D::TEXTURE0));
     GLC(context3D, context3D->uniform1i(program->fragmentShader().samplerLocation(), 0));
-    m_contentsTexture->bindTexture(context3D, layerRenderer->renderSurfaceTextureAllocator());
+    if (filterBitmap.getTexture()) {
+        GrTexture* texture = reinterpret_cast<GrTexture*>(filterBitmap.getTexture());
+        context3D->bindTexture(GraphicsContext3D::TEXTURE_2D, texture->getTextureHandle());
+    } else
+        m_contentsTexture->bindTexture(context3D, layerRenderer->renderSurfaceTextureAllocator());
 
     if (shaderMaskSamplerLocation != -1) {
         GLC(context3D, context3D->activeTexture(GraphicsContext3D::TEXTURE1));
@@ -214,6 +226,17 @@ void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerI
                                     program->vertexShader().matrixLocation(), program->fragmentShader().alphaLocation(), shaderQuadLocation);
 }
 
+SkBitmap CCRenderSurface::applyFilters(LayerRendererChromium* layerRenderer)
+{
+    // Don't use the utility context if we have a compositor thread, since
+    // it can race with canvas's use.
+    if (!m_contentsTexture || !m_filters.size() || CCProxy::hasImplThread())
+        return SkBitmap();
+
+    layerRenderer->context()->flush();
+    return CCRenderSurfaceFilters::apply(m_filters, m_contentsTexture->textureId(), m_contentRect.size(), SharedGraphicsContext3D::get());
+}
+
 String CCRenderSurface::name() const
 {
     return String::format("RenderSurface(id=%i,owner=%s)", m_owningLayer->id(), m_owningLayer->name().utf8().data());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index ab8386d5d..1bcec9260 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -29,10 +29,12 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "FilterOperations.h"
 #include "FloatRect.h"
 #include "IntRect.h"
 #include "ProgramBinding.h"
 #include "ShaderChromium.h"
+#include "SkBitmap.h"
 #include "TextureManager.h"
 #include "TransformationMatrix.h"
 #include "cc/CCLayerQuad.h"
@@ -70,6 +72,13 @@ public:
     void setDrawTransform(const TransformationMatrix& drawTransform) { m_drawTransform = drawTransform; }
     const TransformationMatrix& drawTransform() const { return m_drawTransform; }
 
+    void setFilters(const FilterOperations& filters) { m_filters = filters; }
+    const FilterOperations& filters() const { return m_filters; }
+    SkBitmap applyFilters(LayerRendererChromium*);
+
+    void setNearestAncestorThatMovesPixels(CCRenderSurface* surface) { m_nearestAncestorThatMovesPixels = surface; }
+    const CCRenderSurface* nearestAncestorThatMovesPixels() const { return m_nearestAncestorThatMovesPixels; }
+
     void setReplicaDrawTransform(const TransformationMatrix& replicaDrawTransform) { m_replicaDrawTransform = replicaDrawTransform; }
     const TransformationMatrix& replicaDrawTransform() const { return m_replicaDrawTransform; }
 
@@ -106,9 +115,9 @@ public:
     CCDamageTracker* damageTracker() const { return m_damageTracker.get(); }
 
 private:
-    void drawLayer(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix&);
+    void drawLayer(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix&, const SkBitmap& filterBitmap);
     template <class T>
-    void drawSurface(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad&, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation);
+    void drawSurface(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad&, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation, const SkBitmap& filterBitmap);
 
     CCLayerImpl* m_owningLayer;
     CCLayerImpl* m_maskLayer;
@@ -122,9 +131,14 @@ private:
     TransformationMatrix m_drawTransform;
     TransformationMatrix m_replicaDrawTransform;
     TransformationMatrix m_originTransform;
+    FilterOperations m_filters;
     IntRect m_clipRect;
     Vector<RefPtr<CCLayerImpl> > m_layerList;
 
+    // The nearest ancestor target surface that will contain the contents of this surface, and that is going
+    // to move pixels within the surface (such as with a blur). This can point to itself.
+    CCRenderSurface* m_nearestAncestorThatMovesPixels;
+
     OwnPtr<CCDamageTracker> m_damageTracker;
 
     // Stored in the "surface space" where this damage can be used for scissoring.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
new file mode 100644
index 000000000..b175d112d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
@@ -0,0 +1,315 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCRenderSurfaceFilters.h"
+
+#include "GraphicsContext3D.h"
+#include "SkBlurImageFilter.h"
+#include "SkCanvas.h"
+#include "SkColorMatrixFilter.h"
+#include "SkGpuDevice.h"
+#include "SkGrTexturePixelRef.h"
+
+namespace {
+
+void getBrightnessMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    //    Old implementation, a la the draft spec, a straight-up scale,
+    //    representing <feFunc[R|G|B] type="linear" slope="[amount]">
+    //    (See http://dvcs.w3.org/hg/FXTF/raw-file/tip/filters/index.html#brightnessEquivalent)
+    // matrix[0] = matrix[6] = matrix[12] = amount;
+    // matrix[18] = 1;
+    //    New implementation, a translation in color space, representing
+    //    <feFunc[R|G|B] type="linear" intercept="[amount]"/>
+    //    (See https://www.w3.org/Bugs/Public/show_bug.cgi?id=15647)
+    matrix[0] = matrix[6] = matrix[12] = matrix[18] = 1;
+    matrix[4] = matrix[9] = matrix[14] = amount * 255;
+}
+
+void getContrastMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = amount;
+    matrix[4] = matrix[9] = matrix[14] = (-0.5f * amount + 0.5f) * 255;
+    matrix[18] = 1;
+}
+
+void getSaturateMatrix(float amount, SkScalar matrix[20])
+{
+    matrix[0] = 0.213f + 0.787f * amount;
+    matrix[1] = 0.715f - 0.715f * amount;
+    matrix[2] = 0.072f - 0.072f * amount;
+    matrix[3] = matrix[4] = 0;
+    matrix[5] = 0.213f - 0.213f * amount;
+    matrix[6] = 0.715f + 0.285f * amount;
+    matrix[7] = 0.072f - 0.072f * amount;
+    matrix[8] = matrix[9] = 0;
+    matrix[10] = 0.213f - 0.213f * amount;
+    matrix[11] = 0.715f - 0.715f * amount;
+    matrix[12] = 0.072f + 0.928f * amount;
+    matrix[13] = matrix[14] = 0;
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+void getHueRotateMatrix(float hue, SkScalar matrix[20])
+{
+    float cosHue = cosf(hue * piFloat / 180); 
+    float sinHue = sinf(hue * piFloat / 180); 
+    matrix[0] = 0.213f + cosHue * 0.787f - sinHue * 0.213f;
+    matrix[1] = 0.715f - cosHue * 0.715f - sinHue * 0.715f;
+    matrix[2] = 0.072f - cosHue * 0.072f + sinHue * 0.928f;
+    matrix[3] = matrix[4] = 0;
+    matrix[5] = 0.213f - cosHue * 0.213f + sinHue * 0.143f;
+    matrix[6] = 0.715f + cosHue * 0.285f + sinHue * 0.140f;
+    matrix[7] = 0.072f - cosHue * 0.072f - sinHue * 0.283f;
+    matrix[8] = matrix[9] = 0;
+    matrix[10] = 0.213f - cosHue * 0.213f - sinHue * 0.787f;
+    matrix[11] = 0.715f - cosHue * 0.715f + sinHue * 0.715f;
+    matrix[12] = 0.072f + cosHue * 0.928f + sinHue * 0.072f;
+    matrix[13] = matrix[14] = 0;
+    matrix[15] = matrix[16] = matrix[17] = 0;
+    matrix[18] = 1;
+    matrix[19] = 0;
+}
+
+void getInvertMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = 1 - 2 * amount;
+    matrix[4] = matrix[9] = matrix[14] = amount * 255;
+    matrix[18] = 1;
+}
+
+void getOpacityMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = 1;
+    matrix[18] = amount;
+}
+
+void getGrayscaleMatrix(float amount, SkScalar matrix[20])
+{
+    matrix[0] = 0.2126f + 0.7874f * amount;
+    matrix[1] = 0.7152f - 0.7152f * amount;
+    matrix[2] = 0.0722f - 0.0722f * amount;
+    matrix[3] = matrix[4] = 0;
+
+    matrix[5] = 0.2126f - 0.2126f * amount;
+    matrix[6] = 0.7152f + 0.2848f * amount;
+    matrix[7] = 0.0722f - 0.0722f * amount;
+    matrix[8] = matrix[9] = 0;
+
+    matrix[10] = 0.2126f - 0.2126f * amount;
+    matrix[11] = 0.7152f - 0.7152f * amount;
+    matrix[12] = 0.0722f + 0.9278f * amount;
+    matrix[13] = matrix[14] = 0;
+
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+void getSepiaMatrix(float amount, SkScalar matrix[20])
+{
+    matrix[0] = 0.393f + 0.607f * amount;
+    matrix[1] = 0.769f - 0.769f * amount;
+    matrix[2] = 0.189f - 0.189f * amount;
+    matrix[3] = matrix[4] = 0;
+
+    matrix[5] = 0.349f - 0.349f * amount;
+    matrix[6] = 0.686f + 0.314f * amount;
+    matrix[7] = 0.168f - 0.168f * amount;
+    matrix[8] = matrix[9] = 0;
+
+    matrix[10] = 0.272f - 0.272f * amount;
+    matrix[11] = 0.534f - 0.534f * amount;
+    matrix[12] = 0.131f + 0.869f * amount;
+    matrix[13] = matrix[14] = 0;
+
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+bool applyColorMatrix(SkCanvas* canvas, SkBitmap source, SkScalar matrix[20])
+{
+    SkPaint paint;
+    paint.setColorFilter(new SkColorMatrixFilter(matrix))->unref();
+    canvas->drawBitmap(source, 0, 0, &paint);
+    return true;
+}
+
+}
+
+namespace WebCore {
+
+SkBitmap CCRenderSurfaceFilters::apply(const FilterOperations& filters, unsigned textureId, const FloatSize& size, GraphicsContext3D* context3D)
+{
+    SkBitmap source;
+    if (!context3D)
+        return source;
+
+    GrContext* gr = context3D->grContext();
+    if (!gr)
+        return source;
+    // Wrap the RenderSurface's texture in a Ganesh platform texture.
+    GrPlatformTextureDesc platformTexDesc;
+    platformTexDesc.fWidth = size.width();
+    platformTexDesc.fHeight = size.height();
+    platformTexDesc.fConfig = kSkia8888_PM_GrPixelConfig;
+    platformTexDesc.fTextureHandle = textureId;
+    SkAutoTUnref<GrTexture> texture(gr->createPlatformTexture(platformTexDesc));
+    // Place the platform texture inside an SkBitmap.
+    source.setConfig(SkBitmap::kARGB_8888_Config, size.width(), size.height());
+    source.setPixelRef(new SkGrTexturePixelRef(texture.get()))->unref();
+    
+    GrContext::TextureCacheEntry dest;
+
+    for (unsigned i = 0; i < filters.size(); ++i) {
+        // Save the previous texture cache destination (if any), and keep it
+        // locked during draw to prevent it be re-used as destination.
+        GrContext::TextureCacheEntry sourceEntry = dest;
+        const FilterOperation* filterOperation = filters.at(i);
+        // Allocate a destination texture.
+        GrTextureDesc desc;
+        desc.fFlags = kRenderTarget_GrTextureFlagBit | kNoStencil_GrTextureFlagBit;
+        desc.fSampleCnt = 0;
+        desc.fWidth = size.width();
+        desc.fHeight = size.height();
+        desc.fConfig = kRGBA_8888_GrPixelConfig;
+        // FIXME: could we use approximate match, and fix texcoords on draw
+        dest = gr->lockScratchTexture(desc, GrContext::kExact_ScratchTexMatch);
+        if (!dest.texture())
+            return SkBitmap();
+        SkGpuDevice device(gr, dest.texture());
+        SkCanvas canvas(&device);
+        canvas.clear(0x0);
+        switch (filterOperation->getOperationType()) {
+        case FilterOperation::BRIGHTNESS: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getBrightnessMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::CONTRAST: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getContrastMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::GRAYSCALE: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getGrayscaleMatrix(1 - op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::SEPIA: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getSepiaMatrix(1 - op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::SATURATE: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getSaturateMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::HUE_ROTATE: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getHueRotateMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::INVERT: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getInvertMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::OPACITY: {
+            const BasicComponentTransferFilterOperation* op = static_cast<const BasicComponentTransferFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getOpacityMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::BLUR: {
+            const BlurFilterOperation* op = static_cast<const BlurFilterOperation*>(filterOperation);
+            float stdX = op->stdDeviation().calcFloatValue(0);
+            float stdY = op->stdDeviation().calcFloatValue(1);
+            SkAutoTUnref<SkImageFilter> filter(new SkBlurImageFilter(stdX, stdY));
+            SkPaint paint;
+            paint.setImageFilter(filter.get());
+            paint.setColor(0xFFFFFFFF);
+            canvas.saveLayer(0, &paint);
+            canvas.drawBitmap(source, 0, 0);
+            canvas.restore();
+            break;
+        }
+        case FilterOperation::DROP_SHADOW: {
+            const DropShadowFilterOperation* op = static_cast<const DropShadowFilterOperation*>(filterOperation);
+            SkAutoTUnref<SkImageFilter> blurFilter(new SkBlurImageFilter(op->stdDeviation(), op->stdDeviation()));
+            SkAutoTUnref<SkColorFilter> colorFilter(SkColorFilter::CreateModeFilter(op->color().rgb(), SkXfermode::kSrcIn_Mode));
+            SkPaint paint;
+            paint.setImageFilter(blurFilter.get());
+            paint.setColorFilter(colorFilter.get());
+            paint.setXfermodeMode(SkXfermode::kSrcOver_Mode);
+            canvas.saveLayer(0, &paint);
+            canvas.drawBitmap(source, op->x(), -op->y());
+            canvas.restore();
+            canvas.drawBitmap(source, 0, 0);
+            break;
+        }
+        case FilterOperation::PASSTHROUGH:
+        default:
+            canvas.drawBitmap(source, 0, 0);
+            break;
+        }
+        // Dest texture from this filter becomes source bitmap for next filter.
+        source.setPixelRef(new SkGrTexturePixelRef(dest.texture()))->unref();
+        // Unlock the previous texture cache entry.
+        if (sourceEntry.texture())
+            gr->unlockTexture(sourceEntry);
+    }
+    if (dest.texture())
+        gr->unlockTexture(dest);
+    context3D->flush();
+    return source;
+}
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h
new file mode 100644
index 000000000..68c88d97c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef CCRenderSurfaceFilters_h
+#define CCRenderSurfaceFilters_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+class SkBitmap;
+
+namespace WebCore {
+class FilterOperations;
+class FloatSize;
+class GraphicsContext3D;
+
+class CCRenderSurfaceFilters {
+public:
+    static SkBitmap apply(const FilterOperations& filters, unsigned textureId, const FloatSize&, GraphicsContext3D*);
+private:
+    CCRenderSurfaceFilters();
+};
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index 2e48e10f5..ea8c40f12 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -93,6 +93,11 @@ bool CCSingleThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect
     return true;
 }
 
+void CCSingleThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+{
+    m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+}
+
 GraphicsContext3D* CCSingleThreadProxy::context()
 {
     ASSERT(CCProxy::isMainThread());
@@ -201,6 +206,7 @@ void CCSingleThreadProxy::setNeedsRedraw()
 {
     // FIXME: Once we move render_widget scheduling into this class, we can
     // treat redraw requests more efficiently than commitAndRedraw requests.
+    m_layerTreeHostImpl->setFullRootLayerDamage();
     setNeedsCommit();
 }
 
@@ -227,6 +233,13 @@ void CCSingleThreadProxy::stop()
     m_layerTreeHost = 0;
 }
 
+void CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(CCProxy::isImplThread());
+    DebugScopedSetMainThread main;
+    m_layerTreeHost->setAnimationEvents(events);
+}
+
 // Called by the legacy scheduling path (e.g. where render_widget does the scheduling)
 void CCSingleThreadProxy::compositeImmediately()
 {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
index a94405f3d..71b5e99b2 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
@@ -25,6 +25,7 @@
 #ifndef CCSingleThreadProxy_h
 #define CCSingleThreadProxy_h
 
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCCompletionEvent.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
@@ -42,6 +43,7 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
@@ -62,6 +64,7 @@ public:
     virtual void onSwapBuffersCompleteOnImplThread() { ASSERT_NOT_REACHED(); }
     virtual void setNeedsRedrawOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
     virtual void setNeedsCommitOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
 
     // Called by the legacy path where RenderWidget does the scheduling.
     void compositeImmediately();
@@ -110,6 +113,24 @@ public:
     }
 };
 
+// For use in the single-threaded case. In debug builds, it pretends that the
+// code is running on the main thread to satisfy assertion checks.
+class DebugScopedSetMainThread {
+public:
+    DebugScopedSetMainThread()
+    {
+#if !ASSERT_DISABLED
+        CCProxy::setCurrentThreadIsImplThread(false);
+#endif
+    }
+    ~DebugScopedSetMainThread()
+    {
+#if !ASSERT_DISABLED
+        CCProxy::setCurrentThreadIsImplThread(true);
+#endif
+    }
+};
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 8ca852dda..75ef13623 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -133,6 +133,19 @@ void CCThreadProxy::requestReadbackOnImplThread(ReadbackRequest* request)
     m_schedulerOnImplThread->setNeedsForcedRedraw();
 }
 
+void CCThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+{
+    ASSERT(CCProxy::isMainThread());
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestStartPageScaleAnimationOnImplThread, targetPosition, useAnchor, scale, durationSec));
+}
+
+void CCThreadProxy::requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec)
+{
+    ASSERT(CCProxy::isImplThread());
+    if (m_layerTreeHostImpl)
+        m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+}
+
 GraphicsContext3D* CCThreadProxy::context()
 {
     return 0;
@@ -246,10 +259,18 @@ void CCThreadProxy::setNeedsCommitOnImplThread()
     m_schedulerOnImplThread->setNeedsCommit();
 }
 
+void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(isImplThread());
+    TRACE_EVENT("CCThreadProxy::postAnimationEventsToMainThreadOnImplThread", this, 0);
+    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events));
+}
+
 void CCThreadProxy::setNeedsRedraw()
 {
     ASSERT(isMainThread());
     TRACE_EVENT("CCThreadProxy::setNeedsRedraw", this, 0);
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setFullRootLayerDamageOnImplThread));
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsRedrawOnImplThread));
 }
 
@@ -548,6 +569,14 @@ void CCThreadProxy::didCompleteSwapBuffers()
     m_layerTreeHost->didCompleteSwapBuffers();
 }
 
+void CCThreadProxy::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(isMainThread());
+    if (!m_layerTreeHost)
+        return;
+    m_layerTreeHost->setAnimationEvents(events);
+}
+
 void CCThreadProxy::initializeImplOnImplThread(CCCompletionEvent* completion)
 {
     TRACE_EVENT("CCThreadProxy::initializeImplOnImplThread", this, 0);
@@ -597,6 +626,12 @@ void CCThreadProxy::layerTreeHostClosedOnImplThread(CCCompletionEvent* completio
     completion->signal();
 }
 
+void CCThreadProxy::setFullRootLayerDamageOnImplThread()
+{
+    ASSERT(isImplThread());
+    m_layerTreeHostImpl->setFullRootLayerDamage();
+}
+
 size_t CCThreadProxy::maxPartialTextureUpdates() const
 {
     return textureUpdatesPerFrame;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
index d304acd96..330ef51ca 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
@@ -25,6 +25,7 @@
 #ifndef CCThreadProxy_h
 #define CCThreadProxy_h
 
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCCompletionEvent.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
@@ -49,6 +50,7 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
@@ -69,6 +71,7 @@ public:
     virtual void onSwapBuffersCompleteOnImplThread();
     virtual void setNeedsRedrawOnImplThread();
     virtual void setNeedsCommitOnImplThread();
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
 
     // CCSchedulerClient implementation
     virtual bool canDraw();
@@ -85,6 +88,7 @@ private:
     void beginFrameAndCommit(int sequenceNumber, double frameBeginTime, PassOwnPtr<CCScrollAndScaleSet>);
     void didCommitAndDrawFrame();
     void didCompleteSwapBuffers();
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
 
     // Called on impl thread
     struct ReadbackRequest {
@@ -97,12 +101,14 @@ private:
     void obtainBeginFrameAndCommitTaskFromCCThread(CCCompletionEvent*, CCThread::Task**);
     void beginFrameCompleteOnImplThread(CCCompletionEvent*);
     void requestReadbackOnImplThread(ReadbackRequest*);
+    void requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec);
     void finishAllRenderingOnImplThread(CCCompletionEvent*);
     void initializeImplOnImplThread(CCCompletionEvent*);
     void initializeContextOnImplThread(GraphicsContext3D*);
     void initializeLayerRendererOnImplThread(CCCompletionEvent*, bool* initializeSucceeded, LayerRendererCapabilities*);
     void setVisibleOnImplThread(CCCompletionEvent*, bool visible);
     void layerTreeHostClosedOnImplThread(CCCompletionEvent*);
+    void setFullRootLayerDamageOnImplThread();
 
     // Accessed on main thread only.
     bool m_animateRequested;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
index 80a0435fd..47d0a708c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
@@ -47,7 +47,7 @@ class ManagedTexture;
 class DrawableTile : public CCLayerTilingData::Tile {
     WTF_MAKE_NONCOPYABLE(DrawableTile);
 public:
-    DrawableTile() : m_textureId(0) { }
+    static PassOwnPtr<DrawableTile> create() { return adoptPtr(new DrawableTile()); }
 
     Platform3DObject textureId() const { return m_textureId; }
     void setTextureId(Platform3DObject textureId) { m_textureId = textureId; }
@@ -56,6 +56,8 @@ public:
     void setOpaqueRect(const IntRect& opaqueRect) { m_opaqueRect = opaqueRect; }
 
 private:
+    DrawableTile() : m_textureId(0) { }
+
     Platform3DObject m_textureId;
     IntRect m_opaqueRect;
 };
@@ -103,9 +105,10 @@ DrawableTile* CCTiledLayerImpl::tileAt(int i, int j) const
 
 DrawableTile* CCTiledLayerImpl::createTile(int i, int j)
 {
-    RefPtr<DrawableTile> tile = adoptRef(new DrawableTile());
-    m_tiler->addTile(tile, i, j);
-    return tile.get();
+    OwnPtr<DrawableTile> tile(DrawableTile::create());
+    DrawableTile* addedTile = tile.get();
+    m_tiler->addTile(tile.release(), i, j);
+    return addedTile;
 }
 
 TransformationMatrix CCTiledLayerImpl::quadTransform() const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp
index 3de38e90f..ba5734909 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp
@@ -29,16 +29,18 @@
 
 namespace WebCore {
 
-PassOwnPtr<CCVideoDrawQuad> CCVideoDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCLayerImpl* layer)
+PassOwnPtr<CCVideoDrawQuad> CCVideoDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCVideoLayerImpl::Texture* textures, VideoFrameChromium* frame, GC3Denum format)
 {
-    return adoptPtr(new CCVideoDrawQuad(sharedQuadState, quadRect, layer));
+    return adoptPtr(new CCVideoDrawQuad(sharedQuadState, quadRect, textures, frame, format));
 }
 
-CCVideoDrawQuad::CCVideoDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCLayerImpl* layer)
+CCVideoDrawQuad::CCVideoDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCVideoLayerImpl::Texture* textures, VideoFrameChromium* frame, GC3Denum format)
     : CCDrawQuad(sharedQuadState, CCDrawQuad::VideoContent, quadRect)
-    , m_layer(layer)
+    , m_textures(textures)
+    , m_frame(frame)
+    , m_format(format)
+    , m_matrix(0)
 {
-    ASSERT(m_layer);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h
index b18bc5541..aef78472a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h
@@ -26,23 +26,32 @@
 #ifndef CCVideoDrawQuad_h
 #define CCVideoDrawQuad_h
 
+#include "GraphicsTypes3D.h"
 #include "cc/CCDrawQuad.h"
+#include "cc/CCVideoLayerImpl.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class CCLayerImpl;
 class CCVideoDrawQuad : public CCDrawQuad {
     WTF_MAKE_NONCOPYABLE(CCVideoDrawQuad);
 public:
-    static PassOwnPtr<CCVideoDrawQuad> create(const CCSharedQuadState*, const IntRect&, CCLayerImpl*);
+    static PassOwnPtr<CCVideoDrawQuad> create(const CCSharedQuadState*, const IntRect&, CCVideoLayerImpl::Texture* textures, VideoFrameChromium*, GC3Denum format);
 
-    CCLayerImpl* layer() const { return m_layer; }
+    CCVideoLayerImpl::Texture* textures() const { return m_textures; }
+    VideoFrameChromium* frame() const { return m_frame; }
+    GC3Denum format() const { return m_format; }
+    const float* matrix() const { return m_matrix; }
+
+    void setMatrix(const float* matrix) { m_matrix = matrix; }
 
 private:
-    CCVideoDrawQuad(const CCSharedQuadState*, const IntRect&, CCLayerImpl*);
+    CCVideoDrawQuad(const CCSharedQuadState*, const IntRect&, CCVideoLayerImpl::Texture* textures, VideoFrameChromium*, GC3Denum format);
 
-    CCLayerImpl* m_layer;
+    CCVideoLayerImpl::Texture* m_textures;
+    VideoFrameChromium* m_frame;
+    GC3Denum m_format;
+    const float* m_matrix;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
index eef0ca3e9..35f269f50 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -62,10 +62,21 @@ const float CCVideoLayerImpl::yuvAdjust[3] = {
     -0.5f,
 };
 
+// This matrix is the default transformation for stream textures.
+const float CCVideoLayerImpl::flipTransform[16] = {
+    1, 0, 0, 0,
+    0, -1, 0, 0,
+    0, 0, 1, 0,
+    0, 1, 0, 1,
+};
+
 CCVideoLayerImpl::CCVideoLayerImpl(int id, VideoFrameProvider* provider)
     : CCLayerImpl(id)
     , m_provider(provider)
+    , m_layerTreeHostImpl(0)
+    , m_frame(0)
 {
+    memcpy(m_streamTextureMatrix, flipTransform, sizeof(m_streamTextureMatrix));
     provider->setVideoFrameProviderClient(this);
 }
 
@@ -88,16 +99,16 @@ void CCVideoLayerImpl::stopUsingProvider()
 }
 
 // Convert VideoFrameChromium::Format to GraphicsContext3D's format enum values.
-static GC3Denum convertVFCFormatToGC3DFormat(VideoFrameChromium::Format format)
+static GC3Denum convertVFCFormatToGC3DFormat(const VideoFrameChromium* frame)
 {
-    switch (format) {
+    switch (frame->format()) {
     case VideoFrameChromium::YV12:
     case VideoFrameChromium::YV16:
         return GraphicsContext3D::LUMINANCE;
     case VideoFrameChromium::RGBA:
         return GraphicsContext3D::RGBA;
     case VideoFrameChromium::NativeTexture:
-        return GraphicsContext3D::TEXTURE_2D;
+        return frame->textureTarget();
     case VideoFrameChromium::Invalid:
     case VideoFrameChromium::RGB555:
     case VideoFrameChromium::RGB565:
@@ -112,101 +123,63 @@ static GC3Denum convertVFCFormatToGC3DFormat(VideoFrameChromium::Format format)
     return GraphicsContext3D::INVALID_VALUE;
 }
 
-void CCVideoLayerImpl::draw(LayerRendererChromium* layerRenderer)
+void CCVideoLayerImpl::willDraw(LayerRendererChromium* layerRenderer)
 {
     ASSERT(CCProxy::isImplThread());
 
     MutexLocker locker(m_providerMutex);
 
-    if (!m_provider)
+    if (!m_provider) {
+        m_frame = 0;
         return;
+    }
 
-    VideoFrameChromium* frame = m_provider->getCurrentFrame();
-    if (!frame)
-        return;
-    GC3Denum format = convertVFCFormatToGC3DFormat(frame->format());
+    m_frame = m_provider->getCurrentFrame();
 
-    if (format == GraphicsContext3D::INVALID_VALUE) {
-        m_provider->putCurrentFrame(frame);
+    if (!m_frame)
         return;
-    }
 
-    if (!copyFrameToTextures(frame, format, layerRenderer)) {
-        m_provider->putCurrentFrame(frame);
+    m_format = convertVFCFormatToGC3DFormat(m_frame);
+
+    if (m_format == GraphicsContext3D::INVALID_VALUE) {
+        m_provider->putCurrentFrame(m_frame);
+        m_frame = 0;
         return;
     }
 
-    switch (format) {
-    case GraphicsContext3D::LUMINANCE:
-        drawYUV(layerRenderer);
-        break;
-    case GraphicsContext3D::RGBA:
-        drawRGBA(layerRenderer);
-        break;
-    case GraphicsContext3D::TEXTURE_2D:
-        drawNativeTexture(layerRenderer);
-        break;
-    default:
-        CRASH(); // Someone updated convertVFCFormatToGC3DFormat above but update this!
+    if (!reserveTextures(m_frame, m_format, layerRenderer)) {
+        m_provider->putCurrentFrame(m_frame);
+        m_frame = 0;
     }
-
-    for (unsigned plane = 0; plane < frame->planes(); ++plane)
-        m_textures[plane].m_texture->unreserve();
-    m_provider->putCurrentFrame(frame);
 }
 
 void CCVideoLayerImpl::appendQuads(CCQuadList& quadList, const CCSharedQuadState* sharedQuadState)
 {
     IntRect quadRect(IntPoint(), bounds());
-    quadList.append(CCVideoDrawQuad::create(sharedQuadState, quadRect, this));
+    OwnPtr<CCVideoDrawQuad> videoQuad = CCVideoDrawQuad::create(sharedQuadState, quadRect, m_textures, m_frame, m_format);
+
+    if (m_format == Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES)
+        videoQuad->setMatrix(m_streamTextureMatrix);
+
+    quadList.append(videoQuad.release());
 }
 
-bool CCVideoLayerImpl::copyFrameToTextures(const VideoFrameChromium* frame, GC3Denum format, LayerRendererChromium* layerRenderer)
+void CCVideoLayerImpl::didDraw()
 {
-    if (frame->format() == VideoFrameChromium::NativeTexture) {
-        m_nativeTextureId = frame->textureId();
-        m_nativeTextureSize = IntSize(frame->width(), frame->height());
-        return true;
-    }
+    ASSERT(CCProxy::isImplThread());
 
-    if (!reserveTextures(frame, format, layerRenderer))
-        return false;
+    MutexLocker locker(m_providerMutex);
 
-    for (unsigned plane = 0; plane < frame->planes(); ++plane) {
-        ASSERT(frame->requiredTextureSize(plane) == m_textures[plane].m_texture->size());
-        copyPlaneToTexture(layerRenderer, frame->data(plane), plane);
-    }
-    for (unsigned plane = frame->planes(); plane < MaxPlanes; ++plane) {
-        Texture& texture = m_textures[plane];
-        texture.m_texture.clear();
-        texture.m_visibleSize = IntSize();
-    }
-    m_planes = frame->planes();
-    return true;
-}
+    if (!m_provider || !m_frame)
+        return;
 
-void CCVideoLayerImpl::copyPlaneToTexture(LayerRendererChromium* layerRenderer, const void* plane, int index)
-{
-    Texture& texture = m_textures[index];
-    GraphicsContext3D* context = layerRenderer->context();
-    TextureAllocator* allocator = layerRenderer->renderSurfaceTextureAllocator();
-    texture.m_texture->bindTexture(context, allocator);
-    GC3Denum format = texture.m_texture->format();
-    IntSize dimensions = texture.m_texture->size();
-
-    void* mem = static_cast<Extensions3DChromium*>(context->getExtensions())->mapTexSubImage2DCHROMIUM(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, Extensions3DChromium::WRITE_ONLY);
-    if (mem) {
-        memcpy(mem, plane, dimensions.width() * dimensions.height());
-        GLC(context, static_cast<Extensions3DChromium*>(context->getExtensions())->unmapTexSubImage2DCHROMIUM(mem));
-    } else {
-        // If mapTexSubImage2DCHROMIUM fails, then do the slower texSubImage2D
-        // upload. This does twice the copies as mapTexSubImage2DCHROMIUM, one
-        // in the command buffer and another to the texture.
-        GLC(context, context->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, plane));
-    }
+    for (unsigned plane = 0; plane < m_frame->planes(); ++plane)
+        m_textures[plane].m_texture->unreserve();
+    m_provider->putCurrentFrame(m_frame);
+    m_frame = 0;
 }
 
-static IntSize computeVisibleSize(const VideoFrameChromium* frame, unsigned plane)
+IntSize CCVideoLayerImpl::computeVisibleSize(const VideoFrameChromium* frame, unsigned plane)
 {
     int visibleWidth = frame->width(plane);
     int visibleHeight = frame->height(plane);
@@ -259,79 +232,21 @@ bool CCVideoLayerImpl::reserveTextures(const VideoFrameChromium* frame, GC3Denum
     return true;
 }
 
-void CCVideoLayerImpl::drawYUV(LayerRendererChromium* layerRenderer) const
+void CCVideoLayerImpl::didReceiveFrame()
 {
-    const YUVProgram* program = layerRenderer->videoLayerYUVProgram();
-    ASSERT(program && program->initialized());
-
-    GraphicsContext3D* context = layerRenderer->context();
-    const Texture& yTexture = m_textures[VideoFrameChromium::yPlane];
-    const Texture& uTexture = m_textures[VideoFrameChromium::uPlane];
-    const Texture& vTexture = m_textures[VideoFrameChromium::vPlane];
-
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE1));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, yTexture.m_texture->textureId()));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE2));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, uTexture.m_texture->textureId()));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE3));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, vTexture.m_texture->textureId()));
-
-    GLC(context, context->useProgram(program->program()));
-
-    float yWidthScaleFactor = static_cast<float>(yTexture.m_visibleSize.width()) / yTexture.m_texture->size().width();
-    // Arbitrarily take the u sizes because u and v dimensions are identical.
-    float uvWidthScaleFactor = static_cast<float>(uTexture.m_visibleSize.width()) / uTexture.m_texture->size().width();
-    GLC(context, context->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
-    GLC(context, context->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
-
-    GLC(context, context->uniform1i(program->fragmentShader().yTextureLocation(), 1));
-    GLC(context, context->uniform1i(program->fragmentShader().uTextureLocation(), 2));
-    GLC(context, context->uniform1i(program->fragmentShader().vTextureLocation(), 3));
-
-    GLC(context, context->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(yuv2RGB), 1));
-    GLC(context, context->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(yuvAdjust), 1));
-
-    layerRenderer->drawTexturedQuad(drawTransform(), bounds().width(), bounds().height(), drawOpacity(), FloatQuad(),
-                                    program->vertexShader().matrixLocation(),
-                                    program->fragmentShader().alphaLocation(),
-                                    -1);
-
-    // Reset active texture back to texture 0.
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-}
-
-template<class Program>
-void CCVideoLayerImpl::drawCommon(LayerRendererChromium* layerRenderer, Program* program, float widthScaleFactor, Platform3DObject textureId) const
-{
-    ASSERT(program && program->initialized());
-
-    GraphicsContext3D* context = layerRenderer->context();
-
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
-
-    GLC(context, context->useProgram(program->program()));
-    GLC(context, context->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-
-    layerRenderer->drawTexturedQuad(drawTransform(), bounds().width(), bounds().height(), drawOpacity(), layerRenderer->sharedGeometryQuad(),
-                                    program->vertexShader().matrixLocation(),
-                                    program->fragmentShader().alphaLocation(),
-                                    -1);
+    setNeedsRedraw();
 }
 
-void CCVideoLayerImpl::drawRGBA(LayerRendererChromium* layerRenderer) const
+void CCVideoLayerImpl::didUpdateMatrix(const float matrix[16])
 {
-    const RGBAProgram* program = layerRenderer->videoLayerRGBAProgram();
-    const Texture& texture = m_textures[VideoFrameChromium::rgbPlane];
-    float widthScaleFactor = static_cast<float>(texture.m_visibleSize.width()) / texture.m_texture->size().width();
-    drawCommon(layerRenderer, program, widthScaleFactor, texture.m_texture->textureId());
+    memcpy(m_streamTextureMatrix, matrix, sizeof(m_streamTextureMatrix));
+    setNeedsRedraw();
 }
 
-void CCVideoLayerImpl::drawNativeTexture(LayerRendererChromium* layerRenderer) const
+void CCVideoLayerImpl::setNeedsRedraw()
 {
-    const NativeTextureProgram* program = layerRenderer->videoLayerNativeTextureProgram();
-    drawCommon(layerRenderer, program, 1, m_nativeTextureId);
+    if (m_layerTreeHostImpl)
+        m_layerTreeHostImpl->setNeedsRedraw();
 }
 
 void CCVideoLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
index 182f7b582..caa72dfb9 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -35,6 +35,9 @@
 
 namespace WebCore {
 
+class CCLayerTreeHostImpl;
+class CCVideoLayerImpl;
+
 template<class VertexShader, class FragmentShader> class ProgramBinding;
 
 class CCVideoLayerImpl : public CCLayerImpl
@@ -46,48 +49,55 @@ public:
     }
     virtual ~CCVideoLayerImpl();
 
+    virtual void willDraw(LayerRendererChromium*);
     virtual void appendQuads(CCQuadList&, const CCSharedQuadState*);
+    virtual void didDraw();
 
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> RGBAProgram;
     typedef ProgramBinding<VertexShaderPosTexYUVStretch, FragmentShaderYUVVideo> YUVProgram;
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> NativeTextureProgram;
-
-    virtual void draw(LayerRendererChromium*);
+    typedef ProgramBinding<VertexShaderVideoTransform, FragmentShaderOESImageExternal> StreamTextureProgram;
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
-    // VideoFrameProvider::Client implementation (callable on any thread).
-    virtual void stopUsingProvider();
+    Mutex& providerMutex() { return m_providerMutex; }
+    VideoFrameProvider* provider() const { return m_provider; }
 
-private:
-    explicit CCVideoLayerImpl(int, VideoFrameProvider*);
+    // VideoFrameProvider::Client implementation.
+    virtual void stopUsingProvider(); // Callable on any thread.
+    virtual void didReceiveFrame(); // Callable on impl thread.
+    virtual void didUpdateMatrix(const float*); // Callable on impl thread.
 
-    virtual const char* layerTypeAsString() const { return "VideoLayer"; }
-
-    bool copyFrameToTextures(const VideoFrameChromium*, GC3Denum format, LayerRendererChromium*);
-    void copyPlaneToTexture(LayerRendererChromium*, const void* plane, int index);
-    bool reserveTextures(const VideoFrameChromium*, GC3Denum format, LayerRendererChromium*);
-    void drawYUV(LayerRendererChromium*) const;
-    void drawRGBA(LayerRendererChromium*) const;
-    void drawNativeTexture(LayerRendererChromium*) const;
-    template<class Program> void drawCommon(LayerRendererChromium*, Program*, float widthScaleFactor, Platform3DObject textureId) const;
-
-    Mutex m_providerMutex; // Guards m_provider below.
-    VideoFrameProvider* m_provider;
+    void setNeedsRedraw();
 
     static const float yuv2RGB[9];
     static const float yuvAdjust[3];
+    static const float flipTransform[16];
 
     struct Texture {
         OwnPtr<ManagedTexture> m_texture;
         IntSize m_visibleSize;
     };
     enum { MaxPlanes = 3 };
+
+private:
+    explicit CCVideoLayerImpl(int, VideoFrameProvider*);
+
+    static IntSize computeVisibleSize(const VideoFrameChromium*, unsigned plane);
+    virtual const char* layerTypeAsString() const { return "VideoLayer"; }
+
+    bool reserveTextures(const VideoFrameChromium*, GC3Denum format, LayerRendererChromium*);
+
+    Mutex m_providerMutex; // Guards m_provider below.
+    VideoFrameProvider* m_provider;
+
     Texture m_textures[MaxPlanes];
-    int m_planes;
 
-    Platform3DObject m_nativeTextureId;
-    IntSize m_nativeTextureSize;
+    float m_streamTextureMatrix[16];
+    CCLayerTreeHostImpl* m_layerTreeHostImpl;
+
+    VideoFrameChromium* m_frame;
+    GC3Denum m_format;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/efl/DrawingBufferEfl.cpp b/Source/WebCore/platform/graphics/efl/DrawingBufferEfl.cpp
deleted file mode 100644
index babe5e42a..000000000
--- a/Source/WebCore/platform/graphics/efl/DrawingBufferEfl.cpp
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
-
-#include "DrawingBuffer.h"
-
-#include "Extensions3D.h"
-
-namespace WebCore {
-
-DrawingBuffer::DrawingBuffer(GraphicsContext3D* context, const IntSize& size, bool multisampleExtensionSupported, bool packedDepthStencilExtensionSupported, bool separateBackingTexture)
-    : m_separateBackingTexture(separateBackingTexture)
-    , m_scissorEnabled(false)
-    , m_texture2DBinding(0)
-    , m_activeTextureUnit(GraphicsContext3D::TEXTURE0)
-    , m_context(context)
-    , m_size(-1, -1)
-    , m_multisampleExtensionSupported(multisampleExtensionSupported)
-    , m_packedDepthStencilExtensionSupported(packedDepthStencilExtensionSupported)
-    , m_fbo(context->createFramebuffer())
-    , m_colorBuffer(0)
-    , m_depthStencilBuffer(0)
-    , m_depthBuffer(0)
-    , m_stencilBuffer(0)
-    , m_multisampleFBO(0)
-    , m_multisampleColorBuffer(0)
-{
-    // Support for a separate backing texture has only been enabled for
-    // the chromium port.
-    ASSERT(!m_separateBackingTexture);
-    ASSERT(m_fbo);
-    if (!m_fbo) {
-        clear();
-        return;
-    }
-
-    // Create a texture to render into.
-    m_colorBuffer = context->createTexture();
-    context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_colorBuffer);
-    context->texParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
-    context->texParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
-    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
-    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
-    context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0);
-
-    createSecondaryBuffers();
-    reset(size);
-}
-
-DrawingBuffer::~DrawingBuffer()
-{
-    clear();
-}
-
-Platform3DObject DrawingBuffer::platformColorBuffer() const
-{
-    return m_colorBuffer;
-}
-
-#if USE(ACCELERATED_COMPOSITING)
-void DrawingBuffer::paintCompositedResultsToCanvas(CanvasRenderingContext* context)
-{
-}
-#endif
-
-}
-
-#endif
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
deleted file mode 100644
index 1f1eda21c..000000000
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (C) 2011, 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "GraphicsContext3D.h"
-
-#if ENABLE(WEBGL)
-#include "Extensions3DOpenGL.h"
-#include "GraphicsContext3DPrivate.h"
-#include "OpenGLShims.h"
-#include "ShaderLang.h"
-
-namespace WebCore {
-
-PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
-{
-    bool renderDirectlyToHostWindow = (renderStyle == RenderDirectlyToHostWindow);
-    // This implementation doesn't currently support rendering directly to the HostWindow.
-    if (renderDirectlyToHostWindow)
-        return 0;
-
-    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
-    if (!priv)
-        return 0;
-
-    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, renderDirectlyToHostWindow));
-    context->m_private = priv.release();
-    return context.release();
-}
-
-GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
-    : m_currentWidth(0)
-    , m_currentHeight(0)
-    , m_attrs(attributes)
-    , m_texture(0)
-    , m_fbo(0)
-    , m_depthStencilBuffer(0)
-    , m_boundFBO(0)
-    , m_multisampleFBO(0)
-    , m_multisampleDepthStencilBuffer(0)
-    , m_multisampleColorBuffer(0)
-{
-    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
-
-    validateAttributes();
-
-    // Create a texture to render into.
-    ::glGenTextures(1, &m_texture);
-    ::glBindTexture(GL_TEXTURE_2D, m_texture);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
-    ::glBindTexture(GL_TEXTURE_2D, 0);
-
-    // Create an FBO.
-    ::glGenFramebuffersEXT(1, &m_fbo);
-    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-
-    m_boundFBO = m_fbo;
-    if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth))
-        ::glGenRenderbuffersEXT(1, &m_depthStencilBuffer);
-
-    // Create a multisample FBO.
-    if (m_attrs.antialias) {
-        ::glGenFramebuffersEXT(1, &m_multisampleFBO);
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_multisampleFBO);
-        m_boundFBO = m_multisampleFBO;
-        ::glGenRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glGenRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-    }
-
-    // ANGLE initialization.
-    ShBuiltInResources ANGLEResources;
-    ShInitBuiltInResources(&ANGLEResources);
-
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &ANGLEResources.MaxVertexAttribs);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS, &ANGLEResources.MaxVertexUniformVectors);
-    getIntegerv(GraphicsContext3D::MAX_VARYING_VECTORS, &ANGLEResources.MaxVaryingVectors);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxVertexTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxCombinedTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS, &ANGLEResources.MaxFragmentUniformVectors);
-
-    // Always set to 1 for OpenGL ES.
-    ANGLEResources.MaxDrawBuffers = 1;
-    m_compiler.setResources(ANGLEResources);
-
-    ::glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
-    ::glEnable(GL_POINT_SPRITE);
-    ::glClearColor(0, 0, 0, 0);
-}
-
-GraphicsContext3D::~GraphicsContext3D()
-{
-    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
-    if (!m_private->m_context)
-        return;
-
-    makeContextCurrent();
-    ::glDeleteTextures(1, &m_texture);
-    if (m_attrs.antialias) {
-        ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-        ::glDeleteFramebuffersEXT(1, &m_multisampleFBO);
-    } else {
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
-    }
-    ::glDeleteFramebuffersEXT(1, &m_fbo);
-}
-
-bool GraphicsContext3D::makeContextCurrent()
-{
-    if (!m_private)
-        return false;
-    return m_private->makeContextCurrent();
-}
-
-PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
-{
-    return m_private->m_context;
-}
-
-bool GraphicsContext3D::isGLES2Compliant() const
-{
-    return false;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index c64d02c8a..fbc2c1671 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -239,9 +239,19 @@ void FEComposite::platformApplySoftware()
         filterContext->drawImageBuffer(in->asImageBuffer(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
         break;
     case FECOMPOSITE_OPERATOR_IN: {
-        GraphicsContextStateSaver stateSaver(*filterContext);
-        filterContext->clipToImageBuffer(in2->asImageBuffer(), drawingRegionOfInputImage(in2->absolutePaintRect()));
-        filterContext->drawImageBuffer(in->asImageBuffer(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
+        // Applies only to the intersected region.
+        IntRect destinationRect = in->absolutePaintRect();
+        destinationRect.intersect(in2->absolutePaintRect());
+        destinationRect.intersect(absolutePaintRect());
+        if (destinationRect.isEmpty())
+            break;
+        IntPoint destinationPoint(destinationRect.x() - absolutePaintRect().x(), destinationRect.y() - absolutePaintRect().y());
+        IntRect sourceRect(IntPoint(destinationRect.x() - in->absolutePaintRect().x(),
+                                    destinationRect.y() - in->absolutePaintRect().y()), destinationRect.size());
+        IntRect source2Rect(IntPoint(destinationRect.x() - in2->absolutePaintRect().x(),
+                                     destinationRect.y() - in2->absolutePaintRect().y()), destinationRect.size());
+        filterContext->drawImageBuffer(in2->asImageBuffer(), ColorSpaceDeviceRGB, destinationPoint, source2Rect);
+        filterContext->drawImageBuffer(in->asImageBuffer(), ColorSpaceDeviceRGB, destinationPoint, sourceRect, CompositeSourceIn);
         break;
     }
     case FECOMPOSITE_OPERATOR_OUT:
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperation.h b/Source/WebCore/platform/graphics/filters/FilterOperation.h
index 4d15ec8ed..9ee955768 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperation.h
@@ -74,6 +74,13 @@ public:
 
     virtual OperationType getOperationType() const { return m_type; }
     virtual bool isSameType(const FilterOperation& o) const { return o.getOperationType() == m_type; }
+    
+    virtual bool isDefault() const { return false; }
+
+    // True if the alpha channel of any pixel can change under this operation.
+    virtual bool affectsOpacity() const { return false; }
+    // True if the the value of one pixel can affect the value of another pixel under this operation, such as blur.
+    virtual bool movesPixels() const { return false; }
 
 protected:
     FilterOperation(OperationType type)
@@ -84,6 +91,28 @@ protected:
     OperationType m_type;
 };
 
+class DefaultFilterOperation : public FilterOperation {
+public:
+    static PassRefPtr<DefaultFilterOperation> create(OperationType type)
+    {
+        return adoptRef(new DefaultFilterOperation(type));
+    }
+
+private:
+
+    virtual bool operator==(const FilterOperation& o) const
+    {
+        return isSameType(o);
+    }
+
+    virtual bool isDefault() const { return true; }
+
+    DefaultFilterOperation(OperationType type)
+        : FilterOperation(type)
+    {
+    }
+};
+
 class PassthroughFilterOperation : public FilterOperation {
 public:
     static PassRefPtr<PassthroughFilterOperation> create()
@@ -111,6 +140,9 @@ public:
         return adoptRef(new ReferenceFilterOperation(reference, type));
     }
 
+    virtual bool affectsOpacity() const { return true; }
+    virtual bool movesPixels() const { return true; }
+
     const AtomicString& reference() const { return m_reference; }
 
 private:
@@ -175,6 +207,8 @@ public:
 
     double amount() const { return m_amount; }
 
+    virtual bool affectsOpacity() const { return m_type == OPACITY; }
+
     virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, bool blendToPassthrough = false);
 
 private:
@@ -241,6 +275,9 @@ public:
 
     Length stdDeviation() const { return m_stdDeviation; }
 
+    virtual bool affectsOpacity() const { return true; }
+    virtual bool movesPixels() const { return true; }
+
     virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, bool blendToPassthrough = false);
 
 private:
@@ -273,6 +310,9 @@ public:
     int stdDeviation() const { return m_stdDeviation; }
     Color color() const { return m_color; }
 
+    virtual bool affectsOpacity() const { return true; }
+    virtual bool movesPixels() const { return true; }
+
     virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, bool blendToPassthrough = false);
 
 private:
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
index dd92ac1aa..35282cb53 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
@@ -136,6 +136,22 @@ void FilterOperations::getOutsets(LayoutUnit& top, LayoutUnit& right, LayoutUnit
     }
 }
 
+bool FilterOperations::hasFilterThatAffectsOpacity() const
+{
+    for (size_t i = 0; i < m_operations.size(); ++i)
+        if (m_operations[i]->affectsOpacity())
+            return true;
+    return false;
+}
+
+bool FilterOperations::hasFilterThatMovesPixels() const
+{
+    for (size_t i = 0; i < m_operations.size(); ++i)
+        if (m_operations[i]->movesPixels())
+            return true;
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperations.h b/Source/WebCore/platform/graphics/filters/FilterOperations.h
index 64cee8808..0b492eb9a 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperations.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperations.h
@@ -57,6 +57,7 @@ public:
     Vector<RefPtr<FilterOperation> >& operations() { return m_operations; }
     const Vector<RefPtr<FilterOperation> >& operations() const { return m_operations; }
 
+    bool isEmpty() const { return !m_operations.size(); }
     size_t size() const { return m_operations.size(); }
     const FilterOperation* at(size_t index) const { return index < m_operations.size() ? m_operations.at(index).get() : 0; }
 
@@ -65,6 +66,9 @@ public:
     bool hasOutsets() const;
     void getOutsets(LayoutUnit& top, LayoutUnit& right, LayoutUnit& bottom, LayoutUnit& left) const;
 
+    bool hasFilterThatAffectsOpacity() const;
+    bool hasFilterThatMovesPixels() const;
+
 private:
     Vector<RefPtr<FilterOperation> > m_operations;
 };
diff --git a/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp b/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp
index aeebde6f8..0bd5cbc5a 100644
--- a/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -63,9 +63,8 @@ void SourceAlpha::platformApplySoftware()
 
     FloatRect imageRect(FloatPoint(), absolutePaintRect().size());
     GraphicsContext* filterContext = resultImage->context();
-    GraphicsContextStateSaver stateSaver(*filterContext);
-    filterContext->clipToImageBuffer(filter->sourceImage(), imageRect);
     filterContext->fillRect(imageRect, Color::black, ColorSpaceDeviceRGB);
+    filterContext->drawImageBuffer(filter->sourceImage(), ColorSpaceDeviceRGB, IntPoint(), CompositeDestinationIn);
 }
 
 void SourceAlpha::dump()
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index e28b67b37..fd90fa9a6 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -283,9 +283,17 @@ MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer()
 
 void MediaPlayerPrivateGStreamer::load(const String& url)
 {
-    g_object_set(m_playBin, "uri", url.utf8().data(), NULL);
 
-    LOG_VERBOSE(Media, "Load %s", url.utf8().data());
+    KURL kurl(KURL(), url);
+    String cleanUrl(url);
+
+    // Clean out everything after file:// url path.
+    if (kurl.isLocalFile())
+        cleanUrl = cleanUrl.substring(0, kurl.pathEnd());
+
+    g_object_set(m_playBin, "uri", cleanUrl.utf8().data(), NULL);
+
+    LOG_VERBOSE(Media, "Load %s", cleanUrl.utf8().data());
 
     if (m_preload == MediaPlayer::None) {
         LOG_VERBOSE(Media, "Delaying load.");
@@ -1026,15 +1034,8 @@ void MediaPlayerPrivateGStreamer::sourceChanged()
     gst_object_replace(reinterpret_cast<GstObject**>(&m_source),
                        reinterpret_cast<GstObject*>(element.get()));
 
-    if (WEBKIT_IS_WEB_SRC(element.get())) {
-        Frame* frame = 0;
-        Document* document = m_player->mediaPlayerClient()->mediaPlayerOwningDocument();
-        if (document)
-            frame = document->frame();
-
-        if (frame)
-            webKitWebSrcSetFrame(WEBKIT_WEB_SRC(element.get()), frame);
-    }
+    if (WEBKIT_IS_WEB_SRC(element.get()))
+        webKitWebSrcSetMediaPlayer(WEBKIT_WEB_SRC(element.get()), m_player);
 }
 
 void MediaPlayerPrivateGStreamer::cancelLoad()
@@ -1494,8 +1495,10 @@ static HashSet<String> mimeTypeCache()
                 const gchar* name = gst_structure_get_name(structure);
                 bool cached = false;
 
-                // These formats are supported by GStreamer, but not
-                // correctly advertised.
+                // There isn't a one-to-one correspondance of caps to supported mime types in
+                // GStreamer, so we need to manually map between them. At some point in the future,
+                // GStreamer may reduce the differences between caps and mime types and we can
+                // remove mappings.
                 if (g_str_equal(name, "video/x-h264")) {
                     cache.add(String("video/mp4"));
                     cached = true;
@@ -1523,6 +1526,7 @@ static HashSet<String> mimeTypeCache()
                 if (g_str_equal(name, "audio/x-vorbis")) {
                     cache.add(String("audio/ogg"));
                     cache.add(String("audio/x-vorbis+ogg"));
+                    cache.add(String("audio/webm"));
                     cached = true;
                 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
index eeb08c2e3..33600f696 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
@@ -20,18 +20,26 @@
 #ifndef PlatformVideoWindowPrivate_h
 #define PlatformVideoWindowPrivate_h
 
+#include <QEvent>
 #include <QTimer>
-#include <QWidget>
 
-QT_BEGIN_NAMESPACE
-class QKeyEvent;
-QT_END_NAMESPACE
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+#include <QWindow>
+#else
+#include <QWidget>
+#endif
 
 namespace WebCore {
 
 class HTMLVideoElement;
 
-class FullScreenVideoWindow: public QWidget {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+typedef QWindow Base;
+#else
+typedef QWidget Base;
+#endif
+
+class FullScreenVideoWindow: public Base {
 Q_OBJECT
 public:
     FullScreenVideoWindow();
@@ -39,7 +47,6 @@ public:
 signals:
     void closed();
 protected:
-    void closeEvent(QCloseEvent*);
     void keyPressEvent(QKeyEvent*);
     bool event(QEvent*);
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
index 0a6c45bf7..06a792505 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
@@ -23,10 +23,11 @@
 #include "HTMLVideoElement.h"
 #include "PlatformVideoWindowPrivate.h"
 
+#include <QCursor>
 #include <QGuiApplication>
-#include <QDesktopWidget>
 #include <QKeyEvent>
 #include <QPalette>
+
 using namespace WebCore;
 
 #ifndef QT_NO_CURSOR
@@ -34,13 +35,14 @@ static const int gHideMouseCursorDelay = 3000;
 #endif
 
 FullScreenVideoWindow::FullScreenVideoWindow()
-    : QWidget(0, Qt::Window)
-    , m_mediaElement(0)
+    : m_mediaElement(0)
 {
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     setAttribute(Qt::WA_NativeWindow);
-    setWindowModality(Qt::ApplicationModal);
     setAttribute(Qt::WA_NoSystemBackground, true);
     setAttribute(Qt::WA_PaintOnScreen, true);
+#endif
+    setWindowModality(Qt::ApplicationModal);
 
 #ifndef QT_NO_CURSOR
     m_cursorTimer.setSingleShot(true);
@@ -53,18 +55,6 @@ void FullScreenVideoWindow::setVideoElement(HTMLVideoElement* element)
     m_mediaElement = element;
 }
 
-void FullScreenVideoWindow::closeEvent(QCloseEvent*)
-{
-#ifndef QT_NO_CURSOR
-    m_cursorTimer.stop();
-#endif
-    setMouseTracking(false);
-    releaseMouse();
-#ifndef QT_NO_CURSOR
-    QGuiApplication::restoreOverrideCursor();
-#endif
-}
-
 void FullScreenVideoWindow::keyPressEvent(QKeyEvent* ev)
 {
     if (m_mediaElement && ev->key() == Qt::Key_Space) {
@@ -74,7 +64,7 @@ void FullScreenVideoWindow::keyPressEvent(QKeyEvent* ev)
             m_mediaElement->play();
     } else if (ev->key() == Qt::Key_Escape)
         emit closed();
-    QWidget::keyPressEvent(ev);
+    Base::keyPressEvent(ev);
 }
 
 bool FullScreenVideoWindow::event(QEvent* ev)
@@ -88,17 +78,34 @@ bool FullScreenVideoWindow::event(QEvent* ev)
         emit closed();
         ev->accept();
         return true;
+    case QEvent::Close:
+#ifndef QT_NO_CURSOR
+        m_cursorTimer.stop();
+#endif
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
+        setMouseTracking(false);
+        releaseMouse();
+#endif
+#ifndef QT_NO_CURSOR
+        QGuiApplication::restoreOverrideCursor();
+#endif
+        break;
     default:
-        return QWidget::event(ev);
+        break;
     }
+    return Base::event(ev);
 }
 
 void FullScreenVideoWindow::showFullScreen()
 {
-    QWidget::showFullScreen();
+    Base::showFullScreen();
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     setMouseTracking(true);
+#endif
     raise();
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     setFocus();
+#endif
     hideCursor();
 }
 
@@ -120,14 +127,18 @@ void FullScreenVideoWindow::showCursor()
 
 PlatformVideoWindow::PlatformVideoWindow()
 {
-    m_window = new FullScreenVideoWindow();
-    m_window->setWindowFlags(m_window->windowFlags() | Qt::FramelessWindowHint);
+    Base* win = new FullScreenVideoWindow();
+    m_window = win;
+    win->setWindowFlags(win->windowFlags() | Qt::FramelessWindowHint);
+    // FIXME: Port to Qt 5.
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     QPalette p;
     p.setColor(QPalette::Base, Qt::black);
     p.setColor(QPalette::Window, Qt::black);
-    m_window->setPalette(p);
-    m_window->showFullScreen();
-    m_videoWindowId = m_window->winId();
+    win->setPalette(p);
+#endif
+    win->showFullScreen();
+    m_videoWindowId = win->winId();
 }
 
 PlatformVideoWindow::~PlatformVideoWindow()
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index ad4c24d82..2fc00581a 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -22,9 +22,11 @@
 #if ENABLE(VIDEO) && USE(GSTREAMER)
 
 #include "Document.h"
+#include "Frame.h"
 #include "GOwnPtr.h"
 #include "GRefPtr.h"
 #include "GRefPtrGStreamer.h"
+#include "MediaPlayer.h"
 #include "NetworkingContext.h"
 #include "Noncopyable.h"
 #include "NotImplemented.h"
@@ -63,6 +65,7 @@ struct _WebKitWebSrcPrivate {
     gchar* uri;
 
     RefPtr<WebCore::Frame> frame;
+    WebCore::MediaPlayer* player;
 
     StreamingClient* client;
     RefPtr<ResourceHandle> resourceHandle;
@@ -352,7 +355,9 @@ static void webKitWebSrcStop(WebKitWebSrc* src, bool seeking)
     priv->resourceHandle = 0;
 
     if (priv->frame && !seeking)
-        priv->frame.release();
+        priv->frame.clear();
+
+    priv->player = 0;
 
     GST_OBJECT_LOCK(src);
     if (priv->needDataID)
@@ -414,18 +419,15 @@ static bool webKitWebSrcStart(WebKitWebSrc* src)
     request.setAllowCookies(true);
 
     NetworkingContext* context = 0;
-    if (priv->frame) {
-        Document* document = priv->frame->document();
-        if (document)
-            request.setHTTPReferrer(document->documentURI());
-
-        FrameLoader* loader = priv->frame->loader();
-        if (loader) {
-            loader->addExtraFieldsToSubresourceRequest(request);
-            context = loader->networkingContext();
-        }
+    FrameLoader* loader = priv->frame ? priv->frame->loader() : 0;
+    if (loader) {
+        loader->addExtraFieldsToSubresourceRequest(request);
+        context = loader->networkingContext();
     }
 
+    if (priv->player)
+        request.setHTTPReferrer(priv->player->referrer());
+
     // Let Apple web servers know we want to access their nice movie trailers.
     if (!g_ascii_strcasecmp("movies.apple.com", url.host().utf8().data())
         || !g_ascii_strcasecmp("trailers.apple.com", url.host().utf8().data()))
@@ -739,11 +741,17 @@ static gboolean webKitWebSrcSeekDataCb(GstAppSrc* appsrc, guint64 offset, gpoint
     return TRUE;
 }
 
-void webKitWebSrcSetFrame(WebKitWebSrc* src, WebCore::Frame* frame)
+void webKitWebSrcSetMediaPlayer(WebKitWebSrc* src, WebCore::MediaPlayer* player)
 {
     WebKitWebSrcPrivate* priv = src->priv;
+    WebCore::Frame* frame = 0;
+
+    WebCore::Document* document = player->mediaPlayerClient()->mediaPlayerOwningDocument();
+    if (document)
+        frame = document->frame();
 
     priv->frame = frame;
+    priv->player = player;
 }
 
 StreamingClient::StreamingClient(WebKitWebSrc* src) : m_src(src)
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
index 2712413b9..9ed95cfad 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
@@ -20,7 +20,7 @@
 #define WebKitWebSourceGStreamer_h
 #if ENABLE(VIDEO) && USE(GSTREAMER)
 
-#include "Frame.h"
+#include "MediaPlayer.h"
 #include <gst/gst.h>
 
 G_BEGIN_DECLS
@@ -46,7 +46,7 @@ struct _WebKitWebSrcClass {
 };
 
 GType webkit_web_src_get_type(void);
-void  webKitWebSrcSetFrame(WebKitWebSrc* src, WebCore::Frame* frame);
+void webKitWebSrcSetMediaPlayer(WebKitWebSrc*, WebCore::MediaPlayer*);
 
 G_END_DECLS
 
diff --git a/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp
deleted file mode 100644
index 418b8b461..000000000
--- a/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2011 Igalia S.L.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "GraphicsContext3D.h"
-
-#if ENABLE(WEBGL)
-#include "Extensions3DOpenGL.h"
-#include "GraphicsContext3DPrivate.h"
-#include "OpenGLShims.h"
-#include "ShaderLang.h"
-#include <wtf/NotFound.h>
-
-namespace WebCore {
-
-PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
-{
-    // This implementation doesn't currently support rendering directly to the HostWindow.
-    if (renderStyle == RenderDirectlyToHostWindow)
-        return 0;
-
-    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
-    if (!priv)
-        return 0;
-
-    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, false));
-    context->m_private = priv.release();
-    return context.release();
-}
-
-GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow*, bool)
-    : m_currentWidth(0)
-    , m_currentHeight(0)
-    , m_attrs(attributes)
-    , m_texture(0)
-    , m_fbo(0)
-    , m_depthStencilBuffer(0)
-    , m_boundFBO(0)
-    , m_multisampleFBO(0)
-    , m_multisampleDepthStencilBuffer(0)
-    , m_multisampleColorBuffer(0)
-{
-    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
-
-    validateAttributes();
-
-    // Create a texture to render into.
-    ::glGenTextures(1, &m_texture);
-    ::glBindTexture(GL_TEXTURE_2D, m_texture);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
-    ::glBindTexture(GL_TEXTURE_2D, 0);
-
-    // Create an FBO.
-    ::glGenFramebuffersEXT(1, &m_fbo);
-    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-
-    m_boundFBO = m_fbo;
-    if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth))
-        ::glGenRenderbuffersEXT(1, &m_depthStencilBuffer);
-    
-    // Create a multisample FBO.
-    if (m_attrs.antialias) {
-        ::glGenFramebuffersEXT(1, &m_multisampleFBO);
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_multisampleFBO);
-        m_boundFBO = m_multisampleFBO;
-        ::glGenRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glGenRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-    }
-
-    // ANGLE initialization.
-    ShBuiltInResources ANGLEResources;
-    ShInitBuiltInResources(&ANGLEResources);
-
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &ANGLEResources.MaxVertexAttribs);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS, &ANGLEResources.MaxVertexUniformVectors);
-    getIntegerv(GraphicsContext3D::MAX_VARYING_VECTORS, &ANGLEResources.MaxVaryingVectors);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxVertexTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxCombinedTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS, &ANGLEResources.MaxFragmentUniformVectors);
-
-    // Always set to 1 for OpenGL ES.
-    ANGLEResources.MaxDrawBuffers = 1;
-    m_compiler.setResources(ANGLEResources);
-
-    ::glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
-    ::glEnable(GL_POINT_SPRITE);
-    ::glClearColor(0, 0, 0, 0);
-}
-
-GraphicsContext3D::~GraphicsContext3D()
-{
-    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
-    if (!m_private->m_context)
-        return;
-
-    makeContextCurrent();
-    ::glDeleteTextures(1, &m_texture);
-    if (m_attrs.antialias) {
-        ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-        ::glDeleteFramebuffersEXT(1, &m_multisampleFBO);
-    } else {
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
-    }
-    ::glDeleteFramebuffersEXT(1, &m_fbo);
-}
-
-bool GraphicsContext3D::makeContextCurrent()
-{
-    if (!m_private)
-        return false;
-    return m_private->makeContextCurrent();
-}
-
-PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
-{
-    return m_private->m_context;
-}
-
-bool GraphicsContext3D::isGLES2Compliant() const
-{
-    return false;
-}
-
-}
-
-#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
index 6e81e33a3..c5a5194d0 100644
--- a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 
 #include "BitmapImage.h"
+#include "FileSystem.h"
 #include "GdkCairoUtilities.h"
 #include "GOwnPtrGtk.h"
 #include "SharedBuffer.h"
@@ -33,63 +34,16 @@
 #include <cairo.h>
 #include <gtk/gtk.h>
 
-#if PLATFORM(WIN)
-#include <mbstring.h>
-#include <shlobj.h>
-
-static HMODULE hmodule;
-
-extern "C" {
-BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
-{
-    if (fdwReason == DLL_PROCESS_ATTACH)
-        hmodule = hinstDLL;
-    return TRUE;
-}
-}
-
-static char* getPathToImageResource(char* resource)
-{
-    static char* dataDirectory = 0;
-    if (!dataDirectory) {
-        dataDirectory = new char[PATH_MAX];
-        if (!GetModuleFileName(hmodule, static_cast<CHAR*>(dataDirectory), sizeof(dataDirectory) - 10))
-            dataDirectory = DATA_DIR;
-
-        // FIXME: This is pretty ugly. Ideally we should be using Windows API
-        // functions or GLib methods to calculate paths.
-        unsigned char *p;
-        p = _mbsrchr(static_cast<const unsigned char *>(dataDirectory), '\\');
-        *p = '\0';
-        p = _mbsrchr(static_cast<const unsigned char *>(dataDirectory), '\\');
-        if (p) {
-            if (!stricmp((const char *) (p+1), "bin"))
-                *p = '\0';
-        }
-        strcat(dataDirectory, "\\share\\webkitgtk-"WEBKITGTK_API_VERSION_STRING"\\images\\");
-    }
-
-    char* imageResourcePath = new char[PATH_MAX];
-    strcat(imageResourcePath, dataDirectory);
-    strcat(imageResourcePath, resource);
-
-    return imageResourcePath;
-}
-
-#else
+namespace WebCore {
 
 static char* getPathToImageResource(char* resource)
 {
     if (g_getenv("WEBKIT_TOP_LEVEL"))
         return g_build_filename(g_getenv("WEBKIT_TOP_LEVEL"), "Source", "WebCore", "Resources", resource, NULL);
 
-    return g_build_filename(DATA_DIR, "webkitgtk-"WEBKITGTK_API_VERSION_STRING, "images", resource, NULL);
+    return g_build_filename(sharedResourcesPath().data(), "images", resource, NULL);
 }
 
-#endif
-
-namespace WebCore {
-
 static CString getThemeIconFileName(const char* name, int size)
 {
     GtkIconInfo* iconInfo = gtk_icon_theme_lookup_icon(gtk_icon_theme_get_default(),
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
index 9a36365b4..f244a94c2 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
@@ -52,35 +52,33 @@ static int truncateFixedPointToInteger(HB_Fixed value)
     return value >> 6;
 }
 
-ComplexTextController::ComplexTextController(const TextRun& run, int startingX, int startingY, unsigned wordSpacing, unsigned letterSpacing, unsigned padding, const Font* font)
-    : m_font(font)
-    , m_run(getNormalizedTextRun(run, m_normalizedRun, m_normalizedBuffer))
+ComplexTextController::ComplexTextController(const Font* font, const TextRun& run, int startingX, int startingY)
+    : HarfBuzzShaperBase(font, run)
 {
-    // Do not use |run| inside this constructor. Use |m_run| instead.
+    NormalizeMode mode = m_run.rtl() ? NormalizeMirrorChars : DoNotNormalizeMirrorChars;
+    setNormalizedBuffer(mode);
 
     memset(&m_item, 0, sizeof(m_item));
     // We cannot know, ahead of time, how many glyphs a given script run
     // will produce. We take a guess that script runs will not produce more
     // than twice as many glyphs as there are code points plus a bit of
     // padding and fallback if we find that we are wrong.
-    createGlyphArrays((m_run.length() + 2) * 2);
+    createGlyphArrays((m_normalizedBufferLength + 2) * 2);
 
-    m_item.log_clusters = new unsigned short[m_run.length()];
+    m_item.log_clusters = new unsigned short[m_normalizedBufferLength];
 
     m_item.face = 0;
     m_item.font = allocHarfbuzzFont();
 
     m_item.item.bidiLevel = m_run.rtl();
 
-    m_item.string = m_run.characters();
-    m_item.stringLength = m_run.length();
+    m_item.string = m_normalizedBuffer.get();
+    m_item.stringLength = m_normalizedBufferLength;
 
     reset(startingX);
     m_startingY = startingY;
 
-    setWordSpacingAdjustment(wordSpacing);
-    setLetterSpacingAdjustment(letterSpacing);
-    setPadding(padding);
+    setPadding(m_run.expansion());
 }
 
 ComplexTextController::~ComplexTextController()
@@ -90,59 +88,6 @@ ComplexTextController::~ComplexTextController()
     delete[] m_item.log_clusters;
 }
 
-bool ComplexTextController::isWordBreak(unsigned index)
-{
-    return index && isCodepointSpace(m_item.string[index]) && !isCodepointSpace(m_item.string[index - 1]);
-}
-
-int ComplexTextController::determineWordBreakSpacing(unsigned logClustersIndex)
-{
-    int wordBreakSpacing = 0;
-    // The first half of the conjunction works around the case where
-    // output glyphs aren't associated with any codepoints by the
-    // clusters log.
-    if (logClustersIndex < m_item.item.length
-        && isWordBreak(m_item.item.pos + logClustersIndex)) {
-        wordBreakSpacing = m_wordSpacingAdjustment;
-
-        if (m_padding > 0) {
-            int toPad = roundf(m_padPerWordBreak + m_padError);
-            m_padError += m_padPerWordBreak - toPad;
-
-            if (m_padding < toPad)
-                toPad = m_padding;
-            m_padding -= toPad;
-            wordBreakSpacing += toPad;
-        }
-    }
-    return wordBreakSpacing;
-}
-
-// setPadding sets a number of pixels to be distributed across the TextRun.
-// WebKit uses this to justify text.
-void ComplexTextController::setPadding(int padding)
-{
-    m_padding = padding;
-    m_padError = 0;
-    if (!m_padding)
-        return;
-
-    // If we have padding to distribute, then we try to give an equal
-    // amount to each space. The last space gets the smaller amount, if
-    // any.
-    unsigned numWordBreaks = 0;
-
-    for (unsigned i = 0; i < m_item.stringLength; i++) {
-        if (isWordBreak(i))
-            numWordBreaks++;
-    }
-
-    if (numWordBreaks)
-        m_padPerWordBreak = m_padding / numWordBreaks;
-    else
-        m_padPerWordBreak = 0;
-}
-
 void ComplexTextController::reset(int offset)
 {
     m_indexOfNextScriptRun = 0;
@@ -166,9 +111,9 @@ void ComplexTextController::setupForRTL()
 bool ComplexTextController::nextScriptRun()
 {
     // Ensure we're not pointing at the small caps buffer.
-    m_item.string = m_run.characters();
+    m_item.string = m_normalizedBuffer.get();
 
-    if (!hb_utf16_script_run_next(0, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
+    if (!hb_utf16_script_run_next(0, &m_item.item, m_normalizedBuffer.get(), m_normalizedBufferLength, &m_indexOfNextScriptRun))
         return false;
 
     // It is actually wrong to consider script runs at all in this code.
@@ -254,7 +199,7 @@ void ComplexTextController::setupFontForScriptRun()
     // case change while in small-caps mode always results in different
     // FontData, so we only need to check the first character's case.
     if (m_font->isSmallCaps() && u_islower(m_item.string[m_item.item.pos])) {
-        m_smallCapsString = String(m_run.data(m_item.item.pos), m_item.item.length);
+        m_smallCapsString = String(m_normalizedBuffer.get() + m_item.item.pos, m_item.item.length);
         m_smallCapsString.makeUpper();
         m_item.string = m_smallCapsString.characters();
         m_item.item.pos = 0;
@@ -346,16 +291,17 @@ void ComplexTextController::setGlyphPositions(bool isRTL)
 
     // logClustersIndex indexes logClusters for the first codepoint of the current glyph.
     // Each time we advance a glyph, we skip over all the codepoints that contributed to the current glyph.
-    int logClustersIndex = 0;
+    size_t logClustersIndex = 0;
 
     // Iterate through the glyphs in logical order, flipping for RTL where necessary.
     // Glyphs are positioned starting from m_offsetX; in RTL mode they go leftwards from there.
     for (size_t i = 0; i < m_item.num_glyphs; ++i) {
-        while (static_cast<unsigned>(logClustersIndex) < m_item.item.length && m_item.log_clusters[logClustersIndex] < i)
+        while (logClustersIndex < m_item.item.length && m_item.log_clusters[logClustersIndex] < i)
             logClustersIndex++;
 
         // If the current glyph is just after a space, add in the word spacing.
-        position += determineWordBreakSpacing(logClustersIndex);
+        if (logClustersIndex < m_item.item.length && isWordEnd(m_item.item.pos + logClustersIndex))
+            position += determineWordBreakSpacing();
 
         m_glyphs16[i] = m_item.glyphs[i];
         double offsetX = truncateFixedPointToInteger(m_item.offsets[i].x);
@@ -380,79 +326,6 @@ void ComplexTextController::setGlyphPositions(bool isRTL)
     m_offsetX += m_pixelWidth * rtlFlip;
 }
 
-void ComplexTextController::normalizeSpacesAndMirrorChars(const UChar* source, bool rtl, UChar* destination, int length)
-{
-    int position = 0;
-    bool error = false;
-    // Iterate characters in source and mirror character if needed.
-    while (position < length) {
-        UChar32 character;
-        int nextPosition = position;
-        U16_NEXT(source, nextPosition, length, character);
-        if (Font::treatAsSpace(character))
-            character = ' ';
-        else if (Font::treatAsZeroWidthSpace(character))
-            character = zeroWidthSpace;
-        else if (rtl)
-            character = u_charMirror(character);
-        U16_APPEND(destination, position, length, character, error);
-        ASSERT_UNUSED(error, !error);
-        position = nextPosition;
-    }
-}
-
-const TextRun& ComplexTextController::getNormalizedTextRun(const TextRun& originalRun, OwnPtr<TextRun>& normalizedRun, OwnArrayPtr<UChar>& normalizedBuffer)
-{
-    // Normalize the text run in three ways:
-    // 1) Convert the |originalRun| to NFC normalized form if combining diacritical marks
-    // (U+0300..) are used in the run. This conversion is necessary since most OpenType
-    // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
-    // their GSUB tables.
-    //
-    // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
-    // the API returns FALSE (= not normalized) for complex runs that don't require NFC
-    // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
-    // Harfbuzz will do the same thing for us using the GSUB table.
-    // 2) Convert spacing characters into plain spaces, as some fonts will provide glyphs
-    // for characters like '\n' otherwise.
-    // 3) Convert mirrored characters such as parenthesis for rtl text.
-
-    // Convert to NFC form if the text has diacritical marks.
-    icu::UnicodeString normalizedString;
-    UErrorCode error = U_ZERO_ERROR;
-
-    for (int i = 0; i < originalRun.length(); ++i) {
-        UChar ch = originalRun[i];
-        if (::ublock_getCode(ch) == UBLOCK_COMBINING_DIACRITICAL_MARKS) {
-            icu::Normalizer::normalize(icu::UnicodeString(originalRun.characters(),
-                                       originalRun.length()), UNORM_NFC, 0 /* no options */,
-                                       normalizedString, error);
-            if (U_FAILURE(error))
-                return originalRun;
-            break;
-        }
-    }
-
-    // Normalize space and mirror parenthesis for rtl text.
-    int normalizedBufferLength;
-    const UChar* sourceText;
-    if (normalizedString.isEmpty()) {
-        normalizedBufferLength = originalRun.length();
-        sourceText = originalRun.characters();
-    } else {
-        normalizedBufferLength = normalizedString.length();
-        sourceText = normalizedString.getBuffer();
-    }
-
-    normalizedBuffer = adoptArrayPtr(new UChar[normalizedBufferLength + 1]);
-
-    normalizeSpacesAndMirrorChars(sourceText, originalRun.rtl(), normalizedBuffer.get(), normalizedBufferLength);
-
-    normalizedRun = adoptPtr(new TextRun(originalRun));
-    normalizedRun->setText(normalizedBuffer.get(), normalizedBufferLength);
-    return *normalizedRun;
-}
-
 int ComplexTextController::glyphIndexForXPositionInScriptRun(int targetX) const
 {
     // Iterate through the glyphs in logical order, seeing whether targetX falls between the previous
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h
index fff36ebad..6288d408a 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h
+++ b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h
@@ -31,6 +31,7 @@
 #ifndef ComplexTextControllerHarfBuzz_h
 #define ComplexTextControllerHarfBuzz_h
 
+#include "HarfBuzzShaperBase.h"
 #include "HarfBuzzSkia.h"
 #include "SkPoint.h"
 #include "SkScalar.h"
@@ -63,32 +64,17 @@ class SimpleFontData;
 // Once you have setup the object, call |nextScriptRun| to get the first script
 // run. This will return false when the iteration is complete. At any time you
 // can call |reset| to start over again.
-class ComplexTextController {
+class ComplexTextController : public HarfBuzzShaperBase {
 public:
-    ComplexTextController(const TextRun&, int startingX, int startingY, unsigned wordSpacing, unsigned letterSpacing, unsigned padding, const Font*);
-    ~ComplexTextController();
-
-    bool isWordBreak(unsigned);
-    int determineWordBreakSpacing(unsigned);
-    // setPadding sets a number of pixels to be distributed across the TextRun.
-    // WebKit uses this to justify text.
-    void setPadding(int);
+    ComplexTextController(const Font*, const TextRun&, int startingX, int startingY);
+    virtual ~ComplexTextController();
+
     void reset(int offset);
     // Advance to the next script run, returning false when the end of the
     // TextRun has been reached.
     bool nextScriptRun();
     float widthOfFullRun();
 
-    // setWordSpacingAdjustment sets a delta (in pixels) which is applied at
-    // each word break in the TextRun.
-    void setWordSpacingAdjustment(int wordSpacingAdjustment) { m_wordSpacingAdjustment = wordSpacingAdjustment; }
-
-    // setLetterSpacingAdjustment sets an additional number of pixels that is
-    // added to the advance after each output cluster. This matches the behaviour
-    // of WidthIterator::advance.
-    void setLetterSpacingAdjustment(int letterSpacingAdjustment) { m_letterSpacing = letterSpacingAdjustment; }
-    int letterSpacing() const { return m_letterSpacing; }
-
     void setupForRTL();
     bool rtl() const { return m_run.rtl(); }
     const uint16_t* glyphs() const { return m_glyphs16; }
@@ -126,15 +112,8 @@ private:
     void shapeGlyphs();
     void setGlyphPositions(bool);
 
-    static void normalizeSpacesAndMirrorChars(const UChar* source, bool rtl, UChar* destination, int length);
-    static const TextRun& getNormalizedTextRun(const TextRun& originalRun, OwnPtr<TextRun>& normalizedRun, OwnArrayPtr<UChar>& normalizedBuffer);
-
-    // This matches the logic in RenderBlock::findNextLineBreak
-    static bool isCodepointSpace(HB_UChar16 c) { return c == ' ' || c == '\t'; }
-
     int glyphIndexForXPositionInScriptRun(int targetX) const;
 
-    const Font* const m_font;
     const SimpleFontData* m_currentFontData;
     HB_ShaperItem m_item;
     uint16_t* m_glyphs16; // A vector of 16-bit glyph ids.
@@ -145,17 +124,6 @@ private:
     unsigned m_pixelWidth; // Width (in px) of the current script run.
     unsigned m_glyphsArrayCapacity; // Current size of all the Harfbuzz arrays.
 
-    OwnPtr<TextRun> m_normalizedRun;
-    OwnArrayPtr<UChar> m_normalizedBuffer; // A buffer for normalized run.
-    const TextRun& m_run;
-    int m_wordSpacingAdjustment; // delta adjustment (pixels) for each word break.
-    float m_padding; // pixels to be distributed over the line at word breaks.
-    float m_padPerWordBreak; // pixels to be added to each word break.
-    float m_padError; // |m_padPerWordBreak| might have a fractional component.
-                      // Since we only add a whole number of padding pixels at
-                      // each word break we accumulate error. This is the
-                      // number of pixels that we are behind so far.
-    int m_letterSpacing; // pixels to be added after each glyph.
     String m_smallCapsString; // substring of m_run converted to small caps.
 };
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
index ba8aa2e7d..03f6836c1 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
@@ -195,8 +195,7 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
         setupForTextPainting(&strokePaint, gc->strokeColor().rgb());
     }
 
-    ComplexTextController controller(run, point.x(), point.y(), wordSpacing(), letterSpacing(), run.expansion(), this);
-
+    ComplexTextController controller(this, run, point.x(), point.y());
     if (run.rtl())
         controller.setupForRTL();
 
@@ -228,7 +227,7 @@ void Font::drawEmphasisMarksForComplexText(GraphicsContext* /* context */, const
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */, GlyphOverflow* /* glyphOverflow */) const
 {
-    ComplexTextController controller(run, 0, 0, wordSpacing(), letterSpacing(), run.expansion(), this);
+    ComplexTextController controller(this, run, 0, 0);
     return controller.widthOfFullRun();
 }
 
@@ -242,7 +241,7 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat,
 
     // (Mac code ignores includePartialGlyphs, and they don't know what it's
     // supposed to do, so we just ignore it as well.)
-    ComplexTextController controller(run, 0, 0, wordSpacing(), letterSpacing(), run.expansion(), this);
+    ComplexTextController controller(this, run, 0, 0);
     if (run.rtl())
         controller.setupForRTL();
     return controller.offsetForPosition(targetX);
@@ -253,7 +252,7 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run,
                                             const FloatPoint& point, int height,
                                             int from, int to) const
 {
-    ComplexTextController controller(run, 0, 0, wordSpacing(), letterSpacing(), run.expansion(), this);
+    ComplexTextController controller(this, run, 0, 0);
     if (run.rtl())
         controller.setupForRTL();
     return controller.selectionRect(point, height, from, to);
diff --git a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
new file mode 100644
index 000000000..29c061238
--- /dev/null
+++ b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "HarfBuzzShaperBase.h"
+
+#include "Font.h"
+#include <unicode/normlzr.h>
+#include <unicode/uchar.h>
+#include <wtf/MathExtras.h>
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+HarfBuzzShaperBase::HarfBuzzShaperBase(const Font* font, const TextRun& run)
+    : m_font(font)
+    , m_run(run)
+    , m_wordSpacingAdjustment(font->wordSpacing())
+    , m_letterSpacing(font->letterSpacing())
+{
+}
+
+static void normalizeSpacesAndMirrorChars(const UChar* source, UChar* destination, int length, HarfBuzzShaperBase::NormalizeMode normalizeMode)
+{
+    int position = 0;
+    bool error = false;
+    // Iterate characters in source and mirror character if needed.
+    while (position < length) {
+        UChar32 character;
+        int nextPosition = position;
+        U16_NEXT(source, nextPosition, length, character);
+        if (Font::treatAsSpace(character))
+            character = ' ';
+        else if (Font::treatAsZeroWidthSpace(character))
+            character = zeroWidthSpace;
+        else if (normalizeMode == HarfBuzzShaperBase::NormalizeMirrorChars)
+            character = u_charMirror(character);
+        U16_APPEND(destination, position, length, character, error);
+        ASSERT(!error);
+        position = nextPosition;
+    }
+}
+
+void HarfBuzzShaperBase::setNormalizedBuffer(NormalizeMode normalizeMode)
+{
+    // Normalize the text run in three ways:
+    // 1) Convert the |originalRun| to NFC normalized form if combining diacritical marks
+    // (U+0300..) are used in the run. This conversion is necessary since most OpenType
+    // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
+    // their GSUB tables.
+    //
+    // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
+    // the API returns FALSE (= not normalized) for complex runs that don't require NFC
+    // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
+    // HarfBuzz will do the same thing for us using the GSUB table.
+    // 2) Convert spacing characters into plain spaces, as some fonts will provide glyphs
+    // for characters like '\n' otherwise.
+    // 3) Convert mirrored characters such as parenthesis for rtl text.
+
+    // Convert to NFC form if the text has diacritical marks.
+    icu::UnicodeString normalizedString;
+    UErrorCode error = U_ZERO_ERROR;
+
+    for (int i = 0; i < m_run.length(); ++i) {
+        UChar ch = m_run[i];
+        if (::ublock_getCode(ch) == UBLOCK_COMBINING_DIACRITICAL_MARKS) {
+            icu::Normalizer::normalize(icu::UnicodeString(m_run.characters(),
+                                       m_run.length()), UNORM_NFC, 0 /* no options */,
+                                       normalizedString, error);
+            if (U_FAILURE(error))
+                normalizedString.remove();
+            break;
+        }
+    }
+
+    const UChar* sourceText;
+    if (normalizedString.isEmpty()) {
+        m_normalizedBufferLength = m_run.length();
+        sourceText = m_run.characters();
+    } else {
+        m_normalizedBufferLength = normalizedString.length();
+        sourceText = normalizedString.getBuffer();
+    }
+
+    m_normalizedBuffer = adoptArrayPtr(new UChar[m_normalizedBufferLength + 1]);
+    normalizeSpacesAndMirrorChars(sourceText, m_normalizedBuffer.get(), m_normalizedBufferLength, normalizeMode);
+}
+
+bool HarfBuzzShaperBase::isWordEnd(unsigned index)
+{
+    // This could refer a high-surrogate, but should work.
+    return index && isCodepointSpace(m_normalizedBuffer[index]) && !isCodepointSpace(m_normalizedBuffer[index - 1]);
+}
+
+int HarfBuzzShaperBase::determineWordBreakSpacing()
+{
+    int wordBreakSpacing = m_wordSpacingAdjustment;
+
+    if (m_padding > 0) {
+        int toPad = roundf(m_padPerWordBreak + m_padError);
+        m_padError += m_padPerWordBreak - toPad;
+
+        if (m_padding < toPad)
+            toPad = m_padding;
+        m_padding -= toPad;
+        wordBreakSpacing += toPad;
+    }
+    return wordBreakSpacing;
+}
+
+// setPadding sets a number of pixels to be distributed across the TextRun.
+// WebKit uses this to justify text.
+void HarfBuzzShaperBase::setPadding(int padding)
+{
+    m_padding = padding;
+    m_padError = 0;
+    if (!m_padding)
+        return;
+
+    // If we have padding to distribute, then we try to give an equal
+    // amount to each space. The last space gets the smaller amount, if
+    // any.
+    unsigned numWordEnds = 0;
+
+    for (unsigned i = 0; i < m_normalizedBufferLength; i++) {
+        if (isWordEnd(i))
+            numWordEnds++;
+    }
+
+    if (numWordEnds)
+        m_padPerWordBreak = m_padding / numWordEnds;
+    else
+        m_padPerWordBreak = 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.h b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.h
new file mode 100644
index 000000000..67bcadbff
--- /dev/null
+++ b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HarfBuzzShaperBase_h
+#define HarfBuzzShaperBase_h
+
+#include "TextRun.h"
+#include <wtf/OwnArrayPtr.h>
+
+namespace WebCore {
+
+class Font;
+
+class HarfBuzzShaperBase {
+public:
+    enum NormalizeMode {
+        DoNotNormalizeMirrorChars,
+        NormalizeMirrorChars
+    };
+
+    HarfBuzzShaperBase(const Font*, const TextRun&);
+    virtual ~HarfBuzzShaperBase() { }
+
+protected:
+    void setNormalizedBuffer(NormalizeMode = DoNotNormalizeMirrorChars);
+
+    bool isWordEnd(unsigned);
+    int determineWordBreakSpacing();
+    // setPadding sets a number of pixels to be distributed across the TextRun.
+    // WebKit uses this to justify text.
+    void setPadding(int);
+
+    // This matches the logic in RenderBlock::findNextLineBreak
+    static bool isCodepointSpace(UChar c) { return c == ' ' || c == '\t'; }
+
+    const Font* m_font;
+    OwnArrayPtr<UChar> m_normalizedBuffer;
+    unsigned m_normalizedBufferLength;
+    const TextRun& m_run;
+
+    int m_wordSpacingAdjustment; // delta adjustment (pixels) for each word break.
+    float m_padding; // pixels to be distributed over the line at word breaks.
+    float m_padPerWordBreak; // pixels to be added to each word break.
+    float m_padError; // |m_padPerWordBreak| might have a fractional component.
+                      // Since we only add a whole number of padding pixels at
+                      // each word break we accumulate error. This is the
+                      // number of pixels that we are behind so far.
+    int m_letterSpacing; // pixels to be added after each glyph.
+};
+
+} // namespace WebCore
+
+#endif // HarfBuzzShaperBase_h
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index 67d42ba86..b6410f61c 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -35,10 +35,8 @@
 #if PLATFORM(MAC)
 #include "ANGLE/ShaderLang.h"
 #include <OpenGL/gl.h>
-#elif PLATFORM(GTK) || PLATFORM(EFL)
+#elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
 #include "OpenGLShims.h"
-#elif PLATFORM(QT)
-#include <cairo/OpenGLShims.h>
 #endif
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index 8b4d9d49a..8c002facc 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -36,11 +36,8 @@
 
 #if PLATFORM(MAC)
 #include <OpenGL/gl.h>
-#elif PLATFORM(GTK) || PLATFORM(EFL)
+#elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
 #include "OpenGLShims.h"
-#elif PLATFORM(QT)
-#include <QtGlobal>
-#include <cairo/OpenGLShims.h>
 #endif
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
index cf9d8f615..03d4a32cc 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
@@ -51,11 +51,8 @@
 
 #if PLATFORM(MAC)
 #include <OpenGL/gl.h>
-#elif PLATFORM(GTK) || PLATFORM(EFL)
+#elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
 #include "OpenGLShims.h"
-#elif PLATFORM(QT)
-#include <QtGlobal>
-#include <cairo/OpenGLShims.h>
 #endif
 
 namespace WebCore {
@@ -111,7 +108,6 @@ bool GraphicsContext3D::isResourceSafe()
     return false;
 }
 
-#if !PLATFORM(QT)
 void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer*)
 {
     HTMLCanvasElement* canvas = context->canvas();
@@ -138,7 +134,6 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
     paintToCanvas(pixels.get(), m_currentWidth, m_currentHeight,
                   canvas->width(), canvas->height(), imageBuffer->context()->platformContext());
 }
-#endif
 
 bool GraphicsContext3D::paintCompositedResultsToCanvas(CanvasRenderingContext*)
 {
diff --git a/Source/WebCore/platform/graphics/pango/FontPango.cpp b/Source/WebCore/platform/graphics/pango/FontPango.cpp
index 2684f53f4..0c60c767c 100644
--- a/Source/WebCore/platform/graphics/pango/FontPango.cpp
+++ b/Source/WebCore/platform/graphics/pango/FontPango.cpp
@@ -136,7 +136,7 @@ static gchar* utf16ToUtf8(const UChar* aText, gint aLength, gint &length)
 
     gchar* utf8Text;
     glong itemsWritten;
-    utf8Text = g_utf16_to_utf8(static_cast<const gunichar2*>(aText), aLength, 0, &itemsWritten, 0);
+    utf8Text = g_utf16_to_utf8(reinterpret_cast<const gunichar2*>(aText), aLength, 0, &itemsWritten, 0);
     length = itemsWritten;
 
     return utf8Text;
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
index be786015a..27c8366ef 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
@@ -30,7 +30,7 @@
 #include "Extensions3DQt.h"
 
 #include "GraphicsContext3D.h"
-#include <QGLContext>
+#include "OpenGLShims.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 66bc76e81..80591e9c4 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -21,7 +21,6 @@
 #include "GraphicsContext3D.h"
 
 #include "WebGLObject.h"
-#include <cairo/OpenGLShims.h>
 #include "CanvasRenderingContext.h"
 #if defined(QT_OPENGL_ES_2)
 #include "Extensions3DQt.h"
@@ -34,17 +33,14 @@
 #include "ImageBuffer.h"
 #include "ImageData.h"
 #include "NotImplemented.h"
+#include "OpenGLShims.h"
 #include "QWebPageClient.h"
 #include "SharedBuffer.h"
-#include <QAbstractScrollArea>
-#include <QGraphicsObject>
-#include <QGLContext>
-#include <QStyleOptionGraphicsItem>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TEXTURE_MAPPER_GL)
-#include <opengl/TextureMapperGL.h>
+#include <texmap/TextureMapperGL.h>
 #endif
 
 #if ENABLE(WEBGL)
@@ -60,24 +56,18 @@ typedef char GLchar;
 #endif
 
 class GraphicsContext3DPrivate
-#if USE(ACCELERATED_COMPOSITING)
-#if USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
         : public TextureMapperPlatformLayer
-#else
-        : public QGraphicsObject
-#endif
 #endif
 {
 public:
     GraphicsContext3DPrivate(GraphicsContext3D*, HostWindow*);
     ~GraphicsContext3DPrivate();
 
-    QGLWidget* getViewportGLWidget();
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-    virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask) const;
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask);
 #endif
 
-    void paint(QPainter*, const QStyleOptionGraphicsItem*, QWidget*);
     QRectF boundingRect() const;
     void blitMultisampleFramebuffer() const;
     void blitMultisampleFramebufferAndRestoreContext() const;
@@ -85,8 +75,8 @@ public:
 
     GraphicsContext3D* m_context;
     HostWindow* m_hostWindow;
-    QGLWidget* m_glWidget;
-    QGLWidget* m_viewportGLWidget;
+    PlatformGraphicsSurface3D m_surface;
+    PlatformGraphicsContext3D m_platformContext;
 };
 
 bool GraphicsContext3D::isGLES2Compliant() const
@@ -101,39 +91,24 @@ bool GraphicsContext3D::isGLES2Compliant() const
 GraphicsContext3DPrivate::GraphicsContext3DPrivate(GraphicsContext3D* context, HostWindow* hostWindow)
     : m_context(context)
     , m_hostWindow(hostWindow)
-    , m_glWidget(0)
-    , m_viewportGLWidget(0)
+    , m_surface(0)
+    , m_platformContext(0)
 {
-    m_viewportGLWidget = getViewportGLWidget();
-
-    if (m_viewportGLWidget)
-        m_glWidget = new QGLWidget(0, m_viewportGLWidget);
-    else
-        m_glWidget = new QGLWidget();
-
-    // Geometry can be set to zero because m_glWidget is used only for its QGLContext.
-    m_glWidget->setGeometry(0, 0, 0, 0);
-
+    QWebPageClient* webPageClient = m_hostWindow->platformPageClient();
+    if (!webPageClient)
+        return;
+    webPageClient->createPlatformGraphicsContext3D(&m_platformContext, &m_surface);
+    if (!m_surface)
+        return;
     makeCurrentIfNeeded();
 }
 
 GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
 {
-    delete m_glWidget;
-    m_glWidget = 0;
-}
-
-QGLWidget* GraphicsContext3DPrivate::getViewportGLWidget()
-{
-    QWebPageClient* webPageClient = m_hostWindow->platformPageClient();
-    if (!webPageClient)
-        return 0;
-
-    QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(webPageClient->ownerWidget());
-    if (scrollArea)
-        return qobject_cast<QGLWidget*>(scrollArea->viewport());
-
-    return 0;
+    delete m_surface;
+    m_surface = 0;
+    // Platform context is assumed to be owned by surface.
+    m_platformContext = 0;
 }
 
 static inline quint32 swapBgrToRgb(quint32 pixel)
@@ -142,13 +117,14 @@ static inline quint32 swapBgrToRgb(quint32 pixel)
 }
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture* mask) const
+void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture* mask)
 {
     blitMultisampleFramebufferAndRestoreContext();
 
     if (textureMapper->accelerationMode() == TextureMapper::OpenGLMode) {
         TextureMapperGL* texmapGL = static_cast<TextureMapperGL*>(textureMapper);
-        texmapGL->drawTexture(m_context->m_texture, !m_context->m_attrs.alpha, FloatSize(1, 1), targetRect, matrix, opacity, mask, true /* flip */);
+        TextureMapperGL::Flags flags = TextureMapperGL::ShouldFlipTexture | (m_context->m_attrs.alpha ? TextureMapperGL::SupportsBlending : 0);
+        texmapGL->drawTexture(m_context->m_texture, flags, FloatSize(1, 1), targetRect, matrix, opacity, mask);
         return;
     }
 
@@ -202,58 +178,6 @@ QRectF GraphicsContext3DPrivate::boundingRect() const
     return QRectF(QPointF(0, 0), QSizeF(m_context->m_currentWidth, m_context->m_currentHeight));
 }
 
-void GraphicsContext3DPrivate::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget)
-{
-    Q_UNUSED(widget);
-
-    QRectF rect = option ? option->rect : boundingRect();
-
-    makeCurrentIfNeeded();
-    blitMultisampleFramebuffer();
-
-    // Use direct texture mapping if WebGL canvas has a shared OpenGL context
-    // with browsers OpenGL context.
-    QGLWidget* viewportGLWidget = getViewportGLWidget();
-    if (viewportGLWidget && viewportGLWidget == m_viewportGLWidget && viewportGLWidget == painter->device()) {
-        viewportGLWidget->drawTexture(rect, m_context->m_texture);
-        return;
-    }
-
-    // Alternatively read pixels to a memory buffer.
-    QImage offscreenImage(rect.width(), rect.height(), QImage::Format_ARGB32);
-    quint32* imagePixels = reinterpret_cast<quint32*>(offscreenImage.bits());
-
-    glBindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_context->m_fbo);
-    glReadPixels(/* x */ 0, /* y */ 0, rect.width(), rect.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, imagePixels);
-    glBindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_context->m_boundFBO);
-
-    // OpenGL gives us ABGR on 32 bits, and with the origin at the bottom left
-    // We need RGB32 or ARGB32_PM, with the origin at the top left.
-    quint32* pixelsSrc = imagePixels;
-    const int height = static_cast<int>(rect.height());
-    const int width = static_cast<int>(rect.width());
-    const int halfHeight = height / 2;
-    for (int row = 0; row < halfHeight; ++row) {
-        const int targetIdx = (height - 1 - row) * width;
-        quint32* pixelsDst = imagePixels + targetIdx;
-        for (int column = 0; column < width; ++column) {
-            quint32 tempPixel = *pixelsSrc;
-            *pixelsSrc = swapBgrToRgb(*pixelsDst);
-            *pixelsDst = swapBgrToRgb(tempPixel);
-            ++pixelsSrc;
-            ++pixelsDst;
-        }
-    }
-    if (static_cast<int>(height) % 2) {
-        for (int column = 0; column < width; ++column) {
-            *pixelsSrc = swapBgrToRgb(*pixelsSrc);
-            ++pixelsSrc;
-        }
-    }
-
-    painter->drawImage(/* x */ 0, /* y */ 0, offscreenImage);
-}
-
 void GraphicsContext3DPrivate::blitMultisampleFramebuffer() const
 {
     if (!m_context->m_attrs.antialias)
@@ -269,26 +193,45 @@ void GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext() con
     if (!m_context->m_attrs.antialias)
         return;
 
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    const QOpenGLContext* currentContext = QOpenGLContext::currentContext();
+    QSurface* currentSurface = 0;
+    if (currentContext != m_platformContext) {
+        currentSurface = currentContext->surface();
+        m_platformContext->makeCurrent(m_surface);
+    }
+    blitMultisampleFramebuffer();
+    if (currentSurface)
+        const_cast<QOpenGLContext*>(currentContext)->makeCurrent(currentSurface);
+#else
     const QGLContext* currentContext = QGLContext::currentContext();
-    const QGLContext* widgetContext = m_glWidget->context();
+    const QGLContext* widgetContext = m_surface->context();
     if (currentContext != widgetContext)
-        m_glWidget->makeCurrent();
+        m_surface->makeCurrent();
     blitMultisampleFramebuffer();
     if (currentContext) {
         if (currentContext != widgetContext)
             const_cast<QGLContext*>(currentContext)->makeCurrent();
     } else
-        m_glWidget->doneCurrent();
+        m_surface->doneCurrent();
+#endif
 }
 
 bool GraphicsContext3DPrivate::makeCurrentIfNeeded() const
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    const QOpenGLContext* currentContext = QOpenGLContext::currentContext();
+    if (currentContext == m_platformContext)
+        return true;
+    return m_platformContext->makeCurrent(m_surface);
+#else
     const QGLContext* currentContext = QGLContext::currentContext();
-    const QGLContext* widgetContext = m_glWidget->context();
+    const QGLContext* widgetContext = m_surface->context();
     if (currentContext != widgetContext)
-        m_glWidget->makeCurrent();
+        m_surface->makeCurrent();
 
     return QGLContext::currentContext() == widgetContext;
+#endif
 }
 
 PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
@@ -327,7 +270,7 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
     validateAttributes();
 #endif
 
-    if (!m_private->m_glWidget->isValid()) {
+    if (!m_private->m_surface) {
         LOG_ERROR("GraphicsContext3D: QGLWidget initialization failed.");
         m_private = nullptr;
         return;
@@ -405,8 +348,6 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
 GraphicsContext3D::~GraphicsContext3D()
 {
     makeContextCurrent();
-    if (!m_private->m_glWidget->isValid())
-        return;
     glDeleteTextures(1, &m_texture);
     glDeleteFramebuffers(1, &m_fbo);
     if (m_attrs.antialias) {
@@ -428,7 +369,7 @@ GraphicsContext3D::~GraphicsContext3D()
 
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
 {
-    return m_private->m_glWidget;
+    return m_private->m_platformContext;
 }
 
 Platform3DObject GraphicsContext3D::platformTexture() const
@@ -448,13 +389,16 @@ bool GraphicsContext3D::makeContextCurrent()
     return m_private->makeCurrentIfNeeded();
 }
 
-void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer*)
+void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
+                                      int canvasWidth, int canvasHeight, QPainter* context)
 {
-    makeContextCurrent();
-    HTMLCanvasElement* canvas = context->canvas();
-    ImageBuffer* imageBuffer = canvas->buffer();
-    QPainter* painter = imageBuffer->context()->platformContext();
-    m_private->paint(painter, 0, 0);
+    QImage image(imagePixels, imageWidth, imageHeight, QImage::Format_ARGB32_Premultiplied);
+    context->save();
+    context->translate(0, imageHeight);
+    context->scale(1, -1);
+    context->setCompositionMode(QPainter::CompositionMode_Source);
+    context->drawImage(QRect(0, 0, canvasWidth, -canvasHeight), image);
+    context->restore();
 }
 
 #if defined(QT_OPENGL_ES_2)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 90079ee30..d07d732b4 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -301,7 +301,7 @@ void GraphicsContext::restorePlatformState()
 {
     if (!m_data->layers.isEmpty() && !m_data->layers.top()->alphaMask.isNull())
         if (!--m_data->layers.top()->saveCounter)
-            endTransparencyLayer();
+            endPlatformTransparencyLayer();
 
     m_data->p()->restore();
 
diff --git a/Source/WebCore/platform/graphics/qt/IconQt.cpp b/Source/WebCore/platform/graphics/qt/IconQt.cpp
index eb09eda6b..7d2613fbd 100644
--- a/Source/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/IconQt.cpp
@@ -22,13 +22,10 @@
 #include "Icon.h"
 
 #include "GraphicsContext.h"
-#include "PlatformString.h"
 #include "IntRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
 
-#include <qpainter.h>
-#include <qpixmap.h>
-#include <qrect.h>
-#include <qglobal.h>
 
 namespace WebCore {
 
@@ -41,27 +38,16 @@ Icon::~Icon()
 }
 
 // FIXME: Move the code to ChromeClient::iconForFiles().
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
-    if (filenames.isEmpty())
-        return 0;
-
-    if (filenames.size() == 1) {
-        RefPtr<Icon> i = adoptRef(new Icon);
-        i->m_icon = QIcon(filenames[0]);
-        return i.release();
-    }
-
-    //FIXME: Implement this
+    // FIXME: Should use QMimeType in Qt 5.
+    notImplemented();
     return 0;
 }
 
-void Icon::paint(GraphicsContext* ctx, const IntRect& rect)
+void Icon::paint(GraphicsContext*, const IntRect&)
 {
-    QPixmap px = m_icon.pixmap(rect.size());
-    QPainter *p = static_cast<QPainter*>(ctx->platformContext());
-    if (p && !px.isNull())
-        p->drawPixmap(rect.x(), rect.y(), px);
+    notImplemented();
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/qt/ImageQt.cpp b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
index fa78e01be..eb4be2d4a 100644
--- a/Source/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -41,13 +41,12 @@
 #include "ShadowBlur.h"
 #include "StillImageQt.h"
 
-#include <QApplication>
+#include <QCoreApplication>
 #include <QDebug>
 #include <QImage>
 #include <QImageReader>
 #include <QPainter>
 #include <QPixmap>
-#include <QStyle>
 #include <QTransform>
 
 #include <math.h>
@@ -81,10 +80,6 @@ static WebGraphicHash* graphics()
         hash->insert("deleteButton", QPixmap(QLatin1String(":webkit/resources/deleteButton.png")));
         // QWebSettings::InputSpeechButtonGraphic
         hash->insert("inputSpeech", QPixmap(QLatin1String(":webkit/resources/inputSpeech.png")));
-        // QWebSettings::SearchCancelButtonGraphic
-        hash->insert("searchCancelButton", QApplication::style()->standardPixmap(QStyle::SP_DialogCloseButton));
-        // QWebSettings::SearchCancelButtonPressedGraphic
-        hash->insert("searchCancelButtonPressed", QApplication::style()->standardPixmap(QStyle::SP_DialogCloseButton));
     }
 
     return hash;
diff --git a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index e95b8c5ea..827e1346e 100644
--- a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -148,9 +148,11 @@ void SimpleFontData::platformInit()
     float spaceWidth = fm.width(QLatin1Char(' '));
 #endif
 
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     // Qt subtracts 1 from the descent to account for the baseline,
     // we add it back here to get correct metrics for WebKit.
     descent += 1;
+#endif
 
     // The line spacing should always be >= (ascent + descent), but this
     // may be false in some cases due to misbehaving platform libraries.
diff --git a/Source/WebCore/platform/graphics/skia/FontSkia.cpp b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
index da3e49470..4980526b7 100644
--- a/Source/WebCore/platform/graphics/skia/FontSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
@@ -159,7 +159,6 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
         setupPaint(&paint, font, this, shouldAntialias, shouldSmoothFonts);
         adjustTextRenderMode(&paint, gc->platformContext());
         paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-        paint.setColor(gc->fillColor().rgb());
 
         canvas->drawPosText(glyphs, numGlyphs * sizeof(uint16_t), pos, paint);
     }
@@ -173,7 +172,6 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
         setupPaint(&paint, font, this, shouldAntialias, shouldSmoothFonts);
         adjustTextRenderMode(&paint, gc->platformContext());
         paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-        paint.setColor(gc->strokeColor().rgb());
 
         if (textMode & TextModeFill) {
             // If we also filled, we don't want to draw shadows twice.
diff --git a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
index 30b8a3805..21facaadb 100644
--- a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
@@ -235,7 +235,12 @@ void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineT
 {
     SkRect targetRect = rect;
 
-    // Apply the current clip.
+    // Apply the transform to device coordinate space.
+    SkMatrix canvasTransform = context->canvas()->getTotalMatrix();
+    if (!canvasTransform.mapRect(&targetRect))
+        fillsBounds = false;
+
+    // Apply the current clip in device coordinate space.
     if (context->canvas()->getClipType() != SkCanvas::kRect_ClipType)
         fillsBounds = false;
     else {
@@ -247,10 +252,7 @@ void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineT
     if (!context->clippedToImage().isOpaque())
         fillsBounds = false;
 
-    // Apply the transforms.
-    SkMatrix canvasTransform = context->canvas()->getTotalMatrix();
-    if (!canvasTransform.mapRect(&targetRect))
-        fillsBounds = false;
+    // Apply the transform to the tracking space.
     SkMatrix canvasToTargetTransform = transform;
     if (!canvasToTargetTransform.mapRect(&targetRect))
         fillsBounds = false;
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index c323a0d7e..3a677e2b0 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -52,6 +52,10 @@
 #include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 
+#if PLATFORM(CHROMIUM)
+#include "TraceEvent.h"
+#endif
+
 namespace WebCore {
 
 // State -----------------------------------------------------------------------
@@ -551,6 +555,9 @@ void PlatformContextSkia::paintSkPaint(const SkRect& rect,
 
 const SkBitmap* PlatformContextSkia::bitmap() const
 {
+#if PLATFORM(CHROMIUM)
+    TRACE_EVENT("PlatformContextSkia::bitmap", this, 0);
+#endif
     return &m_canvas->getDevice()->accessBitmap(false);
 }
 
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
index b521d1a21..46169c672 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -20,19 +20,21 @@
 #include "config.h"
 #include "GraphicsLayerTextureMapper.h"
 
-#include "TextureMapperNode.h"
+#include "TextureMapperLayer.h"
 
 namespace WebCore {
 
 GraphicsLayerTextureMapper::GraphicsLayerTextureMapper(GraphicsLayerClient* client)
     : GraphicsLayer(client)
-    , m_node(adoptPtr(new TextureMapperNode()))
+    , m_layer(adoptPtr(new TextureMapperLayer()))
     , m_changeMask(0)
+    , m_needsDisplay(false)
+    , m_contentsLayer(0)
     , m_animationStartedTimer(this, &GraphicsLayerTextureMapper::animationStartedTimerFired)
 {
 }
 
-void GraphicsLayerTextureMapper::notifyChange(TextureMapperNode::ChangeMask changeMask)
+void GraphicsLayerTextureMapper::notifyChange(TextureMapperLayer::ChangeMask changeMask)
 {
     m_changeMask |= changeMask;
     if (!client())
@@ -44,8 +46,8 @@ void GraphicsLayerTextureMapper::didSynchronize()
 {
     m_syncQueued = false;
     m_changeMask = 0;
-    m_pendingContent.needsDisplay = false;
-    m_pendingContent.needsDisplayRect = IntRect();
+    m_needsDisplay = false;
+    m_needsDisplayRect = IntRect();
 }
 
 void GraphicsLayerTextureMapper::setName(const String& name)
@@ -61,34 +63,34 @@ GraphicsLayerTextureMapper::~GraphicsLayerTextureMapper()
 */
 void GraphicsLayerTextureMapper::setNeedsDisplay()
 {
-    m_pendingContent.needsDisplay = true;
-    notifyChange(TextureMapperNode::DisplayChange);
+    m_needsDisplay = true;
+    notifyChange(TextureMapperLayer::DisplayChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setContentsNeedsDisplay()
 {
-    if (!node()->media())
-        m_pendingContent.needsDisplay = true;
-    notifyChange(TextureMapperNode::DisplayChange);
+    if (m_image)
+        setContentsToImage(m_image.get());
+    notifyChange(TextureMapperLayer::DisplayChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setNeedsDisplayInRect(const FloatRect& rect)
 {
-    if (m_pendingContent.needsDisplay)
+    if (m_needsDisplay)
         return;
-    m_pendingContent.needsDisplayRect.unite(rect);
-    notifyChange(TextureMapperNode::DisplayChange);
+    m_needsDisplayRect.unite(rect);
+    notifyChange(TextureMapperLayer::DisplayChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setParent(GraphicsLayer* layer)
 {
-    notifyChange(TextureMapperNode::ParentChange);
+    notifyChange(TextureMapperLayer::ParentChange);
     GraphicsLayer::setParent(layer);
 }
 
@@ -96,7 +98,7 @@ void GraphicsLayerTextureMapper::setParent(GraphicsLayer* layer)
 */
 bool GraphicsLayerTextureMapper::setChildren(const Vector<GraphicsLayer*>& children)
 {
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
     return GraphicsLayer::setChildren(children);
 }
 
@@ -104,7 +106,7 @@ bool GraphicsLayerTextureMapper::setChildren(const Vector<GraphicsLayer*>& child
 */
 void GraphicsLayerTextureMapper::addChild(GraphicsLayer* layer)
 {
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
     GraphicsLayer::addChild(layer);
 }
 
@@ -113,7 +115,7 @@ void GraphicsLayerTextureMapper::addChild(GraphicsLayer* layer)
 void GraphicsLayerTextureMapper::addChildAtIndex(GraphicsLayer* layer, int index)
 {
     GraphicsLayer::addChildAtIndex(layer, index);
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -121,16 +123,15 @@ void GraphicsLayerTextureMapper::addChildAtIndex(GraphicsLayer* layer, int index
 void GraphicsLayerTextureMapper::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
 {
      GraphicsLayer::addChildAbove(layer, sibling);
-     notifyChange(TextureMapperNode::ChildrenChange);
+     notifyChange(TextureMapperLayer::ChildrenChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
 {
-
     GraphicsLayer::addChildBelow(layer, sibling);
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -138,7 +139,7 @@ void GraphicsLayerTextureMapper::addChildBelow(GraphicsLayer* layer, GraphicsLay
 bool GraphicsLayerTextureMapper::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
 {
     if (GraphicsLayer::replaceChild(oldChild, newChild)) {
-        notifyChange(TextureMapperNode::ChildrenChange);
+        notifyChange(TextureMapperLayer::ChildrenChange);
         return true;
     }
     return false;
@@ -150,7 +151,7 @@ void GraphicsLayerTextureMapper::removeFromParent()
 {
     if (!parent())
         return;
-    notifyChange(TextureMapperNode::ParentChange);
+    notifyChange(TextureMapperLayer::ParentChange);
     GraphicsLayer::removeFromParent();
 }
 
@@ -161,7 +162,7 @@ void GraphicsLayerTextureMapper::setMaskLayer(GraphicsLayer* value)
     if (value == maskLayer())
         return;
     GraphicsLayer::setMaskLayer(value);
-    notifyChange(TextureMapperNode::MaskLayerChange);
+    notifyChange(TextureMapperLayer::MaskLayerChange);
 }
 
 
@@ -172,7 +173,7 @@ void GraphicsLayerTextureMapper::setReplicatedByLayer(GraphicsLayer* value)
     if (value == replicaLayer())
         return;
     GraphicsLayer::setReplicatedByLayer(value);
-    notifyChange(TextureMapperNode::ReplicaLayerChange);
+    notifyChange(TextureMapperLayer::ReplicaLayerChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -182,7 +183,7 @@ void GraphicsLayerTextureMapper::setPosition(const FloatPoint& value)
     if (value == position())
         return;
     GraphicsLayer::setPosition(value);
-    notifyChange(TextureMapperNode::PositionChange);
+    notifyChange(TextureMapperLayer::PositionChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -192,7 +193,7 @@ void GraphicsLayerTextureMapper::setAnchorPoint(const FloatPoint3D& value)
     if (value == anchorPoint())
         return;
     GraphicsLayer::setAnchorPoint(value);
-    notifyChange(TextureMapperNode::AnchorPointChange);
+    notifyChange(TextureMapperLayer::AnchorPointChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -203,7 +204,7 @@ void GraphicsLayerTextureMapper::setSize(const FloatSize& value)
         return;
 
     GraphicsLayer::setSize(value);
-    notifyChange(TextureMapperNode::SizeChange);
+    notifyChange(TextureMapperLayer::SizeChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -214,7 +215,7 @@ void GraphicsLayerTextureMapper::setTransform(const TransformationMatrix& value)
         return;
 
     GraphicsLayer::setTransform(value);
-    notifyChange(TextureMapperNode::TransformChange);
+    notifyChange(TextureMapperLayer::TransformChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -224,7 +225,7 @@ void GraphicsLayerTextureMapper::setChildrenTransform(const TransformationMatrix
     if (value == childrenTransform())
         return;
     GraphicsLayer::setChildrenTransform(value);
-    notifyChange(TextureMapperNode::ChildrenTransformChange);
+    notifyChange(TextureMapperLayer::ChildrenTransformChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -234,7 +235,7 @@ void GraphicsLayerTextureMapper::setPreserves3D(bool value)
     if (value == preserves3D())
         return;
     GraphicsLayer::setPreserves3D(value);
-    notifyChange(TextureMapperNode::Preserves3DChange);
+    notifyChange(TextureMapperLayer::Preserves3DChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -244,7 +245,7 @@ void GraphicsLayerTextureMapper::setMasksToBounds(bool value)
     if (value == masksToBounds())
         return;
     GraphicsLayer::setMasksToBounds(value);
-    notifyChange(TextureMapperNode::MasksToBoundsChange);
+    notifyChange(TextureMapperLayer::MasksToBoundsChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -253,39 +254,17 @@ void GraphicsLayerTextureMapper::setDrawsContent(bool value)
 {
     if (value == drawsContent())
         return;
-    notifyChange(TextureMapperNode::DrawsContentChange);
+    notifyChange(TextureMapperLayer::DrawsContentChange);
     GraphicsLayer::setDrawsContent(value);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
-void GraphicsLayerTextureMapper::setBackgroundColor(const Color& value)
-{
-    if (value == m_pendingContent.backgroundColor)
-        return;
-    m_pendingContent.backgroundColor = value;
-    GraphicsLayer::setBackgroundColor(value);
-    notifyChange(TextureMapperNode::BackgroundColorChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerTextureMapper::clearBackgroundColor()
-{
-    if (!m_pendingContent.backgroundColor.isValid())
-        return;
-    m_pendingContent.backgroundColor = Color();
-    GraphicsLayer::clearBackgroundColor();
-    notifyChange(TextureMapperNode::BackgroundColorChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
 void GraphicsLayerTextureMapper::setContentsOpaque(bool value)
 {
     if (value == contentsOpaque())
         return;
-    notifyChange(TextureMapperNode::ContentsOpaqueChange);
+    notifyChange(TextureMapperLayer::ContentsOpaqueChange);
     GraphicsLayer::setContentsOpaque(value);
 }
 
@@ -296,7 +275,7 @@ void GraphicsLayerTextureMapper::setBackfaceVisibility(bool value)
     if (value == backfaceVisibility())
         return;
     GraphicsLayer::setBackfaceVisibility(value);
-    notifyChange(TextureMapperNode::BackfaceVisibilityChange);
+    notifyChange(TextureMapperLayer::BackfaceVisibilityChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -306,7 +285,7 @@ void GraphicsLayerTextureMapper::setOpacity(float value)
     if (value == opacity())
         return;
     GraphicsLayer::setOpacity(value);
-    notifyChange(TextureMapperNode::OpacityChange);
+    notifyChange(TextureMapperLayer::OpacityChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -316,46 +295,51 @@ void GraphicsLayerTextureMapper::setContentsRect(const IntRect& value)
     if (value == contentsRect())
         return;
     GraphicsLayer::setContentsRect(value);
-    notifyChange(TextureMapperNode::ContentsRectChange);
+    notifyChange(TextureMapperLayer::ContentsRectChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setContentsToImage(Image* image)
 {
-    notifyChange(TextureMapperNode::ContentChange);
-    m_pendingContent.contentType = image ? TextureMapperNode::DirectImageContentType : TextureMapperNode::HTMLContentType;
-    m_pendingContent.image = image;
+    if (image == m_image)
+        return;
+
+    m_image = image;
+    if (m_image) {
+        RefPtr<TextureMapperTiledBackingStore> backingStore = TextureMapperTiledBackingStore::create();
+        backingStore->setContentsToImage(image);
+        m_compositedImage = backingStore;
+    } else
+        m_compositedImage = 0;
+
+    setContentsToMedia(m_compositedImage.get());
+    notifyChange(TextureMapperLayer::ContentChange);
     GraphicsLayer::setContentsToImage(image);
 }
 
 void GraphicsLayerTextureMapper::setContentsToMedia(TextureMapperPlatformLayer* media)
 {
+    if (media == m_contentsLayer)
+        return;
+
     GraphicsLayer::setContentsToMedia(media);
-    notifyChange(TextureMapperNode::ContentChange);
-    m_pendingContent.contentType = media ? TextureMapperNode::MediaContentType : TextureMapperNode::HTMLContentType;
-    m_pendingContent.media = media;
+    notifyChange(TextureMapperLayer::ContentChange);
+    m_contentsLayer = media;
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::syncCompositingStateForThisLayerOnly()
 {
-    m_node->syncCompositingState(this);
+    m_layer->syncCompositingState(this);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::syncCompositingState(const FloatRect&)
 {
-    m_node->syncCompositingState(this, TextureMapperNode::TraverseDescendants);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-PlatformLayer* GraphicsLayerTextureMapper::platformLayer() const
-{
-    return const_cast<TextureMapperPlatformLayer*>(node()->media());
+    m_layer->syncCompositingState(this, TextureMapperLayer::TraverseDescendants);
 }
 
 bool GraphicsLayerTextureMapper::addAnimation(const KeyframeValueList& valueList, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double timeOffset)
@@ -372,7 +356,7 @@ bool GraphicsLayerTextureMapper::addAnimation(const KeyframeValueList& valueList
         listsMatch = validateTransformOperations(valueList, hasBigRotation) >= 0;
 
     m_animations.add(keyframesName, TextureMapperAnimation(valueList, boxSize, anim, timeOffset, listsMatch));
-    notifyChange(TextureMapperNode::AnimationChange);
+    notifyChange(TextureMapperLayer::AnimationChange);
     m_animationStartedTimer.startOneShot(0);
     return true;
 }
@@ -399,4 +383,12 @@ PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
     return adoptPtr(new GraphicsLayerTextureMapper(client));
 }
 
+#if ENABLE(CSS_FILTERS)
+bool GraphicsLayerTextureMapper::setFilters(const FilterOperations& filters)
+{
+    notifyChange(TextureMapperLayer::FilterChange);
+    return GraphicsLayer::setFilters(filters);
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index 172fdda24..07f378629 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -24,7 +24,7 @@
 #include "GraphicsLayer.h"
 #include "GraphicsLayerClient.h"
 #include "Image.h"
-#include "TextureMapperNode.h"
+#include "TextureMapperLayer.h"
 
 #if ENABLE(WEBGL)
 #include "GraphicsContext3D.h"
@@ -32,12 +32,12 @@
 
 namespace WebCore {
 
-class TextureMapperNode;
+class TextureMapperLayer;
 class BitmapTexture;
 class TextureMapper;
 
 class GraphicsLayerTextureMapper : public GraphicsLayer {
-    friend class TextureMapperNode;
+    friend class TextureMapperLayer;
 
 public:
     GraphicsLayerTextureMapper(GraphicsLayerClient*);
@@ -64,8 +64,6 @@ public:
     virtual void setPreserves3D(bool b);
     virtual void setMasksToBounds(bool b);
     virtual void setDrawsContent(bool b);
-    virtual void setBackgroundColor(const Color&);
-    virtual void clearBackgroundColor();
     virtual void setContentsOpaque(bool b);
     virtual void setBackfaceVisibility(bool b);
     virtual void setOpacity(float opacity);
@@ -77,10 +75,9 @@ public:
     virtual void syncCompositingState(const FloatRect&);
     virtual void syncCompositingStateForThisLayerOnly();
     virtual void setName(const String& name);
-    virtual PlatformLayer* platformLayer() const;
+    virtual PlatformLayer* platformLayer() const { return 0; }
 
-    void notifyChange(TextureMapperNode::ChangeMask changeMask);
-    inline TextureMapperNode::ContentData& pendingContent() { return m_pendingContent; }
+    void notifyChange(TextureMapperLayer::ChangeMask);
     inline int changeMask() const { return m_changeMask; }
     void didSynchronize();
 
@@ -88,13 +85,24 @@ public:
     virtual void pauseAnimation(const String&, double);
     virtual void removeAnimation(const String&);
 
-    TextureMapperNode* node() const { return m_node.get(); }
+    TextureMapperLayer* layer() const { return m_layer.get(); }
+    TextureMapperPlatformLayer* contentsLayer() const { return m_contentsLayer; }
+    bool needsDisplay() const { return m_needsDisplay; }
+    IntRect needsDisplayRect() const { return enclosingIntRect(m_needsDisplayRect); }
+
+#if ENABLE(CSS_FILTERS)
+    virtual bool setFilters(const FilterOperations&);
+#endif
 
 private:
-    OwnPtr<TextureMapperNode> m_node;
+    OwnPtr<TextureMapperLayer> m_layer;
+    RefPtr<TextureMapperBackingStore> m_compositedImage;
+    RefPtr<Image> m_image;
     bool m_syncQueued;
     int m_changeMask;
-    TextureMapperNode::ContentData m_pendingContent;
+    bool m_needsDisplay;
+    TextureMapperPlatformLayer* m_contentsLayer;
+    FloatRect m_needsDisplayRect;
     TextureMapperAnimations m_animations;
     void animationStartedTimerFired(Timer<GraphicsLayerTextureMapper>*);
     Timer<GraphicsLayerTextureMapper> m_animationStartedTimer;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
index 5e528d46b..58e4f594c 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
@@ -73,7 +73,6 @@ PassRefPtr<BitmapTexture> TextureMapper::acquireTextureFromPool(const IntSize& s
     return selectedTexture;
 }
 
-
 PassOwnPtr<TextureMapper> TextureMapper::create(AccelerationMode mode)
 {
     if (mode == SoftwareMode)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index f25ce0bc1..af2d59e7f 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -27,6 +27,7 @@
     #endif
 #endif
 
+#include "FilterOperations.h"
 #include "GraphicsContext.h"
 #include "IntRect.h"
 #include "IntSize.h"
@@ -47,8 +48,14 @@ class TextureMapper;
 class BitmapTexture  : public RefCounted<BitmapTexture> {
 public:
     enum PixelFormat { BGRAFormat, RGBAFormat, BGRFormat, RGBFormat };
+    enum Flag {
+        SupportsAlpha = 0x01
+    };
+
+    typedef unsigned Flags;
+
     BitmapTexture()
-        : m_isOpaque(true)
+        : m_flags(0)
     {
     }
 
@@ -59,21 +66,30 @@ public:
     virtual void updateContents(Image*, const IntRect&, const IntRect&, BitmapTexture::PixelFormat) = 0;
     virtual void updateContents(const void*, const IntRect&) = 0;
     virtual bool isValid() const = 0;
+    inline Flags flags() const { return m_flags; }
 
     virtual int bpp() const { return 32; }
-    virtual void reset(const IntSize& size, bool opaque = false)
+    virtual void didReset() { }
+    void reset(const IntSize& size, Flags flags)
     {
-        m_isOpaque = opaque;
+        m_flags = flags;
         m_contentSize = size;
+        didReset();
     }
 
     inline IntSize contentSize() const { return m_contentSize; }
     inline int numberOfBytes() const { return size().width() * size().height() * bpp() >> 3; }
-    inline bool isOpaque() const { return m_isOpaque; }
+    inline bool isOpaque() const { return !(m_flags & SupportsAlpha); }
+
+#if ENABLE(CSS_FILTERS)
+    virtual void applyFilters(const BitmapTexture& contentTexture, const FilterOperations&) { }
+#endif
 
 protected:
     IntSize m_contentSize;
-    bool m_isOpaque;
+
+private:
+    Flags m_flags;
 };
 
 // A "context" class used to encapsulate accelerated texture mapping functions: i.e. drawing a texture
@@ -106,6 +122,8 @@ public:
     virtual void beginPainting() { }
     virtual void endPainting() { }
 
+    virtual IntSize maxTextureSize() const { return IntSize(INT_MAX, INT_MAX); }
+
     // A surface is released implicitly when dereferenced.
     virtual PassRefPtr<BitmapTexture> acquireTextureFromPool(const IntSize&);
 
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
index 6be518a8b..37374928d 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
@@ -123,7 +123,7 @@ static TransformationMatrix applyTransformAnimation(const TransformOperations* f
 
     // Animation to "-webkit-transform: none".
     if (!to->size()) {
-        TransformOperations blended(*to);
+        TransformOperations blended(*from);
         for (size_t i = 0; i < blended.operations().size(); ++i)
             blended.operations()[i]->blend(0, progress, true)->apply(matrix, boxSize);
         return matrix;
@@ -131,7 +131,7 @@ static TransformationMatrix applyTransformAnimation(const TransformOperations* f
 
     // Animation from "-webkit-transform: none".
     if (!from->size()) {
-        TransformOperations blended(*from);
+        TransformOperations blended(*to);
         for (size_t i = 0; i < blended.operations().size(); ++i)
             blended.operations()[i]->blend(0, 1. - progress, true)->apply(matrix, boxSize);
         return matrix;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
new file mode 100644
index 000000000..6c3e2d8df
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
@@ -0,0 +1,155 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TextureMapperBackingStore.h"
+
+#include "GraphicsLayer.h"
+#include "ImageBuffer.h"
+#include "TextureMapper.h"
+
+namespace WebCore {
+
+void TextureMapperTile::updateContents(TextureMapper* textureMapper, Image* image, const IntRect& dirtyRect, BitmapTexture::PixelFormat format)
+{
+    IntRect targetRect = enclosingIntRect(m_rect);
+    targetRect.intersect(dirtyRect);
+    if (targetRect.isEmpty())
+        return;
+    IntRect sourceRect = targetRect;
+
+    // Normalize sourceRect to the buffer's coordinates.
+    sourceRect.move(-dirtyRect.x(), -dirtyRect.y());
+
+    // Normalize targetRect to the texture's coordinates.
+    targetRect.move(-m_rect.x(), -m_rect.y());
+    if (!m_texture) {
+        m_texture = textureMapper->createTexture();
+        m_texture->reset(targetRect.size(), image->currentFrameHasAlpha() ? BitmapTexture::SupportsAlpha : 0);
+    }
+
+    m_texture->updateContents(image, targetRect, sourceRect, format);
+}
+
+void TextureMapperTile::paint(TextureMapper* textureMapper, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+{
+    textureMapper->drawTexture(*texture().get(), rect(), transform, opacity, mask);
+}
+
+void TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded(TextureMapper* textureMapper)
+{
+    if (!m_image)
+        return;
+
+    updateContents(textureMapper, m_image.get(), m_image->currentFrameHasAlpha() ? BitmapTexture::BGRAFormat : BitmapTexture::BGRFormat);
+    m_image.clear();
+}
+
+void TextureMapperTiledBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+{
+    updateContentsFromImageIfNeeded(textureMapper);
+    TransformationMatrix adjustedTransform = transform;
+    adjustedTransform.multiply(TransformationMatrix::rectToRect(rect(), targetRect));
+    for (size_t i = 0; i < m_tiles.size(); ++i)
+        m_tiles[i].paint(textureMapper, adjustedTransform, opacity, mask);
+}
+
+void TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded(const FloatSize& size, const IntSize& tileSize, bool hasAlpha)
+{
+    if (size == m_size)
+        return;
+
+    m_size = size;
+
+    Vector<FloatRect> tileRectsToAdd;
+    Vector<int> tileIndicesToRemove;
+    static const size_t TileEraseThreshold = 6;
+
+    // This method recycles tiles. We check which tiles we need to add, which to remove, and use as many
+    // removable tiles as replacement for new tiles when possible.
+    for (float y = 0; y < m_size.height(); y += tileSize.height()) {
+        for (float x = 0; x < m_size.width(); x += tileSize.width()) {
+            FloatRect tileRect(x, y, tileSize.width(), tileSize.height());
+            tileRect.intersect(rect());
+            tileRectsToAdd.append(tileRect);
+        }
+    }
+
+    // Check which tiles need to be removed, and which already exist.
+    for (int i = m_tiles.size() - 1; i >= 0; --i) {
+        FloatRect oldTile = m_tiles[i].rect();
+        bool existsAlready = false;
+
+        for (int j = tileRectsToAdd.size() - 1; j >= 0; --j) {
+            FloatRect newTile = tileRectsToAdd[j];
+            if (oldTile != newTile)
+                continue;
+
+            // A tile that we want to add already exists, no need to add or remove it.
+            existsAlready = true;
+            tileRectsToAdd.remove(j);
+            break;
+        }
+
+        // This tile is not needed.
+        if (!existsAlready)
+            tileIndicesToRemove.append(i);
+    }
+
+    // Recycle removable tiles to be used for newly requested tiles.
+    for (size_t i = 0; i < tileRectsToAdd.size(); ++i) {
+        if (!tileIndicesToRemove.isEmpty()) {
+            // We recycle an existing tile for usage with a new tile rect.
+            TextureMapperTile& tile = m_tiles[tileIndicesToRemove.last()];
+            tileIndicesToRemove.removeLast();
+            tile.setRect(tileRectsToAdd[i]);
+
+            if (tile.texture())
+                tile.texture()->reset(enclosingIntRect(tile.rect()).size(), hasAlpha ? BitmapTexture::SupportsAlpha : 0);
+            continue;
+        }
+
+        m_tiles.append(TextureMapperTile(tileRectsToAdd[i]));
+    }
+
+    // Remove unnecessary tiles, if they weren't recycled.
+    // We use a threshold to make sure we don't create/destroy tiles too eagerly.
+    for (size_t i = 0; i < tileIndicesToRemove.size() && m_tiles.size() > TileEraseThreshold; ++i)
+        m_tiles.remove(tileIndicesToRemove[i]);
+}
+
+void TextureMapperTiledBackingStore::updateContents(TextureMapper* textureMapper, Image* image, const FloatSize& totalSize, const IntRect& dirtyRect, BitmapTexture::PixelFormat format)
+{
+    createOrDestroyTilesIfNeeded(totalSize, textureMapper->maxTextureSize(), image->currentFrameHasAlpha());
+    for (size_t i = 0; i < m_tiles.size(); ++i)
+        m_tiles[i].updateContents(textureMapper, image, dirtyRect, format);
+}
+
+PassRefPtr<BitmapTexture> TextureMapperTiledBackingStore::texture() const
+{
+    for (size_t i = 0; i < m_tiles.size(); ++i) {
+        RefPtr<BitmapTexture> texture = m_tiles[i].texture();
+        if (texture)
+            return texture;
+    }
+
+    return PassRefPtr<BitmapTexture>();
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
new file mode 100644
index 000000000..9f056e012
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
@@ -0,0 +1,84 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TextureMapperBackingStore_h
+#define TextureMapperBackingStore_h
+
+#include "FloatRect.h"
+#include "Image.h"
+#include "RefPtr.h"
+#include "TextureMapper.h"
+#include "TextureMapperPlatformLayer.h"
+
+namespace WebCore {
+
+class GraphicsLayer;
+
+class TextureMapperBackingStore : public TextureMapperPlatformLayer, public RefCounted<TextureMapperBackingStore> {
+public:
+    virtual PassRefPtr<BitmapTexture> texture() const = 0;
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix&, float, BitmapTexture*) = 0;
+    virtual ~TextureMapperBackingStore() { }
+};
+
+class TextureMapperTile {
+public:
+    inline PassRefPtr<BitmapTexture> texture() const { return m_texture; }
+    inline FloatRect rect() const { return m_rect; }
+    inline void setTexture(BitmapTexture* texture) { m_texture = texture; }
+    inline void setRect(const FloatRect& rect) { m_rect = rect; }
+
+    void updateContents(TextureMapper*, Image*, const IntRect&, BitmapTexture::PixelFormat);
+    virtual void paint(TextureMapper*, const TransformationMatrix&, float, BitmapTexture*);
+    virtual ~TextureMapperTile() { }
+
+    TextureMapperTile(const FloatRect& rect)
+        : m_rect(rect)
+    {
+    }
+
+private:
+    RefPtr<BitmapTexture> m_texture;
+    FloatRect m_rect;
+};
+
+class TextureMapperTiledBackingStore : public TextureMapperBackingStore {
+public:
+    void updateContentsFromLayer(TextureMapper*, GraphicsLayer*, const IntRect&);
+    virtual ~TextureMapperTiledBackingStore() { }
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix&, float, BitmapTexture*);
+    virtual PassRefPtr<BitmapTexture> texture() const;
+    void updateContents(TextureMapper*, Image*, const FloatSize&, const IntRect&, BitmapTexture::PixelFormat);
+    void updateContents(TextureMapper* textureMapper, Image* image, BitmapTexture::PixelFormat format) { updateContents(textureMapper, image, image->size(), image->rect(), format); }
+    inline FloatRect rect() const { return FloatRect(FloatPoint::zero(), m_size); }
+    static PassRefPtr<TextureMapperTiledBackingStore> create() { return adoptRef(new TextureMapperTiledBackingStore); }
+    void setContentsToImage(Image* image) { m_image = image; }
+    void updateContentsFromImageIfNeeded(TextureMapper*);
+
+private:
+    TextureMapperTiledBackingStore() { }
+    void createOrDestroyTilesIfNeeded(const FloatSize& backingStoreSize, const IntSize& tileSize, bool hasAlpha);
+
+    Vector<TextureMapperTile> m_tiles;
+    FloatSize m_size;
+    RefPtr<Image> m_image;
+};
+
+}
+#endif // TextureMapperBackingStore_h
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index 9e69ce698..746a1d89b 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -22,6 +22,7 @@
 
 #include "GraphicsContext.h"
 #include "Image.h"
+#include "TextureMapperShaderManager.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/OwnArrayPtr.h>
@@ -35,17 +36,6 @@
 #endif
 #endif
 
-#if PLATFORM(QT) || USE(CAIRO)
-#include <cairo/OpenGLShims.h>
-#elif defined(TEXMAP_OPENGL_ES_2)
-#include <GLES2/gl2.h>
-#include <GLES2/gl2ext.h>
-#elif OS(MAC_OS_X)
-#include <gl.h>
-#else
-#include <GL/gl.h>
-#endif
-
 #if defined(TEXMAP_OPENGL_ES_2)
 #include <EGL/egl.h>
 #elif OS(WINDOWS)
@@ -63,50 +53,6 @@
 #include <wtf/ByteArray.h>
 #endif
 
-#if !defined(TEXMAP_OPENGL_ES_2) && !PLATFORM(QT) && !PLATFORM(GTK)
-extern "C" {
-    void glUniform1f(GLint, GLfloat);
-    void glUniform1i(GLint, GLint);
-    void glVertexAttribPointer(GLuint, GLint, GLenum, GLboolean, GLsizei, const GLvoid*);
-    void glUniform4f(GLint, GLfloat, GLfloat, GLfloat, GLfloat);
-    void glShaderSource(GLuint, GLsizei, const char**, const GLint*);
-    GLuint glCreateShader(GLenum);
-    void glShaderSource(GLuint, GLsizei, const char**, const GLint*);
-    void glCompileShader(GLuint);
-    void glDeleteShader(GLuint);
-    void glUniformMatrix4fv(GLint, GLsizei, GLboolean, const GLfloat*);
-    GLuint glCreateProgram();
-    void glAttachShader(GLuint, GLuint);
-    void glLinkProgram(GLuint);
-    void glUseProgram(GLuint);
-    void glDisableVertexAttribArray(GLuint);
-    void glEnableVertexAttribArray(GLuint);
-    void glBindFramebuffer(GLenum target, GLuint framebuffer);
-    void glDeleteFramebuffers(GLsizei n, const GLuint* framebuffers);
-    void glGenFramebuffers(GLsizei n, GLuint* framebuffers);
-    void glFramebufferTexture2D(GLenum target, GLenum attachment, GLenum textarget, GLuint texture, GLint level);
-    void glGetFramebufferAttachmentParameteriv(GLenum target, GLenum attachment, GLenum pname, GLint* params);
-    void glBindBuffer(GLenum, GLuint);
-    void glDeleteBuffers(GLsizei, const GLuint*);
-    void glGenBuffers(GLsizei, GLuint*);
-    void glBufferData(GLenum, GLsizeiptr, const GLvoid*, GLenum);
-    void glBufferSubData(GLenum, GLsizeiptr, GLsizeiptr, const GLvoid*);
-    void glGetProgramInfoLog(GLuint, GLsizei, GLsizei*, GLchar*);
-    void glGetShaderInfoLog(GLuint, GLsizei, GLsizei*, GLchar*);
-    void glGenRenderbuffers(GLsizei n, GLuint* ids);
-    void glDeleteRenderbuffers(GLsizei n, const GLuint* ids);
-    void glBindRenderbuffer(GLenum target, GLuint id);
-    void glRenderbufferStorage(GLenum target, GLenum internalFormat, GLsizei width, GLsizei height);
-    void glFramebufferRenderbuffer(GLenum target, GLenum attachmentPoint, GLenum renderbufferTarget, GLuint renderbufferId);
-    GLenum glCheckFramebufferStatus(GLenum target);
-    GLint glGetAttribLocation(GLuint program, const GLchar* name);
-#if !OS(MAC_OS_X)
-    GLint glGetUniformLocation(GLuint, const GLchar*);
-    GLint glBindAttribLocation(GLuint, GLuint, const GLchar*);
-#endif
-}
-#endif
-
 namespace WebCore {
 
 inline static void debugGLCommand(const char* command, int line)
@@ -179,91 +125,65 @@ struct TextureMapperGLData {
             return adoptRef(new SharedGLData(getCurrentGLContext()));
         }
 
-        enum ShaderProgramIndex {
-            NoProgram = -1,
-            SimpleProgram,
-            OpacityAndMaskProgram,
-            ClipProgram,
-
-            ProgramCount
-        };
-
-        enum ShaderVariableIndex {
-            InMatrixVariable,
-            InSourceMatrixVariable,
-            InMaskMatrixVariable,
-            OpacityVariable,
-            SourceTextureVariable,
-            MaskTextureVariable,
-
-            VariableCount
+        struct ClipState {
+            IntRect scissorBox;
+            int stencilIndex;
+            ClipState(const IntRect& scissors, int stencil)
+                : scissorBox(scissors)
+                , stencilIndex(stencil)
+            { }
+
+            ClipState()
+                : stencilIndex(1)
+            { }
         };
 
-        struct ProgramInfo {
-            GLuint id;
-            GLuint vertexAttrib;
-            GLint vars[VariableCount];
-            GLuint vertexShader;
-            GLuint fragmentShader;
-            ProgramInfo() : id(0) { }
-        };
+        ClipState clipState;
+        Vector<ClipState> clipStack;
 
-        GLint getUniformLocation(ShaderProgramIndex prog, ShaderVariableIndex var, const char* name)
+        void pushClipState()
         {
-            return programs[prog].vars[var] = glGetUniformLocation(programs[prog].id, name);
+            clipStack.append(clipState);
         }
 
-        void createShaderProgram(const char* vertexShaderSource, const char* fragmentShaderSource, ShaderProgramIndex index)
+        void popClipState()
         {
-            GLuint vertexShader = glCreateShader(GL_VERTEX_SHADER);
-            GLuint fragmentShader = glCreateShader(GL_FRAGMENT_SHADER);
-            GL_CMD(glShaderSource(vertexShader, 1, &vertexShaderSource, 0))
-            GL_CMD(glShaderSource(fragmentShader, 1, &fragmentShaderSource, 0))
-            GLuint programID = glCreateProgram();
-            GL_CMD(glCompileShader(vertexShader))
-            GL_CMD(glCompileShader(fragmentShader))
-            GL_CMD(glAttachShader(programID, vertexShader))
-            GL_CMD(glAttachShader(programID, fragmentShader))
-            GL_CMD(glLinkProgram(programID))
-            programs[index].vertexAttrib = glGetAttribLocation(programID, "InVertex");
-            programs[index].id = programID;
-            programs[index].vertexShader = vertexShader;
-            programs[index].fragmentShader = fragmentShader;
+            if (clipStack.isEmpty())
+                return;
+            clipState = clipStack.last();
+            clipStack.removeLast();
         }
 
-        void deleteShaderProgram(ShaderProgramIndex index)
+        static void scissorClip(const IntRect& rect)
         {
-            ProgramInfo& programInfo = programs[index];
-            GLuint programID = programInfo.id;
-            if (!programID)
+            if (rect.isEmpty())
                 return;
 
-            GL_CMD(glDetachShader(programID, programInfo.vertexShader))
-            GL_CMD(glDeleteShader(programInfo.vertexShader))
-            GL_CMD(glDetachShader(programID, programInfo.fragmentShader))
-            GL_CMD(glDeleteShader(programInfo.fragmentShader))
-            GL_CMD(glDeleteProgram(programID))
+            GLint viewport[4];
+            GL_CMD(glGetIntegerv(GL_VIEWPORT, viewport))
+            GL_CMD(glScissor(rect.x(), viewport[3] - rect.maxY() + 1, rect.width() - 1, rect.height() - 1))
         }
 
-        void initializeShaders();
-
-        ProgramInfo programs[ProgramCount];
+        void applyCurrentClip()
+        {
+            scissorClip(clipState.scissorBox);
+            GL_CMD(glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP))
+            glStencilFunc(GL_EQUAL, clipState.stencilIndex - 1, clipState.stencilIndex - 1);
+            if (clipState.stencilIndex == 1)
+                glDisable(GL_STENCIL_TEST);
+            else
+                glEnable(GL_STENCIL_TEST);
+        }
 
-        int stencilIndex;
-        Vector<IntRect> clipStack;
+        TextureMapperShaderManager textureMapperShaderManager;
 
         SharedGLData(GLContext glContext)
-            : stencilIndex(1)
         {
             glContextDataMap().add(glContext, this);
-            initializeShaders();
         }
 
         ~SharedGLData()
         {
-            for (int i = SimpleProgram; i < ProgramCount; ++i)
-                deleteShaderProgram(ShaderProgramIndex(i));
-
             GLContextDataMap::const_iterator end = glContextDataMap().end();
             GLContextDataMap::iterator it;
             for (it = glContextDataMap().begin(); it != end; ++it) {
@@ -282,19 +202,25 @@ struct TextureMapperGLData {
         return *(m_sharedGLData.get());
     }
 
+    void initializeStencil();
+
     TextureMapperGLData()
-        : currentProgram(SharedGLData::NoProgram)
-        , previousProgram(0)
+        : previousProgram(0)
+        , didModifyStencil(false)
         , previousScissorState(0)
+        , previousDepthState(0)
         , m_sharedGLData(TextureMapperGLData::SharedGLData::currentSharedGLData())
     { }
 
     TransformationMatrix projectionMatrix;
-    int currentProgram;
     GLint previousProgram;
+    bool didModifyStencil;
     GLint previousScissorState;
+    GLint previousDepthState;
     GLint viewport[4];
+    GLint previousScissor[4];
     RefPtr<SharedGLData> m_sharedGLData;
+    RefPtr<BitmapTexture> currentSurface;
 };
 
 class BitmapTextureGL : public BitmapTexture {
@@ -302,8 +228,9 @@ public:
     virtual void destroy();
     virtual IntSize size() const;
     virtual bool isValid() const;
-    virtual void reset(const IntSize&, bool opaque);
+    virtual void didReset();
     void bind();
+    void initializeStencil();
     ~BitmapTextureGL() { destroy(); }
     virtual uint32_t id() const { return m_id; }
     inline FloatSize relativeSize() const { return m_relativeSize; }
@@ -318,7 +245,6 @@ private:
     IntRect m_dirtyRect;
     GLuint m_fbo;
     GLuint m_rbo;
-    IntSize m_actualSize;
     bool m_surfaceNeedsReset;
     TextureMapperGL* m_textureMapper;
     BitmapTextureGL()
@@ -333,12 +259,20 @@ private:
     friend class TextureMapperGL;
 };
 
-#define TEXMAP_GET_SHADER_VAR_LOCATION(prog, var) \
-    if (getUniformLocation(prog##Program, var##Variable, #var) < 0) \
-            LOG_ERROR("Couldn't find variable "#var" in program "#prog"\n");
+void TextureMapperGLData::initializeStencil()
+{
+    if (currentSurface) {
+        static_cast<BitmapTextureGL*>(currentSurface.get())->initializeStencil();
+        return;
+    }
+
+    if (didModifyStencil)
+        return;
 
-#define TEXMAP_BUILD_SHADER(program) \
-    createShaderProgram(vertexShaderSource##program, fragmentShaderSource##program, program##Program);
+    glClearStencil(0);
+    glClear(GL_STENCIL_BUFFER_BIT);
+    didModifyStencil = true;
+}
 
 TextureMapperGL::TextureMapperGL()
     : m_data(new TextureMapperGLData)
@@ -346,114 +280,6 @@ TextureMapperGL::TextureMapperGL()
 {
 }
 
-void TextureMapperGLData::SharedGLData::initializeShaders()
-{
-#ifndef TEXMAP_OPENGL_ES_2
-#define OES2_PRECISION_DEFINITIONS \
-    "#define lowp\n#define highp\n"
-#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION
-#else
-#define OES2_PRECISION_DEFINITIONS
-#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION \
-    "precision mediump float; \n"
-#endif
-
-#define VERTEX_SHADER(src...) OES2_PRECISION_DEFINITIONS#src
-#define FRAGMENT_SHADER(src...) OES2_PRECISION_DEFINITIONS\
-                                OES2_FRAGMENT_SHADER_DEFAULT_PRECISION\
-                                #src
-
-    if (!initializeOpenGLShims())
-        return;
-
-    const char* fragmentShaderSourceOpacityAndMask =
-        FRAGMENT_SHADER(
-            uniform sampler2D SourceTexture, MaskTexture;
-            uniform lowp float Opacity;
-            varying highp vec2 OutTexCoordSource, OutTexCoordMask;
-            void main(void)
-            {
-                lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
-                lowp vec4 maskColor = texture2D(MaskTexture, OutTexCoordMask);
-                lowp float fragmentAlpha = Opacity * maskColor.a;
-                gl_FragColor = vec4(color.rgb * fragmentAlpha, color.a * fragmentAlpha);
-            }
-        );
-
-    const char* vertexShaderSourceOpacityAndMask =
-        VERTEX_SHADER(
-            uniform mat4 InMatrix, InSourceMatrix, InMaskMatrix;
-            attribute vec4 InVertex;
-            varying highp vec2 OutTexCoordSource, OutTexCoordMask;
-            void main(void)
-            {
-                OutTexCoordSource = vec2(InSourceMatrix * InVertex);
-                OutTexCoordMask = vec2(InMaskMatrix * InVertex);
-                gl_Position = InMatrix * InVertex;
-            }
-        );
-
-    const char* fragmentShaderSourceSimple =
-        FRAGMENT_SHADER(
-            uniform sampler2D SourceTexture;
-            uniform lowp float Opacity;
-            varying highp vec2 OutTexCoordSource;
-            void main(void)
-            {
-                lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
-                gl_FragColor = vec4(color.rgb * Opacity, color.a * Opacity);
-            }
-        );
-
-    const char* vertexShaderSourceSimple =
-        VERTEX_SHADER(
-            uniform mat4 InMatrix, InSourceMatrix;
-            attribute vec4 InVertex;
-            varying highp vec2 OutTexCoordSource;
-            void main(void)
-            {
-                OutTexCoordSource = vec2(InSourceMatrix * InVertex);
-                gl_Position = InMatrix * InVertex;
-            }
-        );
-    const char* fragmentShaderSourceClip =
-        FRAGMENT_SHADER(
-            void main(void)
-            {
-                gl_FragColor = vec4(0.0, 0.0, 0.0, 0.0);
-            }
-        );
-
-    const char* vertexShaderSourceClip =
-        VERTEX_SHADER(
-            uniform mat4 InMatrix;
-            attribute vec4 InVertex;
-            void main(void)
-            {
-                gl_Position = InMatrix * InVertex;
-            }
-        );
-
-
-    TEXMAP_BUILD_SHADER(Simple)
-    TEXMAP_BUILD_SHADER(OpacityAndMask)
-    TEXMAP_BUILD_SHADER(Clip)
-
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, InMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, InSourceMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, InMaskMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, SourceTexture)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, MaskTexture)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, Opacity)
-
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, InSourceMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, InMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, SourceTexture)
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, Opacity)
-
-    TEXMAP_GET_SHADER_VAR_LOCATION(Clip, InMatrix)
-}
-
 void TextureMapperGL::beginPainting()
 {
     // Make sure that no GL error code stays from previous operations.
@@ -464,7 +290,8 @@ void TextureMapperGL::beginPainting()
 
     glGetIntegerv(GL_CURRENT_PROGRAM, &data().previousProgram);
     data().previousScissorState = glIsEnabled(GL_SCISSOR_TEST);
-
+    data().previousDepthState = glIsEnabled(GL_DEPTH_TEST);
+    glDisable(GL_DEPTH_TEST);
     glEnable(GL_SCISSOR_TEST);
 #if PLATFORM(QT)
     if (m_context) {
@@ -473,23 +300,36 @@ void TextureMapperGL::beginPainting()
         painter->beginNativePainting();
     }
 #endif
-    glClearStencil(0);
-    glClear(GL_STENCIL_BUFFER_BIT);
+    data().didModifyStencil = false;
+    glDepthMask(0);
     glGetIntegerv(GL_VIEWPORT, data().viewport);
+    glGetIntegerv(GL_SCISSOR_BOX, data().previousScissor);
+    data().sharedGLData().clipState.stencilIndex = 1;
+    data().sharedGLData().clipState.scissorBox = IntRect(0, 0, data().viewport[2], data().viewport[3]);
     bindSurface(0);
 }
 
 void TextureMapperGL::endPainting()
 {
-    glClearStencil(1);
-    glClear(GL_STENCIL_BUFFER_BIT);
+    if (data().didModifyStencil) {
+        glClearStencil(1);
+        glClear(GL_STENCIL_BUFFER_BIT);
+    }
+
     glUseProgram(data().previousProgram);
 
+    glScissor(data().previousScissor[0], data().previousScissor[1], data().previousScissor[2], data().previousScissor[3]);
     if (data().previousScissorState)
         glEnable(GL_SCISSOR_TEST);
     else
         glDisable(GL_SCISSOR_TEST);
 
+    if (data().previousDepthState)
+        glEnable(GL_DEPTH_TEST);
+    else
+        glDisable(GL_DEPTH_TEST);
+
+
 #if PLATFORM(QT)
     if (!m_context)
         return;
@@ -504,27 +344,33 @@ void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect&
 {
     if (!texture.isValid())
         return;
+
+    if (data().sharedGLData().clipState.scissorBox.isEmpty())
+        return;
+
     const BitmapTextureGL& textureGL = static_cast<const BitmapTextureGL&>(texture);
-    drawTexture(textureGL.id(), textureGL.isOpaque(), textureGL.relativeSize(), targetRect, matrix, opacity, mask, false);
+    drawTexture(textureGL.id(), textureGL.isOpaque() ? 0 : SupportsBlending, textureGL.relativeSize(), targetRect, matrix, opacity, mask);
 }
 
-void TextureMapperGL::drawTexture(uint32_t texture, bool opaque, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture, bool flip)
+void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
 {
-    TextureMapperGLData::SharedGLData::ShaderProgramIndex program;
     if (maskTexture)
-        program = TextureMapperGLData::SharedGLData::OpacityAndMaskProgram;
+        drawTextureWithMaskAndOpacity(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
     else
-        program = TextureMapperGLData::SharedGLData::SimpleProgram;
+        drawTextureSimple(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
+}
+
+void TextureMapperGL::drawTextureWithMaskAndOpacity(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
+{
+    RefPtr<TextureMapperShaderProgramOpacityAndMask> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramOpacityAndMask>();
 
-    const TextureMapperGLData::SharedGLData::ProgramInfo& programInfo = data().sharedGLData().programs[program];
-    GL_CMD(glUseProgram(programInfo.id))
-    data().currentProgram = program;
-    GL_CMD(glEnableVertexAttribArray(programInfo.vertexAttrib))
+    GL_CMD(glUseProgram(shaderInfo->id()))
+    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
     GL_CMD(glActiveTexture(GL_TEXTURE0))
     GL_CMD(glBindTexture(GL_TEXTURE_2D, texture))
     GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
     const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(programInfo.vertexAttrib, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
 
     TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
             targetRect.width(), 0, 0, 0,
@@ -539,16 +385,16 @@ void TextureMapperGL::drawTexture(uint32_t texture, bool opaque, const FloatSize
         matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
     };
     const GLfloat m4src[] = {relativeSize.width(), 0, 0, 0,
-                                     0, relativeSize.height() * (flip ? -1 : 1), 0, 0,
+                                     0, relativeSize.height() * ((flags & ShouldFlipTexture) ? -1 : 1), 0, 0,
                                      0, 0, 1, 0,
-                                     0, flip ? relativeSize.height() : 0, 0, 1};
+                                     0, (flags & ShouldFlipTexture) ? relativeSize.height() : 0, 0, 1};
 
-    GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InMatrixVariable], 1, GL_FALSE, m4))
-    GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InSourceMatrixVariable], 1, GL_FALSE, m4src))
-    GL_CMD(glUniform1i(programInfo.vars[TextureMapperGLData::SharedGLData::SourceTextureVariable], 0))
-    GL_CMD(glUniform1f(programInfo.vars[TextureMapperGLData::SharedGLData::OpacityVariable], opacity))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
+    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
+    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
 
-    if (maskTexture && maskTexture->isValid()) {
+    if (maskTexture->isValid()) {
         const BitmapTextureGL* maskTextureGL = static_cast<const BitmapTextureGL*>(maskTexture);
         GL_CMD(glActiveTexture(GL_TEXTURE1))
         GL_CMD(glBindTexture(GL_TEXTURE_2D, maskTextureGL->id()))
@@ -556,22 +402,62 @@ void TextureMapperGL::drawTexture(uint32_t texture, bool opaque, const FloatSize
                                          0, maskTextureGL->relativeSize().height(), 0, 0,
                                          0, 0, 1, 0,
                                          0, 0, 0, 1};
-        GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InMaskMatrixVariable], 1, GL_FALSE, m4mask));
-        GL_CMD(glUniform1i(programInfo.vars[TextureMapperGLData::SharedGLData::MaskTextureVariable], 1))
+        GL_CMD(glUniformMatrix4fv(shaderInfo->maskMatrixVariable(), 1, GL_FALSE, m4mask));
+        GL_CMD(glUniform1i(shaderInfo->maskTextureVariable(), 1))
         GL_CMD(glActiveTexture(GL_TEXTURE0))
     }
 
-    if (opaque && opacity > 0.99 && !maskTexture)
-        GL_CMD(glDisable(GL_BLEND))
-    else {
+    GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
+    GL_CMD(glEnable(GL_BLEND))
+
+    GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
+    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
+}
+
+void TextureMapperGL::drawTextureSimple(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture*)
+{
+    RefPtr<TextureMapperShaderProgramSimple> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
+
+    GL_CMD(glUseProgram(shaderInfo->id()))
+    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
+    GL_CMD(glActiveTexture(GL_TEXTURE0))
+    GL_CMD(glBindTexture(GL_TEXTURE_2D, texture))
+    GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
+    const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
+    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+
+    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
+            targetRect.width(), 0, 0, 0,
+            0, targetRect.height(), 0, 0,
+            0, 0, 1, 0,
+            targetRect.x(), targetRect.y(), 0, 1));
+
+    const GLfloat m4[] = {
+        matrix.m11(), matrix.m12(), matrix.m13(), matrix.m14(),
+        matrix.m21(), matrix.m22(), matrix.m23(), matrix.m24(),
+        matrix.m31(), matrix.m32(), matrix.m33(), matrix.m34(),
+        matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
+    };
+    const GLfloat m4src[] = {relativeSize.width(), 0, 0, 0,
+                                     0, relativeSize.height() * ((flags & ShouldFlipTexture) ? -1 : 1), 0, 0,
+                                     0, 0, 1, 0,
+                                     0, (flags & ShouldFlipTexture) ? relativeSize.height() : 0, 0, 1};
+
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
+    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
+    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
+
+    bool needsBlending = (flags & SupportsBlending) || opacity < 0.99;
+
+    if (needsBlending) {
         GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
         GL_CMD(glEnable(GL_BLEND))
-    }
-
-    GL_CMD(glDisable(GL_DEPTH_TEST))
+    } else
+        GL_CMD(glDisable(GL_BLEND))
 
     GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
-    GL_CMD(glDisableVertexAttribArray(programInfo.vertexAttrib))
+    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
 }
 
 const char* TextureMapperGL::type() const
@@ -579,23 +465,9 @@ const char* TextureMapperGL::type() const
     return "OpenGL";
 }
 
-// This function is similar with GraphicsContext3D::texImage2DResourceSafe.
-static void texImage2DResourceSafe(size_t width, size_t height)
+void BitmapTextureGL::didReset()
 {
-    const int pixelSize = 4; // RGBA
-    OwnArrayPtr<unsigned char> zero;
-    if (width && height) {
-        unsigned int size = width * height * pixelSize;
-        zero = adoptArrayPtr(new unsigned char[size]);
-        memset(zero.get(), 0, size);
-    }
-    GL_CMD(glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, width, height, 0, GL_RGBA, GL_UNSIGNED_BYTE, zero.get()))
-}
-
-void BitmapTextureGL::reset(const IntSize& newSize, bool opaque)
-{
-    BitmapTexture::reset(newSize, opaque);
-    IntSize newTextureSize = nextPowerOfTwo(newSize);
+    IntSize newTextureSize = nextPowerOfTwo(contentSize());
     bool justCreated = false;
     if (!m_id) {
         GL_CMD(glGenTextures(1, &m_id))
@@ -609,14 +481,14 @@ void BitmapTextureGL::reset(const IntSize& newSize, bool opaque)
         GL_CMD(glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR))
         GL_CMD(glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE))
         GL_CMD(glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE))
-        texImage2DResourceSafe(m_textureSize.width(), m_textureSize.height());
+        GL_CMD(glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, m_textureSize.width(), m_textureSize.height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, 0))
     }
-    m_actualSize = newSize;
-    m_relativeSize = FloatSize(float(newSize.width()) / m_textureSize.width(), float(newSize.height()) / m_textureSize.height());
+
+    // We decrease the size by one, since this is used as rectangle coordinates and not as size.
+    m_relativeSize = FloatSize(float(contentSize().width() - 1) / m_textureSize.width(), float(contentSize().height() - 1) / m_textureSize.height());
     m_surfaceNeedsReset = true;
 }
 
-#if PLATFORM(QT) || (USE(CAIRO) && defined(TEXMAP_OPENGL_ES_2))
 static void swizzleBGRAToRGBA(uint32_t* data, const IntSize& size)
 {
     int width = size.width();
@@ -627,12 +499,38 @@ static void swizzleBGRAToRGBA(uint32_t* data, const IntSize& size)
             p[x] = ((p[x] << 16) & 0xff0000) | ((p[x] >> 16) & 0xff) | (p[x] & 0xff00ff00);
     }
 }
+
+// FIXME: Move this to Extensions3D when we move TextureMapper to use GC3D.
+static bool hasExtension(const char* extension)
+{
+    static Vector<String> availableExtensions;
+    if (!availableExtensions.isEmpty())
+        return availableExtensions.contains(extension);
+    String extensionsString(reinterpret_cast<const char*>(glGetString(GL_EXTENSIONS)));
+    extensionsString.split(" ", availableExtensions);
+    return availableExtensions.contains(extension);
+}
+static bool hasBGRAExtension()
+{
+#if !defined(TEXMAP_OPENGL_ES_2)
+    return true;
 #endif
+    static bool hasBGRA = hasExtension("GL_EXT_texture_format_BGRA8888");
+    return hasBGRA;
+}
 
 void BitmapTextureGL::updateContents(const void* data, const IntRect& targetRect)
 {
+    GLuint glFormat = GL_RGBA;
     GL_CMD(glBindTexture(GL_TEXTURE_2D, m_id))
-    GL_CMD(glTexSubImage2D(GL_TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), GL_RGBA, GL_UNSIGNED_BYTE, data))
+    if (hasBGRAExtension())
+        glFormat = GL_BGRA;
+    else {
+        swizzleBGRAToRGBA(static_cast<uint32_t*>(const_cast<void*>(data)), targetRect.size());
+        glFormat = GL_RGBA;
+    }
+
+    GL_CMD(glTexSubImage2D(GL_TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), glFormat, GL_UNSIGNED_BYTE, data))
 }
 
 void BitmapTextureGL::updateContents(Image* image, const IntRect& targetRect, const IntRect& sourceRect, BitmapTexture::PixelFormat format)
@@ -658,8 +556,12 @@ void BitmapTextureGL::updateContents(Image* image, const IntRect& targetRect, co
 
     if (IntSize(qtImage.size()) != sourceRect.size())
         qtImage = qtImage.copy(sourceRect);
-    if (format == BGRAFormat || format == BGRFormat)
-        swizzleBGRAToRGBA(reinterpret_cast<uint32_t*>(qtImage.bits()), qtImage.size());
+    if (format == BGRAFormat || format == BGRFormat) {
+        if (hasBGRAExtension())
+            glFormat = isOpaque() ? GL_BGR : GL_BGRA;
+        else
+            swizzleBGRAToRGBA(reinterpret_cast<uint32_t*>(qtImage.bits()), qtImage.size());
+    }
     GL_CMD(glTexSubImage2D(GL_TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), glFormat, GL_UNSIGNED_BYTE, qtImage.constBits()))
 
 #elif USE(CAIRO)
@@ -698,39 +600,40 @@ static inline TransformationMatrix createProjectionMatrix(const IntSize& size, b
                                 -1, flip ? 1 : -1, -(far + near) / (far - near), 1);
 }
 
+void BitmapTextureGL::initializeStencil()
+{
+    if (m_rbo)
+        return;
+    GL_CMD(glGenRenderbuffers(1, &m_rbo));
+    GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, m_rbo))
+#ifdef TEXMAP_OPENGL_ES_2
+    GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_STENCIL_INDEX8, m_textureSize.width(), m_textureSize.height()))
+#else
+    GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH_STENCIL, m_textureSize.width(), m_textureSize.height()))
+#endif
+    GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, 0))
+    GL_CMD(glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER, m_rbo))
+    GL_CMD(glClearStencil(0))
+    GL_CMD(glClear(GL_STENCIL_BUFFER_BIT))
+}
+
 void BitmapTextureGL::bind()
 {
-    int& stencilIndex = m_textureMapper->data().sharedGLData().stencilIndex;
     if (m_surfaceNeedsReset || !m_fbo) {
         if (!m_fbo)
             GL_CMD(glGenFramebuffers(1, &m_fbo))
-        if (!m_rbo)
-            GL_CMD(glGenRenderbuffers(1, &m_rbo));
-        GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, m_rbo))
-#ifdef TEXMAP_OPENGL_ES_2
-        GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_STENCIL_INDEX8, m_textureSize.width(), m_textureSize.height()))
-#else
-        GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH_STENCIL, m_textureSize.width(), m_textureSize.height()))
-#endif
         GL_CMD(glBindFramebuffer(GL_FRAMEBUFFER, m_fbo))
         GL_CMD(glBindTexture(GL_TEXTURE_2D, 0))
-        GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, 0))
         GL_CMD(glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, id(), 0))
-        GL_CMD(glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER, m_rbo))
-#ifndef TEXMAP_OPENGL_ES_2
-        GL_CMD(glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, GL_RENDERBUFFER, m_rbo));
-#endif
         GL_CMD(glClearColor(0, 0, 0, 0))
-        GL_CMD(glClearStencil(stencilIndex - 1))
-        GL_CMD(glClear(GL_STENCIL_BUFFER_BIT | GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT))
+        GL_CMD(glClear(GL_COLOR_BUFFER_BIT))
         m_surfaceNeedsReset = false;
     } else
         GL_CMD(glBindFramebuffer(GL_FRAMEBUFFER, m_fbo))
 
-    glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP);
-    glStencilFunc(stencilIndex > 1 ? GL_GEQUAL : GL_ALWAYS, stencilIndex - 1, stencilIndex - 1);
     GL_CMD(glViewport(0, 0, size().width(), size().height()))
     m_textureMapper->data().projectionMatrix = createProjectionMatrix(size(), false);
+    m_textureMapper->beginClip(TransformationMatrix(), FloatRect(IntPoint::zero(), contentSize()));
 }
 
 void BitmapTextureGL::destroy()
@@ -745,6 +648,7 @@ void BitmapTextureGL::destroy()
         GL_CMD(glDeleteRenderbuffers(1, &m_rbo))
 
     m_fbo = 0;
+    m_rbo = 0;
     m_id = 0;
     m_textureSize = IntSize();
     m_relativeSize = FloatSize(1, 1);
@@ -773,21 +677,16 @@ void TextureMapperGL::bindSurface(BitmapTexture *surfacePointer)
         IntSize viewportSize(data().viewport[2], data().viewport[3]);
         GL_CMD(glBindFramebuffer(GL_FRAMEBUFFER, 0))
         data().projectionMatrix = createProjectionMatrix(viewportSize, true);
-        GL_CMD(glStencilFunc(data().sharedGLData().stencilIndex > 1 ? GL_EQUAL : GL_ALWAYS, data().sharedGLData().stencilIndex - 1, data().sharedGLData().stencilIndex - 1))
-        GL_CMD(glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP))
         GL_CMD(glViewport(0, 0, viewportSize.width(), viewportSize.height()))
-        data().sharedGLData().clipStack.append(IntRect(data().viewport[0], data().viewport[1], data().viewport[2], data().viewport[3]));
+        if (data().currentSurface)
+            endClip();
+        data().currentSurface.clear();
         return;
     }
 
-    surface->bind();
-}
 
-static void scissorClip(const IntRect& rect)
-{
-    GLint viewport[4];
-    glGetIntegerv(GL_VIEWPORT, viewport);
-    glScissor(rect.x(), viewport[3] - rect.maxY(), rect.width(), rect.height());
+    surface->bind();
+    data().currentSurface = surface;
 }
 
 bool TextureMapperGL::beginScissorClip(const TransformationMatrix& modelViewMatrix, const FloatRect& targetRect)
@@ -796,44 +695,28 @@ bool TextureMapperGL::beginScissorClip(const TransformationMatrix& modelViewMatr
     IntRect rect = quad.enclosingBoundingBox();
 
     // Only use scissors on rectilinear clips.
-    if (!quad.isRectilinear() || rect.isEmpty()) {
-        data().sharedGLData().clipStack.append(IntRect());
+    if (!quad.isRectilinear() || rect.isEmpty())
         return false;
-    }
-
-    // Intersect with previous clip.
-    if (!data().sharedGLData().clipStack.isEmpty())
-        rect.intersect(data().sharedGLData().clipStack.last());
-
-    scissorClip(rect);
-    data().sharedGLData().clipStack.append(rect);
 
-    return true;
-}
-
-bool TextureMapperGL::endScissorClip()
-{
-    data().sharedGLData().clipStack.removeLast();
-    ASSERT(!data().sharedGLData().clipStack.isEmpty());
-
-    IntRect rect = data().sharedGLData().clipStack.last();
-    if (rect.isEmpty())
-        return false;
-
-    scissorClip(rect);
+    data().sharedGLData().clipState.scissorBox.intersect(rect);
+    data().sharedGLData().applyCurrentClip();
     return true;
 }
 
 void TextureMapperGL::beginClip(const TransformationMatrix& modelViewMatrix, const FloatRect& targetRect)
 {
+    data().sharedGLData().pushClipState();
     if (beginScissorClip(modelViewMatrix, targetRect))
         return;
-    TextureMapperGLData::SharedGLData::ShaderProgramIndex program = TextureMapperGLData::SharedGLData::ClipProgram;
-    const TextureMapperGLData::SharedGLData::ProgramInfo& programInfo = data().sharedGLData().programs[program];
-    GL_CMD(glUseProgram(programInfo.id))
-    GL_CMD(glEnableVertexAttribArray(programInfo.vertexAttrib))
+
+    data().initializeStencil();
+
+    RefPtr<TextureMapperShaderProgramSimple> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
+
+    GL_CMD(glUseProgram(shaderInfo->id()))
+    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
     const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(programInfo.vertexAttrib, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
 
     TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix)
             .multiply(modelViewMatrix)
@@ -849,32 +732,46 @@ void TextureMapperGL::beginClip(const TransformationMatrix& modelViewMatrix, con
         matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
     };
 
-    int& stencilIndex = data().sharedGLData().stencilIndex;
+    const GLfloat m4all[] = {
+        2, 0, 0, 0,
+        0, 2, 0, 0,
+        0, 0, 1, 0,
+        -1, -1, 0, 1
+    };
+
+    int& stencilIndex = data().sharedGLData().clipState.stencilIndex;
 
-    GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InMatrixVariable], 1, GL_FALSE, m4))
     GL_CMD(glEnable(GL_STENCIL_TEST))
+
+    // Make sure we don't do any actual drawing.
     GL_CMD(glStencilFunc(GL_NEVER, stencilIndex, stencilIndex))
-    GL_CMD(glStencilOp(GL_REPLACE, GL_REPLACE, GL_REPLACE))
+
+    // Operate only on the stencilIndex and above.
     GL_CMD(glStencilMask(0xff & ~(stencilIndex - 1)))
+
+    // First clear the entire buffer at the current index.
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4all))
+    GL_CMD(glStencilOp(GL_ZERO, GL_ZERO, GL_ZERO))
     GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
-    GL_CMD(glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP))
-    stencilIndex <<= 1;
-    glStencilFunc(stencilIndex > 1 ? GL_EQUAL : GL_ALWAYS, stencilIndex - 1, stencilIndex - 1);
-    GL_CMD(glDisableVertexAttribArray(programInfo.vertexAttrib))
-}
 
-void TextureMapperGL::endClip()
-{
-    if (endScissorClip())
-        return;
+    // Now apply the current index to the new quad.
+    GL_CMD(glStencilOp(GL_REPLACE, GL_REPLACE, GL_REPLACE))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
+    GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
 
-    data().sharedGLData().stencilIndex >>= 1;
-    glStencilFunc(data().sharedGLData().stencilIndex > 1 ? GL_EQUAL : GL_ALWAYS, data().sharedGLData().stencilIndex - 1, data().sharedGLData().stencilIndex - 1);    
+    // Clear the state.
+    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
+    GL_CMD(glStencilMask(0))
 
-    // After we've cleared the last non-rectalinear clip, we disable the stencil test.
-    if (data().sharedGLData().stencilIndex == 1)
-        GL_CMD(glDisable(GL_STENCIL_TEST))
+    // Increase stencilIndex and apply stencil testing.
+    stencilIndex *= 2;
+    data().sharedGLData().applyCurrentClip();
+}
 
+void TextureMapperGL::endClip()
+{
+    data().sharedGLData().popClipState();
+    data().sharedGLData().applyCurrentClip();
 }
 
 PassRefPtr<BitmapTexture> TextureMapperGL::createTexture()
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
index 08fa0adef..3e598904b 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
@@ -38,14 +38,24 @@ public:
     TextureMapperGL();
     virtual ~TextureMapperGL();
 
+    enum Flag {
+        SupportsBlending = 0x01,
+        ShouldFlipTexture = 0x02
+    };
+
+    typedef int Flags;
+
     // reimps from TextureMapper
     virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
-    virtual void drawTexture(uint32_t texture, bool opaque, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture, bool flip);
+    virtual void drawTexture(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
+    virtual void drawTextureWithMaskAndOpacity(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
+    virtual void drawTextureSimple(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
     virtual void bindSurface(BitmapTexture* surface);
     virtual void beginClip(const TransformationMatrix&, const FloatRect&);
     virtual void beginPainting();
     virtual void endPainting();
     virtual void endClip();
+    virtual IntSize maxTextureSize() { return IntSize(2000, 2000); }
     virtual PassRefPtr<BitmapTexture> createTexture();
     virtual const char* type() const;
     static PassOwnPtr<TextureMapperGL> create() { return adoptPtr(new TextureMapperGL); }
@@ -57,7 +67,6 @@ public:
 
 private:
     bool beginScissorClip(const TransformationMatrix&, const FloatRect&);
-    bool endScissorClip();
     inline TextureMapperGLData& data() { return *m_data; }
     TextureMapperGLData* m_data;
     GraphicsContext* m_context;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
index 783b03bf7..e53b9f8d6 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
@@ -20,6 +20,8 @@
 #include "config.h"
 #include "TextureMapperImageBuffer.h"
 
+#include "FilterEffectRenderer.h"
+
 #if USE(TEXTURE_MAPPER)
 namespace WebCore {
 
@@ -35,6 +37,11 @@ void BitmapTextureImageBuffer::updateContents(const void* data, const IntRect& t
 #endif
 }
 
+void BitmapTextureImageBuffer::didReset()
+{
+    m_image = ImageBuffer::create(contentSize());
+}
+
 void BitmapTextureImageBuffer::updateContents(Image* image, const IntRect& targetRect, const IntRect& sourceRect, PixelFormat)
 {
     m_image->context()->drawImage(image, ColorSpaceDeviceRGB, targetRect, sourceRect, CompositeCopy);
@@ -101,5 +108,21 @@ void TextureMapperImageBuffer::drawTexture(const BitmapTexture& texture, const F
     context->restore();
 }
 
+#if ENABLE(CSS_FILTERS)
+void BitmapTextureImageBuffer::applyFilters(const BitmapTexture& contentTexture, const FilterOperations& filters)
+{
+    RefPtr<FilterEffectRenderer> renderer = FilterEffectRenderer::create(0);
+    renderer->setSourceImageRect(FloatRect(FloatPoint::zero(), contentTexture.size()));
+
+    // The document parameter is only needed for CSS shaders.
+    renderer->build(0 /*document */, filters);
+    renderer->prepare();
+    GraphicsContext* context = renderer->inputContext();
+    context->drawImageBuffer(static_cast<const BitmapTextureImageBuffer&>(contentTexture).m_image.get(), ColorSpaceDeviceRGB, IntPoint::zero());
+    renderer->apply();
+    m_image->context()->drawImageBuffer(renderer->output(), ColorSpaceDeviceRGB, renderer->outputRect());
+}
+#endif
+
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
index 8411206cf..0b363a33a 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
@@ -33,16 +33,15 @@ public:
     ~BitmapTextureImageBuffer() { destroy(); }
     virtual void destroy() { m_image.clear(); }
     virtual IntSize size() const { return m_image->size(); }
-    virtual void reset(const IntSize& size, bool opaque)
-    {
-        BitmapTexture::reset(size, opaque);
-        m_image = ImageBuffer::create(size);
-    }
-
+    virtual void didReset();
     virtual bool isValid() const { return m_image; }
     inline GraphicsContext* graphicsContext() { return m_image ? m_image->context() : 0; }
     virtual void updateContents(Image*, const IntRect&, const IntRect&, PixelFormat);
     void updateContents(const void* data, const IntRect& targetRect);
+#if ENABLE(CSS_FILTERS)
+    void applyFilters(const BitmapTexture&, const FilterOperations&);
+#endif
+
 private:
     BitmapTextureImageBuffer() { }
     OwnPtr<ImageBuffer> m_image;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
new file mode 100644
index 000000000..da0b40e36
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
@@ -0,0 +1,514 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TextureMapperLayer.h"
+
+#include "stdio.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerTextureMapper.h"
+#include "ImageBuffer.h"
+#include "MathExtras.h"
+
+namespace WebCore {
+
+TextureMapperLayer* toTextureMapperLayer(GraphicsLayer* layer)
+{
+    return layer ? toGraphicsLayerTextureMapper(layer)->layer() : 0;
+}
+
+TextureMapperLayer* TextureMapperLayer::rootLayer()
+{
+    if (m_effectTarget)
+        return m_effectTarget->rootLayer();
+    if (m_parent)
+        return m_parent->rootLayer();
+    return this;
+}
+
+void TextureMapperLayer::setTransform(const TransformationMatrix& matrix)
+{
+    m_transform.setLocalTransform(matrix);
+}
+
+void TextureMapperLayer::clearBackingStoresRecursive()
+{
+    m_backingStore.clear();
+    m_contentsLayer = 0;
+    for (size_t i = 0; i < m_children.size(); ++i)
+        m_children[i]->clearBackingStoresRecursive();
+    if (m_state.maskLayer)
+        m_state.maskLayer->clearBackingStoresRecursive();
+}
+
+void TextureMapperLayer::computeTransformsRecursive()
+{
+    if (m_size.isEmpty() && m_state.masksToBounds)
+        return;
+
+    // Compute transforms recursively on the way down to leafs.
+    TransformationMatrix parentTransform;
+    if (m_parent)
+        parentTransform = m_parent->m_transform.combinedForChildren();
+    else if (m_effectTarget)
+        parentTransform = m_effectTarget->m_transform.combined();
+    m_transform.combineTransforms(parentTransform);
+
+    m_state.visible = m_state.backfaceVisibility || m_transform.combined().inverse().m33() >= 0;
+
+    if (m_parent && m_parent->m_state.preserves3D)
+        m_centerZ = m_transform.combined().mapPoint(FloatPoint3D(m_size.width() / 2, m_size.height() / 2, 0)).z();
+
+    if (m_state.maskLayer)
+        m_state.maskLayer->computeTransformsRecursive();
+    if (m_state.replicaLayer)
+        m_state.replicaLayer->computeTransformsRecursive();
+    for (size_t i = 0; i < m_children.size(); ++i)
+        m_children[i]->computeTransformsRecursive();
+
+    // Reorder children if needed on the way back up.
+    if (m_state.preserves3D)
+        sortByZOrder(m_children, 0, m_children.size());
+}
+
+void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, GraphicsLayer* layer)
+{
+    if (!layer || !textureMapper)
+        return;
+
+    if (!m_shouldUpdateBackingStoreFromLayer)
+        return;
+
+    if (!m_state.drawsContent || m_size.isEmpty()) {
+        m_backingStore.clear();
+        return;
+    }
+
+    IntRect dirtyRect = enclosingIntRect(m_state.needsDisplay ? layerRect() : m_state.needsDisplayRect);
+    if (dirtyRect.isEmpty())
+        return;
+
+    if (!m_backingStore)
+        m_backingStore = TextureMapperTiledBackingStore::create();
+
+#if PLATFORM(QT)
+    ASSERT(dynamic_cast<TextureMapperTiledBackingStore*>(m_backingStore.get()));
+#endif
+
+    // Paint the entire dirty rect into an image buffer. This ensures we only paint once.
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(dirtyRect.size());
+    GraphicsContext* context = imageBuffer->context();
+    context->setImageInterpolationQuality(textureMapper->imageInterpolationQuality());
+    context->setTextDrawingMode(textureMapper->textDrawingMode());
+    context->translate(-dirtyRect.x(), -dirtyRect.y());
+    layer->paintGraphicsLayerContents(*context, dirtyRect);
+
+    RefPtr<Image> image;
+
+#if PLATFORM(QT)
+    image = imageBuffer->copyImage(DontCopyBackingStore);
+#else
+    // FIXME: support DontCopyBackingStore in non-Qt ports that use TextureMapper.
+    image = imageBuffer->copyImage(CopyBackingStore);
+#endif
+
+    static_cast<TextureMapperTiledBackingStore*>(m_backingStore.get())->updateContents(textureMapper, image.get(), m_size, dirtyRect, BitmapTexture::BGRAFormat);
+}
+
+void TextureMapperLayer::paint()
+{
+    computeTransformsRecursive();
+
+    TextureMapperPaintOptions options;
+    options.textureMapper = m_textureMapper;
+    options.textureMapper->bindSurface(0);
+    paintRecursive(options);
+}
+
+void TextureMapperLayer::paintSelf(const TextureMapperPaintOptions& options)
+{
+    // We apply the following transform to compensate for painting into a surface, and then apply the offset so that the painting fits in the target rect.
+    TransformationMatrix transform =
+            TransformationMatrix(options.transform)
+            .multiply(m_transform.combined())
+            .translate(options.offset.width(), options.offset.height());
+
+    float opacity = options.opacity;
+    RefPtr<BitmapTexture> mask = options.mask;
+
+    if (m_backingStore)
+        m_backingStore->paintToTextureMapper(options.textureMapper, layerRect(), transform, opacity, mask.get());
+
+    if (m_contentsLayer)
+        m_contentsLayer->paintToTextureMapper(options.textureMapper, m_state.contentsRect, transform, opacity, mask.get());
+}
+
+int TextureMapperLayer::compareGraphicsLayersZValue(const void* a, const void* b)
+{
+    TextureMapperLayer* const* layerA = static_cast<TextureMapperLayer* const*>(a);
+    TextureMapperLayer* const* layerB = static_cast<TextureMapperLayer* const*>(b);
+    return int(((*layerA)->m_centerZ - (*layerB)->m_centerZ) * 1000);
+}
+
+void TextureMapperLayer::sortByZOrder(Vector<TextureMapperLayer* >& array, int first, int last)
+{
+    qsort(array.data(), array.size(), sizeof(TextureMapperLayer*), compareGraphicsLayersZValue);
+}
+
+void TextureMapperLayer::paintSelfAndChildren(const TextureMapperPaintOptions& options)
+{
+    paintSelf(options);
+
+    if (m_children.isEmpty())
+        return;
+
+    bool shouldClip = m_state.masksToBounds && !m_state.preserves3D;
+    if (shouldClip)
+        options.textureMapper->beginClip(TransformationMatrix(options.transform).multiply(m_transform.combined()), layerRect());
+
+    for (int i = 0; i < m_children.size(); ++i)
+        m_children[i]->paintRecursive(options);
+
+    if (shouldClip)
+        options.textureMapper->endClip();
+}
+
+IntRect TextureMapperLayer::intermediateSurfaceRect()
+{
+    // FIXME: Add an inverse transform to LayerTransform.
+    return intermediateSurfaceRect(m_transform.combined().inverse());
+}
+
+IntRect TextureMapperLayer::intermediateSurfaceRect(const TransformationMatrix& matrix)
+{
+    IntRect rect;
+    TransformationMatrix localTransform = TransformationMatrix(matrix).multiply(m_transform.combined());
+    rect = enclosingIntRect(localTransform.mapRect(layerRect()));
+    if (!m_state.masksToBounds && !m_state.maskLayer) {
+        for (size_t i = 0; i < m_children.size(); ++i)
+            rect.unite(m_children[i]->intermediateSurfaceRect(matrix));
+    }
+
+    if (m_state.replicaLayer)
+        rect.unite(m_state.replicaLayer->intermediateSurfaceRect(matrix));
+
+    return rect;
+}
+
+bool TextureMapperLayer::shouldPaintToIntermediateSurface() const
+{
+#if ENABLE(CSS_FILTERS)
+    if (m_state.filters.size())
+        return true;
+#endif
+    bool hasOpacity = m_opacity < 0.99;
+    bool hasChildren = !m_children.isEmpty();
+    bool hasReplica = !!m_state.replicaLayer;
+    bool hasMask = !!m_state.maskLayer;
+
+    // We don't use two-pass blending for preserves-3d, that's in sync with Safari.
+    if (m_state.preserves3D)
+        return false;
+
+    // We should use an intermediate surface when blending several items with an ancestor opacity.
+    // Tested by compositing/reflections/reflection-opacity.html
+    if (hasOpacity && (hasChildren || hasReplica))
+        return true;
+
+    // We should use an intermediate surface with a masked ancestor.
+    // In the case of replicas the mask is applied before replicating.
+    // Tested by compositing/masks/masked-ancestor.html
+    if (hasMask && hasChildren && !hasReplica)
+        return true;
+
+    return false;
+}
+
+bool TextureMapperLayer::isVisible() const
+{
+    if (m_size.isEmpty() && (m_state.masksToBounds || m_state.maskLayer || m_children.isEmpty()))
+        return false;
+    if (!m_state.visible || m_opacity < 0.01)
+        return false;
+    return true;
+}
+
+void TextureMapperLayer::paintSelfAndChildrenWithReplica(const TextureMapperPaintOptions& options)
+{
+    if (m_state.replicaLayer) {
+        TextureMapperPaintOptions replicaOptions(options);
+        // We choose either the content's mask or the replica's mask.
+        // FIXME: blend the two if both exist.
+        if (m_state.replicaLayer->m_state.maskLayer)
+            replicaOptions.mask = m_state.replicaLayer->m_state.maskLayer->texture();
+
+        replicaOptions.transform
+                  .multiply(m_state.replicaLayer->m_transform.combined())
+                  .multiply(m_transform.combined().inverse());
+        paintSelfAndChildren(replicaOptions);
+    }
+
+    paintSelfAndChildren(options);
+}
+
+#if ENABLE(CSS_FILTERS)
+static PassRefPtr<BitmapTexture> applyFilters(const FilterOperations& filters, TextureMapper* textureMapper, BitmapTexture* source, IntRect& targetRect)
+{
+    if (!filters.size())
+        return source;
+
+    RefPtr<BitmapTexture> filterSurface(source);
+    int leftOutset, topOutset, bottomOutset, rightOutset;
+    if (filters.hasOutsets()) {
+        filters.getOutsets(topOutset, rightOutset, bottomOutset, leftOutset);
+        IntRect unfilteredTargetRect(targetRect);
+        targetRect.move(std::max(0, -leftOutset), std::max(0, -topOutset));
+        targetRect.expand(leftOutset + rightOutset, topOutset + bottomOutset);
+        targetRect.unite(unfilteredTargetRect);
+        filterSurface = textureMapper->acquireTextureFromPool(targetRect.size());
+    }
+
+    filterSurface->applyFilters(*source, filters);
+    return filterSurface;
+}
+#endif
+
+void TextureMapperLayer::paintRecursive(const TextureMapperPaintOptions& options)
+{
+    if (!isVisible())
+        return;
+
+    float opacity = options.opacity * m_opacity;
+    RefPtr<BitmapTexture> maskTexture = m_state.maskLayer ? m_state.maskLayer->texture() : 0;
+
+    TextureMapperPaintOptions paintOptions(options);
+    paintOptions.mask = maskTexture.get();
+    IntRect surfaceRect;
+
+    RefPtr<BitmapTexture> surface;
+
+    if (!shouldPaintToIntermediateSurface()) {
+        paintOptions.opacity = opacity;
+        paintSelfAndChildrenWithReplica(paintOptions);
+        return;
+    }
+
+    // Prepare a surface to paint into.
+    // We paint into the surface ignoring the opacity/transform of the current layer.
+    surfaceRect = intermediateSurfaceRect();
+    surface = options.textureMapper->acquireTextureFromPool(surfaceRect.size());
+    options.textureMapper->bindSurface(surface.get());
+    paintOptions.opacity = 1;
+
+    // We have to use combinedForChildren() and not combined(), otherwise preserve-3D doesn't work.
+    paintOptions.transform = m_transform.combinedForChildren().inverse();
+    paintOptions.offset = -IntSize(surfaceRect.x(), surfaceRect.y());
+
+    paintSelfAndChildrenWithReplica(paintOptions);
+
+    // If we painted the replica, the mask is already applied so we don't need to paint it again.
+    if (m_state.replicaLayer)
+        maskTexture = 0;
+
+#if ENABLE(CSS_FILTERS)
+    surface = applyFilters(m_state.filters, options.textureMapper, surface.get(), surfaceRect);
+#endif
+
+    options.textureMapper->bindSurface(options.surface.get());
+    TransformationMatrix targetTransform =
+            TransformationMatrix(options.transform)
+                .multiply(m_transform.combined())
+                .translate(options.offset.width(), options.offset.height());
+    options.textureMapper->drawTexture(*surface.get(), surfaceRect, targetTransform, opacity, maskTexture.get());
+}
+
+TextureMapperLayer::~TextureMapperLayer()
+{
+    for (int i = m_children.size() - 1; i >= 0; --i)
+        m_children[i]->m_parent = 0;
+
+    if (m_parent)
+        m_parent->m_children.remove(m_parent->m_children.find(this));
+}
+
+void TextureMapperLayer::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, int options)
+{
+    syncCompositingState(graphicsLayer, rootLayer()->m_textureMapper, options);
+}
+
+void TextureMapperLayer::syncCompositingStateSelf(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper)
+{
+    int changeMask = graphicsLayer->changeMask();
+
+    if (changeMask == NoChanges && graphicsLayer->m_animations.isEmpty())
+        return;
+
+    if (changeMask & ParentChange) {
+        TextureMapperLayer* newParent = toTextureMapperLayer(graphicsLayer->parent());
+        if (newParent != m_parent) {
+            // Remove layer from current from child list first.
+            if (m_parent) {
+                size_t index = m_parent->m_children.find(this);
+                m_parent->m_children.remove(index);
+                m_parent = 0;
+            }
+            // Set new layer parent and add layer to the parents child list.
+            if (newParent) {
+                m_parent = newParent;
+                m_parent->m_children.append(this);
+            }
+        }
+    }
+
+    if (changeMask & ChildrenChange) {
+        // Clear children parent pointer to avoid unsync and crash on layer delete.
+        for (size_t i = 0; i < m_children.size(); i++)
+            m_children[i]->m_parent = 0;
+
+        m_children.clear();
+        for (size_t i = 0; i < graphicsLayer->children().size(); ++i) {
+            TextureMapperLayer* child = toTextureMapperLayer(graphicsLayer->children()[i]);
+            if (!child)
+                continue;
+            m_children.append(child);
+            child->m_parent = this;
+        }
+    }
+
+    m_size = graphicsLayer->size();
+
+    if (changeMask & MaskLayerChange) {
+       if (TextureMapperLayer* layer = toTextureMapperLayer(graphicsLayer->maskLayer()))
+           layer->m_effectTarget = this;
+    }
+
+    if (changeMask & ReplicaLayerChange) {
+       if (TextureMapperLayer* layer = toTextureMapperLayer(graphicsLayer->replicaLayer()))
+           layer->m_effectTarget = this;
+    }
+
+    if (changeMask & AnimationChange)
+        m_animations = graphicsLayer->m_animations;
+
+    m_state.maskLayer = toTextureMapperLayer(graphicsLayer->maskLayer());
+    m_state.replicaLayer = toTextureMapperLayer(graphicsLayer->replicaLayer());
+    m_state.pos = graphicsLayer->position();
+    m_state.anchorPoint = graphicsLayer->anchorPoint();
+    m_state.size = graphicsLayer->size();
+    m_state.contentsRect = graphicsLayer->contentsRect();
+    m_state.transform = graphicsLayer->transform();
+    m_state.contentsRect = graphicsLayer->contentsRect();
+    m_state.preserves3D = graphicsLayer->preserves3D();
+    m_state.masksToBounds = graphicsLayer->masksToBounds();
+    m_state.drawsContent = graphicsLayer->drawsContent();
+    m_state.contentsOpaque = graphicsLayer->contentsOpaque();
+    m_state.backfaceVisibility = graphicsLayer->backfaceVisibility();
+    m_state.childrenTransform = graphicsLayer->childrenTransform();
+    m_state.opacity = graphicsLayer->opacity();
+#if ENABLE(CSS_FILTERS)
+    m_state.filters = graphicsLayer->filters();
+#endif
+
+    m_state.needsDisplay = m_state.needsDisplay || graphicsLayer->needsDisplay();
+    if (!m_state.needsDisplay)
+        m_state.needsDisplayRect.unite(graphicsLayer->needsDisplayRect());
+    m_contentsLayer = graphicsLayer->contentsLayer();
+
+    m_transform.setPosition(m_state.pos);
+    m_transform.setAnchorPoint(m_state.anchorPoint);
+    m_transform.setSize(m_state.size);
+    m_transform.setFlattening(!m_state.preserves3D);
+    m_transform.setChildrenTransform(m_state.childrenTransform);
+}
+
+bool TextureMapperLayer::descendantsOrSelfHaveRunningAnimations() const
+{
+    if (m_animations.hasRunningAnimations())
+        return true;
+
+    for (size_t i = 0; i < m_children.size(); ++i) {
+        if (m_children[i]->descendantsOrSelfHaveRunningAnimations())
+            return true;
+    }
+
+    return false;
+}
+
+void TextureMapperLayer::syncAnimations()
+{
+    m_animations.apply(this);
+    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
+        setTransform(m_state.transform);
+    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
+        setOpacity(m_state.opacity);
+}
+
+void TextureMapperLayer::syncAnimationsRecursively()
+{
+    syncAnimations();
+
+    for (int i = m_children.size() - 1; i >= 0; --i)
+        m_children[i]->syncAnimationsRecursively();
+}
+
+void TextureMapperLayer::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper, int options)
+{
+    if (!textureMapper)
+        return;
+
+    if (graphicsLayer && !(options & ComputationsOnly)) {
+        syncCompositingStateSelf(graphicsLayer, textureMapper);
+        graphicsLayer->didSynchronize();
+    }
+
+    if (graphicsLayer && m_state.maskLayer) {
+        m_state.maskLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->maskLayer()), textureMapper);
+
+        // A mask layer has its parent's size by default, in case it's not set specifically.
+        if (m_state.maskLayer->m_size.isEmpty())
+            m_state.maskLayer->m_size = m_size;
+    }
+
+    if (m_state.replicaLayer)
+        m_state.replicaLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->replicaLayer()), textureMapper);
+
+    syncAnimations();
+    updateBackingStore(textureMapper, graphicsLayer);
+
+    if (!(options & TraverseDescendants))
+        options = ComputationsOnly;
+
+    if (graphicsLayer) {
+        Vector<GraphicsLayer*> children = graphicsLayer->children();
+        for (int i = children.size() - 1; i >= 0; --i) {
+            TextureMapperLayer* layer = toTextureMapperLayer(children[i]);
+            if (!layer)
+                continue;
+            layer->syncCompositingState(toGraphicsLayerTextureMapper(children[i]), textureMapper, options);
+        }
+    } else {
+        for (int i = m_children.size() - 1; i >= 0; --i)
+            m_children[i]->syncCompositingState(0, textureMapper, options);
+    }
+}
+
+}
+#endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
index 230c9e0e0..e10d5a798 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
@@ -17,9 +17,10 @@
  Boston, MA 02110-1301, USA.
  */
 
-#ifndef TextureMapperNode_h
-#define TextureMapperNode_h
+#ifndef TextureMapperLayer_h
+#define TextureMapperLayer_h
 
+#include "FilterOperations.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
@@ -28,6 +29,7 @@
 #include "LayerTransform.h"
 #include "TextureMapper.h"
 #include "TextureMapperAnimation.h"
+#include "TextureMapperBackingStore.h"
 #include "Timer.h"
 #include "TransformOperations.h"
 #include <wtf/CurrentTime.h>
@@ -37,26 +39,24 @@
 namespace WebCore {
 
 class TextureMapperPlatformLayer;
-class TextureMapperNode;
+class TextureMapperLayer;
 class GraphicsLayerTextureMapper;
 
 class TextureMapperPaintOptions {
 public:
-    BitmapTexture* surface;
-    BitmapTexture* mask;
+    RefPtr<BitmapTexture> surface;
+    RefPtr<BitmapTexture> mask;
     float opacity;
     TransformationMatrix transform;
     IntSize offset;
     TextureMapper* textureMapper;
     TextureMapperPaintOptions()
-        : surface(0)
-        , mask(0)
-        , opacity(1)
+        : opacity(1)
         , textureMapper(0)
     { }
 };
 
-class TextureMapperNode : public TextureMapperAnimationClient {
+class TextureMapperLayer : public TextureMapperAnimationClient {
 
 public:
     // This set of flags help us defer which properties of the layer have been
@@ -89,7 +89,8 @@ public:
         BackgroundColorChange =     (1L << 19),
 
         ReplicaLayerChange =        (1L << 20),
-        AnimationChange =           (1L << 21)
+        AnimationChange =           (1L << 21),
+        FilterChange =              (1L << 22)
     };
 
     enum SyncOptions {
@@ -97,41 +98,17 @@ public:
         ComputationsOnly = 2
     };
 
-    enum TileOwnership {
-        OwnedTiles,
-        ExternallyManagedTiles
-    };
-
-    typedef HashMap<TextureMapperNode*, FloatRect> NodeRectMap;
-
-    // The compositor lets us special-case images and colors, so we try to do so.
-    enum ContentType { HTMLContentType, DirectImageContentType, ColorContentType, MediaContentType, Canvas3DContentType};
-    struct ContentData {
-        FloatRect needsDisplayRect;
-        bool needsDisplay;
-        Color backgroundColor;
-
-        ContentType contentType;
-        RefPtr<Image> image;
-        const TextureMapperPlatformLayer* media;
-        ContentData()
-            : needsDisplay(false)
-            , contentType(HTMLContentType)
-            , image(0)
-            , media(0)
-        {
-        }
-    };
-
-    TextureMapperNode()
+    TextureMapperLayer()
         : m_parent(0)
         , m_effectTarget(0)
+        , m_contentsLayer(0)
         , m_opacity(1)
         , m_centerZ(0)
+        , m_shouldUpdateBackingStoreFromLayer(true)
         , m_textureMapper(0)
     { }
 
-    virtual ~TextureMapperNode();
+    virtual ~TextureMapperLayer();
 
     void syncCompositingState(GraphicsLayerTextureMapper*, int syncOptions = 0);
     void syncCompositingState(GraphicsLayerTextureMapper*, TextureMapper*, int syncOptions = 0);
@@ -144,22 +121,13 @@ public:
 
     void paint();
 
-#if USE(TILED_BACKING_STORE)
-    void setTileOwnership(TileOwnership ownership) { m_state.tileOwnership = ownership; }
-    int createContentsTile(float scale);
-    void removeContentsTile(int id);
-    void setContentsTileBackBuffer(int id, const IntRect& sourceRect, const IntRect& targetRect, const void*);
-    void setTileBackBufferTextureForDirectlyCompositedImage(int id, const IntRect& sourceRect, const FloatRect& targetRect, BitmapTexture*);
-    void clearAllDirectlyCompositedImageTiles();
-    void purgeNodeTexturesRecursive();
-#endif
-    void setID(int id) { m_id = id; }
-    int id() const { return m_id; }
-
-    const TextureMapperPlatformLayer* media() const { return m_currentContent.media; }
+    void setShouldUpdateBackingStoreFromLayer(bool b) { m_shouldUpdateBackingStoreFromLayer = b; }
+    void setBackingStore(TextureMapperBackingStore* backingStore) { m_backingStore = backingStore; }
+    PassRefPtr<TextureMapperBackingStore> backingStore() { return m_backingStore; }
+    void clearBackingStoresRecursive();
 
 private:
-    TextureMapperNode* rootLayer();
+    TextureMapperLayer* rootLayer();
     void computeTransformsRecursive();
     void computeOverlapsIfNeeded();
     void computeTiles();
@@ -169,18 +137,18 @@ private:
     FloatRect targetRectForTileRect(const FloatRect& totalTargetRect, const FloatRect& tileRect) const;
     void invalidateViewport(const FloatRect&);
     void notifyChange(ChangeMask);
-    void syncCompositingStateSelf(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper);
+    void syncCompositingStateSelf(GraphicsLayerTextureMapper*, TextureMapper*);
 
     static int compareGraphicsLayersZValue(const void* a, const void* b);
-    static void sortByZOrder(Vector<TextureMapperNode* >& array, int first, int last);
+    static void sortByZOrder(Vector<TextureMapperLayer* >& array, int first, int last);
 
-    BitmapTexture* texture() { return m_ownedTiles.isEmpty() ? 0 : m_ownedTiles[0].texture.get(); }
+    PassRefPtr<BitmapTexture> texture() { return m_backingStore ? m_backingStore->texture() : 0; }
 
     void paintRecursive(const TextureMapperPaintOptions&);
     void paintSelf(const TextureMapperPaintOptions&);
     void paintSelfAndChildren(const TextureMapperPaintOptions&);
     void paintSelfAndChildrenWithReplica(const TextureMapperPaintOptions&);
-    void renderContent(TextureMapper*, GraphicsLayer*);
+    void updateBackingStore(TextureMapper*, GraphicsLayer*);
 
     void syncAnimations();
     bool isVisible() const;
@@ -188,63 +156,21 @@ private:
 
     LayerTransform m_transform;
 
-    inline FloatRect targetRect() const
-    {
-        return m_currentContent.contentType == HTMLContentType ? entireRect() : m_state.contentsRect;
-    }
-
-    inline FloatRect entireRect() const
-    {
-        return FloatRect(0, 0, m_size.width(), m_size.height());
-    }
-
-    FloatSize contentSize() const
+    inline FloatRect layerRect() const
     {
-        return m_currentContent.contentType == DirectImageContentType && m_currentContent.image ? m_currentContent.image->size() : m_size;
+        return FloatRect(FloatPoint::zero(), m_size);
     }
-    struct OwnedTile {
-        FloatRect rect;
-        RefPtr<BitmapTexture> texture;
-        bool needsReset;
-    };
-
-    Vector<OwnedTile> m_ownedTiles;
-
-#if USE(TILED_BACKING_STORE)
-    struct ExternallyManagedTileBuffer {
-        FloatRect sourceRect;
-        FloatRect targetRect;
-        RefPtr<BitmapTexture> texture;
-    };
-
-    struct ExternallyManagedTile {
-        bool isBackBufferUpdated;
-        bool isDirectlyCompositedImage;
-        float scale;
-        ExternallyManagedTileBuffer frontBuffer;
-        ExternallyManagedTileBuffer backBuffer;
-
-        ExternallyManagedTile(float scale = 1.0)
-            : isBackBufferUpdated(false)
-            , isDirectlyCompositedImage(false)
-            , scale(scale)
-        {
-        }
-    };
 
-    HashMap<int, ExternallyManagedTile> m_externallyManagedTiles;
-#endif
-
-    ContentData m_currentContent;
-
-    Vector<TextureMapperNode*> m_children;
-    TextureMapperNode* m_parent;
-    TextureMapperNode* m_effectTarget;
+    Vector<TextureMapperLayer*> m_children;
+    TextureMapperLayer* m_parent;
+    TextureMapperLayer* m_effectTarget;
+    RefPtr<TextureMapperBackingStore> m_backingStore;
+    TextureMapperPlatformLayer* m_contentsLayer;
     FloatSize m_size;
     float m_opacity;
     float m_centerZ;
     String m_name;
-    int m_id;
+    bool m_shouldUpdateBackingStoreFromLayer;
 
     struct State {
         FloatPoint pos;
@@ -254,22 +180,23 @@ private:
         TransformationMatrix childrenTransform;
         float opacity;
         FloatRect contentsRect;
+        FloatRect needsDisplayRect;
         int descendantsWithContent;
-        TextureMapperNode* maskLayer;
-        TextureMapperNode* replicaLayer;
+        TextureMapperLayer* maskLayer;
+        TextureMapperLayer* replicaLayer;
+#if ENABLE(CSS_FILTERS)
+         FilterOperations filters;
+#endif
+
         bool preserves3D : 1;
         bool masksToBounds : 1;
         bool drawsContent : 1;
         bool contentsOpaque : 1;
         bool backfaceVisibility : 1;
         bool visible : 1;
-        bool needsReset: 1;
+        bool needsDisplay: 1;
         bool mightHaveOverlaps : 1;
         bool needsRepaint;
-        float contentScale;
-#if USE(TILED_BACKING_STORE)
-        TileOwnership tileOwnership;
-#endif
         State()
             : opacity(1.f)
             , maskLayer(0)
@@ -280,13 +207,9 @@ private:
             , contentsOpaque(false)
             , backfaceVisibility(false)
             , visible(true)
-            , needsReset(false)
+            , needsDisplay(true)
             , mightHaveOverlaps(false)
             , needsRepaint(false)
-            , contentScale(1.0f)
-#if USE(TILED_BACKING_STORE)
-            , tileOwnership(OwnedTiles)
-#endif
         {
         }
     };
@@ -297,7 +220,7 @@ private:
 };
 
 
-TextureMapperNode* toTextureMapperNode(GraphicsLayer*);
+TextureMapperLayer* toTextureMapperLayer(GraphicsLayer*);
 
 }
-#endif // TextureMapperNode_h
+#endif // TextureMapperLayer_h
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp
deleted file mode 100644
index 45b94bd91..000000000
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp
+++ /dev/null
@@ -1,709 +0,0 @@
-/*
- Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
-
- This library is free software; you can redistribute it and/or
- modify it under the terms of the GNU Library General Public
- License as published by the Free Software Foundation; either
- version 2 of the License, or (at your option) any later version.
-
- This library is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- Library General Public License for more details.
-
- You should have received a copy of the GNU Library General Public License
- along with this library; see the file COPYING.LIB.  If not, write to
- the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "TextureMapperNode.h"
-
-#if USE(ACCELERATED_COMPOSITING)
-
-#include "GraphicsLayerTextureMapper.h"
-#include "ImageBuffer.h"
-#include "MathExtras.h"
-
-namespace {
-    static const float gTileDimension = 1024.0;
-}
-
-namespace WebCore {
-
-TextureMapperNode* toTextureMapperNode(GraphicsLayer* layer)
-{
-    return layer ? toGraphicsLayerTextureMapper(layer)->node() : 0;
-}
-
-TextureMapperNode* TextureMapperNode::rootLayer()
-{
-    if (m_effectTarget)
-        return m_effectTarget->rootLayer();
-    if (m_parent)
-        return m_parent->rootLayer();
-    return this;
-}
-
-void TextureMapperNode::setTransform(const TransformationMatrix& matrix)
-{
-    m_transform.setLocalTransform(matrix);
-}
-
-void TextureMapperNode::computeTransformsRecursive()
-{
-    if (m_size.isEmpty() && m_state.masksToBounds)
-        return;
-
-    // Compute transforms recursively on the way down to leafs.
-    TransformationMatrix parentTransform;
-    if (m_parent)
-        parentTransform = m_parent->m_transform.combinedForChildren();
-    else if (m_effectTarget)
-        parentTransform = m_effectTarget->m_transform.combined();
-    m_transform.combineTransforms(parentTransform);
-
-    m_state.visible = m_state.backfaceVisibility || m_transform.combined().inverse().m33() >= 0;
-
-    if (m_parent && m_parent->m_state.preserves3D)
-        m_centerZ = m_transform.combined().mapPoint(FloatPoint3D(m_size.width() / 2, m_size.height() / 2, 0)).z();
-
-    if (m_state.maskLayer)
-        m_state.maskLayer->computeTransformsRecursive();
-    if (m_state.replicaLayer)
-        m_state.replicaLayer->computeTransformsRecursive();
-    for (int i = 0; i < m_children.size(); ++i)
-        m_children[i]->computeTransformsRecursive();
-
-    // Reorder children if needed on the way back up.
-    if (m_state.preserves3D)
-        sortByZOrder(m_children, 0, m_children.size());
-}
-
-void TextureMapperNode::computeTiles()
-{
-#if USE(TILED_BACKING_STORE)
-    if (m_state.tileOwnership == ExternallyManagedTiles)
-        return;
-#endif
-    if (m_currentContent.contentType == HTMLContentType && !m_state.drawsContent) {
-        m_ownedTiles.clear();
-        return;
-    }
-    Vector<FloatRect> tilesToAdd;
-    Vector<int> tilesToRemove;
-    const int TileEraseThreshold = 6;
-    FloatSize size = contentSize();
-    FloatRect contentRect(0, 0, size.width(), size.height());
-
-    for (float y = 0; y < contentRect.height(); y += gTileDimension) {
-        for (float x = 0; x < contentRect.width(); x += gTileDimension) {
-            FloatRect tileRect(x, y, gTileDimension, gTileDimension);
-            tileRect.intersect(contentRect);
-            tilesToAdd.append(tileRect);
-        }
-    }
-
-    for (int i = m_ownedTiles.size() - 1; i >= 0; --i) {
-        const FloatRect oldTile = m_ownedTiles[i].rect;
-        bool found = false;
-
-        for (int j = tilesToAdd.size() - 1; j >= 0; --j) {
-            const FloatRect newTile = tilesToAdd[j];
-            if (oldTile != newTile)
-                continue;
-
-            found = true;
-            tilesToAdd.remove(j);
-            break;
-        }
-
-        if (!found)
-            tilesToRemove.append(i);
-    }
-
-    for (size_t i = 0; i < tilesToAdd.size(); ++i) {
-        if (!tilesToRemove.isEmpty()) {
-            OwnedTile& tile = m_ownedTiles[tilesToRemove[0]];
-            tilesToRemove.remove(0);
-            tile.rect = tilesToAdd[i];
-            tile.needsReset = true;
-            continue;
-        }
-
-        OwnedTile tile;
-        tile.rect = tilesToAdd[i];
-        tile.needsReset = true;
-        m_ownedTiles.append(tile);
-    }
-
-    for (size_t i = 0; i < tilesToRemove.size() && m_ownedTiles.size() > TileEraseThreshold; ++i)
-        m_ownedTiles.remove(tilesToRemove[i]);
-}
-
-void TextureMapperNode::renderContent(TextureMapper* textureMapper, GraphicsLayer* layer)
-{
-#if USE(TILED_BACKING_STORE)
-    if (m_state.tileOwnership == ExternallyManagedTiles)
-        return;
-#endif
-
-    if (m_size.isEmpty() || !layer || (!m_state.drawsContent && m_currentContent.contentType == HTMLContentType)) {
-        m_ownedTiles.clear();
-        return;
-    }
-
-    if (!textureMapper)
-        return;
-
-    IntRect dirtyRect = enclosingIntRect(m_currentContent.needsDisplay ? entireRect() : m_currentContent.needsDisplayRect);
-
-    for (size_t tileIndex = 0; tileIndex < m_ownedTiles.size(); ++tileIndex) {
-        OwnedTile& tile = m_ownedTiles[tileIndex];
-        if (!tile.texture)
-            tile.texture = textureMapper->createTexture();
-        RefPtr<BitmapTexture>& texture = tile.texture;
-        IntSize tileSize = enclosingIntRect(tile.rect).size();
-
-        if (tile.needsReset || texture->contentSize() != tileSize || !texture->isValid()) {
-            tile.needsReset = false;
-            texture->reset(tileSize, m_state.contentsOpaque);
-            dirtyRect.unite(enclosingIntRect(tile.rect));
-        }
-    }
-
-    if (dirtyRect.isEmpty())
-        return;
-
-    // Paint the entire dirty rect into an image buffer. This ensures we only paint once.
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(dirtyRect.size());
-    GraphicsContext* context = imageBuffer->context();
-    context->setImageInterpolationQuality(textureMapper->imageInterpolationQuality());
-    context->setTextDrawingMode(textureMapper->textDrawingMode());
-    context->translate(-dirtyRect.x(), -dirtyRect.y());
-    layer->paintGraphicsLayerContents(*context, dirtyRect);
-    if (m_currentContent.contentType == DirectImageContentType)
-        context->drawImage(m_currentContent.image.get(), ColorSpaceDeviceRGB, m_state.contentsRect);
-
-    RefPtr<Image> image;
-
-#if PLATFORM(QT)
-    image = imageBuffer->copyImage(DontCopyBackingStore);
-#else
-    // FIXME: support DontCopyBackingStore in non-Qt ports that use TextureMapper.
-    image = imageBuffer->copyImage(CopyBackingStore);
-#endif
-
-    // Divide the image to tiles.
-    for (size_t tileIndex = 0; tileIndex < m_ownedTiles.size(); ++tileIndex) {
-        OwnedTile& tile = m_ownedTiles[tileIndex];
-        IntRect targetRect = enclosingIntRect(tile.rect);
-        targetRect.intersect(dirtyRect);
-        if (targetRect.isEmpty())
-            continue;
-        IntRect sourceRect = targetRect;
-
-        // Normalize sourceRect to the buffer's coordinates.
-        sourceRect.move(-dirtyRect.x(), -dirtyRect.y());
-
-        // Normalize targetRect to the texture's coordinqates.
-        targetRect.move(-tile.rect.x(), -tile.rect.y());
-        tile.texture->updateContents(image.get(), targetRect, sourceRect, BitmapTexture::RGBAFormat);
-    }
-
-    m_currentContent.needsDisplay = false;
-    m_currentContent.needsDisplayRect = IntRect();
-}
-
-void TextureMapperNode::paint()
-{
-    if (m_size.isEmpty())
-        return;
-
-    computeTransformsRecursive();
-
-    TextureMapperPaintOptions opt;
-    opt.textureMapper = m_textureMapper;
-    opt.textureMapper->bindSurface(0);
-    paintRecursive(opt);
-}
-
-FloatRect TextureMapperNode::targetRectForTileRect(const FloatRect& targetRect, const FloatRect& tileRect) const
-{
-    return FloatRect(
-                targetRect.x() + (tileRect.x() - targetRect.x()),
-                targetRect.y() + (tileRect.y() - targetRect.y()),
-                tileRect.width(),
-                tileRect.height());
-}
-
-void TextureMapperNode::paintSelf(const TextureMapperPaintOptions& options)
-{
-    if (m_size.isEmpty() || (!m_state.drawsContent && m_currentContent.contentType == HTMLContentType))
-        return;
-
-    float opacity = options.opacity;
-    BitmapTexture* mask = options.mask;
-    FloatRect targetRect = this->targetRect();
-
-    // We apply the following transform to compensate for painting into a surface, and then apply the offset so that the painting fits in the target rect.
-    TransformationMatrix transform =
-            TransformationMatrix(options.transform)
-            .multiply(m_transform.combined())
-            .translate(options.offset.width(), options.offset.height());
-
-#if USE(TILED_BACKING_STORE)
-    Vector<ExternallyManagedTile> tilesToPaint;
-
-    if (m_state.tileOwnership == ExternallyManagedTiles) {
-        // Sort tiles, with current scale factor last.
-        Vector<ExternallyManagedTile*> tiles;
-        HashMap<int, ExternallyManagedTile>::iterator end = m_externallyManagedTiles.end();
-        for (HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.begin(); it != end; ++it) {
-            if (!it->second.frontBuffer.texture)
-                continue;
-
-            if (it->second.scale == m_state.contentScale) {
-                tiles.append(&it->second);
-                continue;
-            }
-
-            // This creates a transitional effect looks good only when there's no transparency, so we only use it when the opacity for the layer is above a certain threshold.
-            if (opacity > 0.95)
-                tiles.prepend(&it->second);
-        }
-
-        for (int i = 0; i < tiles.size(); ++i) {
-            ExternallyManagedTile& tile = *tiles[i];
-            FloatRect rect = tile.frontBuffer.targetRect;
-            BitmapTexture& texture = *tile.frontBuffer.texture;
-            options.textureMapper->drawTexture(texture, rect, transform, opacity, mask);
-        }
-        return;
-    }
-#endif
-
-    // Now we paint owned tiles, if we're in OwnedTileMode.
-    for (size_t i = 0; i < m_ownedTiles.size(); ++i) {
-        BitmapTexture* texture = m_ownedTiles[i].texture.get();
-        const FloatRect rect = targetRectForTileRect(targetRect, m_ownedTiles[i].rect);
-        options.textureMapper->drawTexture(*texture, rect, transform, opacity, mask);
-    }
-
-    if (m_currentContent.contentType == MediaContentType && m_currentContent.media)
-        m_currentContent.media->paintToTextureMapper(options.textureMapper, targetRect, transform, opacity, mask);
-}
-
-int TextureMapperNode::compareGraphicsLayersZValue(const void* a, const void* b)
-{
-    TextureMapperNode* const* nodeA = static_cast<TextureMapperNode* const*>(a);
-    TextureMapperNode* const* nodeB = static_cast<TextureMapperNode* const*>(b);
-    return int(((*nodeA)->m_centerZ - (*nodeB)->m_centerZ) * 1000);
-}
-
-void TextureMapperNode::sortByZOrder(Vector<TextureMapperNode* >& array, int first, int last)
-{
-    qsort(array.data(), array.size(), sizeof(TextureMapperNode*), compareGraphicsLayersZValue);
-}
-
-void TextureMapperNode::paintSelfAndChildren(const TextureMapperPaintOptions& options)
-{
-    bool hasClip = m_state.masksToBounds && !m_children.isEmpty();
-    if (hasClip)
-        options.textureMapper->beginClip(TransformationMatrix(options.transform).multiply(m_transform.combined()), FloatRect(0, 0, m_size.width(), m_size.height()));
-
-    paintSelf(options);
-
-    for (int i = 0; i < m_children.size(); ++i)
-        m_children[i]->paintRecursive(options);
-
-    if (hasClip)
-        options.textureMapper->endClip();
-}
-
-IntRect TextureMapperNode::intermediateSurfaceRect()
-{
-    // FIXME: Add an inverse transform to LayerTransform.
-    return intermediateSurfaceRect(m_transform.combined().inverse());
-}
-
-IntRect TextureMapperNode::intermediateSurfaceRect(const TransformationMatrix& matrix)
-{
-    IntRect rect;
-    TransformationMatrix localTransform = TransformationMatrix(matrix).multiply(m_transform.combined());
-    rect = enclosingIntRect(localTransform.mapRect(entireRect()));
-    if (!m_state.masksToBounds && !m_state.maskLayer) {
-        for (int i = 0; i < m_children.size(); ++i)
-            rect.unite(m_children[i]->intermediateSurfaceRect(matrix));
-    }
-
-    if (m_state.replicaLayer)
-        rect.unite(m_state.replicaLayer->intermediateSurfaceRect(matrix));
-
-    return rect;
-}
-
-bool TextureMapperNode::shouldPaintToIntermediateSurface() const
-{
-    bool hasOpacity = m_opacity < 0.99;
-    bool hasChildren = !m_children.isEmpty();
-    bool hasReplica = !!m_state.replicaLayer;
-    bool hasMask = !!m_state.maskLayer;
-
-    // We don't use two-pass blending for preserves-3d, that's in sync with Safari.
-    if (m_state.preserves3D)
-        return false;
-
-    // We should use an intermediate surface when blending several items with an ancestor opacity.
-    // Tested by compositing/reflections/reflection-opacity.html
-    if (hasOpacity && (hasChildren || hasReplica))
-        return true;
-
-    // We should use an intermediate surface with a masked ancestor.
-    // In the case of replicas the mask is applied before replicating.
-    // Tested by compositing/masks/masked-ancestor.html
-    if (hasMask && hasChildren && !hasReplica)
-        return true;
-
-    return false;
-}
-
-bool TextureMapperNode::isVisible() const
-{
-    if (m_size.isEmpty() && (m_state.masksToBounds || m_state.maskLayer || m_children.isEmpty()))
-        return false;
-    if (!m_state.visible || m_opacity < 0.01)
-        return false;
-    return true;
-}
-
-void TextureMapperNode::paintSelfAndChildrenWithReplica(const TextureMapperPaintOptions& options)
-{
-    if (m_state.replicaLayer) {
-        TextureMapperPaintOptions replicaOptions(options);
-        // We choose either the content's mask or the replica's mask.
-        // FIXME: blend the two if both exist.
-        if (m_state.replicaLayer->m_state.maskLayer)
-            replicaOptions.mask = m_state.replicaLayer->m_state.maskLayer->texture();
-
-        replicaOptions.transform
-                  .multiply(m_state.replicaLayer->m_transform.combined())
-                  .multiply(m_transform.combined().inverse());
-        paintSelfAndChildren(replicaOptions);
-    }
-
-    paintSelfAndChildren(options);
-}
-
-void TextureMapperNode::paintRecursive(const TextureMapperPaintOptions& options)
-{
-    if (!isVisible())
-        return;
-
-    float opacity = options.opacity * m_opacity;
-    RefPtr<BitmapTexture> maskTexture = m_state.maskLayer ? m_state.maskLayer->texture() : 0;
-
-    TextureMapperPaintOptions paintOptions(options);
-    paintOptions.mask = maskTexture.get();
-    IntRect surfaceRect;
-
-    RefPtr<BitmapTexture> surface;
-
-    if (!shouldPaintToIntermediateSurface()) {
-        paintOptions.opacity = opacity;
-        paintSelfAndChildrenWithReplica(paintOptions);
-        return;
-    }
-
-    // Prepare a surface to paint into.
-    // We paint into the surface ignoring the opacity/transform of the current layer.
-    surfaceRect = intermediateSurfaceRect();
-    surface = options.textureMapper->acquireTextureFromPool(surfaceRect.size());
-    options.textureMapper->bindSurface(surface.get());
-    paintOptions.opacity = 1;
-
-    // We have to use combinedForChildren() and not combined(), otherwise preserve-3D doesn't work.
-    paintOptions.transform = m_transform.combinedForChildren().inverse();
-    paintOptions.offset = -IntSize(surfaceRect.x(), surfaceRect.y());
-
-    paintSelfAndChildrenWithReplica(paintOptions);
-
-    // If we painted the replica, the mask is already applied so we don't need to paint it again.
-    if (m_state.replicaLayer)
-        maskTexture = 0;
-
-    options.textureMapper->bindSurface(options.surface);
-    TransformationMatrix targetTransform =
-            TransformationMatrix(options.transform)
-                .multiply(m_transform.combined())
-                .translate(options.offset.width(), options.offset.height());
-    options.textureMapper->drawTexture(*surface.get(), surfaceRect, targetTransform, opacity, maskTexture.get());
-}
-
-TextureMapperNode::~TextureMapperNode()
-{
-    for (int i = m_children.size() - 1; i >= 0; --i)
-        m_children[i]->m_parent = 0;
-
-    if (m_parent)
-        m_parent->m_children.remove(m_parent->m_children.find(this));
-}
-
-#if USE(TILED_BACKING_STORE)
-int TextureMapperNode::createContentsTile(float scale)
-{
-    static int nextID = 0;
-    int id = ++nextID;
-    m_externallyManagedTiles.add(id, ExternallyManagedTile(scale));
-    m_state.contentScale = scale;
-    return id;
-}
-
-void TextureMapperNode::removeContentsTile(int id)
-{
-    m_externallyManagedTiles.remove(id);
-}
-
-void TextureMapperNode::purgeNodeTexturesRecursive()
-{
-    m_externallyManagedTiles.clear();
-
-    for (int i = m_children.size() - 1; i >= 0; --i)
-        m_children[i]->purgeNodeTexturesRecursive();
-}
-
-void TextureMapperNode::setTileBackBufferTextureForDirectlyCompositedImage(int id, const IntRect& sourceRect, const FloatRect& targetRect, BitmapTexture* texture)
-{
-    HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.find(id);
-
-    if (it == m_externallyManagedTiles.end())
-        return;
-
-    ExternallyManagedTile& tile = it->second;
-
-    tile.backBuffer.sourceRect = sourceRect;
-    tile.backBuffer.targetRect = targetRect;
-    tile.backBuffer.texture = texture;
-    tile.isBackBufferUpdated = true;
-    tile.isDirectlyCompositedImage = true;
-}
-
-void TextureMapperNode::clearAllDirectlyCompositedImageTiles()
-{
-    for (HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.begin(); it != m_externallyManagedTiles.end(); ++it) {
-        if (it->second.isDirectlyCompositedImage)
-            m_externallyManagedTiles.remove(it);
-    }
-}
-
-void TextureMapperNode::setContentsTileBackBuffer(int id, const IntRect& sourceRect, const IntRect& targetRect, const void* data)
-{
-    ASSERT(m_textureMapper);
-
-    HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.find(id);
-    if (it == m_externallyManagedTiles.end())
-        return;
-
-    ExternallyManagedTile& tile = it->second;
-
-    tile.backBuffer.sourceRect = sourceRect;
-    tile.backBuffer.targetRect = FloatRect(targetRect);
-    tile.backBuffer.targetRect.scale(1.0 / tile.scale);
-
-    if (!tile.backBuffer.texture)
-        tile.backBuffer.texture = m_textureMapper->createTexture();
-    tile.backBuffer.texture->reset(sourceRect.size(), false);
-    tile.backBuffer.texture->updateContents(data, sourceRect);
-    tile.isBackBufferUpdated = true;
-}
-
-void TextureMapperNode::swapContentsBuffers()
-{
-    HashMap<int, ExternallyManagedTile>::iterator end = m_externallyManagedTiles.end();
-    for (HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.begin(); it != end; ++it) {
-        ExternallyManagedTile& tile = it->second;
-        if (!tile.isBackBufferUpdated)
-            continue;
-        tile.isBackBufferUpdated = false;
-        ExternallyManagedTileBuffer swapBuffer = tile.frontBuffer;
-        tile.frontBuffer = tile.backBuffer;
-        tile.backBuffer = swapBuffer;
-    }
-}
-#endif
-
-void TextureMapperNode::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, int options)
-{
-    syncCompositingState(graphicsLayer, rootLayer()->m_textureMapper, options);
-}
-
-void TextureMapperNode::syncCompositingStateSelf(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper)
-{
-    int changeMask = graphicsLayer->changeMask();
-    const TextureMapperNode::ContentData& pendingContent = graphicsLayer->pendingContent();
-#if USE(TILED_BACKING_STORE)
-    swapContentsBuffers();
-#endif
-    if (changeMask == NoChanges && graphicsLayer->m_animations.isEmpty() && pendingContent.needsDisplayRect.isEmpty() && !pendingContent.needsDisplay)
-        return;
-
-    if (m_currentContent.contentType == HTMLContentType && (changeMask & ParentChange)) {
-        TextureMapperNode* newParent = toTextureMapperNode(graphicsLayer->parent());
-        if (newParent != m_parent) {
-            // Remove node from current from child list first.
-            if (m_parent) {
-                size_t index = m_parent->m_children.find(this);
-                m_parent->m_children.remove(index);
-                m_parent = 0;
-            }
-            // Set new node parent and add node to the parents child list.
-            if (newParent) {
-                m_parent = newParent;
-                m_parent->m_children.append(this);
-            }
-        }
-    }
-
-    if (changeMask & ChildrenChange) {
-        // Clear children parent pointer to avoid unsync and crash on node delete.
-        for (size_t i = 0; i < m_children.size(); i++)
-            m_children[i]->m_parent = 0;
-
-        m_children.clear();
-        for (size_t i = 0; i < graphicsLayer->children().size(); ++i) {
-            TextureMapperNode* child = toTextureMapperNode(graphicsLayer->children()[i]);
-            if (!child)
-                continue;
-            m_children.append(child);
-            child->m_parent = this;
-        }
-    }
-
-    if (changeMask & (SizeChange | ContentsRectChange)) {
-        FloatSize wantedSize(graphicsLayer->size().width(), graphicsLayer->size().height());
-        if (wantedSize.isEmpty() && pendingContent.contentType == HTMLContentType)
-            wantedSize = FloatSize(graphicsLayer->contentsRect().width(), graphicsLayer->contentsRect().height());
-
-        if (wantedSize != m_size)
-            m_ownedTiles.clear();
-
-        m_size = wantedSize;
-    }
-
-    if (changeMask & MaskLayerChange) {
-       if (TextureMapperNode* layer = toTextureMapperNode(graphicsLayer->maskLayer()))
-           layer->m_effectTarget = this;
-    }
-
-    if (changeMask & ReplicaLayerChange) {
-       if (TextureMapperNode* layer = toTextureMapperNode(graphicsLayer->replicaLayer()))
-           layer->m_effectTarget = this;
-    }
-
-    if (changeMask & AnimationChange)
-        m_animations = graphicsLayer->m_animations;
-
-    m_state.maskLayer = toTextureMapperNode(graphicsLayer->maskLayer());
-    m_state.replicaLayer = toTextureMapperNode(graphicsLayer->replicaLayer());
-    m_state.pos = graphicsLayer->position();
-    m_state.anchorPoint = graphicsLayer->anchorPoint();
-    m_state.size = graphicsLayer->size();
-    m_state.contentsRect = graphicsLayer->contentsRect();
-    m_state.transform = graphicsLayer->transform();
-    m_state.contentsRect = graphicsLayer->contentsRect();
-    m_state.preserves3D = graphicsLayer->preserves3D();
-    m_state.masksToBounds = graphicsLayer->masksToBounds();
-    m_state.drawsContent = graphicsLayer->drawsContent();
-    m_state.contentsOpaque = graphicsLayer->contentsOpaque();
-    m_state.backfaceVisibility = graphicsLayer->backfaceVisibility();
-    m_state.childrenTransform = graphicsLayer->childrenTransform();
-    m_state.opacity = graphicsLayer->opacity();
-
-    m_currentContent.contentType = pendingContent.contentType;
-    m_currentContent.image = pendingContent.image;
-    m_currentContent.media = pendingContent.media;
-    m_currentContent.needsDisplay = m_currentContent.needsDisplay || pendingContent.needsDisplay;
-    if (!m_currentContent.needsDisplay)
-        m_currentContent.needsDisplayRect.unite(pendingContent.needsDisplayRect);
-
-    m_transform.setPosition(m_state.pos);
-    m_transform.setAnchorPoint(m_state.anchorPoint);
-    m_transform.setSize(m_state.size);
-    m_transform.setFlattening(!m_state.preserves3D);
-    m_transform.setChildrenTransform(m_state.childrenTransform);
-}
-
-bool TextureMapperNode::descendantsOrSelfHaveRunningAnimations() const
-{
-    if (m_animations.hasRunningAnimations())
-        return true;
-
-    for (size_t i = 0; i < m_children.size(); ++i) {
-        if (m_children[i]->descendantsOrSelfHaveRunningAnimations())
-            return true;
-    }
-
-    return false;
-}
-
-void TextureMapperNode::syncAnimations()
-{
-    m_animations.apply(this);
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
-        setTransform(m_state.transform);
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
-        setOpacity(m_state.opacity);
-}
-
-void TextureMapperNode::syncAnimationsRecursively()
-{
-    syncAnimations();
-
-    for (int i = m_children.size() - 1; i >= 0; --i)
-        m_children[i]->syncAnimationsRecursively();
-}
-
-void TextureMapperNode::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper, int options)
-{
-    if (graphicsLayer && !(options & ComputationsOnly)) {
-        syncCompositingStateSelf(graphicsLayer, textureMapper);
-        graphicsLayer->didSynchronize();
-    }
-
-    if (graphicsLayer && m_state.maskLayer) {
-        m_state.maskLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->maskLayer()), textureMapper);
-
-        // A mask layer has its parent's size by default, in case it's not set specifically.
-        if (m_state.maskLayer->m_size.isEmpty())
-            m_state.maskLayer->m_size = m_size;
-    }
-
-    if (m_state.replicaLayer)
-        m_state.replicaLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->replicaLayer()), textureMapper);
-
-    syncAnimations();
-    computeTiles();
-
-    if (graphicsLayer)
-        renderContent(textureMapper, graphicsLayer);
-
-    if (!(options & TraverseDescendants))
-        options = ComputationsOnly;
-
-    if (graphicsLayer) {
-        Vector<GraphicsLayer*> children = graphicsLayer->children();
-        for (int i = children.size() - 1; i >= 0; --i) {
-            TextureMapperNode* node = toTextureMapperNode(children[i]);
-            if (!node)
-                continue;
-            node->syncCompositingState(toGraphicsLayerTextureMapper(children[i]), textureMapper, options);
-        }
-    } else {
-        for (int i = m_children.size() - 1; i >= 0; --i)
-            m_children[i]->syncCompositingState(0, textureMapper, options);
-    }
-}
-
-}
-#endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
index 1b29290d6..c69c1fbca 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
@@ -20,7 +20,6 @@
 #ifndef TextureMapperPlatformLayer_h
 #define TextureMapperPlatformLayer_h
 
-#include "FloatRect.h"
 #include "TransformationMatrix.h"
 
 namespace WebCore {
@@ -30,7 +29,8 @@ class BitmapTexture;
 
 class TextureMapperPlatformLayer {
 public:
-    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix& modelViewMatrix = TransformationMatrix(), float opacity = 1.0, BitmapTexture* mask = 0) const = 0;
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix& modelViewMatrix = TransformationMatrix(), float opacity = 1.0, BitmapTexture* mask = 0) = 0;
+    virtual void swapBuffers() { }
 };
 
 };
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
new file mode 100644
index 000000000..3eb34d16e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
@@ -0,0 +1,195 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TextureMapperShaderManager.h"
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+
+namespace WebCore {
+
+#ifndef TEXMAP_OPENGL_ES_2
+#define OES2_PRECISION_DEFINITIONS \
+    "#define lowp\n#define highp\n"
+#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION
+#else
+#define OES2_PRECISION_DEFINITIONS
+#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION \
+    "precision mediump float; \n"
+#endif
+
+#define VERTEX_SHADER(src...) OES2_PRECISION_DEFINITIONS#src
+#define FRAGMENT_SHADER(src...) OES2_PRECISION_DEFINITIONS\
+                                OES2_FRAGMENT_SHADER_DEFAULT_PRECISION\
+                                #src
+
+static const char* fragmentShaderSourceOpacityAndMask =
+    FRAGMENT_SHADER(
+        uniform sampler2D SourceTexture, MaskTexture;
+        uniform lowp float Opacity;
+        varying highp vec2 OutTexCoordSource, OutTexCoordMask;
+        void main(void)
+        {
+            lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
+            lowp vec4 maskColor = texture2D(MaskTexture, OutTexCoordMask);
+            lowp float fragmentAlpha = Opacity * maskColor.a;
+            gl_FragColor = vec4(color.rgb * fragmentAlpha, color.a * fragmentAlpha);
+        }
+    );
+
+static const char* vertexShaderSourceOpacityAndMask =
+    VERTEX_SHADER(
+        uniform mat4 InMatrix, InSourceMatrix, InMaskMatrix;
+        attribute vec4 InVertex;
+        varying highp vec2 OutTexCoordSource, OutTexCoordMask;
+        void main(void)
+        {
+            OutTexCoordSource = vec2(InSourceMatrix * InVertex);
+            OutTexCoordMask = vec2(InMaskMatrix * InVertex);
+            gl_Position = InMatrix * InVertex;
+        }
+    );
+
+static const char* fragmentShaderSourceSimple =
+    FRAGMENT_SHADER(
+        uniform sampler2D SourceTexture;
+        uniform lowp float Opacity;
+        varying highp vec2 OutTexCoordSource;
+        void main(void)
+        {
+            lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
+            gl_FragColor = vec4(color.rgb * Opacity, color.a * Opacity);
+        }
+    );
+
+static const char* vertexShaderSourceSimple =
+    VERTEX_SHADER(
+        uniform mat4 InMatrix, InSourceMatrix;
+        attribute vec4 InVertex;
+        varying highp vec2 OutTexCoordSource;
+        void main(void)
+        {
+            OutTexCoordSource = vec2(InSourceMatrix * InVertex);
+            gl_Position = InMatrix * InVertex;
+        }
+    );
+
+void TextureMapperShaderProgram::initializeProgram()
+{
+    const char* vertexShaderSourceProgram = vertexShaderSource();
+    const char* fragmentShaderSourceProgram = fragmentShaderSource();
+    GLuint vertexShader = glCreateShader(GL_VERTEX_SHADER);
+    GLuint fragmentShader = glCreateShader(GL_FRAGMENT_SHADER);
+    glShaderSource(vertexShader, 1, &vertexShaderSourceProgram, 0);
+    glShaderSource(fragmentShader, 1, &fragmentShaderSourceProgram, 0);
+    GLuint programID = glCreateProgram();
+    glCompileShader(vertexShader);
+    glCompileShader(fragmentShader);
+    glAttachShader(programID, vertexShader);
+    glAttachShader(programID, fragmentShader);
+    glLinkProgram(programID);
+
+    m_vertexAttrib = glGetAttribLocation(programID, "InVertex");
+    m_id = programID;
+    m_vertexShader = vertexShader;
+    m_fragmentShader = fragmentShader;
+}
+
+void TextureMapperShaderProgram::getUniformLocation(GLint &variable, const char* name)
+{
+    variable = glGetUniformLocation(m_id, name);
+    ASSERT(variable >= 0);
+}
+
+TextureMapperShaderProgram::~TextureMapperShaderProgram()
+{
+    GLuint programID = m_id;
+    if (!programID)
+        return;
+
+    glDetachShader(programID, m_vertexShader);
+    glDeleteShader(m_vertexShader);
+    glDetachShader(programID, m_fragmentShader);
+    glDeleteShader(m_fragmentShader);
+    glDeleteProgram(programID);
+}
+
+PassRefPtr<TextureMapperShaderProgramSimple> TextureMapperShaderProgramSimple::create()
+{
+    return adoptRef(new TextureMapperShaderProgramSimple());
+}
+
+TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple()
+{
+    initializeProgram();
+    getUniformLocation(m_sourceMatrixVariable, "InSourceMatrix");
+    getUniformLocation(m_matrixVariable, "InMatrix");
+    getUniformLocation(m_sourceTextureVariable, "SourceTexture");
+    getUniformLocation(m_opacityVariable, "Opacity");
+}
+
+const char* TextureMapperShaderProgramSimple::vertexShaderSource()
+{
+    return vertexShaderSourceSimple;
+}
+
+const char* TextureMapperShaderProgramSimple::fragmentShaderSource()
+{
+    return fragmentShaderSourceSimple;
+}
+
+PassRefPtr<TextureMapperShaderProgramOpacityAndMask> TextureMapperShaderProgramOpacityAndMask::create()
+{
+    return adoptRef(new TextureMapperShaderProgramOpacityAndMask());
+}
+
+TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMask()
+{
+    initializeProgram();
+    getUniformLocation(m_matrixVariable, "InMatrix");
+    getUniformLocation(m_sourceMatrixVariable, "InSourceMatrix");
+    getUniformLocation(m_maskMatrixVariable, "InMaskMatrix");
+    getUniformLocation(m_sourceTextureVariable, "SourceTexture");
+    getUniformLocation(m_maskTextureVariable, "MaskTexture");
+    getUniformLocation(m_opacityVariable, "Opacity");
+}
+
+const char* TextureMapperShaderProgramOpacityAndMask::vertexShaderSource()
+{
+    return vertexShaderSourceOpacityAndMask;
+}
+
+const char* TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource()
+{
+    return fragmentShaderSourceOpacityAndMask;
+}
+
+TextureMapperShaderManager::TextureMapperShaderManager()
+{
+    ASSERT(initializeOpenGLShims());
+}
+
+TextureMapperShaderManager::~TextureMapperShaderManager()
+{
+    m_textureMapperShaderProgramMap.clear();
+}
+
+};
+
+#endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
new file mode 100644
index 000000000..53aeaaacc
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
@@ -0,0 +1,134 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TextureMapperShaderManager_h
+#define TextureMapperShaderManager_h
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+
+#include "FloatQuad.h"
+#include "IntSize.h"
+#include "OpenGLShims.h"
+#include "TextureMapper.h"
+#include "TransformationMatrix.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+typedef void* ShaderType;
+
+class TextureMapperShaderManager;
+
+class TextureMapperShaderProgram : public RefCounted<TextureMapperShaderProgram> {
+public:
+    GLuint id() { return m_id; }
+    GLuint vertexAttrib() { return m_vertexAttrib; }
+
+    virtual ~TextureMapperShaderProgram();
+
+    template<class T>
+    static ShaderType shaderType()
+    {
+        static int type = 0;
+        return &type;
+    }
+
+protected:
+    void getUniformLocation(GLint& var, const char* name);
+    void initializeProgram();
+    virtual const char* vertexShaderSource() = 0;
+    virtual const char* fragmentShaderSource() = 0;
+
+    GLuint m_id;
+    GLuint m_vertexAttrib;
+    GLuint m_vertexShader;
+    GLuint m_fragmentShader;
+};
+
+class TextureMapperShaderProgramSimple : public TextureMapperShaderProgram {
+public:
+    static PassRefPtr<TextureMapperShaderProgramSimple> create();
+    GLint matrixVariable() { return m_matrixVariable; }
+    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
+    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
+    GLint opacityVariable() { return m_opacityVariable; }
+
+private:
+    virtual const char* vertexShaderSource();
+    virtual const char* fragmentShaderSource();
+    TextureMapperShaderProgramSimple();
+    GLint m_matrixVariable;
+    GLint m_sourceMatrixVariable;
+    GLint m_sourceTextureVariable;
+    GLint m_opacityVariable;
+};
+
+class TextureMapperShaderProgramOpacityAndMask : public TextureMapperShaderProgram {
+public:
+    static PassRefPtr<TextureMapperShaderProgramOpacityAndMask> create();
+    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
+    GLint matrixVariable() { return m_matrixVariable; }
+    GLint maskMatrixVariable() { return m_maskMatrixVariable; }
+    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
+    GLint maskTextureVariable() { return m_maskTextureVariable; }
+    GLint opacityVariable() { return m_opacityVariable; }
+
+private:
+    static int m_classID;
+    virtual const char* vertexShaderSource();
+    virtual const char* fragmentShaderSource();
+    TextureMapperShaderProgramOpacityAndMask();
+    GLint m_sourceMatrixVariable;
+    GLint m_matrixVariable;
+    GLint m_maskMatrixVariable;
+    GLint m_sourceTextureVariable;
+    GLint m_maskTextureVariable;
+    GLint m_opacityVariable;
+};
+
+class TextureMapperShaderManager {
+public:
+    TextureMapperShaderManager();
+    virtual ~TextureMapperShaderManager();
+
+    template<class T>
+    PassRefPtr<T> getShaderProgram()
+    {
+        ShaderType shaderType = TextureMapperShaderProgram::shaderType<T>();
+        TextureMapperShaderProgramMap::iterator it = m_textureMapperShaderProgramMap.find(shaderType);
+        if (it != m_textureMapperShaderProgramMap.end())
+            return static_cast<T*>(it->second.get());
+
+        RefPtr<T> t = T::create();
+        m_textureMapperShaderProgramMap.add(shaderType, t);
+        return t;
+    }
+
+private:
+    typedef HashMap<ShaderType, RefPtr<TextureMapperShaderProgram> > TextureMapperShaderProgramMap;
+    TextureMapperShaderProgramMap m_textureMapperShaderProgramMap;
+};
+
+}
+
+#endif
+
+#endif // TextureMapperShaderManager_h
diff --git a/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp
new file mode 100644
index 000000000..c1db006a8
--- /dev/null
+++ b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2012 ChangSeok Oh <shivamidow@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA
+ */
+
+#include "config.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystemGtk.h"
+
+#include "AsyncFileSystemCallbacks.h"
+#include "ExceptionCode.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+bool AsyncFileSystem::isAvailable()
+{
+    notImplemented();
+    return false;
+}
+
+bool AsyncFileSystem::isValidType(Type type)
+{
+    notImplemented();
+    return false;
+}
+
+PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(Type type)
+{
+    return adoptPtr(new AsyncFileSystemGtk(type));
+}
+
+void AsyncFileSystem::openFileSystem(const String& basePath, const String& storageIdentifier, Type type, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+    callbacks->didFail(NOT_SUPPORTED_ERR);
+}
+
+bool AsyncFileSystem::crackFileSystemURL(const KURL& url, AsyncFileSystem::Type& type, String& filePath)
+{
+    notImplemented();
+    return false;
+}
+
+AsyncFileSystemGtk::AsyncFileSystemGtk(AsyncFileSystem::Type type)
+    : AsyncFileSystem(type)
+{
+    notImplemented();
+}
+
+AsyncFileSystemGtk::~AsyncFileSystemGtk()
+{
+    notImplemented();
+}
+
+String AsyncFileSystemGtk::toURL(const String& originString, const String& fullPath)
+{
+    notImplemented();
+    return String();
+}
+
+void AsyncFileSystemGtk::move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+
+void AsyncFileSystemGtk::createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/gtk/AsyncFileSystemGtk.h b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.h
new file mode 100644
index 000000000..cb45b6ea4
--- /dev/null
+++ b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 ChangSeok Oh <shivamidow@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA
+ */
+
+#ifndef  AsyncFileSystemGtk_h
+#define  AsyncFileSystemGtk_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class AsyncFileSystemCallbacks;
+
+class AsyncFileSystemGtk : public AsyncFileSystem {
+public:
+    AsyncFileSystemGtk(AsyncFileSystem::Type);
+    virtual ~AsyncFileSystemGtk();
+
+    virtual String toURL(const String& originString, const String& fullPath);
+    virtual void move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createWriter(AsyncFileWriterClient*, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif //  AsyncFileSystemGtk_h
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.cpp b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
index b1d2b5269..b20216760 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.cpp
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
@@ -18,6 +18,7 @@
 #include "ClipboardGtk.h"
 
 #include "CachedImage.h"
+#include "DOMStringList.h"
 #include "DragData.h"
 #include "Editor.h"
 #include "Element.h"
@@ -189,33 +190,33 @@ bool ClipboardGtk::setData(const String& typeString, const String& data)
     return success;
 }
 
-HashSet<String> ClipboardGtk::types() const
+PassRefPtr<DOMStringList> ClipboardGtk::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return HashSet<String>();
+        return DOMStringList::create();
 
     if (m_clipboard)
         PasteboardHelper::defaultPasteboardHelper()->getClipboardContents(m_clipboard);
 
-    HashSet<String> types;
+    RefPtr<DOMStringList> types = DOMStringList::create();
     if (m_dataObject->hasText()) {
-        types.add("text/plain");
-        types.add("Text");
-        types.add("text");
+        types->append("text/plain");
+        types->append("Text");
+        types->append("text");
     }
 
     if (m_dataObject->hasMarkup())
-        types.add("text/html");
+        types->append("text/html");
 
     if (m_dataObject->hasURIList()) {
-        types.add("text/uri-list");
-        types.add("URL");
+        types->append("text/uri-list");
+        types->append("URL");
     }
 
     if (m_dataObject->hasFilenames())
-        types.add("Files");
+        types->append("Files");
 
-    return types;
+    return types.release();
 }
 
 PassRefPtr<FileList> ClipboardGtk::files() const
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.h b/Source/WebCore/platform/gtk/ClipboardGtk.h
index d8b751825..b72e1c81b 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.h
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.h
@@ -57,7 +57,7 @@ namespace WebCore {
         String getData(const String&, bool&) const;
         bool setData(const String&, const String&);
 
-        virtual HashSet<String> types() const;
+        virtual PassRefPtr<DOMStringList> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/gtk/ContextMenuGtk.cpp b/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
index 6f168fedc..51072f7f5 100644
--- a/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
+++ b/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
@@ -75,6 +75,14 @@ PlatformMenuDescription ContextMenu::releasePlatformDescription()
     return description;
 }
 
+unsigned ContextMenu::itemCount() const
+{
+    ASSERT(m_platformDescription);
+
+    GOwnPtr<GList> children(gtk_container_get_children(GTK_CONTAINER(m_platformDescription)));
+    return g_list_length(children.get());
+}
+
 Vector<ContextMenuItem> contextMenuItemVector(const PlatformMenuDescription menu)
 {
     Vector<ContextMenuItem> menuItemVector;
diff --git a/Source/WebCore/platform/gtk/FileSystemGtk.cpp b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
index fc9d4bfc5..950d61823 100644
--- a/Source/WebCore/platform/gtk/FileSystemGtk.cpp
+++ b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
@@ -190,6 +190,26 @@ CString applicationDirectoryPath()
     return dirname.get();
 }
 
+CString sharedResourcesPath()
+{
+    static CString cachedPath;
+    if (!cachedPath.isNull())
+        return cachedPath;
+
+#if OS(WINDOWS)
+    HMODULE hmodule = 0;
+    GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, reinterpret_cast<char*>(sharedResourcesPath), &hmodule);
+
+    GOwnPtr<gchar> runtimeDir(g_win32_get_package_installation_directory_of_module(hmodule));
+    GOwnPtr<gchar> dataPath(g_build_filename(runtimeDir.get(), "share", "webkitgtk-"WEBKITGTK_API_VERSION_STRING, NULL));
+#else
+    GOwnPtr<gchar> dataPath(g_build_filename(DATA_DIR, "webkitgtk-"WEBKITGTK_API_VERSION_STRING, NULL));
+#endif
+
+    cachedPath = dataPath.get();
+    return cachedPath;
+}
+
 uint64_t getVolumeFreeSizeForPath(const char* path)
 {
     GRefPtr<GFile> file = adoptGRef(g_file_new_for_path(path));
diff --git a/Source/WebCore/platform/gtk/GtkPluginWidget.cpp b/Source/WebCore/platform/gtk/GtkPluginWidget.cpp
index 82023592a..4cf1b680d 100644
--- a/Source/WebCore/platform/gtk/GtkPluginWidget.cpp
+++ b/Source/WebCore/platform/gtk/GtkPluginWidget.cpp
@@ -41,6 +41,11 @@ GtkPluginWidget::GtkPluginWidget(GtkWidget* widget)
     gtk_widget_hide(widget);
 }
 
+GtkPluginWidget::~GtkPluginWidget()
+{
+    gtk_container_remove(GTK_CONTAINER(gtk_widget_get_parent(platformWidget())), platformWidget());
+}
+
 void GtkPluginWidget::invalidateRect(const IntRect& coreRect)
 {
     /* no need to */
@@ -66,49 +71,4 @@ void GtkPluginWidget::frameRectsChanged()
     gtk_widget_show(platformWidget());
 }
 
-void GtkPluginWidget::paint(GraphicsContext* context, const IntRect& rect)
-{
-    if (!context->gdkExposeEvent())
-        return;
-
-    /* only paint widgets with no window this way */
-    if (gtk_widget_get_has_window(platformWidget()))
-        return;
-
-    GtkWidget* widget = platformWidget();
-    ASSERT(!gtk_widget_get_has_window(widget));
-
-    GdkEvent* event = gdk_event_new(GDK_EXPOSE);
-    event->expose = *context->gdkExposeEvent();
-    event->expose.area = static_cast<GdkRectangle>(rect);
-
-    IntPoint loc = parent()->contentsToWindow(rect.location());
-
-    event->expose.area.x = loc.x();
-    event->expose.area.y = loc.y();
-
-#ifdef GTK_API_VERSION_2
-    event->expose.region = gdk_region_rectangle(&event->expose.area);
-#else
-    event->expose.region = cairo_region_create_rectangle(&event->expose.area);
-#endif
-
-    /*
-     * This will be unref'ed by gdk_event_free.
-     */
-    g_object_ref(event->expose.window);
-
-    /*
-     * If we are going to paint do the translation and GtkAllocation manipulation.
-     */
-#ifdef GTK_API_VERSION_2
-    if (!gdk_region_empty(event->expose.region))
-#else
-    if (!cairo_region_is_empty(event->expose.region))
-#endif
-        gtk_widget_send_expose(widget, event);
-
-    gdk_event_free(event);
-}
-
 }
diff --git a/Source/WebCore/platform/gtk/GtkPluginWidget.h b/Source/WebCore/platform/gtk/GtkPluginWidget.h
index cad346284..7373ec590 100644
--- a/Source/WebCore/platform/gtk/GtkPluginWidget.h
+++ b/Source/WebCore/platform/gtk/GtkPluginWidget.h
@@ -33,9 +33,9 @@ namespace WebCore {
     class GtkPluginWidget : public Widget {
     public:
         GtkPluginWidget(GtkWidget*);
+        virtual ~GtkPluginWidget();
         void invalidateRect(const IntRect&);
         void frameRectsChanged();
-        void paint(GraphicsContext*, const IntRect&);
     };
 }
 
diff --git a/Source/WebCore/platform/gtk/GtkPopupMenu.cpp b/Source/WebCore/platform/gtk/GtkPopupMenu.cpp
index b9112e9bf..fd7c84c53 100644
--- a/Source/WebCore/platform/gtk/GtkPopupMenu.cpp
+++ b/Source/WebCore/platform/gtk/GtkPopupMenu.cpp
@@ -178,9 +178,9 @@ bool GtkPopupMenu::typeAheadFind(GdkEventKey* event)
     // menulists.
     bool repeatingCharacter = unicodeCharacter != m_previousKeyEventCharacter;
     if (event->time - m_previousKeyEventTimestamp > gSearchTimeoutMs)
-        m_currentSearchString = String(static_cast<UChar*>(utf16String.get()), charactersWritten);
+        m_currentSearchString = String(reinterpret_cast<UChar*>(utf16String.get()), charactersWritten);
     else if (repeatingCharacter)
-        m_currentSearchString.append(String(static_cast<UChar*>(utf16String.get()), charactersWritten));
+        m_currentSearchString.append(String(reinterpret_cast<UChar*>(utf16String.get()), charactersWritten));
 
     m_previousKeyEventTimestamp = event->time;
     m_previousKeyEventCharacter = unicodeCharacter;
diff --git a/Source/WebCore/platform/gtk/KURLGtk.cpp b/Source/WebCore/platform/gtk/KURLGtk.cpp
index 47bc48b87..12d2b1883 100644
--- a/Source/WebCore/platform/gtk/KURLGtk.cpp
+++ b/Source/WebCore/platform/gtk/KURLGtk.cpp
@@ -20,6 +20,9 @@
 #include "KURL.h"
 
 #include "FileSystem.h"
+#include <gio/gio.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
 
 #include <glib.h>
@@ -28,13 +31,9 @@ namespace WebCore {
 
 String KURL::fileSystemPath() const
 {
-    gchar* filename = g_filename_from_uri(m_string.utf8().data(), 0, 0);
-    if (!filename)
-        return String();
-
-    String path = filenameToString(filename);
-    g_free(filename);
-    return path;
+    GRefPtr<GFile> file = adoptGRef(g_file_new_for_uri(m_string.utf8().data()));
+    GOwnPtr<char> filename(g_file_get_path(file.get()));
+    return filenameToString(filename.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index f1620a794..bb67eaf37 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -701,7 +701,7 @@ static bool stringByAdoptingFileSystemRepresentation(gchar* systemFilename, Stri
     return true;
 }
 
-String RenderThemeGtk::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed)
+String RenderThemeGtk::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed) const
 {
     if (width <= 0)
         return String();
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index ad7990ed2..c26f9c967 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -181,7 +181,7 @@ protected:
     virtual bool paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&);
 
 private:
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed);
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed) const;
 
     void platformInit();
     static void setTextInputBorders(RenderStyle*);
diff --git a/Source/WebCore/platform/gtk/WidgetGtk.cpp b/Source/WebCore/platform/gtk/WidgetGtk.cpp
index ba21226eb..203f3c9c7 100644
--- a/Source/WebCore/platform/gtk/WidgetGtk.cpp
+++ b/Source/WebCore/platform/gtk/WidgetGtk.cpp
@@ -58,18 +58,6 @@ Widget::~Widget()
 
 void Widget::setFocus(bool focused)
 {
-    if (!focused)
-        return;
-
-    GtkWidget* widget = platformWidget() ? platformWidget() : root()->hostWindow()->platformPageClient();
-    if (widget) {
-        gtk_widget_grab_focus(widget);
-        return;
-    }
-
-    // We are running WK2.
-    if (Frame* frame = Frame::frameForWidget(this))
-        frame->page()->chrome()->focus();
 }
 
 void Widget::setCursor(const Cursor& cursor)
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index 5b42490ab..f0fbe44ac 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -70,6 +70,7 @@ extern "C" {
 #endif
 
 #if defined(JCS_ALPHA_EXTENSIONS) && ASSUME_LITTLE_ENDIAN
+inline J_DCT_METHOD dctMethod() { return JDCT_IFAST; }
 #define TURBO_JPEG_RGB_SWIZZLE
 #if USE(SKIA) && (!SK_R32_SHIFT && SK_G32_SHIFT == 8 && SK_B32_SHIFT == 16)
 inline J_COLOR_SPACE rgbOutputColorSpace() { return JCS_EXT_RGBA; }
@@ -78,6 +79,7 @@ inline J_COLOR_SPACE rgbOutputColorSpace() { return JCS_EXT_BGRA; }
 #endif
 inline bool turboSwizzled(J_COLOR_SPACE colorSpace) { return colorSpace == rgbOutputColorSpace(); }
 #else
+inline J_DCT_METHOD dctMethod() { return JDCT_ISLOW; }
 inline J_COLOR_SPACE rgbOutputColorSpace() { return JCS_RGB; }
 #endif
 
@@ -291,7 +293,7 @@ public:
             // Set parameters for decompression.
             // FIXME -- Should reset dct_method and dither mode for final pass
             // of progressive JPEG.
-            m_info.dct_method =  JDCT_ISLOW;
+            m_info.dct_method = dctMethod();
             m_info.dither_mode = JDITHER_FS;
             m_info.do_fancy_upsampling = true;
             m_info.enable_2pass_quant = false;
diff --git a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
index 01b0dc5a4..eb3341cc5 100644
--- a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
+++ b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
@@ -136,7 +136,8 @@ static bool encodePixels(IntSize imageSize, unsigned char* inputPixels, bool pre
 
 #if defined(JCS_EXTENSIONS)
     if (premultiplied) {
-        cinfo.in_color_space = JCS_EXT_BGRX;
+        cinfo.in_color_space = SK_B32_SHIFT ? JCS_EXT_RGBX : JCS_EXT_BGRX;
+
         cinfo.input_components = 4;
 
         jpeg_set_defaults(&cinfo);
diff --git a/Source/WebCore/platform/mac/ClipboardMac.h b/Source/WebCore/platform/mac/ClipboardMac.h
index 24e9b8060..a84f289dc 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.h
+++ b/Source/WebCore/platform/mac/ClipboardMac.h
@@ -41,9 +41,9 @@ class FileList;
 class ClipboardMac : public Clipboard, public CachedImageClient {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassRefPtr<ClipboardMac> create(ClipboardType clipboardType, NSPasteboard *pasteboard, ClipboardAccessPolicy policy, Frame* frame)
+    static PassRefPtr<ClipboardMac> create(ClipboardType clipboardType, const String& pasteboardName, ClipboardAccessPolicy policy, Frame* frame)
     {
-        return adoptRef(new ClipboardMac(clipboardType, pasteboard, policy, frame));
+        return adoptRef(new ClipboardMac(clipboardType, pasteboardName, policy, frame));
     }
 
     virtual ~ClipboardMac();
@@ -56,7 +56,7 @@ public:
     virtual bool hasData();
     
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
@@ -72,14 +72,14 @@ public:
     
     // Methods for getting info in Cocoa's type system
     NSImage *dragNSImage(NSPoint&) const; // loc converted from dragLoc, based on whole image size
-    NSPasteboard *pasteboard() { return m_pasteboard.get(); }
+    const String& pasteboardName() { return m_pasteboardName; }
 
 private:
-    ClipboardMac(ClipboardType, NSPasteboard *, ClipboardAccessPolicy, Frame*);
+    ClipboardMac(ClipboardType, const String& pasteboardName, ClipboardAccessPolicy, Frame*);
 
     void setDragImage(CachedImage*, Node*, const IntPoint&);
 
-    RetainPtr<NSPasteboard> m_pasteboard;
+    String m_pasteboardName;
     int m_changeCount;
     Frame* m_frame; // used on the source side to generate dragging images
 };
diff --git a/Source/WebCore/platform/mac/ClipboardMac.mm b/Source/WebCore/platform/mac/ClipboardMac.mm
index d37c5f3f3..88eefcb53 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.mm
+++ b/Source/WebCore/platform/mac/ClipboardMac.mm
@@ -27,6 +27,7 @@
 #import "ClipboardMac.h"
 
 #import "DOMElementInternal.h"
+#import "DOMStringList.h"
 #import "DragClient.h"
 #import "DragController.h"
 #import "DragData.h"
@@ -36,6 +37,8 @@
 #import "Image.h"
 #import "Page.h"
 #import "Pasteboard.h"
+#import "PasteboardStrategy.h"
+#import "PlatformStrategies.h"
 #import "RenderImage.h"
 #import "ScriptExecutionContext.h"
 #import "SecurityOrigin.h"
@@ -46,15 +49,15 @@ namespace WebCore {
 
 PassRefPtr<Clipboard> Clipboard::create(ClipboardAccessPolicy policy, DragData* dragData, Frame* frame)
 {
-    return ClipboardMac::create(DragAndDrop, dragData->pasteboard(), policy, frame);
+    return ClipboardMac::create(DragAndDrop, dragData->pasteboardName(), policy, frame);
 }
 
-ClipboardMac::ClipboardMac(ClipboardType clipboardType, NSPasteboard *pasteboard, ClipboardAccessPolicy policy, Frame *frame)
+ClipboardMac::ClipboardMac(ClipboardType clipboardType, const String& pasteboardName, ClipboardAccessPolicy policy, Frame *frame)
     : Clipboard(policy, clipboardType)
-    , m_pasteboard(pasteboard)
+    , m_pasteboardName(pasteboardName)
     , m_frame(frame)
 {
-    m_changeCount = [m_pasteboard.get() changeCount];
+    m_changeCount = platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName);
 }
 
 ClipboardMac::~ClipboardMac()
@@ -63,10 +66,12 @@ ClipboardMac::~ClipboardMac()
 
 bool ClipboardMac::hasData()
 {
-    return m_pasteboard && [m_pasteboard.get() types] && [[m_pasteboard.get() types] count] > 0;
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return !types.isEmpty();
 }
     
-static RetainPtr<NSString> cocoaTypeFromHTMLClipboardType(const String& type)
+static String cocoaTypeFromHTMLClipboardType(const String& type)
 {
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html#dom-datatransfer-setdata
     String qType = type.lower();
@@ -78,27 +83,27 @@ static RetainPtr<NSString> cocoaTypeFromHTMLClipboardType(const String& type)
 
     // Ignore any trailing charset - JS strings are Unicode, which encapsulates the charset issue
     if (qType == "text/plain" || qType.startsWith("text/plain;"))
-        return NSStringPboardType;
+        return String(NSStringPboardType);
     if (qType == "text/uri-list")
         // special case because UTI doesn't work with Cocoa's URL type
-        return NSURLPboardType; // note special case in getData to read NSFilenamesType
+        return String(NSURLPboardType); // note special case in getData to read NSFilenamesType
 
     // Try UTI now
-    NSString *mimeType = qType;
-    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL));
+    String mimeType = qType;
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, mimeType.createCFString(), NULL));
     if (utiType) {
         CFStringRef pbType = UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassNSPboardType);
         if (pbType)
-            return (NSString *)pbType;
+            return pbType;
     }
 
     // No mapping, just pass the whole string though
-    return (NSString *)qType;
+    return qType;
 }
 
-static String utiTypeFromCocoaType(NSString *type)
+static String utiTypeFromCocoaType(const String& type)
 {
-    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL));
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, type.createCFString(), NULL));
     if (utiType) {
         RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassMIMEType));
         if (mimeType)
@@ -107,37 +112,38 @@ static String utiTypeFromCocoaType(NSString *type)
     return String();
 }
 
-static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
+static void addHTMLClipboardTypesForCocoaType(DOMStringList* resultTypes, const String& cocoaType, const String& pasteboardName)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([cocoaType isEqualToString:NSStringPboardType]) {
-        resultTypes.add("text/plain");
+    if (cocoaType == String(NSStringPboardType)) {
+        resultTypes->append("text/plain");
         return;
     }
-    if ([cocoaType isEqualToString:NSURLPboardType]) {
-        resultTypes.add("text/uri-list");
+    if (cocoaType == String(NSURLPboardType)) {
+        resultTypes->append("text/uri-list");
         return;
     }
-    if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+    if (cocoaType == String(NSFilenamesPboardType)) {
         // If file list is empty, add nothing.
         // Note that there is a chance that the file list count could have changed since we grabbed the types array.
         // However, this is not really an issue for us doing a sanity check here.
-        NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
-        if ([fileList count]) {
+        Vector<String> fileList;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(fileList, String(NSFilenamesPboardType), pasteboardName);
+        if (!fileList.isEmpty()) {
             // It is unknown if NSFilenamesPboardType always implies NSURLPboardType in Cocoa,
             // but NSFilenamesPboardType should imply both 'text/uri-list' and 'Files'
-            resultTypes.add("text/uri-list");
-            resultTypes.add("Files");
+            resultTypes->append("text/uri-list");
+            resultTypes->append("Files");
         }
         return;
     }
     String utiType = utiTypeFromCocoaType(cocoaType);
     if (!utiType.isEmpty()) {
-        resultTypes.add(utiType);
+        resultTypes->append(utiType);
         return;
     }
     // No mapping, just pass the whole string though
-    resultTypes.add(cocoaType);
+    resultTypes->append(cocoaType);
 }
 
 void ClipboardMac::clearData(const String& type)
@@ -147,8 +153,9 @@ void ClipboardMac::clearData(const String& type)
 
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    if (RetainPtr<NSString> cocoaType = cocoaTypeFromHTMLClipboardType(type))
-        [m_pasteboard.get() setString:@"" forType:cocoaType.get()];
+    String cocoaType = cocoaTypeFromHTMLClipboardType(type);
+    if (!cocoaType.isEmpty())
+        platformStrategies()->pasteboardStrategy()->setStringForType("", cocoaType, m_pasteboardName);
 }
 
 void ClipboardMac::clearAllData()
@@ -158,53 +165,51 @@ void ClipboardMac::clearAllData()
 
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
+    Pasteboard pasteboard(m_pasteboardName);
+    pasteboard.clear();
 }
 
-static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL = false)
+static Vector<String> absoluteURLsFromPasteboardFilenames(const String& pasteboardName, bool onlyFirstURL = false)
 {
-    NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
+    Vector<String> fileList;
+    platformStrategies()->pasteboardStrategy()->getPathnamesForType(fileList, String(NSFilenamesPboardType), pasteboardName);
 
-    // FIXME: Why does this code need to guard against bad values on the pasteboard?
-    ASSERT(!fileList || [fileList isKindOfClass:[NSArray class]]);
-    if (!fileList || ![fileList isKindOfClass:[NSArray class]] || ![fileList count])
-        return nil;
+    if (fileList.isEmpty())
+        return fileList;
 
-    NSUInteger count = onlyFirstURL ? 1 : [fileList count];
-    NSMutableArray *urls = [NSMutableArray array];
-    for (NSUInteger i = 0; i < count; i++) {
-        NSString *string = [fileList objectAtIndex:i];
-
-        ASSERT([string isKindOfClass:[NSString class]]);  // Added to understand why this if code is here
-        if (![string isKindOfClass:[NSString class]])
-            return nil; // Non-string object in the list, bail out!  FIXME: When can this happen?
-
-        NSURL *url = [NSURL fileURLWithPath:string];
-        [urls addObject:[url absoluteString]];
+    size_t count = onlyFirstURL ? 1 : fileList.size();
+    Vector<String> urls;
+    for (size_t i = 0; i < count; i++) {
+        NSURL *url = [NSURL fileURLWithPath:fileList[i]];
+        urls.append(String([url absoluteString]));
     }
     return urls;
 }
 
-static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL = false)
+static Vector<String> absoluteURLsFromPasteboard(const String& pasteboardName, bool onlyFirstURL = false)
 {
     // NOTE: We must always check [availableTypes containsObject:] before accessing pasteboard data
     // or CoreFoundation will printf when there is not data of the corresponding type.
-    NSArray *availableTypes = [pasteboard types];
+    Vector<String> availableTypes;
+    Vector<String> absoluteURLs;
+    platformStrategies()->pasteboardStrategy()->getTypes(availableTypes, pasteboardName);
 
     // Try NSFilenamesPboardType because it contains a list
-    if ([availableTypes containsObject:NSFilenamesPboardType]) {
-        if (NSArray* absoluteURLs = absoluteURLsFromPasteboardFilenames(pasteboard, onlyFirstURL))
+    if (availableTypes.contains(String(NSFilenamesPboardType))) {
+        absoluteURLs = absoluteURLsFromPasteboardFilenames(pasteboardName, onlyFirstURL);
+        if (!absoluteURLs.isEmpty())
             return absoluteURLs;
     }
 
     // Fallback to NSURLPboardType (which is a single URL)
-    if ([availableTypes containsObject:NSURLPboardType]) {
-        if (NSURL *url = [NSURL URLFromPasteboard:pasteboard])
-            return [NSArray arrayWithObject:[url absoluteString]];
+    if (availableTypes.contains(String(NSURLPboardType))) {
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(absoluteURLs, String(NSURLPboardType), pasteboardName);
+        if (!absoluteURLs.isEmpty())
+            return absoluteURLs;
     }
 
     // No file paths on the pasteboard, return nil
-    return nil;
+    return Vector<String>();
 }
 
 String ClipboardMac::getData(const String& type, bool& success) const
@@ -213,23 +218,24 @@ String ClipboardMac::getData(const String& type, bool& success) const
     if (policy() != ClipboardReadable)
         return String();
 
-    RetainPtr<NSString> cocoaType = cocoaTypeFromHTMLClipboardType(type);
-    NSString *cocoaValue = nil;
+    const String& cocoaType = cocoaTypeFromHTMLClipboardType(type);
+    String cocoaValue;
 
     // Grab the value off the pasteboard corresponding to the cocoaType
-    if ([cocoaType.get() isEqualToString:NSURLPboardType]) {
+    if (cocoaType == String(NSURLPboardType)) {
         // "url" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromHTMLClipboardType(), "url" only wants the first URL
         bool onlyFirstURL = (equalIgnoringCase(type, "url"));
-        NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get(), onlyFirstURL);
-        cocoaValue = [absoluteURLs componentsJoinedByString:@"\n"];
-    } else if ([cocoaType.get() isEqualToString:NSStringPboardType]) {
-        cocoaValue = [[m_pasteboard.get() stringForType:cocoaType.get()] precomposedStringWithCanonicalMapping];
-    } else if (cocoaType)
-        cocoaValue = [m_pasteboard.get() stringForType:cocoaType.get()];
+        Vector<String> absoluteURLs = absoluteURLsFromPasteboard(m_pasteboardName, onlyFirstURL);
+        for (size_t i = 0; i < absoluteURLs.size(); i++)
+            cocoaValue = i ? "\n" + absoluteURLs[i]: absoluteURLs[i];
+    } else if (cocoaType == String(NSStringPboardType))
+        cocoaValue = [platformStrategies()->pasteboardStrategy()->stringForType(cocoaType, m_pasteboardName) precomposedStringWithCanonicalMapping];
+    else if (!cocoaType.isEmpty())
+        cocoaValue = platformStrategies()->pasteboardStrategy()->stringForType(cocoaType, m_pasteboardName);
 
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
-    if (cocoaValue && m_changeCount == [m_pasteboard.get() changeCount]) {
+    if (!cocoaValue.isEmpty() && m_changeCount == platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName)) {
         success = true;
         return cocoaValue;
     }
@@ -243,58 +249,65 @@ bool ClipboardMac::setData(const String &type, const String &data)
         return false;
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    RetainPtr<NSString> cocoaType = cocoaTypeFromHTMLClipboardType(type);
-    NSString *cocoaData = data;
+    const String& cocoaType = cocoaTypeFromHTMLClipboardType(type);
+    String cocoaData = data;
 
-    if ([cocoaType.get() isEqualToString:NSURLPboardType]) {
-        [m_pasteboard.get() addTypes:[NSArray arrayWithObject:NSURLPboardType] owner:nil];
+    if (cocoaType == String(NSURLPboardType)) {
+        Vector<String> types;
+        types.append(String(NSURLPboardType));
+
+        platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+        platformStrategies()->pasteboardStrategy()->setStringForType(cocoaData, String(NSURLPboardType), m_pasteboardName);
         NSURL *url = [[NSURL alloc] initWithString:cocoaData];
-        [url writeToPasteboard:m_pasteboard.get()];
 
         if ([url isFileURL] && m_frame->document()->securityOrigin()->canLoadLocalResources()) {
-            [m_pasteboard.get() addTypes:[NSArray arrayWithObject:NSFilenamesPboardType] owner:nil];
-            NSArray *fileList = [NSArray arrayWithObject:[url path]];
-            [m_pasteboard.get() setPropertyList:fileList forType:NSFilenamesPboardType];
+            types.append(String(NSFilenamesPboardType));
+            platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+            Vector<String> fileList;
+            fileList.append(String([url path]));
+            platformStrategies()->pasteboardStrategy()->setPathnamesForType(fileList, String(NSFilenamesPboardType), m_pasteboardName);
         }
 
         [url release];
         return true;
     }
 
-    if (cocoaType) {
+    if (!cocoaType.isEmpty()) {
         // everything else we know of goes on the pboard as a string
-        [m_pasteboard.get() addTypes:[NSArray arrayWithObject:cocoaType.get()] owner:nil];
-        return [m_pasteboard.get() setString:cocoaData forType:cocoaType.get()];
+        Vector<String> types;
+        types.append(cocoaType);
+        platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+        platformStrategies()->pasteboardStrategy()->setStringForType(cocoaData, cocoaType, m_pasteboardName);
+        return true;
     }
 
     return false;
 }
 
-HashSet<String> ClipboardMac::types() const
+PassRefPtr<DOMStringList> ClipboardMac::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return HashSet<String>();
+        return DOMStringList::create();
 
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
 
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
-    if (m_changeCount != [m_pasteboard.get() changeCount])
-        return HashSet<String>();
+    if (m_changeCount != platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName))
+        return DOMStringList::create();
 
-    HashSet<String> result;
-    NSUInteger count = [types count];
+    RefPtr<DOMStringList> result = DOMStringList::create();
     // FIXME: This loop could be split into two stages. One which adds all the HTML5 specified types
     // and a second which adds all the extra types from the cocoa clipboard (which is Mac-only behavior).
-    for (NSUInteger i = 0; i < count; i++) {
-        NSString *pbType = [types objectAtIndex:i];
-        if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
+    for (size_t i = 0; i < types.size(); i++) {
+        if (types[i] == "NeXT plain ascii pasteboard type")
             continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-        addHTMLClipboardTypesForCocoaType(result, pbType, m_pasteboard.get());
+        addHTMLClipboardTypesForCocoaType(result.get(), types[i], m_pasteboardName);
     }
 
-    return result;
+    return result.release();
 }
 
 // FIXME: We could cache the computed fileList if necessary
@@ -305,12 +318,11 @@ PassRefPtr<FileList> ClipboardMac::files() const
     if (policy() != ClipboardReadable)
         return FileList::create();
 
-    NSArray *absoluteURLs = absoluteURLsFromPasteboardFilenames(m_pasteboard.get());
-    NSUInteger count = [absoluteURLs count];
+    Vector<String> absoluteURLs = absoluteURLsFromPasteboardFilenames(m_pasteboardName);
 
     RefPtr<FileList> fileList = FileList::create();
-    for (NSUInteger x = 0; x < count; x++) {
-        NSURL *absoluteURL = [NSURL URLWithString:[absoluteURLs objectAtIndex:x]];
+    for (size_t i = 0; i < absoluteURLs.size(); i++) {
+        NSURL *absoluteURL = [NSURL URLWithString:absoluteURLs[i]];
         ASSERT([absoluteURL isFileURL]);
         fileList->append(File::create([absoluteURL path]));
     }
@@ -341,7 +353,7 @@ void ClipboardMac::setDragImage(CachedImage* image, Node *node, const IntPoint &
         m_dragLoc = loc;
         m_dragImageElement = node;
         
-        if (dragStarted() && m_changeCount == [m_pasteboard.get() changeCount]) {
+        if (dragStarted() && m_changeCount == platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName)) {
             NSPoint cocoaLoc;
             NSImage* cocoaImage = dragNSImage(cocoaLoc);
             if (cocoaImage) {
@@ -367,21 +379,21 @@ void ClipboardMac::writeRange(Range* range, Frame* frame)
 {
     ASSERT(range);
     ASSERT(frame);
-    Pasteboard pasteboard([m_pasteboard.get() name]);
+    Pasteboard pasteboard(m_pasteboardName);
     pasteboard.writeSelection(range, frame->editor()->smartInsertDeleteEnabled() && frame->selection()->granularity() == WordGranularity, frame);
 }
 
 void ClipboardMac::writePlainText(const String& text)
 {
-    Pasteboard pasteboard([m_pasteboard.get() name]);
+    Pasteboard pasteboard(m_pasteboardName);
     pasteboard.writePlainText(text);
 }
 
 void ClipboardMac::writeURL(const KURL& url, const String& title, Frame* frame)
 {   
     ASSERT(frame);
-    ASSERT(m_pasteboard);
-    Pasteboard pasteboard([m_pasteboard.get() name]);
+    ASSERT(m_pasteboardName);
+    Pasteboard pasteboard(m_pasteboardName);
     pasteboard.writeURL(url, title, frame);
 }
     
@@ -390,7 +402,7 @@ void ClipboardMac::declareAndWriteDragImage(Element* element, const KURL& url, c
 {
     ASSERT(frame);
     if (Page* page = frame->page())
-        page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), kit(element), url, title, frame);
+        page->dragController()->client()->declareAndWriteDragImage(m_pasteboardName, kit(element), url, title, frame);
 }
 #endif // ENABLE(DRAG_SUPPORT)
     
diff --git a/Source/WebCore/platform/mac/DragDataMac.mm b/Source/WebCore/platform/mac/DragDataMac.mm
index bec007bd4..61eac930e 100644
--- a/Source/WebCore/platform/mac/DragDataMac.mm
+++ b/Source/WebCore/platform/mac/DragDataMac.mm
@@ -36,6 +36,8 @@
 #import "Frame.h"
 #import "MIMETypeRegistry.h"
 #import "Pasteboard.h"
+#import "PasteboardStrategy.h"
+#import "PlatformStrategies.h"
 #import "Range.h"
 
 namespace WebCore {
@@ -47,7 +49,7 @@ DragData::DragData(DragDataRef data, const IntPoint& clientPosition, const IntPo
     , m_platformDragData(data)
     , m_draggingSourceOperationMask(sourceOperationMask)
     , m_applicationFlags(flags)
-    , m_pasteboard([m_platformDragData draggingPasteboard])
+    , m_pasteboardName([[m_platformDragData draggingPasteboard] name])
 {
 }
 
@@ -58,92 +60,78 @@ DragData::DragData(const String& dragStorageName, const IntPoint& clientPosition
     , m_platformDragData(0)
     , m_draggingSourceOperationMask(sourceOperationMask)
     , m_applicationFlags(flags)
-    , m_pasteboard([NSPasteboard pasteboardWithName:dragStorageName])
+    , m_pasteboardName(dragStorageName)
 {
 }
     
 bool DragData::canSmartReplace() const
 {
-    //Need to call this so that the various Pasteboard type strings are intialised
-    Pasteboard::generalPasteboard();
-    return [[m_pasteboard.get() types] containsObject:WebSmartPastePboardType];
+    return Pasteboard(m_pasteboardName).canSmartReplace();
 }
 
 bool DragData::containsColor() const
 {
-    return [[m_pasteboard.get() types] containsObject:NSColorPboardType];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(String(NSColorPboardType));
 }
 
 bool DragData::containsFiles() const
 {
-    return [[m_pasteboard.get() types] containsObject:NSFilenamesPboardType];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(String(NSFilenamesPboardType));
 }
 
 unsigned DragData::numberOfFiles() const
 {
-    if (![[m_pasteboard.get() types] containsObject:NSFilenamesPboardType])
-        return 0;
-    return [[m_pasteboard.get() propertyListForType:NSFilenamesPboardType] count];
+    Vector<String> files;
+    platformStrategies()->pasteboardStrategy()->getPathnamesForType(files, String(NSFilenamesPboardType), m_pasteboardName);
+    return files.size();
 }
 
 void DragData::asFilenames(Vector<String>& result) const
 {
-    NSArray *filenames = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-    NSEnumerator *fileEnumerator = [filenames objectEnumerator];
-    
-    while (NSString *filename = [fileEnumerator nextObject])
-        result.append(filename);
+    platformStrategies()->pasteboardStrategy()->getPathnamesForType(result, String(NSFilenamesPboardType), m_pasteboardName);
 }
 
 bool DragData::containsPlainText() const
 {
-    NSArray *types = [m_pasteboard.get() types];
-    
-    return [types containsObject:NSStringPboardType] 
-        || [types containsObject:NSRTFDPboardType]
-        || [types containsObject:NSRTFPboardType]
-        || [types containsObject:NSFilenamesPboardType]
-        || [NSURL URLFromPasteboard:m_pasteboard.get()];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+
+    return types.contains(String(NSStringPboardType))
+        || types.contains(String(NSRTFDPboardType))
+        || types.contains(String(NSRTFPboardType))
+        || types.contains(String(NSFilenamesPboardType))
+        || platformStrategies()->pasteboardStrategy()->stringForType(String(NSURLPboardType), m_pasteboardName).length();
 }
 
 String DragData::asPlainText(Frame *frame) const
 {
-    Pasteboard pasteboard([m_pasteboard.get() name]);
-    return pasteboard.plainText(frame);
+    return Pasteboard(m_pasteboardName).plainText(frame);
 }
 
 Color DragData::asColor() const
 {
-    NSColor *color = [NSColor colorFromPasteboard:m_pasteboard.get()];
-    
-    // The color may not be in an RGB colorspace. This commonly occurs when a color is 
-    // dragged from the NSColorPanel grayscale picker.
-    if ([[color colorSpace] colorSpaceModel] != NSRGBColorSpaceModel)
-        color = [color colorUsingColorSpaceName:NSCalibratedRGBColorSpace];
-    
-    return makeRGBA((int)([color redComponent] * 255.0 + 0.5), (int)([color greenComponent] * 255.0 + 0.5), 
-                    (int)([color blueComponent] * 255.0 + 0.5), (int)([color alphaComponent] * 255.0 + 0.5));
+    return platformStrategies()->pasteboardStrategy()->color(m_pasteboardName);
 }
 
-static NSArray *insertablePasteboardTypes()
-{
-    static NSArray *types = nil;
-    if (!types) {
-        types = [[NSArray alloc] initWithObjects:WebArchivePboardType, NSHTMLPboardType, NSFilenamesPboardType, NSTIFFPboardType, NSPDFPboardType,
-#ifdef BUILDING_ON_LEOPARD
-                 NSPICTPboardType,
-#endif
-                 NSURLPboardType, NSRTFDPboardType, NSRTFPboardType, NSStringPboardType, NSColorPboardType, kUTTypePNG, nil];
-        CFRetain(types);
-    }
-    return types;
-}
-    
 bool DragData::containsCompatibleContent() const
 {
-    NSMutableSet *types = [NSMutableSet setWithArray:[m_pasteboard.get() types]];
-    [types intersectSet:[NSSet setWithArray:insertablePasteboardTypes()]];
-    return [types count] != 0;
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(String(WebArchivePboardType))
+        || types.contains(String(NSHTMLPboardType))
+        || types.contains(String(NSFilenamesPboardType))
+        || types.contains(String(NSTIFFPboardType))
+        || types.contains(String(NSPDFPboardType))
+        || types.contains(String(NSURLPboardType))
+        || types.contains(String(NSRTFDPboardType))
+        || types.contains(String(NSRTFPboardType))
+        || types.contains(String(NSStringPboardType))
+        || types.contains(String(NSColorPboardType))
+        || types.contains(String(kUTTypePNG));
 }
     
 bool DragData::containsURL(Frame* frame, FilenameConversionPolicy filenamePolicy) const
@@ -157,39 +145,40 @@ String DragData::asURL(Frame* frame, FilenameConversionPolicy filenamePolicy, St
     (void)filenamePolicy;
 
     if (title) {
-        if (NSString *URLTitleString = [m_pasteboard.get() stringForType:WebURLNamePboardType])
+        String URLTitleString = platformStrategies()->pasteboardStrategy()->stringForType(String(WebURLNamePboardType), m_pasteboardName);
+        if (!URLTitleString.isEmpty())
             *title = URLTitleString;
     }
     
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
     
     // FIXME: using the editorClient to call into WebKit, for now, since 
     // calling webkit_canonicalize from WebCore involves migrating a sizable amount of 
     // helper code that should either be done in a separate patch or figured out in another way.
     
-    if ([types containsObject:NSURLPboardType]) {
-        NSURL *URLFromPasteboard = [NSURL URLFromPasteboard:m_pasteboard.get()];
+    if (types.contains(String(NSURLPboardType))) {
+        NSURL *URLFromPasteboard = [NSURL URLWithString:platformStrategies()->pasteboardStrategy()->stringForType(String(NSURLPboardType), m_pasteboardName)];
         NSString *scheme = [URLFromPasteboard scheme];
         if ([scheme isEqualToString:@"http"] || [scheme isEqualToString:@"https"]) {
             return [frame->editor()->client()->canonicalizeURL(URLFromPasteboard) absoluteString];
         }
     }
     
-    if ([types containsObject:NSStringPboardType]) {
-        NSString *URLString = [m_pasteboard.get() stringForType:NSStringPboardType];
-        NSURL *URL = frame->editor()->client()->canonicalizeURLString(URLString);
+    if (types.contains(String(NSStringPboardType))) {
+        NSURL *URL = frame->editor()->client()->canonicalizeURLString(platformStrategies()->pasteboardStrategy()->stringForType(String(NSStringPboardType), m_pasteboardName));
         if (URL)
             return [URL absoluteString];
     }
     
-    if ([types containsObject:NSFilenamesPboardType]) {
-        NSArray *files = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-        if ([files count] == 1) {
-            NSString *file = [files objectAtIndex:0];
+    if (types.contains(String(NSFilenamesPboardType))) {
+        Vector<String> files;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(files, String(NSFilenamesPboardType), m_pasteboardName);
+        if (files.size() == 1) {
             BOOL isDirectory;
-            if ([[NSFileManager defaultManager] fileExistsAtPath:file isDirectory:&isDirectory] && isDirectory)
+            if ([[NSFileManager defaultManager] fileExistsAtPath:files[0] isDirectory:&isDirectory] && isDirectory)
                 return String();
-            return [frame->editor()->client()->canonicalizeURL([NSURL fileURLWithPath:file]) absoluteString];
+            return [frame->editor()->client()->canonicalizeURL([NSURL fileURLWithPath:files[0]]) absoluteString];
         }
     }
     
@@ -198,9 +187,7 @@ String DragData::asURL(Frame* frame, FilenameConversionPolicy filenamePolicy, St
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range> range, bool allowPlainText, bool& chosePlainText) const
 {
-    Pasteboard pasteboard([m_pasteboard.get() name]);
-    
-    return pasteboard.documentFragment(frame, range, allowPlainText, chosePlainText);
+    return Pasteboard(m_pasteboardName).documentFragment(frame, range, allowPlainText, chosePlainText);
 }
     
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/Language.mm b/Source/WebCore/platform/mac/Language.mm
index 78ff1dd31..c15ff5ad9 100644
--- a/Source/WebCore/platform/mac/Language.mm
+++ b/Source/WebCore/platform/mac/Language.mm
@@ -56,33 +56,27 @@ static BOOL useCachedPreferredLanguages;
 
 namespace WebCore {
 
-static NSString *createHTTPStyleLanguageCode(NSString *languageCode)
+static String httpStyleLanguageCode(NSString *languageCode)
 {
     ASSERT(isMainThread());
 
     // Look up the language code using CFBundle.
-    CFStringRef preferredLanguageCode = wkCopyCFLocalizationPreferredName((CFStringRef)languageCode);
+    RetainPtr<CFStringRef> preferredLanguageCode(AdoptCF, wkCopyCFLocalizationPreferredName((CFStringRef)languageCode));
 
     if (preferredLanguageCode)
-        languageCode = (NSString *)preferredLanguageCode;
-    
+        languageCode = (NSString *)preferredLanguageCode.get();
+
     // Make the string lowercase.
     NSString *lowercaseLanguageCode = [languageCode lowercaseString];
-    
-    NSString *httpStyleLanguageCode;
-    
+
     // Turn a '_' into a '-' if it appears after a 2-letter language code.
     if ([lowercaseLanguageCode length] >= 3 && [lowercaseLanguageCode characterAtIndex:2] == '_') {
-        NSMutableString *mutableLanguageCode = [lowercaseLanguageCode mutableCopy];
-        [mutableLanguageCode replaceCharactersInRange:NSMakeRange(2, 1) withString:@"-"];
-        httpStyleLanguageCode = mutableLanguageCode;
-    } else
-        httpStyleLanguageCode = [lowercaseLanguageCode retain];
-    
-    if (preferredLanguageCode)
-        CFRelease(preferredLanguageCode);
+        RetainPtr<NSMutableString> mutableLanguageCode(AdoptNS, [lowercaseLanguageCode mutableCopy]);
+        [mutableLanguageCode.get() replaceCharactersInRange:NSMakeRange(2, 1) withString:@"-"];
+        return mutableLanguageCode.get();
+    }
 
-    return httpStyleLanguageCode;
+    return lowercaseLanguageCode;
 }
 
 Vector<String> platformUserPreferredLanguages()
@@ -103,7 +97,7 @@ Vector<String> platformUserPreferredLanguages()
             userPreferredLanguages.append("en");
         else {
             for (CFIndex i = 0; i < languageCount; i++)
-                userPreferredLanguages.append(createHTTPStyleLanguageCode((NSString *)CFArrayGetValueAtIndex(languages.get(), i)));
+                userPreferredLanguages.append(httpStyleLanguageCode((NSString *)CFArrayGetValueAtIndex(languages.get(), i)));
         }
     }
 
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index 877e0a6f7..6e4bda87d 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -56,59 +56,64 @@
 #import <wtf/StdLibExtras.h>
 #import <wtf/RetainPtr.h>
 #import <wtf/UnusedParam.h>
+#import <wtf/text/StringBuilder.h>
 #import <wtf/unicode/CharacterNames.h>
 
-@interface NSAttributedString (AppKitSecretsIKnowAbout)
-- (id)_initWithDOMRange:(DOMRange *)domRange;
-@end
+#if USE(PLATFORM_STRATEGIES)
+#include "PasteboardStrategy.h"
+#include "PlatformStrategies.h"
+#endif
+
 namespace WebCore {
 
 // FIXME: It's not great to have these both here and in WebKit.
-NSString *WebArchivePboardType = @"Apple Web Archive pasteboard type";
-NSString *WebSmartPastePboardType = @"NeXT smart paste pasteboard type";
-NSString *WebURLNamePboardType = @"public.url-name";
-NSString *WebURLPboardType = @"public.url";
-NSString *WebURLsWithTitlesPboardType = @"WebURLsWithTitlesPboardType";
+const char* WebArchivePboardType = "Apple Web Archive pasteboard type";
+const char* WebSmartPastePboardType = "NeXT smart paste pasteboard type";
+const char* WebURLNamePboardType = "public.url-name";
+const char* WebURLPboardType = "public.url";
+const char* WebURLsWithTitlesPboardType = "WebURLsWithTitlesPboardType";
 
-static NSArray* selectionPasteboardTypes(bool canSmartCopyOrDelete, bool selectionContainsAttachments)
+static Vector<String> selectionPasteboardTypes(bool canSmartCopyOrDelete, bool selectionContainsAttachments)
 {
-    if (selectionContainsAttachments) {
-        if (canSmartCopyOrDelete)
-            return [NSArray arrayWithObjects:WebSmartPastePboardType, WebArchivePboardType, NSRTFDPboardType, NSRTFPboardType, NSStringPboardType, nil];
-        else
-            return [NSArray arrayWithObjects:WebArchivePboardType, NSRTFDPboardType, NSRTFPboardType, NSStringPboardType, nil];
-    } else { // Don't write RTFD to the pasteboard when the copied attributed string has no attachments.
-        if (canSmartCopyOrDelete)
-            return [NSArray arrayWithObjects:WebSmartPastePboardType, WebArchivePboardType, NSRTFPboardType, NSStringPboardType, nil];
-        else
-            return [NSArray arrayWithObjects:WebArchivePboardType, NSRTFPboardType, NSStringPboardType, nil];
-    }
+    Vector<String> types;
+    if (canSmartCopyOrDelete)
+        types.append(WebSmartPastePboardType);
+    types.append(WebArchivePboardType);
+    if (selectionContainsAttachments)
+        types.append(String(NSRTFDPboardType));
+    types.append(String(NSRTFPboardType));
+    types.append(String(NSStringPboardType));
+
+    return types;
 }
 
-static NSArray* writableTypesForURL()
+static const Vector<String> writableTypesForURL()
 {
-    DEFINE_STATIC_LOCAL(RetainPtr<NSArray>, types, ([[NSArray alloc] initWithObjects:
-            WebURLsWithTitlesPboardType,
-            NSURLPboardType,
-            WebURLPboardType,
-            WebURLNamePboardType,
-            NSStringPboardType,
-            nil]));
-    return types.get();
+    Vector<String> types;
+    
+    types.append(WebURLsWithTitlesPboardType);
+    types.append(String(NSURLPboardType));
+    types.append(WebURLPboardType);
+    types.append(WebURLNamePboardType);
+    types.append(String(NSStringPboardType));        
+    return types;
 }
 
-static inline NSArray* createWritableTypesForImage()
+static inline Vector<String> createWritableTypesForImage()
 {
-    NSMutableArray *types = [[NSMutableArray alloc] initWithObjects:NSTIFFPboardType, nil];
-    [types addObjectsFromArray:writableTypesForURL()];
-    [types addObject:NSRTFDPboardType];
+    Vector<String> types;
+    
+    types.append(String(NSTIFFPboardType));
+    types.append(writableTypesForURL());
+    types.append(String(NSRTFDPboardType));
     return types;
 }
 
-static NSArray* writableTypesForImage()
+static Vector<String> writableTypesForImage()
 {
-    DEFINE_STATIC_LOCAL(RetainPtr<NSArray>, types, (createWritableTypesForImage()));
-    return types.get();
+    Vector<String> types;
+    types.append(createWritableTypesForImage());
+    return types;
 }
 
 Pasteboard* Pasteboard::generalPasteboard() 
@@ -118,17 +123,17 @@ Pasteboard* Pasteboard::generalPasteboard()
 }
 
 Pasteboard::Pasteboard(const String& pasteboardName)
-    : m_pasteboard([NSPasteboard pasteboardWithName:pasteboardName])
+    : m_pasteboardName(pasteboardName)
 {
     ASSERT(pasteboardName);
 }
 
 void Pasteboard::clear()
 {
-    [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
+    platformStrategies()->pasteboardStrategy()->setTypes(Vector<String>(), m_pasteboardName);
 }
 
-void Pasteboard::writeSelectionForTypes(NSArray* pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
+void Pasteboard::writeSelectionForTypes(const Vector<String>& pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     if (!WebArchivePboardType)
         Pasteboard::generalPasteboard(); // Initializes pasteboard types.
@@ -145,44 +150,36 @@ void Pasteboard::writeSelectionForTypes(NSArray* pasteboardTypes, Range* selecte
     if (enclosingAnchor && comparePositions(firstPositionInOrBeforeNode(selectedRange->startPosition().anchorNode()), selectedRange->startPosition()) >= 0)
         selectedRange->setStart(enclosingAnchor, 0, ec);
 
-    // Using different API for WebKit and WebKit2.
     NSAttributedString *attributedString = nil;
-    if (frame->view()->platformWidget())
-        attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
-#ifndef BUILDING_ON_LEOPARD
-    else {
-        // In WebKit2 we are using a different way to create the NSAttributedString from the DOMrange that doesn't require access to the WebView.
-        RetainPtr<WebHTMLConverter> converter(AdoptNS, [[WebHTMLConverter alloc] initWithDOMRange:kit(selectedRange)]);
-        if (converter)
-            attributedString = [converter.get() attributedString];
-    }
-#endif
+    RetainPtr<WebHTMLConverter> converter(AdoptNS, [[WebHTMLConverter alloc] initWithDOMRange:kit(selectedRange)]);
+    if (converter)
+        attributedString = [converter.get() attributedString];
 
-    NSArray *types = pasteboardTypes ? pasteboardTypes : selectionPasteboardTypes(canSmartCopyOrDelete, [attributedString containsAttachments]);
-    [m_pasteboard.get() declareTypes:types owner:nil];
+    const Vector<String> types = !pasteboardTypes.isEmpty() ? pasteboardTypes : selectionPasteboardTypes(canSmartCopyOrDelete, [attributedString containsAttachments]);
+    platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
     frame->editor()->client()->didSetSelectionTypesForPasteboard();
     
     // Put HTML on the pasteboard.
-    if ([types containsObject:WebArchivePboardType]) {
+    if (types.contains(WebArchivePboardType)) {
         RefPtr<LegacyWebArchive> archive = LegacyWebArchive::createFromSelection(frame);
         RetainPtr<CFDataRef> data = archive ? archive->rawDataRepresentation() : 0;
-        [m_pasteboard.get() setData:(NSData *)data.get() forType:WebArchivePboardType];
+        platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)data.get()), WebArchivePboardType, m_pasteboardName);
     }
     
     // Put the attributed string on the pasteboard (RTF/RTFD format).
-    if ([types containsObject:NSRTFDPboardType]) {
+    if (types.contains(String(NSRTFDPboardType))) {
         NSData *RTFDData = [attributedString RTFDFromRange:NSMakeRange(0, [attributedString length]) documentAttributes:nil];
-        [m_pasteboard.get() setData:RTFDData forType:NSRTFDPboardType];
+        platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)RTFDData).get(), NSRTFDPboardType, m_pasteboardName);
     }
-    if ([types containsObject:NSRTFPboardType]) {
+    if (types.contains(String(NSRTFPboardType))) {
         if ([attributedString containsAttachments])
             attributedString = attributedStringByStrippingAttachmentCharacters(attributedString);
         NSData *RTFData = [attributedString RTFFromRange:NSMakeRange(0, [attributedString length]) documentAttributes:nil];
-        [m_pasteboard.get() setData:RTFData forType:NSRTFPboardType];
+        platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)RTFData).get(), NSRTFPboardType, m_pasteboardName);
     }
     
     // Put plain string on the pasteboard.
-    if ([types containsObject:NSStringPboardType]) {
+    if (types.contains(String(NSStringPboardType))) {
         // Map &nbsp; to a plain old space because this is better for source code, other browsers do it,
         // and because HTML forces you to do this any time you want two spaces in a row.
         String text = frame->editor()->selectedText();
@@ -190,29 +187,30 @@ void Pasteboard::writeSelectionForTypes(NSArray* pasteboardTypes, Range* selecte
         
         NSString *NonBreakingSpaceString = [NSString stringWithCharacters:&noBreakSpace length:1];
         [s replaceOccurrencesOfString:NonBreakingSpaceString withString:@" " options:0 range:NSMakeRange(0, [s length])];
-        [m_pasteboard.get() setString:s forType:NSStringPboardType];
+        platformStrategies()->pasteboardStrategy()->setStringForType(s, NSStringPboardType, m_pasteboardName);
         [s release];
     }
     
-    if ([types containsObject:WebSmartPastePboardType]) {
-        [m_pasteboard.get() setData:nil forType:WebSmartPastePboardType];
-    }
+    if (types.contains(WebSmartPastePboardType))
+        platformStrategies()->pasteboardStrategy()->setBufferForType(0, WebSmartPastePboardType, m_pasteboardName);
 }
 
 void Pasteboard::writePlainText(const String& text)
 {
-    [m_pasteboard.get() declareTypes:[NSArray arrayWithObject:NSStringPboardType] owner:nil];
-    [m_pasteboard.get() setString:text forType:NSStringPboardType];
+    Vector<String> types;
+    types.append(NSStringPboardType);
+    platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+    platformStrategies()->pasteboardStrategy()->setStringForType(text, NSStringPboardType, m_pasteboardName);
 }
     
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
-    writeSelectionForTypes(nil, selectedRange, canSmartCopyOrDelete, frame);
+    writeSelectionForTypes(Vector<String>(), selectedRange, canSmartCopyOrDelete, frame);
 }
 
-static void writeURLForTypes(NSArray* types, NSPasteboard* pasteboard, const KURL& url, const String& titleStr, Frame* frame)
+static void writeURLForTypes(const Vector<String>& types, const String& pasteboardName, const KURL& url, const String& titleStr, Frame* frame)
 {
-    [pasteboard declareTypes:types owner:nil];
+    platformStrategies()->pasteboardStrategy()->setTypes(types, pasteboardName);
     
     ASSERT(!url.isEmpty());
     
@@ -225,25 +223,25 @@ static void writeURLForTypes(NSArray* types, NSPasteboard* pasteboard, const KUR
         if ([title length] == 0)
             title = userVisibleString;
     }
-        
-    if ([types containsObject:WebURLsWithTitlesPboardType])
-        [pasteboard setPropertyList:[NSArray arrayWithObjects:[NSArray arrayWithObject:userVisibleString], 
-                                     [NSArray arrayWithObject:(NSString*)titleStr.stripWhiteSpace()], 
-                                     nil]
-                            forType:WebURLsWithTitlesPboardType];
-    if ([types containsObject:NSURLPboardType])
-        [cocoaURL writeToPasteboard:pasteboard];
-    if ([types containsObject:WebURLPboardType])
-        [pasteboard setString:userVisibleString forType:WebURLPboardType];
-    if ([types containsObject:WebURLNamePboardType])
-        [pasteboard setString:title forType:WebURLNamePboardType];
-    if ([types containsObject:NSStringPboardType])
-        [pasteboard setString:userVisibleString forType:NSStringPboardType];
+    if (types.contains(WebURLsWithTitlesPboardType)) {
+        Vector<String> paths;
+        paths.append(userVisibleString);
+        paths.append(titleStr.stripWhiteSpace());
+        platformStrategies()->pasteboardStrategy()->setPathnamesForType(paths, WebURLsWithTitlesPboardType, pasteboardName);
+    }
+    if (types.contains(String(NSURLPboardType)))
+        platformStrategies()->pasteboardStrategy()->setStringForType([cocoaURL absoluteString], NSURLPboardType, pasteboardName);
+    if (types.contains(WebURLPboardType))
+        platformStrategies()->pasteboardStrategy()->setStringForType(userVisibleString, WebURLPboardType, pasteboardName);
+    if (types.contains(WebURLNamePboardType))
+        platformStrategies()->pasteboardStrategy()->setStringForType(title, WebURLNamePboardType, pasteboardName);
+    if (types.contains(String(NSStringPboardType)))
+        platformStrategies()->pasteboardStrategy()->setStringForType(userVisibleString, NSStringPboardType, pasteboardName);
 }
     
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
 {
-    writeURLForTypes(writableTypesForURL(), m_pasteboard.get(), url, titleStr, frame);
+    writeURLForTypes(writableTypesForURL(), m_pasteboardName, url, titleStr, frame);
 }
 
 static NSFileWrapper* fileWrapperForImage(CachedResource* resource, NSURL *url)
@@ -259,7 +257,7 @@ static NSFileWrapper* fileWrapperForImage(CachedResource* resource, NSURL *url)
     return wrapper;
 }
 
-static void writeFileWrapperAsRTFDAttachment(NSFileWrapper* wrapper, NSPasteboard* pasteboard)
+static void writeFileWrapperAsRTFDAttachment(NSFileWrapper* wrapper, const String& pasteboardName)
 {
     NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:wrapper];
     
@@ -267,7 +265,7 @@ static void writeFileWrapperAsRTFDAttachment(NSFileWrapper* wrapper, NSPasteboar
     [attachment release];
     
     NSData *RTFDData = [string RTFDFromRange:NSMakeRange(0, [string length]) documentAttributes:nil];
-    [pasteboard setData:RTFDData forType:NSRTFDPboardType];
+    platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)RTFDData).get(), NSRTFDPboardType, pasteboardName);
 }
 
 void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
@@ -277,8 +275,6 @@ void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
     if (!(node->renderer() && node->renderer()->isImage()))
         return;
 
-    Frame* frame = node->document()->frame();
-
     NSURL *cocoaURL = url;
     ASSERT(cocoaURL);
 
@@ -287,68 +283,72 @@ void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
     if (!cachedImage || cachedImage->errorOccurred())
         return;
 
-    writeURLForTypes(writableTypesForImage(), m_pasteboard.get(), cocoaURL, nsStringNilIfEmpty(title), frame);
+    writeURLForTypes(writableTypesForImage(), m_pasteboardName, cocoaURL, nsStringNilIfEmpty(title), node->document()->frame());
     
     Image* image = cachedImage->imageForRenderer(renderer);
     ASSERT(image);
     
-    [m_pasteboard.get() setData:[image->getNSImage() TIFFRepresentation] forType:NSTIFFPboardType];
+    platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)[image->getNSImage() TIFFRepresentation]), NSTIFFPboardType, m_pasteboardName);
 
     String MIMEType = cachedImage->response().mimeType();
     ASSERT(MIMETypeRegistry::isSupportedImageResourceMIMEType(MIMEType));
 
-    writeFileWrapperAsRTFDAttachment(fileWrapperForImage(cachedImage, cocoaURL), m_pasteboard.get());
+    writeFileWrapperAsRTFDAttachment(fileWrapperForImage(cachedImage, cocoaURL), m_pasteboardName);
 }
 
 void Pasteboard::writeClipboard(Clipboard* clipboard)
 {
-    NSPasteboard* pasteboard = static_cast<ClipboardMac*>(clipboard)->pasteboard();
-    NSArray* types = [pasteboard types];
-
-    [m_pasteboard.get() addTypes:types owner:nil];
-    for (NSUInteger i = 0; i < [types count]; i++) {
-        NSString* type = [types objectAtIndex:i];
-        [m_pasteboard.get() setData:[pasteboard dataForType:type] forType:type];
-    }
+    platformStrategies()->pasteboardStrategy()->copy(static_cast<ClipboardMac*>(clipboard)->pasteboardName(), m_pasteboardName);
 }
 
 bool Pasteboard::canSmartReplace()
 {
-    return [[m_pasteboard.get() types] containsObject:WebSmartPastePboardType];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(WebSmartPastePboardType);
 }
 
 String Pasteboard::plainText(Frame* frame)
 {
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
     
-    if ([types containsObject:NSStringPboardType])
-        return [[m_pasteboard.get() stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping];
+    if (types.contains(String(NSStringPboardType)))
+        return [(NSString *)platformStrategies()->pasteboardStrategy()->stringForType(NSStringPboardType, m_pasteboardName) precomposedStringWithCanonicalMapping];
     
     NSAttributedString *attributedString = nil;
     NSString *string;
 
-    if ([types containsObject:NSRTFDPboardType])
-        attributedString = [[NSAttributedString alloc] initWithRTFD:[m_pasteboard.get() dataForType:NSRTFDPboardType] documentAttributes:NULL];
-    if (attributedString == nil && [types containsObject:NSRTFPboardType])
-        attributedString = [[NSAttributedString alloc] initWithRTF:[m_pasteboard.get() dataForType:NSRTFPboardType] documentAttributes:NULL];
+    if (types.contains(String(NSRTFDPboardType))) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFDPboardType, m_pasteboardName);
+        attributedString = [[NSAttributedString alloc] initWithRTFD:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
+    if (attributedString == nil && types.contains(String(NSRTFPboardType))) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFPboardType, m_pasteboardName);
+        attributedString = [[NSAttributedString alloc] initWithRTF:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
     if (attributedString != nil) {
         string = [[attributedString string] precomposedStringWithCanonicalMapping];
         [attributedString release];
         return string;
     }
     
-    if ([types containsObject:NSFilenamesPboardType]) {
-        string = [[[m_pasteboard.get() propertyListForType:NSFilenamesPboardType] componentsJoinedByString:@"\n"] precomposedStringWithCanonicalMapping];
-        if (string != nil)
-            return string;
+    if (types.contains(String(NSFilenamesPboardType))) {
+        Vector<String> pathnames;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(pathnames, NSFilenamesPboardType, m_pasteboardName);
+        StringBuilder builder;
+        for (size_t i = 0; i < pathnames.size(); i++)
+            builder.append(i ? "\n" + pathnames[i] : pathnames[i]);
+        string = builder.toString();
+        return [string precomposedStringWithCanonicalMapping];
     }
     
-    
-    if (NSURL *url = [NSURL URLFromPasteboard:m_pasteboard.get()]) {
+    string = platformStrategies()->pasteboardStrategy()->stringForType(NSURLPboardType, m_pasteboardName);
+    if ([string length]) {
         // FIXME: using the editorClient to call into webkit, for now, since 
         // calling _web_userVisibleString from WebCore involves migrating a sizable web of 
         // helper code that should either be done in a separate patch or figured out in another way.
-        string = frame->editor()->client()->userVisibleString(url);
+        string = frame->editor()->client()->userVisibleString([NSURL URLWithString:string]);
         if ([string length] > 0)
             return [string precomposedStringWithCanonicalMapping];
     }
@@ -377,16 +377,20 @@ static PassRefPtr<DocumentFragment> documentFragmentWithImageResource(Frame* fra
     return 0;
 }
 
-static PassRefPtr<DocumentFragment> documentFragmentWithRTF(Frame* frame, NSString *pasteboardType, NSPasteboard *pasteboard)
+static PassRefPtr<DocumentFragment> documentFragmentWithRTF(Frame* frame, NSString *pasteboardType,const String& pastebordName)
 {
     if (!frame || !frame->document() || !frame->document()->isHTMLDocument())
         return 0;
 
     NSAttributedString *string = nil;
-    if (pasteboardType == NSRTFDPboardType)
-        string = [[NSAttributedString alloc] initWithRTFD:[pasteboard dataForType:NSRTFDPboardType] documentAttributes:NULL];
-    if (string == nil)
-        string = [[NSAttributedString alloc] initWithRTF:[pasteboard dataForType:NSRTFPboardType] documentAttributes:NULL];
+    if (pasteboardType == NSRTFDPboardType) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFDPboardType, pastebordName);
+        string = [[NSAttributedString alloc] initWithRTFD:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
+    if (string == nil) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFPboardType, pastebordName);
+        string = [[NSAttributedString alloc] initWithRTF:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
     if (string == nil)
         return nil;
 
@@ -426,12 +430,13 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
 
 PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefPtr<Range> context, bool allowPlainText, bool& chosePlainText)
 {
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
     RefPtr<DocumentFragment> fragment;
     chosePlainText = false;
 
-    if ([types containsObject:WebArchivePboardType]) {
-        RefPtr<LegacyWebArchive> coreArchive = LegacyWebArchive::create(KURL(), SharedBuffer::wrapNSData([m_pasteboard.get() dataForType:WebArchivePboardType]).get());
+    if (types.contains(WebArchivePboardType)) {
+        RefPtr<LegacyWebArchive> coreArchive = LegacyWebArchive::create(KURL(), platformStrategies()->pasteboardStrategy()->bufferForType(WebArchivePboardType, m_pasteboardName).get());
         if (coreArchive) {
             RefPtr<ArchiveResource> mainResource = coreArchive->mainResource();
             if (mainResource) {
@@ -454,17 +459,16 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
             return fragment.release();
     } 
 
-    if ([types containsObject:NSFilenamesPboardType]) {
-        NSArray* paths = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-        NSEnumerator* enumerator = [paths objectEnumerator];
-        NSString* path;
+    if (types.contains(String(NSFilenamesPboardType))) {
+        Vector<String> paths;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(paths, NSFilenamesPboardType, m_pasteboardName);
         Vector< RefPtr<Node> > refNodesVector;
         Vector<Node*> nodesVector;
 
-        while ((path = [enumerator nextObject]) != nil) {
+        for (size_t i = 0; i < paths.size(); i++) {
             // Non-image file types; _web_userVisibleString is appropriate here because this will
             // be pasted as visible text.
-            NSString *url = frame->editor()->client()->userVisibleString([NSURL fileURLWithPath:path]);
+            NSString *url = frame->editor()->client()->userVisibleString([NSURL fileURLWithPath:paths[i]]);
             RefPtr<Node> textNode = frame->document()->createTextNode(url);
             refNodesVector.append(textNode.get());
             nodesVector.append(textNode.get());
@@ -474,8 +478,8 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
             return fragment.release();
     }
 
-    if ([types containsObject:NSHTMLPboardType]) {
-        NSString *HTMLString = [m_pasteboard.get() stringForType:NSHTMLPboardType];
+    if (types.contains(String(NSHTMLPboardType))) {
+        NSString *HTMLString = platformStrategies()->pasteboardStrategy()->stringForType(NSHTMLPboardType, m_pasteboardName);
         // This is a hack to make Microsoft's HTML pasteboard data work. See 3778785.
         if ([HTMLString hasPrefix:@"Version:"]) {
             NSRange range = [HTMLString rangeOfString:@"<html" options:NSCaseInsensitiveSearch];
@@ -488,36 +492,28 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
             return fragment.release();
     }
 
-    if ([types containsObject:NSRTFDPboardType] &&
-        (fragment = documentFragmentWithRTF(frame, NSRTFDPboardType, m_pasteboard.get())))
+    if (types.contains(String(NSRTFDPboardType)) &&
+        (fragment = documentFragmentWithRTF(frame, NSRTFDPboardType, m_pasteboardName)))
        return fragment.release();
 
-    if ([types containsObject:NSRTFPboardType] &&
-        (fragment = documentFragmentWithRTF(frame, NSRTFPboardType, m_pasteboard.get())))
+    if (types.contains(String(NSRTFPboardType)) &&
+        (fragment = documentFragmentWithRTF(frame, NSRTFPboardType, m_pasteboardName)))
         return fragment.release();
 
-    if ([types containsObject:NSTIFFPboardType] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:NSTIFFPboardType] copy] autorelease]), uniqueURLWithRelativePart(@"image.tiff"), "image/tiff", "", ""))))
+    if (types.contains(String(NSTIFFPboardType)) &&
+        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(platformStrategies()->pasteboardStrategy()->bufferForType(NSTIFFPboardType, m_pasteboardName), uniqueURLWithRelativePart(@"image.tiff"), "image/tiff", "", ""))))
         return fragment.release();
 
-    if ([types containsObject:NSPDFPboardType] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:NSPDFPboardType] copy] autorelease]), uniqueURLWithRelativePart(@"application.pdf"), "application/pdf", "", ""))))
+    if (types.contains(String(NSPDFPboardType)) &&
+        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(platformStrategies()->pasteboardStrategy()->bufferForType(NSPDFPboardType, m_pasteboardName).get(), uniqueURLWithRelativePart(@"application.pdf"), "application/pdf", "", ""))))
         return fragment.release();
 
-#ifdef BUILDING_ON_LEOPARD
-    if ([types containsObject:NSPICTPboardType] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:NSPICTPboardType] copy] autorelease]), uniqueURLWithRelativePart(@"image.pict"), "image/pict", "", ""))))
-        return fragment.release();
-#endif
-
-    // Only 10.5 and higher support setting and retrieving pasteboard types with UTIs, but we don't believe
-    // that any applications on Tiger put types for which we only have a UTI, like PNG, on the pasteboard.
-    if ([types containsObject:(NSString*)kUTTypePNG] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:(NSString*)kUTTypePNG] copy] autorelease]), uniqueURLWithRelativePart(@"image.png"), "image/png", "", ""))))
+    if (types.contains(String(kUTTypePNG)) &&
+        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(platformStrategies()->pasteboardStrategy()->bufferForType(String(kUTTypePNG), m_pasteboardName), uniqueURLWithRelativePart(@"image.png"), "image/png", "", ""))))
         return fragment.release();
 
-    if ([types containsObject:NSURLPboardType]) {
-        NSURL *URL = [NSURL URLFromPasteboard:m_pasteboard.get()];
+    if (types.contains(String(NSURLPboardType))) {
+        NSURL *URL = [NSURL URLWithString:platformStrategies()->pasteboardStrategy()->stringForType(NSURLPboardType, m_pasteboardName)];
         Document* document = frame->document();
         ASSERT(document);
         if (!document)
@@ -526,7 +522,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
         NSString *URLString = [URL absoluteString]; // Original data is ASCII-only, so there is no need to precompose.
         if ([URLString length] == 0)
             return nil;
-        NSString *URLTitleString = [[m_pasteboard.get() stringForType:WebURLNamePboardType] precomposedStringWithCanonicalMapping];
+        NSString *URLTitleString = [platformStrategies()->pasteboardStrategy()->stringForType(WebURLNamePboardType, m_pasteboardName) precomposedStringWithCanonicalMapping];
         ExceptionCode ec;
         anchor->setAttribute(HTMLNames::hrefAttr, URLString);
         anchor->appendChild(document->createTextNode(URLTitleString), ec);
@@ -537,9 +533,9 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
         }
     }
 
-    if (allowPlainText && [types containsObject:NSStringPboardType]) {
+    if (allowPlainText && types.contains(String(NSStringPboardType))) {
         chosePlainText = true;
-        fragment = createFragmentFromText(context.get(), [[m_pasteboard.get() stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping]);
+        fragment = createFragmentFromText(context.get(), [platformStrategies()->pasteboardStrategy()->stringForType(NSStringPboardType, m_pasteboardName) precomposedStringWithCanonicalMapping]);
         return fragment.release();
     }
 
diff --git a/Source/WebCore/platform/mac/PlatformPasteboardMac.mm b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
new file mode 100644
index 000000000..d03df24b5
--- /dev/null
+++ b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+#import "Color.h"
+#import "PlatformPasteboard.h"
+
+namespace WebCore {
+
+PlatformPasteboard::PlatformPasteboard(const String& pasteboardName)
+    : m_pasteboard([NSPasteboard pasteboardWithName:pasteboardName])
+{
+    ASSERT(pasteboardName);
+}
+
+void PlatformPasteboard::getTypes(Vector<String>& types)
+{
+    NSArray *pasteboardTypes = [m_pasteboard.get() types];
+    
+    for (NSUInteger i = 0; i < [pasteboardTypes count]; i++)
+        types.append([pasteboardTypes objectAtIndex:i]);
+}
+
+PassRefPtr<SharedBuffer> PlatformPasteboard::bufferForType(const String& pasteboardType)
+{
+    return SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:pasteboardType] copy] autorelease]);
+}
+
+void PlatformPasteboard::getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType)
+{
+    NSArray* paths = [m_pasteboard.get() propertyListForType:pasteboardType];
+    if ([paths isKindOfClass:[NSString class]]) {
+        pathnames.append((NSString *)paths);
+        return;        
+    }
+    for (NSUInteger i = 0; i < [paths count]; i++)
+        pathnames.append([paths objectAtIndex:i]);
+}
+
+String PlatformPasteboard::stringForType(const String& pasteboardType)
+{
+    return [m_pasteboard.get() stringForType:pasteboardType];
+}
+
+int PlatformPasteboard::changeCount() const
+{
+    return [m_pasteboard.get() changeCount];
+}
+
+String PlatformPasteboard::uniqueName()
+{
+    return [[NSPasteboard pasteboardWithUniqueName] name];
+}
+
+Color PlatformPasteboard::color()
+{
+    NSColor *color = [NSColor colorFromPasteboard:m_pasteboard.get()];
+    
+    // The color may not be in an RGB colorspace. This commonly occurs when a color is 
+    // dragged from the NSColorPanel grayscale picker.
+    if ([[color colorSpace] colorSpaceModel] != NSRGBColorSpaceModel)
+        color = [color colorUsingColorSpaceName:NSCalibratedRGBColorSpace];
+    
+    return makeRGBA((int)([color redComponent] * 255.0 + 0.5), (int)([color greenComponent] * 255.0 + 0.5), 
+                    (int)([color blueComponent] * 255.0 + 0.5), (int)([color alphaComponent] * 255.0 + 0.5));    
+}
+
+void PlatformPasteboard::copy(const String& fromPasteboard)
+{
+    NSPasteboard* pasteboard = [NSPasteboard pasteboardWithName:fromPasteboard];
+    NSArray* types = [pasteboard types];
+    
+    [m_pasteboard.get() addTypes:types owner:nil];
+    for (NSUInteger i = 0; i < [types count]; i++) {
+        NSString* type = [types objectAtIndex:i];
+        [m_pasteboard.get() setData:[pasteboard dataForType:type] forType:type];
+    }    
+}
+
+void PlatformPasteboard::setTypes(const Vector<String>& pasteboardTypes)
+{
+    if (pasteboardTypes.isEmpty()) {
+        [m_pasteboard.get() declareTypes:nil owner:nil];
+        return;
+    }
+
+    RetainPtr<NSMutableArray> types(AdoptNS, [[NSMutableArray alloc] init]);
+    for (size_t i = 0; i < pasteboardTypes.size(); ++i)
+        [types.get() addObject:pasteboardTypes[i]];
+
+    [m_pasteboard.get() declareTypes:types.get() owner:nil];
+}
+
+void PlatformPasteboard::setBufferForType(PassRefPtr<SharedBuffer> buffer, const String& pasteboardType)
+{
+    [m_pasteboard.get() setData:buffer ? [buffer->createNSData() autorelease] : nil forType:pasteboardType];
+}
+
+void PlatformPasteboard::setPathnamesForType(const Vector<String>& pathnames, const String& pasteboardType)
+{
+    RetainPtr<NSMutableArray> paths(AdoptNS, [[NSMutableArray alloc] init]);    
+    for (size_t i = 0; i < pathnames.size(); ++i)
+        [paths.get() addObject: [NSArray arrayWithObject:pathnames[i]]];
+    [m_pasteboard.get() setPropertyList:paths.get() forType:pasteboardType];
+}
+
+void PlatformPasteboard::setStringForType(const String& string, const String& pasteboardType)
+{
+    [m_pasteboard.get() setString:string forType:pasteboardType];
+}
+
+}
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index c8d9b232a..3720feb74 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -111,8 +111,8 @@ private:
 
     virtual bool shouldScrollbarParticipateInHitTesting(Scrollbar*);
 
-    float adjustScrollXPositionIfNecessary(float) const;
-    float adjustScrollYPositionIfNecessary(float) const;
+    virtual void notifyContentAreaScrolled() OVERRIDE;
+
     FloatPoint adjustScrollPositionIfNecessary(const FloatPoint&) const;
 
     void immediateScrollTo(const FloatPoint&);
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 63c247770..5bcc77549 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -621,22 +621,6 @@ void ScrollAnimatorMac::scrollToOffsetWithoutAnimation(const FloatPoint& offset)
     immediateScrollTo(offset);
 }
 
-float ScrollAnimatorMac::adjustScrollXPositionIfNecessary(float position) const
-{
-    if (!m_scrollableArea->constrainsScrollingToContentEdge())
-        return position;
-
-    return max<float>(min<float>(position, m_scrollableArea->contentsSize().width() - m_scrollableArea->visibleWidth()), 0);
-}
-
-float ScrollAnimatorMac::adjustScrollYPositionIfNecessary(float position) const
-{
-    if (!m_scrollableArea->constrainsScrollingToContentEdge())
-        return position;
-
-    return max<float>(min<float>(position, m_scrollableArea->contentsSize().height() - m_scrollableArea->visibleHeight()), 0);
-}
-
 FloatPoint ScrollAnimatorMac::adjustScrollPositionIfNecessary(const FloatPoint& position) const
 {
     if (!m_scrollableArea->constrainsScrollingToContentEdge())
@@ -669,13 +653,7 @@ void ScrollAnimatorMac::immediateScrollToPointForScrollAnimation(const FloatPoin
 
 void ScrollAnimatorMac::notifyPositionChanged()
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        // This function is called when a page is going into the page cache, but the page 
-        // isn't really scrolling in that case. We should only pass the message on to the
-        // ScrollbarPainterController when we're really scrolling on an active page.
-        if (scrollableArea()->isOnActivePage())
-            [m_scrollbarPainterController.get() contentAreaScrolled];
-    }
+    notifyContentAreaScrolled();
     ScrollAnimator::notifyPositionChanged();
 }
 
@@ -803,68 +781,72 @@ void ScrollAnimatorMac::didEndScrollGesture() const
 
 void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
+
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        ASSERT(!m_verticalScrollbarPainterDelegate);
-        m_verticalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
+    ASSERT(!m_verticalScrollbarPainterDelegate);
+    m_verticalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
 
-        [painter setDelegate:m_verticalScrollbarPainterDelegate.get()];
-        [m_scrollbarPainterController.get() setVerticalScrollerImp:painter];
-        if (scrollableArea()->inLiveResize())
-            [painter setKnobAlpha:1];
-    }
+    [painter setDelegate:m_verticalScrollbarPainterDelegate.get()];
+    [m_scrollbarPainterController.get() setVerticalScrollerImp:painter];
+    if (scrollableArea()->inLiveResize())
+        [painter setKnobAlpha:1];
 }
 
 void ScrollAnimatorMac::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
 
-        ASSERT(m_verticalScrollbarPainterDelegate);
-        [m_verticalScrollbarPainterDelegate.get() invalidate];
-        m_verticalScrollbarPainterDelegate = nullptr;
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        [painter setDelegate:nil];
-        [m_scrollbarPainterController.get() setVerticalScrollerImp:nil];
-    }
+    ASSERT(m_verticalScrollbarPainterDelegate);
+    [m_verticalScrollbarPainterDelegate.get() invalidate];
+    m_verticalScrollbarPainterDelegate = nullptr;
+
+    [painter setDelegate:nil];
+    [m_scrollbarPainterController.get() setVerticalScrollerImp:nil];
 }
 
 void ScrollAnimatorMac::didAddHorizontalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
 
-        ASSERT(!m_horizontalScrollbarPainterDelegate);
-        m_horizontalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        [painter setDelegate:m_horizontalScrollbarPainterDelegate.get()];
-        [m_scrollbarPainterController.get() setHorizontalScrollerImp:painter];
-        if (scrollableArea()->inLiveResize())
-            [painter setKnobAlpha:1];
-    }
+    ASSERT(!m_horizontalScrollbarPainterDelegate);
+    m_horizontalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
+
+    [painter setDelegate:m_horizontalScrollbarPainterDelegate.get()];
+    [m_scrollbarPainterController.get() setHorizontalScrollerImp:painter];
+    if (scrollableArea()->inLiveResize())
+        [painter setKnobAlpha:1];
 }
 
 void ScrollAnimatorMac::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
 
-        ASSERT(m_horizontalScrollbarPainterDelegate);
-        [m_horizontalScrollbarPainterDelegate.get() invalidate];
-        m_horizontalScrollbarPainterDelegate = nullptr;
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        [painter setDelegate:nil];
-        [m_scrollbarPainterController.get() setHorizontalScrollerImp:nil];
-    }
+    ASSERT(m_horizontalScrollbarPainterDelegate);
+    [m_horizontalScrollbarPainterDelegate.get() invalidate];
+    m_horizontalScrollbarPainterDelegate = nullptr;
+
+    [painter setDelegate:nil];
+    [m_scrollbarPainterController.get() setHorizontalScrollerImp:nil];
 }
 
 bool ScrollAnimatorMac::shouldScrollbarParticipateInHitTesting(Scrollbar* scrollbar)
@@ -883,6 +865,18 @@ bool ScrollAnimatorMac::shouldScrollbarParticipateInHitTesting(Scrollbar* scroll
     return [painter knobAlpha] > 0;
 }
 
+void ScrollAnimatorMac::notifyContentAreaScrolled()
+{
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
+
+    // This function is called when a page is going into the page cache, but the page 
+    // isn't really scrolling in that case. We should only pass the message on to the
+    // ScrollbarPainterController when we're really scrolling on an active page.
+    if (scrollableArea()->isOnActivePage())
+        [m_scrollbarPainterController.get() contentAreaScrolled];
+}
+
 void ScrollAnimatorMac::cancelAnimations()
 {
     m_haveScrolledSincePageLoad = false;
@@ -1034,14 +1028,12 @@ void ScrollAnimatorMac::immediateScrollByWithoutContentEdgeConstraints(const Flo
 
 void ScrollAnimatorMac::immediateScrollBy(const FloatSize& delta)
 {
-    float newPosX = adjustScrollXPositionIfNecessary(m_currentPosX + delta.width());
-    float newPosY = adjustScrollYPositionIfNecessary(m_currentPosY + delta.height());
-
-    if (newPosX == m_currentPosX && newPosY == m_currentPosY)
+    FloatPoint newPos = adjustScrollPositionIfNecessary(FloatPoint(m_currentPosX, m_currentPosY) + delta);
+    if (newPos.x() == m_currentPosX && newPos.y() == m_currentPosY)
         return;
 
-    m_currentPosX = newPosX;
-    m_currentPosY = newPosY;
+    m_currentPosX = newPos.x();
+    m_currentPosY = newPos.y();
     notifyPositionChanged();
 }
 
diff --git a/Source/WebCore/platform/mediastream/PeerConnectionHandler.h b/Source/WebCore/platform/mediastream/PeerConnectionHandler.h
index 778cd1b25..fa22cf4c7 100644
--- a/Source/WebCore/platform/mediastream/PeerConnectionHandler.h
+++ b/Source/WebCore/platform/mediastream/PeerConnectionHandler.h
@@ -41,7 +41,6 @@
 namespace WebCore {
 
 class PeerConnectionHandlerClient;
-class SecurityOrigin;
 
 #if PLATFORM(CHROMIUM)
 class PeerConnectionHandlerInternal;
@@ -51,7 +50,7 @@ class PeerConnectionHandler {
     WTF_MAKE_NONCOPYABLE(PeerConnectionHandler);
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<PeerConnectionHandler> create(PeerConnectionHandlerClient*, const String& serverConfiguration, PassRefPtr<SecurityOrigin>);
+    static PassOwnPtr<PeerConnectionHandler> create(PeerConnectionHandlerClient*, const String& serverConfiguration, const String& username);
     ~PeerConnectionHandler();
 
     void produceInitialOffer(const MediaStreamDescriptorVector& pendingAddStreams);
@@ -63,7 +62,7 @@ public:
     void stop();
 
 private:
-    PeerConnectionHandler(PeerConnectionHandlerClient*, const String& serverConfiguration, PassRefPtr<SecurityOrigin>);
+    PeerConnectionHandler(PeerConnectionHandlerClient*, const String& serverConfiguration, const String& username);
 
 #if PLATFORM(CHROMIUM)
     OwnPtr<PeerConnectionHandlerInternal> m_private;
diff --git a/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp b/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp
index 4569b5fdb..371293412 100644
--- a/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp
+++ b/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp
@@ -35,18 +35,16 @@
 #include "PeerConnectionHandler.h"
 
 #include "PeerConnectionHandlerClient.h"
-#include "SecurityOrigin.h"
 
 namespace WebCore {
 
-PassOwnPtr<PeerConnectionHandler> PeerConnectionHandler::create(PeerConnectionHandlerClient* client, const String& serverConfiguration, PassRefPtr<SecurityOrigin> securityOrigin)
+PassOwnPtr<PeerConnectionHandler> PeerConnectionHandler::create(PeerConnectionHandlerClient* client, const String& serverConfiguration, const String& username)
 {
-    return adoptPtr(new PeerConnectionHandler(client, serverConfiguration, securityOrigin));
+    return adoptPtr(new PeerConnectionHandler(client, serverConfiguration, username));
 }
 
-// FIXME: remove when real implementations are available
 // Empty implementations for ports that build with MEDIA_STREAM enabled by default.
-PeerConnectionHandler::PeerConnectionHandler(PeerConnectionHandlerClient*, const String&, PassRefPtr<SecurityOrigin>)
+PeerConnectionHandler::PeerConnectionHandler(PeerConnectionHandlerClient*, const String&, const String&)
 {
 }
 
diff --git a/Source/WebCore/platform/network/NetworkingContext.h b/Source/WebCore/platform/network/NetworkingContext.h
index f2b10c445..046085c2f 100644
--- a/Source/WebCore/platform/network/NetworkingContext.h
+++ b/Source/WebCore/platform/network/NetworkingContext.h
@@ -35,6 +35,10 @@ class QUrl;
 QT_END_NAMESPACE
 #endif
 
+#if USE(SOUP)
+typedef struct _SoupSession SoupSession;
+#endif
+
 namespace WebCore {
 
 class ResourceError;
@@ -66,6 +70,10 @@ public:
     virtual ResourceError blockedError(const ResourceRequest&) const = 0;
 #endif
 
+#if USE(SOUP)
+    virtual SoupSession* soupSession() const = 0;
+#endif
+
 protected:
     NetworkingContext() { }
 };
diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
index 877997963..bc79ed12b 100644
--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
@@ -189,6 +189,7 @@ namespace WebCore {
         unsigned long m_bodySize;
         unsigned long m_bodyDataSent;
         RefPtr<NetworkingContext> m_context;
+        SoupSession* soupSession();
 #endif
 #if PLATFORM(QT)
         QNetworkReplyHandler* m_job;
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index 6be4cff08..29134757a 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -111,6 +111,7 @@ NetworkJob::NetworkJob()
     , m_redirectCount(0)
     , m_deferredData(*this)
     , m_deferLoadingCount(0)
+    , m_frame(0)
 {
 }
 
@@ -137,6 +138,14 @@ bool NetworkJob::initialize(int playerId,
 
     m_streamFactory = streamFactory;
     m_frame = &frame;
+
+    if (m_frame && m_frame->loader()->pageDismissalEventBeingDispatched() != FrameLoader::NoDismissal) {
+        // In the case the frame will be detached soon, we still need to ping the server, but it is
+        // no longer safe to reference the Frame object.
+        // See http://trac.webkit.org/changeset/65910 and https://bugs.webkit.org/show_bug.cgi?id=30457.
+        m_frame = 0;
+    }
+
     m_redirectCount = redirectCount;
     m_deferLoadingCount = deferLoadingCount;
 
diff --git a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
index aa99df345..3088eb4c8 100644
--- a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
+++ b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
@@ -42,7 +42,7 @@ static void emptyPerform(void*)
 {
 }
 
-static void* runLoaderThread(void*)
+static void runLoaderThread(void*)
 {
     loaderRunLoopObject = CFRunLoopGetCurrent();
 
@@ -56,8 +56,6 @@ static void* runLoaderThread(void*)
         AutodrainedPool pool;
         result = CFRunLoopRunInMode(kCFRunLoopDefaultMode, std::numeric_limits<double>::max(), true);
     } while (result != kCFRunLoopRunStopped && result != kCFRunLoopRunFinished);
-
-    return 0;
 }
 
 CFRunLoopRef loaderRunLoop()
diff --git a/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp b/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
index 245e6ff3c..6b0c8b0c5 100644
--- a/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
@@ -27,7 +27,9 @@
 #include "ProxyServer.h"
 
 #include "KURL.h"
+#include "Logging.h"
 #include <wtf/RetainPtr.h>
+#include <wtf/text/CString.h>
 
 #if PLATFORM(WIN)
 #include <CFNetwork/CFNetwork.h>
@@ -36,33 +38,69 @@
 namespace WebCore {
 
 #ifndef BUILDING_ON_LEOPARD
-static void addProxyServersForURL(Vector<ProxyServer>& proxyServers, const KURL& url)
+
+static void processProxyServers(Vector<ProxyServer>& proxyServers, CFArrayRef proxies, CFURLRef url);
+
+static void proxyAutoConfigurationResultCallback(void *context, CFArrayRef proxies, CFErrorRef error)
 {
-    RetainPtr<CFDictionaryRef> proxySettings(AdoptCF, CFNetworkCopySystemProxySettings());
-    if (!proxySettings)
-        return;
+    // We only expect a single result callback per invocation. Stop our runloop to unblock our caller.
+    CFRunLoopStop(CFRunLoopGetCurrent());
 
-    RetainPtr<CFURLRef> cfURL(AdoptCF, url.createCFURL());
-    RetainPtr<CFArrayRef> proxiesForURL(AdoptCF, CFNetworkCopyProxiesForURL(cfURL.get(), proxySettings.get()));
-    if (!proxiesForURL)
+    Vector<ProxyServer>* proxyServers = (Vector<ProxyServer>*)context;
+    if (!proxies) {
+        ASSERT(error);
+        RetainPtr<CFStringRef> errorDescriptionCF(AdoptCF, CFErrorCopyDescription(error));
+        String errorDescription(errorDescriptionCF.get());
+        LOG(Network, "Failed to process proxy auto-configuration file with error: %s", errorDescription.utf8().data());
         return;
+    }
+
+    processProxyServers(*proxyServers, proxies, 0);
+}
 
-    CFIndex numProxies = CFArrayGetCount(proxiesForURL.get());
+static void processProxyServers(Vector<ProxyServer>& proxyServers, CFArrayRef proxies, CFURLRef url)
+{
+    CFIndex numProxies = CFArrayGetCount(proxies);
     for (CFIndex i = 0; i < numProxies; ++i) {
-        CFDictionaryRef proxyDictionary = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxiesForURL.get(), i));
+        CFDictionaryRef proxyDictionary = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxies, i));
 
         ProxyServer::Type type = ProxyServer::Direct;
         CFStringRef typeString = static_cast<CFStringRef>(CFDictionaryGetValue(proxyDictionary, kCFProxyTypeKey));
+
+        if (!url) {
+            // If we have no URL then we're processing an auto-configuration response.
+            // It isn't sensible to receive another auto-configured proxy in such a response.
+            ASSERT(!CFEqual(typeString, kCFProxyTypeAutoConfigurationURL));
+        }
+
         if (CFEqual(typeString, kCFProxyTypeAutoConfigurationURL)) {
-            // FIXME: Handle PAC URLs.
+            if (!url)
+                continue;
+
+            // FIXME: We should restructure to allow this to happen asynchronously.
+            CFURLRef scriptURL = static_cast<CFURLRef>(CFDictionaryGetValue(proxyDictionary, kCFProxyAutoConfigurationURLKey));
+            if (!scriptURL || CFGetTypeID(scriptURL) != CFURLGetTypeID())
+                continue;
+
+            CFStreamClientContext context = { 0, (void*)&proxyServers, 0, 0, 0 };
+            RetainPtr<CFRunLoopSourceRef> runLoopSource(AdoptCF, CFNetworkExecuteProxyAutoConfigurationURL(scriptURL, url, proxyAutoConfigurationResultCallback, &context));
+
+            CFStringRef privateRunLoopMode = CFSTR("com.apple.WebKit.ProxyAutoConfiguration");
+            CFTimeInterval timeout = 5;
+            CFRunLoopAddSource(CFRunLoopGetCurrent(), runLoopSource.get(), privateRunLoopMode);
+            CFRunLoopRunInMode(privateRunLoopMode, timeout, 0);
+            CFRunLoopRemoveSource(CFRunLoopGetCurrent(), runLoopSource.get(), privateRunLoopMode);
+            CFRunLoopSourceInvalidate(runLoopSource.get());
+
+            // The proxyAutoConfigurationResultCallback has added any relevant ProxyServers to proxyServers.
             continue;
-        } 
-        
+        }
+
         if (CFEqual(typeString, kCFProxyTypeNone)) {
             proxyServers.append(ProxyServer(ProxyServer::Direct, String(), -1));
             continue;
         }
-        
+
         if (CFEqual(typeString, kCFProxyTypeHTTP))
             type = ProxyServer::HTTP;
         else if (CFEqual(typeString, kCFProxyTypeHTTPS))
@@ -83,6 +121,20 @@ static void addProxyServersForURL(Vector<ProxyServer>& proxyServers, const KURL&
     }
 }
 
+static void addProxyServersForURL(Vector<ProxyServer>& proxyServers, const KURL& url)
+{
+    RetainPtr<CFDictionaryRef> proxySettings(AdoptCF, CFNetworkCopySystemProxySettings());
+    if (!proxySettings)
+        return;
+
+    RetainPtr<CFURLRef> cfURL(AdoptCF, url.createCFURL());
+    RetainPtr<CFArrayRef> proxiesForURL(AdoptCF, CFNetworkCopyProxiesForURL(cfURL.get(), proxySettings.get()));
+    if (!proxiesForURL)
+        return;
+
+    processProxyServers(proxyServers, proxiesForURL.get(), cfURL.get());
+}
+
 Vector<ProxyServer> proxyServersForURL(const KURL& url, const NetworkingContext*)
 {
     Vector<ProxyServer> proxyServers;
diff --git a/Source/WebCore/platform/network/chromium/ResourceResponse.h b/Source/WebCore/platform/network/chromium/ResourceResponse.h
index a2a8c5d30..997cd71dd 100644
--- a/Source/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/Source/WebCore/platform/network/chromium/ResourceResponse.h
@@ -36,6 +36,11 @@ namespace WebCore {
 
     class ResourceResponse : public ResourceResponseBase {
     public:
+        class ExtraData : public RefCounted<ExtraData> {
+        public:
+            virtual ~ExtraData() { }
+        };
+
         ResourceResponse()
             : m_appCacheID(0)
             , m_isMultipartPayload(false)
@@ -103,6 +108,10 @@ namespace WebCore {
         const File* downloadedFile() const { return m_downloadedFile.get(); }
         void setDownloadedFile(PassRefPtr<File> downloadedFile) { m_downloadedFile = downloadedFile; }
 
+        // Extra data associated with this response.
+        ExtraData* extraData() const { return m_extraData.get(); }
+        void setExtraData(PassRefPtr<ExtraData> extraData) { m_extraData = extraData; }
+
     private:
         friend class ResourceResponseBase;
 
@@ -155,6 +164,9 @@ namespace WebCore {
 
         // The downloaded file if the load streamed to a file.
         RefPtr<File> m_downloadedFile;
+
+        // ExtraData associated with the response.
+        RefPtr<ExtraData> m_extraData;
     };
 
     struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
diff --git a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
index f170d2d54..3b8a544cf 100644
--- a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
+++ b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
@@ -23,8 +23,12 @@
 
 #include "Cookie.h"
 #include "Document.h"
+#include "Frame.h"
+#include "FrameLoader.h"
 #include "GOwnPtrSoup.h"
 #include "KURL.h"
+#include "NetworkingContext.h"
+#include "ResourceHandle.h"
 #include <wtf/text/CString.h>
 
 namespace WebCore {
@@ -32,6 +36,22 @@ namespace WebCore {
 static bool cookiesInitialized;
 static SoupCookieJar* cookieJar;
 
+static SoupCookieJar* cookieJarForDocument(const Document* document)
+{
+    if (!document)
+        return 0;
+    const Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    const FrameLoader* loader = frame->loader();
+    if (!loader)
+        return 0;
+    const NetworkingContext* context = loader->networkingContext();
+    if (!context)
+        return 0;
+    return SOUP_COOKIE_JAR(soup_session_get_feature(context->soupSession(), SOUP_TYPE_COOKIE_JAR));
+}
+
 SoupCookieJar* defaultCookieJar()
 {
     if (!cookiesInitialized) {
@@ -59,7 +79,7 @@ void setDefaultCookieJar(SoupCookieJar* jar)
 
 void setCookies(Document* document, const KURL& url, const String& value)
 {
-    SoupCookieJar* jar = defaultCookieJar();
+    SoupCookieJar* jar = cookieJarForDocument(document);
     if (!jar)
         return;
 
@@ -73,9 +93,9 @@ void setCookies(Document* document, const KURL& url, const String& value)
                                                 value.utf8().data());
 }
 
-String cookies(const Document* /*document*/, const KURL& url)
+String cookies(const Document* document, const KURL& url)
 {
-    SoupCookieJar* jar = defaultCookieJar();
+    SoupCookieJar* jar = cookieJarForDocument(document);
     if (!jar)
         return String();
 
@@ -89,9 +109,9 @@ String cookies(const Document* /*document*/, const KURL& url)
     return result;
 }
 
-String cookieRequestHeaderFieldValue(const Document* /*document*/, const KURL& url)
+String cookieRequestHeaderFieldValue(const Document* document, const KURL& url)
 {
-    SoupCookieJar* jar = defaultCookieJar();
+    SoupCookieJar* jar = cookieJarForDocument(document);
     if (!jar)
         return String();
 
@@ -105,9 +125,9 @@ String cookieRequestHeaderFieldValue(const Document* /*document*/, const KURL& u
     return result;
 }
 
-bool cookiesEnabled(const Document* /*document*/)
+bool cookiesEnabled(const Document* document)
 {
-    return defaultCookieJar();
+    return !!cookieJarForDocument(document);
 }
 
 bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 5cb53bdff..e671660ae 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -141,6 +141,11 @@ ResourceHandleInternal::~ResourceHandleInternal()
 {
 }
 
+SoupSession* ResourceHandleInternal::soupSession()
+{
+    return (m_context && m_context->isValid()) ? m_context->soupSession() : ResourceHandle::defaultSession();
+}
+
 ResourceHandle::~ResourceHandle()
 {
     cleanupSoupRequestOperation(this, true);
@@ -151,11 +156,13 @@ static void ensureSessionIsInitialized(SoupSession* session)
     if (g_object_get_data(G_OBJECT(session), "webkit-init"))
         return;
 
-    SoupCookieJar* jar = SOUP_COOKIE_JAR(soup_session_get_feature(session, SOUP_TYPE_COOKIE_JAR));
-    if (!jar)
-        soup_session_add_feature(session, SOUP_SESSION_FEATURE(defaultCookieJar()));
-    else
-        setDefaultCookieJar(jar);
+    if (session == ResourceHandle::defaultSession()) {
+        SoupCookieJar* jar = SOUP_COOKIE_JAR(soup_session_get_feature(session, SOUP_TYPE_COOKIE_JAR));
+        if (!jar)
+            soup_session_add_feature(session, SOUP_SESSION_FEATURE(defaultCookieJar()));
+        else
+            setDefaultCookieJar(jar);
+    }
 
     if (!soup_session_get_feature(session, SOUP_TYPE_LOGGER) && LogNetwork.state == WTFLogChannelOn) {
         SoupLogger* logger = soup_logger_new(static_cast<SoupLoggerLogLevel>(SOUP_LOGGER_LOG_BODY), -1);
@@ -319,7 +326,7 @@ static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer dat
         d->m_response.updateFromSoupMessage(soupMessage);
 
         if (d->m_defersLoading)
-            soup_session_pause_message(handle->defaultSession(), soupMessage);
+            soup_session_pause_message(d->soupSession(), soupMessage);
     } else {
         d->m_response.setURL(handle->firstRequest().url());
         const gchar* contentType = soup_request_get_content_type(d->m_soupRequest.get());
@@ -442,12 +449,12 @@ static bool startHTTPRequest(ResourceHandle* handle)
 {
     ASSERT(handle);
 
-    SoupSession* session = handle->defaultSession();
+    ResourceHandleInternal* d = handle->getInternal();
+
+    SoupSession* session = d->soupSession();
     ensureSessionIsInitialized(session);
     SoupRequester* requester = SOUP_REQUESTER(soup_session_get_feature(session, SOUP_TYPE_REQUESTER));
 
-    ResourceHandleInternal* d = handle->getInternal();
-
     ResourceRequest request(handle->firstRequest());
     KURL url(request.url());
     url.removeFragmentIdentifier();
@@ -552,7 +559,7 @@ void ResourceHandle::cancel()
 {
     d->m_cancelled = true;
     if (d->m_soupMessage)
-        soup_session_cancel_message(defaultSession(), d->m_soupMessage.get(), SOUP_STATUS_CANCELLED);
+        soup_session_cancel_message(d->soupSession(), d->m_soupMessage.get(), SOUP_STATUS_CANCELLED);
     else if (d->m_cancellable)
         g_cancellable_cancel(d->m_cancellable.get());
 }
@@ -687,10 +694,11 @@ static bool startNonHTTPRequest(ResourceHandle* handle, KURL url)
     if (handle->firstRequest().httpMethod() != "GET" && handle->firstRequest().httpMethod() != "POST")
         return false;
 
-    SoupSession* session = handle->defaultSession();
+    ResourceHandleInternal* d = handle->getInternal();
+
+    SoupSession* session = d->soupSession();
     ensureSessionIsInitialized(session);
     SoupRequester* requester = SOUP_REQUESTER(soup_session_get_feature(session, SOUP_TYPE_REQUESTER));
-    ResourceHandleInternal* d = handle->getInternal();
 
     CString urlStr = url.string().utf8();
 
@@ -727,7 +735,10 @@ SoupSession* ResourceHandle::defaultSession()
         session = soup_session_async_new();
         g_object_set(session,
                      SOUP_SESSION_MAX_CONNS, maxConnections,
-                     SOUP_SESSION_MAX_CONNS_PER_HOST, maxConnectionsPerHost, 
+                     SOUP_SESSION_MAX_CONNS_PER_HOST, maxConnectionsPerHost,
+                     SOUP_SESSION_ADD_FEATURE_BY_TYPE, SOUP_TYPE_CONTENT_DECODER,
+                     SOUP_SESSION_ADD_FEATURE_BY_TYPE, SOUP_TYPE_CONTENT_SNIFFER,
+                     SOUP_SESSION_ADD_FEATURE_BY_TYPE, SOUP_TYPE_PROXY_RESOLVER_DEFAULT,
                      NULL);
     }
 
diff --git a/Source/WebCore/platform/qt/ClipboardQt.cpp b/Source/WebCore/platform/qt/ClipboardQt.cpp
index 2734952d9..3d8bab1f6 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.cpp
+++ b/Source/WebCore/platform/qt/ClipboardQt.cpp
@@ -30,6 +30,7 @@
 #include "ClipboardQt.h"
 
 #include "CachedImage.h"
+#include "DOMStringList.h"
 #include "DataTransferItemListQt.h"
 #include "Document.h"
 #include "DragData.h"
@@ -189,17 +190,17 @@ bool ClipboardQt::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardQt::types() const
+PassRefPtr<DOMStringList> ClipboardQt::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return HashSet<String>();
+        return DOMStringList::create();
 
     ASSERT(m_readableData);
-    HashSet<String> result;
+    RefPtr<DOMStringList> result = DOMStringList::create();
     QStringList formats = m_readableData->formats();
     for (int i = 0; i < formats.count(); ++i)
-        result.add(formats.at(i));
-    return result;
+        result->append(formats.at(i));
+    return result.release();
 }
 
 PassRefPtr<FileList> ClipboardQt::files() const
diff --git a/Source/WebCore/platform/qt/ClipboardQt.h b/Source/WebCore/platform/qt/ClipboardQt.h
index dc6ba4173..a840becf6 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.h
+++ b/Source/WebCore/platform/qt/ClipboardQt.h
@@ -57,7 +57,7 @@ public:
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/qt/ContextMenuQt.cpp b/Source/WebCore/platform/qt/ContextMenuQt.cpp
index 61aab6dad..0fefeb986 100644
--- a/Source/WebCore/platform/qt/ContextMenuQt.cpp
+++ b/Source/WebCore/platform/qt/ContextMenuQt.cpp
@@ -30,7 +30,6 @@
 #include <Document.h>
 #include <Frame.h>
 #include <FrameView.h>
-#include <QAction>
 #include <wtf/Assertions.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/qt/LocalizedStringsQt.cpp b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
new file mode 100644
index 000000000..a48d6b846
--- /dev/null
+++ b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
@@ -0,0 +1,692 @@
+/*
+ * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2010, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 INdT - Instituto Nokia de Tecnologia
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedStrings.h"
+
+#include "IntSize.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include <QCoreApplication>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+String inputElementAltText()
+{
+    return QCoreApplication::translate("QWebPage", "Submit", "Submit (input element) alt text for <input> elements with no alt, title, or value");
+}
+
+String resetButtonDefaultLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Reset", "default label for Reset buttons in forms on web pages");
+}
+
+String searchableIndexIntroduction()
+{
+    return QCoreApplication::translate("QWebPage", "This is a searchable index. Enter search keywords: ", "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
+}
+
+String submitButtonDefaultLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Submit", "default label for Submit buttons in forms on web pages");
+}
+
+String fileButtonChooseFileLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Choose File", "title for a single file chooser button used in HTML forms");
+}
+
+String fileButtonChooseMultipleFilesLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Choose Files", "title for a multiple file chooser button used in HTML forms. This title should be as short as possible.");
+}
+
+String fileButtonNoFileSelectedLabel()
+{
+    return QCoreApplication::translate("QWebPage", "No file selected", "text to display in file button used in HTML forms when no file is selected");
+}
+
+String fileButtonNoFilesSelectedLabel()
+{
+    return QCoreApplication::translate("QWebPage", "No files selected", "text to display in file button used in HTML forms when no files are selected and the button allows multiple files to be selected");
+}
+
+String defaultDetailsSummaryText()
+{
+    return QCoreApplication::translate("QWebPage", "Details", "text to display in <details> tag when it has no <summary> child");
+}
+
+String contextMenuItemTagOpenLinkInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open in New Window", "Open in New Window context menu item");
+}
+
+String contextMenuItemTagDownloadLinkToDisk()
+{
+    return QCoreApplication::translate("QWebPage", "Save Link...", "Download Linked File context menu item");
+}
+
+String contextMenuItemTagCopyLinkToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Link", "Copy Link context menu item");
+}
+
+String contextMenuItemTagOpenImageInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Image", "Open Image in New Window context menu item");
+}
+
+String contextMenuItemTagDownloadImageToDisk()
+{
+    return QCoreApplication::translate("QWebPage", "Save Image", "Download Image context menu item");
+}
+
+String contextMenuItemTagCopyImageToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Image", "Copy Link context menu item");
+}
+
+String contextMenuItemTagCopyImageUrlToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Image Address", "Copy Image Address menu item");
+}
+
+String contextMenuItemTagOpenVideoInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Video", "Open Video in New Window");
+}
+
+String contextMenuItemTagOpenAudioInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Audio", "Open Audio in New Window");
+}
+
+String contextMenuItemTagCopyVideoLinkToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Video", "Copy Video Link Location");
+}
+
+String contextMenuItemTagCopyAudioLinkToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Audio", "Copy Audio Link Location");
+}
+
+String contextMenuItemTagToggleMediaControls()
+{
+    return QCoreApplication::translate("QWebPage", "Toggle Controls", "Toggle Media Controls");
+}
+
+String contextMenuItemTagToggleMediaLoop()
+{
+    return QCoreApplication::translate("QWebPage", "Toggle Loop", "Toggle Media Loop Playback");
+}
+
+String contextMenuItemTagEnterVideoFullscreen()
+{
+    return QCoreApplication::translate("QWebPage", "Enter Fullscreen", "Switch Video to Fullscreen");
+}
+
+String contextMenuItemTagMediaPlay()
+{
+    return QCoreApplication::translate("QWebPage", "Play", "Play");
+}
+
+String contextMenuItemTagMediaPause()
+{
+    return QCoreApplication::translate("QWebPage", "Pause", "Pause");
+}
+
+String contextMenuItemTagMediaMute()
+{
+    return QCoreApplication::translate("QWebPage", "Mute", "Mute");
+}
+
+String contextMenuItemTagOpenFrameInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Frame", "Open Frame in New Window context menu item");
+}
+
+String contextMenuItemTagCopy()
+{
+    return QCoreApplication::translate("QWebPage", "Copy", "Copy context menu item");
+}
+
+String contextMenuItemTagGoBack()
+{
+    return QCoreApplication::translate("QWebPage", "Go Back", "Back context menu item");
+}
+
+String contextMenuItemTagGoForward()
+{
+    return QCoreApplication::translate("QWebPage", "Go Forward", "Forward context menu item");
+}
+
+String contextMenuItemTagStop()
+{
+    return QCoreApplication::translate("QWebPage", "Stop", "Stop context menu item");
+}
+
+String contextMenuItemTagReload()
+{
+    return QCoreApplication::translate("QWebPage", "Reload", "Reload context menu item");
+}
+
+String contextMenuItemTagCut()
+{
+    return QCoreApplication::translate("QWebPage", "Cut", "Cut context menu item");
+}
+
+String contextMenuItemTagPaste()
+{
+    return QCoreApplication::translate("QWebPage", "Paste", "Paste context menu item");
+}
+
+String contextMenuItemTagSelectAll()
+{
+    return QCoreApplication::translate("QWebPage", "Select All", "Select All context menu item");
+}
+
+String contextMenuItemTagNoGuessesFound()
+{
+    return QCoreApplication::translate("QWebPage", "No Guesses Found", "No Guesses Found context menu item");
+}
+
+String contextMenuItemTagIgnoreSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Ignore", "Ignore Spelling context menu item");
+}
+
+String contextMenuItemTagLearnSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Add To Dictionary", "Learn Spelling context menu item");
+}
+
+String contextMenuItemTagSearchWeb()
+{
+    return QCoreApplication::translate("QWebPage", "Search The Web", "Search The Web context menu item");
+}
+
+String contextMenuItemTagLookUpInDictionary(const String&)
+{
+    return QCoreApplication::translate("QWebPage", "Look Up In Dictionary", "Look Up in Dictionary context menu item");
+}
+
+String contextMenuItemTagOpenLink()
+{
+    return QCoreApplication::translate("QWebPage", "Open Link", "Open Link context menu item");
+}
+
+String contextMenuItemTagIgnoreGrammar()
+{
+    return QCoreApplication::translate("QWebPage", "Ignore", "Ignore Grammar context menu item");
+}
+
+String contextMenuItemTagSpellingMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Spelling", "Spelling and Grammar context sub-menu item");
+}
+
+String contextMenuItemTagShowSpellingPanel(bool show)
+{
+    return show ? QCoreApplication::translate("QWebPage", "Show Spelling and Grammar", "menu item title") :
+                  QCoreApplication::translate("QWebPage", "Hide Spelling and Grammar", "menu item title");
+}
+
+String contextMenuItemTagCheckSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Check Spelling", "Check spelling context menu item");
+}
+
+String contextMenuItemTagCheckSpellingWhileTyping()
+{
+    return QCoreApplication::translate("QWebPage", "Check Spelling While Typing", "Check spelling while typing context menu item");
+}
+
+String contextMenuItemTagCheckGrammarWithSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Check Grammar With Spelling", "Check grammar with spelling context menu item");
+}
+
+String contextMenuItemTagFontMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Fonts", "Font context sub-menu item");
+}
+
+String contextMenuItemTagBold()
+{
+    return QCoreApplication::translate("QWebPage", "Bold", "Bold context menu item");
+}
+
+String contextMenuItemTagItalic()
+{
+    return QCoreApplication::translate("QWebPage", "Italic", "Italic context menu item");
+}
+
+String contextMenuItemTagUnderline()
+{
+    return QCoreApplication::translate("QWebPage", "Underline", "Underline context menu item");
+}
+
+String contextMenuItemTagOutline()
+{
+    return QCoreApplication::translate("QWebPage", "Outline", "Outline context menu item");
+}
+
+String contextMenuItemTagWritingDirectionMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Direction", "Writing direction context sub-menu item");
+}
+
+String contextMenuItemTagTextDirectionMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Text Direction", "Text direction context sub-menu item");
+}
+
+String contextMenuItemTagDefaultDirection()
+{
+    return QCoreApplication::translate("QWebPage", "Default", "Default writing direction context menu item");
+}
+
+String contextMenuItemTagLeftToRight()
+{
+    return QCoreApplication::translate("QWebPage", "Left to Right", "Left to Right context menu item");
+}
+
+String contextMenuItemTagRightToLeft()
+{
+    return QCoreApplication::translate("QWebPage", "Right to Left", "Right to Left context menu item");
+}
+
+String contextMenuItemTagInspectElement()
+{
+    return QCoreApplication::translate("QWebPage", "Inspect", "Inspect Element context menu item");
+}
+
+String searchMenuNoRecentSearchesText()
+{
+    return QCoreApplication::translate("QWebPage", "No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
+}
+
+String searchMenuRecentSearchesText()
+{
+    return QCoreApplication::translate("QWebPage", "Recent searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
+}
+
+String searchMenuClearRecentSearchesText()
+{
+    return QCoreApplication::translate("QWebPage", "Clear recent searches", "menu item in Recent Searches menu that empties menu's contents");
+}
+
+String AXWebAreaText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXLinkText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXListMarkerText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXImageMapText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXHeadingText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXDefinitionListTermText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXDefinitionListDefinitionText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXButtonActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXRadioButtonActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXTextFieldActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXCheckedCheckBoxActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXUncheckedCheckBoxActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXMenuListActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXMenuListPopupActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXLinkActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String missingPluginText()
+{
+    return QCoreApplication::translate("QWebPage", "Missing Plug-in", "Label text to be used when a plug-in is missing");
+}
+
+String crashedPluginText()
+{
+    notImplemented();
+    return String();
+}
+
+String multipleFileUploadText(unsigned)
+{
+    notImplemented();
+    return String();
+}
+
+String unknownFileSizeText()
+{
+    return QCoreApplication::translate("QWebPage", "Unknown", "Unknown filesize FTP directory listing item");
+}
+
+String imageTitle(const String& filename, const IntSize& size)
+{
+    return QCoreApplication::translate("QWebPage", "%1 (%2x%3 pixels)", "Title string for images").arg(filename).arg(size.width()).arg(size.height());
+}
+
+String mediaElementLoadingStateText()
+{
+    return QCoreApplication::translate("QWebPage", "Loading...", "Media controller status message when the media is loading");
+}
+
+String mediaElementLiveBroadcastStateText()
+{
+    return QCoreApplication::translate("QWebPage", "Live Broadcast", "Media controller status message when watching a live broadcast");
+}
+
+#if ENABLE(VIDEO)
+
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio Element", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video Element", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute Button", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute Button", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Play Button", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause Button", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Slider", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Slider Thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind Button", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return to Real-time Button", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Elapsed Time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining Time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Status Display", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Fullscreen Button", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek Forward Button", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek Back Button", "Media controller element");
+
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio element playback controls and status display", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video element playback controls and status display", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute audio tracks", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute audio tracks", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Begin playback", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause playback", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind movie", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return streaming movie to real-time", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining movie time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie status", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Play movie in full-screen mode", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly back", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly forward", "Media controller element");
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return QCoreApplication::translate("QWebPage", "Indefinite time", "Media time description");
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days)
+        return QCoreApplication::translate("QWebPage", "%1 days %2 hours %3 minutes %4 seconds", "Media time description").arg(days).arg(hours).arg(minutes).arg(seconds);
+
+    if (hours)
+        return QCoreApplication::translate("QWebPage", "%1 hours %2 minutes %3 seconds", "Media time description").arg(hours).arg(minutes).arg(seconds);
+
+    if (minutes)
+        return QCoreApplication::translate("QWebPage", "%1 minutes %2 seconds", "Media time description").arg(minutes).arg(seconds);
+
+    return QCoreApplication::translate("QWebPage", "%1 seconds", "Media time description").arg(seconds);
+}
+
+#else // ENABLE(VIDEO)
+// FIXME: #if ENABLE(VIDEO) should be in the base class
+
+String localizedMediaControlElementString(const String& name)
+{
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    return String();
+}
+
+#endif // ENABLE(VIDEO)
+
+
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForCheckboxText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForFileText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForMultipleFileText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForRadioText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForSelectText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchForEmailText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchForMultipleEmailText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchForURLText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText(int valueLength, int maxLength)
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText(const String& minimum)
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText(const String& maximum)
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText(const String& base, const String& step)
+{
+    notImplemented();
+    return String();
+}
+
+String localizedString(const char* key)
+{
+    return String::fromUTF8(key, strlen(key));
+}
+
+}
diff --git a/Source/WebCore/platform/qt/PlatformScreenQt.cpp b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
index 3c1329ba3..62dcf501f 100644
--- a/Source/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -38,8 +38,13 @@
 #include "NotImplemented.h"
 #include "Widget.h"
 #include "QWebPageClient.h"
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+#include <QGuiApplication>
+#include <QScreen>
+#else
 #include <QApplication>
 #include <QDesktopWidget>
+#endif
 
 namespace WebCore {
 
@@ -66,11 +71,20 @@ static int screenNumber(Widget* w)
 
 int screenDepth(Widget* w)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    return QGuiApplication::screens().value(screenNumber(w))->depth();
+#else
     return QApplication::desktop()->screen(screenNumber(w))->depth();
+#endif
 }
 
 int screenDepthPerComponent(Widget* w)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    int depth = QGuiApplication::primaryScreen()->depth();
+    // FIXME: Use widget's screen
+    Q_UNUSED(w);
+#else
     int depth = QApplication::desktop()->screen(0)->depth();
     if (w) {
         QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
@@ -81,6 +95,7 @@ int screenDepthPerComponent(Widget* w)
                 depth = view->depth();
         }
     }
+#endif
     // An interface to establish the actual number of bits per color
     // doesn't exist in Qt, or probably at all, so use common-sense
     // values for each screen depth and assume RGB/RGBA where appropriate.
@@ -99,18 +114,32 @@ int screenDepthPerComponent(Widget* w)
 
 bool screenIsMonochrome(Widget* w)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    Q_UNUSED(w);
+    // FIXME: In Qt 5 colorCount() isn't even implemented beyond returning 256 :)
+    return false;
+#else
     return QApplication::desktop()->screen(screenNumber(w))->colorCount() == 2;
+#endif
 }
 
 FloatRect screenRect(Widget* widget)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    QRect r = QGuiApplication::screens().value(screenNumber(widget))->geometry();
+#else
     QRect r = QApplication::desktop()->screenGeometry(screenNumber(widget));
+#endif
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
 FloatRect screenAvailableRect(Widget* widget)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    QRect r = QGuiApplication::screens().value(screenNumber(widget))->availableGeometry();
+#else
     QRect r = QApplication::desktop()->availableGeometry(screenNumber(widget));
+#endif
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
diff --git a/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp b/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp
index e3cae8c5a..17a51e9ed 100644
--- a/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp
@@ -40,11 +40,39 @@ PlatformTouchEvent::PlatformTouchEvent(QTouchEvent* event)
     case QEvent::TouchEnd:
         m_type = PlatformEvent::TouchEnd;
         break;
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    case QEvent::TouchCancel:
+        m_type = PlatformEvent::TouchCancel;
+        break;
+#endif
     }
 
     const QList<QTouchEvent::TouchPoint>& points = event->touchPoints();
-    for (int i = 0; i < points.count(); ++i)
-        m_touchPoints.append(PlatformTouchPoint(points.at(i)));
+    for (int i = 0; i < points.count(); ++i) {
+        PlatformTouchPoint::State state = PlatformTouchPoint::TouchStateEnd;
+
+        switch (points.at(i).state()) {
+        case Qt::TouchPointReleased:
+            state = PlatformTouchPoint::TouchReleased;
+            break;
+        case Qt::TouchPointMoved:
+            state = PlatformTouchPoint::TouchMoved;
+            break;
+        case Qt::TouchPointPressed:
+            state = PlatformTouchPoint::TouchPressed;
+            break;
+        case Qt::TouchPointStationary:
+            state = PlatformTouchPoint::TouchStationary;
+            break;
+        }
+
+        // Qt does not have a Qt::TouchPointCancelled point state, so if we receive a touch cancel event,
+        // simply cancel all touch points here.
+        if (m_type == PlatformEvent::TouchCancel)
+            state = PlatformTouchPoint::TouchCancelled;
+
+        m_touchPoints.append(PlatformTouchPoint(points.at(i), state));
+    }
 
     m_modifiers = 0;
     if (event->modifiers()  & Qt::ShiftModifier)
diff --git a/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp b/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp
index ee5e56df7..0f9afa48e 100644
--- a/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp
@@ -27,18 +27,13 @@
 
 namespace WebCore {
 
-PlatformTouchPoint::PlatformTouchPoint(const QTouchEvent::TouchPoint& point)
+PlatformTouchPoint::PlatformTouchPoint(const QTouchEvent::TouchPoint& point, State state)
     // The QTouchEvent::TouchPoint API states that ids will be >= 0.
     : m_id(point.id())
+    , m_state(state)
     , m_screenPos(point.screenPos().toPoint())
     , m_pos(point.pos().toPoint())
 {
-    switch (point.state()) {
-    case Qt::TouchPointReleased: m_state = TouchReleased; break;
-    case Qt::TouchPointMoved: m_state = TouchMoved; break;
-    case Qt::TouchPointPressed: m_state = TouchPressed; break;
-    case Qt::TouchPointStationary: m_state = TouchStationary; break;
-    }
     // Qt reports touch point size as rectangles, but we will pretend it is an oval.
     QRect touchRect = point.rect().toAlignedRect();
     if (touchRect.isValid()) {
diff --git a/Source/WebCore/platform/qt/QWebPageClient.h b/Source/WebCore/platform/qt/QWebPageClient.h
index 8396caca5..30c3b48ea 100644
--- a/Source/WebCore/platform/qt/QWebPageClient.h
+++ b/Source/WebCore/platform/qt/QWebPageClient.h
@@ -34,6 +34,10 @@
 #include <GraphicsLayer.h>
 #endif
 
+#if ENABLE(WEBGL)
+#include <GraphicsContext3D.h>
+#endif
+
 #include <QPalette>
 #include <QRect>
 
@@ -41,6 +45,10 @@ QT_BEGIN_NAMESPACE
 class QStyle;
 QT_END_NAMESPACE
 
+namespace WebCore {
+class Widget;
+}
+
 class QWebPageClient {
 public:
     virtual ~QWebPageClient() { }
@@ -95,6 +103,13 @@ public:
 
     virtual QRectF windowRect() const = 0;
 
+    virtual void setWidgetVisible(WebCore::Widget*, bool visible) = 0;
+
+#if ENABLE(WEBGL)
+    virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
+                                                 PlatformGraphicsSurface3D*) = 0;
+#endif
+
 protected:
 #ifndef QT_NO_CURSOR
     virtual QCursor cursor() const = 0;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 18df290db..00b8b1c1b 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -845,7 +845,7 @@ double RenderThemeQt::caretBlinkInterval() const
     return static_cast<QGuiApplication*>(qApp)->styleHints()->cursorFlashTime() / 1000.0 / 2.0;
 }
 
-String RenderThemeQt::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width)
+String RenderThemeQt::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width) const
 {
     if (width <= 0)
         return String();
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index 1393536b3..cdaaa98eb 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -151,7 +151,7 @@ protected:
 #endif
     virtual void computeSizeBasedOnStyle(RenderStyle*) const = 0;
 
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width);
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width) const;
 
     virtual QRect inflateButtonRect(const QRect& originalRect) const;
 
diff --git a/Source/WebCore/platform/qt/ScrollbarQt.cpp b/Source/WebCore/platform/qt/ScrollbarQt.cpp
deleted file mode 100644
index 190f08da9..000000000
--- a/Source/WebCore/platform/qt/ScrollbarQt.cpp
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "Scrollbar.h"
-
-#include "EventHandler.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "IntRect.h"
-#include "PlatformMouseEvent.h"
-#include "ScrollableArea.h"
-#include "ScrollbarTheme.h"
-
-#include <QApplication>
-#include <QDebug>
-#include <QMenu>
-#include <QPainter>
-#include <QStyle>
-
-using namespace std;
-
-namespace WebCore {
-
-bool Scrollbar::contextMenu(const PlatformMouseEvent& event)
-{
-#ifndef QT_NO_CONTEXTMENU
-    if (!QApplication::style()->styleHint(QStyle::SH_ScrollBar_ContextMenu))
-        return true;
-
-    bool horizontal = (m_orientation == HorizontalScrollbar);
-
-    QMenu menu;
-    QAction* actScrollHere = menu.addAction(QCoreApplication::translate("QWebPage", "Scroll here"));
-    menu.addSeparator();
-
-    QAction* actScrollTop = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Left edge") : QCoreApplication::translate("QWebPage", "Top"));
-    QAction* actScrollBottom = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Right edge") : QCoreApplication::translate("QWebPage", "Bottom"));
-    menu.addSeparator();
-
-    QAction* actPageUp = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Page left") : QCoreApplication::translate("QWebPage", "Page up"));
-    QAction* actPageDown = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Page right") : QCoreApplication::translate("QWebPage", "Page down"));
-    menu.addSeparator();
-
-    QAction* actScrollUp = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Scroll left") : QCoreApplication::translate("QWebPage", "Scroll up"));
-    QAction* actScrollDown = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Scroll right") : QCoreApplication::translate("QWebPage", "Scroll down"));
-
-    const QPoint globalPos = QPoint(event.globalPosition().x(), event.globalPosition().y());
-    QAction* actionSelected = menu.exec(globalPos);
-
-    if (actionSelected == actScrollHere) {
-        // Set the pressed position to the middle of the thumb so that when we 
-        // do move, the delta will be from the current pixel position of the
-        // thumb to the new position
-        int position = theme()->trackPosition(this) + theme()->thumbPosition(this) + theme()->thumbLength(this) / 2;
-        setPressedPos(position); 
-        const QPoint pos = convertFromContainingWindow(event.position());
-        moveThumb(horizontal ? pos.x() : pos.y());
-    } else if (actionSelected == actScrollTop)
-        scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByDocument);
-    else if (actionSelected == actScrollBottom)
-        scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByDocument);
-    else if (actionSelected == actPageUp)
-        scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByPage);
-    else if (actionSelected == actPageDown)
-        scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByPage);
-    else if (actionSelected == actScrollUp)
-        scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByLine);
-    else if (actionSelected == actScrollDown)
-        scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByLine);
-#endif // QT_NO_CONTEXTMENU
-    return true;
-}
-
-}
-
-// vim: ts=4 sw=4 et
diff --git a/Source/WebCore/platform/qt/SoundQt.cpp b/Source/WebCore/platform/qt/SoundQt.cpp
index bf9e1426a..7e3c99119 100644
--- a/Source/WebCore/platform/qt/SoundQt.cpp
+++ b/Source/WebCore/platform/qt/SoundQt.cpp
@@ -28,13 +28,16 @@
 #include "config.h"
 #include "Sound.h"
 
-#include <QApplication>
+#include <NotImplemented.h>
 
 namespace WebCore {
 
 void systemBeep()
 {
-    QApplication::beep();
+    // FIXME: Not implemented in Qt 5 right now. The implementation in QApplication:beep()
+    // is empty. If anyone is going to bother implementing this via QPlatformNativeInterface, then
+    // we could use that here.
+    notImplemented();
 }
 
 }
diff --git a/Source/WebCore/platform/qt/WidgetQt.cpp b/Source/WebCore/platform/qt/WidgetQt.cpp
index 5215e6661..86ee4307f 100644
--- a/Source/WebCore/platform/qt/WidgetQt.cpp
+++ b/Source/WebCore/platform/qt/WidgetQt.cpp
@@ -45,11 +45,10 @@
 #include <QDebug>
 #include <QPaintEngine>
 #include <QPainter>
-#include <QWidget>
 
 namespace WebCore {
 
-Widget::Widget(QWidget* widget)
+Widget::Widget(PlatformWidget widget)
 {
     init(widget);
 }
@@ -89,16 +88,24 @@ void Widget::show()
 {
     setSelfVisible(true);
 
-    if (isParentVisible() && platformWidget())
-        platformWidget()->show();
+    if (!isParentVisible() || !platformWidget())
+        return;
+
+    QWebPageClient* client = root()->hostWindow()->platformPageClient();
+    if (client)
+        client->setWidgetVisible(this, true);
 }
 
 void Widget::hide()
 {
     setSelfVisible(false);
 
-    if (isParentVisible() && platformWidget())
-        platformWidget()->hide();
+    if (!isParentVisible() || !platformWidget())
+        return;
+
+    QWebPageClient* client = root()->hostWindow()->platformPageClient();
+    if (client)
+        client->setWidgetVisible(this, false);
 }
 
 void Widget::paint(GraphicsContext*, const IntRect&)
diff --git a/Source/WebCore/platform/sql/SQLiteDatabase.cpp b/Source/WebCore/platform/sql/SQLiteDatabase.cpp
index 5b9e9c570..bfca58636 100644
--- a/Source/WebCore/platform/sql/SQLiteDatabase.cpp
+++ b/Source/WebCore/platform/sql/SQLiteDatabase.cpp
@@ -102,7 +102,7 @@ bool SQLiteDatabase::open(const String& filename, bool forWebSQLDatabase)
 void SQLiteDatabase::close()
 {
     if (m_db) {
-        // FIXME: This is being called on themain thread during JS GC. <rdar://problem/5739818>
+        // FIXME: This is being called on the main thread during JS GC. <rdar://problem/5739818>
         // ASSERT(currentThread() == m_openingThread);
         sqlite3* db = m_db;
         {
@@ -167,7 +167,7 @@ void SQLiteDatabase::setMaximumSize(int64_t size)
     
     int currentPageSize = pageSize();
 
-    ASSERT(currentPageSize);
+    ASSERT(currentPageSize || !m_db);
     int64_t newMaxPageCount = currentPageSize ? size / currentPageSize : 0;
     
     MutexLocker locker(m_authorizerLock);
diff --git a/Source/WebCore/platform/sql/SQLiteDatabase.h b/Source/WebCore/platform/sql/SQLiteDatabase.h
index 0bf03141a..26fea2471 100644
--- a/Source/WebCore/platform/sql/SQLiteDatabase.h
+++ b/Source/WebCore/platform/sql/SQLiteDatabase.h
@@ -104,7 +104,7 @@ public:
     const char* lastErrorMsg();
     
     sqlite3* sqlite3Handle() const {
-        ASSERT(m_sharable || currentThread() == m_openingThread);
+        ASSERT(m_sharable || currentThread() == m_openingThread || !m_db);
         return m_db;
     }
     
diff --git a/Source/WebCore/platform/text/TextCheckerClient.h b/Source/WebCore/platform/text/TextCheckerClient.h
index d16ade164..6b0fa8053 100644
--- a/Source/WebCore/platform/text/TextCheckerClient.h
+++ b/Source/WebCore/platform/text/TextCheckerClient.h
@@ -37,6 +37,7 @@
 namespace WebCore {
 
 class SpellChecker;
+class TextCheckingRequest;
 
 struct GrammarDetail {
     int location;
@@ -71,7 +72,7 @@ public:
     // provide more accurate correction suggestions. Caller can pass in more text in "context" to aid such spellcheckers on language
     // identification. Noramlly it's the text surrounding the "word" for which we are getting correction suggestions.
     virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses) = 0;
-    virtual void requestCheckingOfString(SpellChecker*, int, TextCheckingTypeMask, const String&) = 0;
+    virtual void requestCheckingOfString(SpellChecker*, const TextCheckingRequest&) = 0;
 };
 
 }
diff --git a/Source/WebCore/platform/text/TextChecking.h b/Source/WebCore/platform/text/TextChecking.h
index 967eac5b3..be9ed5f9e 100644
--- a/Source/WebCore/platform/text/TextChecking.h
+++ b/Source/WebCore/platform/text/TextChecking.h
@@ -31,6 +31,8 @@
 #ifndef TextChecking_h
 #define TextChecking_h
 
+#include <wtf/text/WTFString.h>
+
 namespace WebCore {
 
 #define WTF_USE_GRAMMAR_CHECKING 1
@@ -61,6 +63,34 @@ enum TextCheckingType {
 
 typedef unsigned TextCheckingTypeMask;
 
+enum TextCheckingProcessType {
+    TextCheckingProcessBatch,
+    TextCheckingProcessIncremental
+};
+
+class TextCheckingRequest {
+public:
+    TextCheckingRequest(int sequence, String text, TextCheckingTypeMask mask, TextCheckingProcessType processType)
+        : m_sequence(sequence)
+        , m_text(text)
+        , m_mask(mask)
+        , m_processType(processType)
+    {
+    }
+
+    void setSequence(int sequence) { m_sequence = sequence; }
+    int sequence() const { return m_sequence; }
+    String text() const { return m_text; }
+    TextCheckingTypeMask mask() const { return m_mask; }
+    TextCheckingProcessType processType() const { return m_processType; }
+
+private:
+    int m_sequence;
+    String m_text;
+    TextCheckingTypeMask m_mask;
+    TextCheckingProcessType m_processType;
+};
+
 }
 
 #endif // TextChecking_h
diff --git a/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp b/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp
index 52d130cb8..3eff66b2f 100644
--- a/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp
+++ b/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp
@@ -20,10 +20,8 @@
 #include "PlatformString.h"
 
 #include "WebString.h"
-#include "WebStringImpl.h"
 
 using BlackBerry::WebKit::WebString;
-using BlackBerry::WebKit::WebStringImpl;
 
 namespace WTF {
 
@@ -34,7 +32,7 @@ String::String(const WebString& webString)
 
 String::operator WebString() const
 {
-    WebString webString(static_cast<WebStringImpl*>(m_impl.get()));
+    WebString webString(m_impl.get());
     return webString;
 }
 
diff --git a/Source/WebCore/platform/win/ClipboardWin.cpp b/Source/WebCore/platform/win/ClipboardWin.cpp
index aa383881a..89cacb351 100644
--- a/Source/WebCore/platform/win/ClipboardWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardWin.cpp
@@ -28,6 +28,7 @@
 
 #include "CachedImage.h"
 #include "ClipboardUtilitiesWin.h"
+#include "DOMStringList.h"
 #include "Document.h"
 #include "DragData.h"
 #include "Editor.h"
@@ -485,24 +486,24 @@ bool ClipboardWin::setData(const String& type, const String& data)
     return false;
 }
 
-static void addMimeTypesForFormat(HashSet<String>& results, const FORMATETC& format)
+static void addMimeTypesForFormat(DOMStringList* results, const FORMATETC& format)
 {
     // URL and Text are provided for compatibility with IE's model
     if (format.cfFormat == urlFormat()->cfFormat || format.cfFormat == urlWFormat()->cfFormat) {
-        results.add("URL");
-        results.add("text/uri-list");
+        results->append("URL");
+        results->append("text/uri-list");
     }
 
     if (format.cfFormat == plainTextWFormat()->cfFormat || format.cfFormat == plainTextFormat()->cfFormat) {
-        results.add("Text");
-        results.add("text/plain");
+        results->append("Text");
+        results->append("text/plain");
     }
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardWin::types() const
+PassRefPtr<DOMStringList> ClipboardWin::types() const
 { 
-    HashSet<String> results; 
+    RefPtr<DOMStringList> results = DOMStringList::create();
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
         return results;
 
@@ -522,16 +523,16 @@ HashSet<String> ClipboardWin::types() const
 
         // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
         while (itr->Next(1, &data, 0) == S_OK)
-            addMimeTypesForFormat(results, data);
+            addMimeTypesForFormat(results.get(), data);
     } else {
         for (DragDataMap::const_iterator it = m_dragDataMap.begin(); it != m_dragDataMap.end(); ++it) {
             FORMATETC data;
             data.cfFormat = (*it).first;
-            addMimeTypesForFormat(results, data);
+            addMimeTypesForFormat(results.get(), data);
         }
     }
 
-    return results;
+    return results.release();
 }
 
 PassRefPtr<FileList> ClipboardWin::files() const
diff --git a/Source/WebCore/platform/win/ClipboardWin.h b/Source/WebCore/platform/win/ClipboardWin.h
index a35d8b48a..8c22c0a35 100644
--- a/Source/WebCore/platform/win/ClipboardWin.h
+++ b/Source/WebCore/platform/win/ClipboardWin.h
@@ -64,7 +64,7 @@ public:
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/win/FileSystemWin.cpp b/Source/WebCore/platform/win/FileSystemWin.cpp
index d9b0dbcf2..118754455 100644
--- a/Source/WebCore/platform/win/FileSystemWin.cpp
+++ b/Source/WebCore/platform/win/FileSystemWin.cpp
@@ -32,45 +32,64 @@
 
 #include "NotImplemented.h"
 #include "PathWalker.h"
+#include <wtf/CryptographicallyRandomNumber.h>
 #include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
 #include <windows.h>
-#include <winbase.h>
 #include <shlobj.h>
 #include <shlwapi.h>
 
 namespace WebCore {
 
-static bool statFile(String path, struct _stat64& st)
+static const ULONGLONG kSecondsFromFileTimeToTimet = 11644473600;
+
+static bool getFindData(String path, WIN32_FIND_DATAW& findData)
 {
-    ASSERT_ARG(path, !path.isNull());
-    return !_wstat64(path.charactersWithNullTermination(), &st) && (st.st_mode & _S_IFMT) == _S_IFREG;
+    HANDLE handle = FindFirstFileW(path.charactersWithNullTermination(), &findData);
+    if (handle == INVALID_HANDLE_VALUE)
+        return false;
+    FindClose(handle);
+    return true;
 }
 
 bool getFileSize(const String& path, long long& result)
 {
-    struct _stat64 sb;
-    if (!statFile(path, sb))
+    WIN32_FIND_DATAW findData;
+    if (!getFindData(path, findData))
+        return false;
+
+    ULARGE_INTEGER fileSize;
+    fileSize.HighPart = findData.nFileSizeHigh;
+    fileSize.LowPart = findData.nFileSizeLow;
+
+    if (fileSize.QuadPart > static_cast<ULONGLONG>(std::numeric_limits<long long>::max()))
         return false;
-    result = sb.st_size;
+
+    result = fileSize.QuadPart;
     return true;
 }
 
 bool getFileModificationTime(const String& path, time_t& result)
 {
-    struct _stat64 st;
-    if (!statFile(path, st))
+    WIN32_FIND_DATAW findData;
+    if (!getFindData(path, findData))
         return false;
-    result = st.st_mtime;
+
+    ULARGE_INTEGER fileSize;
+    fileSize.HighPart = findData.ftLastWriteTime.dwHighDateTime;
+    fileSize.LowPart = findData.ftLastWriteTime.dwLowDateTime;
+
+    // Information about converting time_t to FileTime is available at http://msdn.microsoft.com/en-us/library/ms724228%28v=vs.85%29.aspx
+    result = fileSize.QuadPart / 10000000 - kSecondsFromFileTimeToTimet;
     return true;
 }
 
-bool fileExists(const String& path) 
+bool fileExists(const String& path)
 {
-    struct _stat64 st;
-    return statFile(path, st);
+    WIN32_FIND_DATAW findData;
+    return getFindData(path, findData);
 }
 
 bool deleteFile(const String& path)
@@ -145,9 +164,11 @@ String directoryName(const String& path)
 
 static String bundleName()
 {
-    static bool initialized;
     static String name = "WebKit";
 
+#if USE(CF)
+    static bool initialized;
+
     if (!initialized) {
         initialized = true;
 
@@ -156,6 +177,7 @@ static String bundleName()
                 if (CFGetTypeID(bundleExecutable) == CFStringGetTypeID())
                     name = reinterpret_cast<CFStringRef>(bundleExecutable);
     }
+#endif
 
     return name;
 }
@@ -194,21 +216,16 @@ String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     handle = INVALID_HANDLE_VALUE;
 
-    char tempPath[MAX_PATH];
-    int tempPathLength = ::GetTempPathA(WTF_ARRAY_LENGTH(tempPath), tempPath);
+    wchar_t tempPath[MAX_PATH];
+    int tempPathLength = ::GetTempPathW(WTF_ARRAY_LENGTH(tempPath), tempPath);
     if (tempPathLength <= 0 || tempPathLength > WTF_ARRAY_LENGTH(tempPath))
         return String();
 
-    HCRYPTPROV hCryptProv = 0;
-    if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
-        return String();
-
-    char proposedPath[MAX_PATH];
-    while (1) {
-        char tempFile[] = "XXXXXXXX.tmp"; // Use 8.3 style name (more characters aren't helpful due to 8.3 short file names)
+    String proposedPath;
+    do {
+        wchar_t tempFile[] = L"XXXXXXXX.tmp"; // Use 8.3 style name (more characters aren't helpful due to 8.3 short file names)
         const int randomPartLength = 8;
-        if (!CryptGenRandom(hCryptProv, randomPartLength, reinterpret_cast<BYTE*>(tempFile)))
-            break;
+        cryptographicallyRandomValues(tempFile, randomPartLength * sizeof(wchar_t));
 
         // Limit to valid filesystem characters, also excluding others that could be problematic, like punctuation.
         // don't include both upper and lowercase since Windows file systems are typically not case sensitive.
@@ -216,25 +233,20 @@ String openTemporaryFile(const String&, PlatformFileHandle& handle)
         for (int i = 0; i < randomPartLength; ++i)
             tempFile[i] = validChars[tempFile[i] % (sizeof(validChars) - 1)];
 
-        ASSERT(strlen(tempFile) == sizeof(tempFile) - 1);
+        ASSERT(wcslen(tempFile) == WTF_ARRAY_LENGTH(tempFile) - 1);
 
-        if (!PathCombineA(proposedPath, tempPath, tempFile))
+        proposedPath = pathByAppendingComponent(tempPath, tempFile);
+        if (proposedPath.isEmpty())
             break;
- 
-        // use CREATE_NEW to avoid overwriting an existing file with the same name
-        handle = CreateFileA(proposedPath, GENERIC_READ | GENERIC_WRITE, 0, 0, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
-        if (!isHandleValid(handle) && GetLastError() == ERROR_ALREADY_EXISTS)
-            continue;
 
-        break;
-    }
-
-    CryptReleaseContext(hCryptProv, 0);
+        // use CREATE_NEW to avoid overwriting an existing file with the same name
+        handle = ::CreateFileW(proposedPath.charactersWithNullTermination(), GENERIC_READ | GENERIC_WRITE, 0, 0, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
+    } while (!isHandleValid(handle) && GetLastError() == ERROR_ALREADY_EXISTS);
 
     if (!isHandleValid(handle))
         return String();
 
-    return String::fromUTF8(proposedPath);
+    return proposedPath;
 }
 
 PlatformFileHandle openFile(const String& path, FileOpenMode mode)
@@ -294,6 +306,8 @@ String roamingUserSpecificStorageDirectory()
     return cachedStorageDirectory(CSIDL_APPDATA);
 }
 
+#if USE(CF)
+
 bool safeCreateFile(const String& path, CFDataRef data)
 {
     // Create a temporary file.
@@ -324,6 +338,8 @@ bool safeCreateFile(const String& path, CFDataRef data)
     return true;
 }
 
+#endif // USE(CF)
+
 Vector<String> listDirectory(const String& directory, const String& filter)
 {
     Vector<String> entries;
diff --git a/Source/WebCore/platform/win/PasteboardWin.cpp b/Source/WebCore/platform/win/PasteboardWin.cpp
index 887fc912c..065e3a801 100644
--- a/Source/WebCore/platform/win/PasteboardWin.cpp
+++ b/Source/WebCore/platform/win/PasteboardWin.cpp
@@ -42,6 +42,7 @@
 #include "RenderImage.h"
 #include "TextEncoding.h"
 #include "WebCoreInstanceHandle.h"
+#include "WindowsExtras.h"
 #include "markup.h"
 #include <wtf/text/CString.h>
 
@@ -88,11 +89,6 @@ Pasteboard* Pasteboard::generalPasteboard()
 
 Pasteboard::Pasteboard()
 {
-    HWND hWndParent = 0;
-#if !OS(WINCE)
-    hWndParent = HWND_MESSAGE;
-#endif
-
     WNDCLASS wc;
     memset(&wc, 0, sizeof(WNDCLASS));
     wc.lpfnWndProc    = PasteboardOwnerWndProc;
@@ -101,7 +97,7 @@ Pasteboard::Pasteboard()
     RegisterClass(&wc);
 
     m_owner = ::CreateWindow(L"PasteboardOwnerWindowClass", L"PasteboardOwnerWindow", 0, 0, 0, 0, 0,
-        hWndParent, 0, 0, 0);
+        HWND_MESSAGE, 0, 0, 0);
 
     HTMLClipboardFormat = ::RegisterClipboardFormat(L"HTML Format");
     BookmarkClipboardFormat = ::RegisterClipboardFormat(L"UniformResourceLocatorW");
diff --git a/Source/WebCore/platform/win/PopupMenuWin.cpp b/Source/WebCore/platform/win/PopupMenuWin.cpp
index d0b3ec940..9ac2674c4 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.cpp
+++ b/Source/WebCore/platform/win/PopupMenuWin.cpp
@@ -43,6 +43,7 @@
 #include "SimpleFontData.h"
 #include "TextRun.h"
 #include "WebCoreInstanceHandle.h"
+#include "WindowsExtras.h"
 
 #include <windows.h>
 #include <windowsx.h>
@@ -536,12 +537,12 @@ bool PopupMenuWin::scrollToRevealSelection()
     int index = focusedIndex();
 
     if (index < m_scrollOffset) {
-        ScrollableArea::scrollToYOffsetWithoutAnimation(index);
+        ScrollableArea::scrollToOffsetWithoutAnimation(VerticalScrollbar, index);
         return true;
     }
 
     if (index >= m_scrollOffset + visibleItems()) {
-        ScrollableArea::scrollToYOffsetWithoutAnimation(index - visibleItems() + 1);
+        ScrollableArea::scrollToOffsetWithoutAnimation(VerticalScrollbar, index - visibleItems() + 1);
         return true;
     }
 
@@ -763,24 +764,14 @@ void PopupMenuWin::registerClass()
 
 LRESULT CALLBACK PopupMenuWin::PopupMenuWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
-#if OS(WINCE)
-    LONG longPtr = GetWindowLong(hWnd, 0);
-#else
-    LONG_PTR longPtr = GetWindowLongPtr(hWnd, 0);
-#endif
-    
-    if (PopupMenuWin* popup = reinterpret_cast<PopupMenuWin*>(longPtr))
+    if (PopupMenuWin* popup = static_cast<PopupMenuWin*>(getWindowPointer(hWnd, 0)))
         return popup->wndProc(hWnd, message, wParam, lParam);
-    
+
     if (message == WM_CREATE) {
         LPCREATESTRUCT createStruct = reinterpret_cast<LPCREATESTRUCT>(lParam);
 
         // Associate the PopupMenu with the window.
-#if OS(WINCE)
-        ::SetWindowLong(hWnd, 0, (LONG)createStruct->lpCreateParams);
-#else
-        ::SetWindowLongPtr(hWnd, 0, (LONG_PTR)createStruct->lpCreateParams);
-#endif
+        setWindowPointer(hWnd, 0, createStruct->lpCreateParams);
         return 0;
     }
 
diff --git a/Source/WebCore/platform/win/RunLoopWin.cpp b/Source/WebCore/platform/win/RunLoopWin.cpp
index 120c252a6..1663b6613 100644
--- a/Source/WebCore/platform/win/RunLoopWin.cpp
+++ b/Source/WebCore/platform/win/RunLoopWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RunLoop.h"
 
+#include "WindowsExtras.h"
 #include <wtf/CurrentTime.h>
 
 using namespace std;
@@ -37,16 +38,14 @@ static const LPWSTR kRunLoopMessageWindowClassName = L"RunLoopMessageWindow";
 
 LRESULT CALLBACK RunLoop::RunLoopWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
-    LONG_PTR longPtr = ::GetWindowLongPtr(hWnd, 0);
-    
-    if (RunLoop* runLoop = reinterpret_cast<RunLoop*>(longPtr))
+    if (RunLoop* runLoop = static_cast<RunLoop*>(getWindowPointer(hWnd, 0)))
         return runLoop->wndProc(hWnd, message, wParam, lParam);
 
     if (message == WM_CREATE) {
         LPCREATESTRUCT createStruct = reinterpret_cast<LPCREATESTRUCT>(lParam);
 
         // Associate the RunLoop with the window.
-        ::SetWindowLongPtr(hWnd, 0, (LONG_PTR)createStruct->lpCreateParams);
+        setWindowPointer(hWnd, 0, createStruct->lpCreateParams);
         return 0;
     }
 
@@ -87,13 +86,12 @@ bool RunLoop::registerRunLoopMessageWindowClass()
 {
     // FIXME: This really only needs to be called once.
 
-    WNDCLASSEX windowClass = { 0 };
-    windowClass.cbSize          = sizeof(windowClass);
+    WNDCLASS windowClass = { 0 };
     windowClass.lpfnWndProc     = RunLoop::RunLoopWndProc;
     windowClass.cbWndExtra      = sizeof(RunLoop*);
     windowClass.lpszClassName   = kRunLoopMessageWindowClassName;
 
-    return !!::RegisterClassEx(&windowClass);
+    return !!::RegisterClass(&windowClass);
 }
 
 RunLoop::RunLoop()
diff --git a/Source/WebCore/platform/win/WindowsExtras.h b/Source/WebCore/platform/win/WindowsExtras.h
new file mode 100644
index 000000000..ab1e85376
--- /dev/null
+++ b/Source/WebCore/platform/win/WindowsExtras.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WindowsExtras_h
+#define WindowsExtras_h
+
+#include <windows.h>
+
+namespace WebCore {
+
+#ifndef HWND_MESSAGE
+const HWND HWND_MESSAGE = 0;
+#endif
+
+inline void* getWindowPointer(HWND hWnd, int index)
+{
+#if OS(WINCE)
+    return reinterpret_cast<void*>(::GetWindowLong(hWnd, index));
+#else
+    return reinterpret_cast<void*>(::GetWindowLongPtr(hWnd, index));
+#endif
+}
+
+inline void* setWindowPointer(HWND hWnd, int index, void* value)
+{
+#if OS(WINCE)
+    return reinterpret_cast<void*>(::SetWindowLong(hWnd, index, reinterpret_cast<LONG>(value)));
+#else
+    return reinterpret_cast<void*>(::SetWindowLongPtr(hWnd, index, reinterpret_cast<LONG_PTR>(value)));
+#endif
+}
+
+} // namespace WebCore
+
+#endif // WindowsExtras_h
diff --git a/Source/WebCore/platform/wx/ClipboardWx.cpp b/Source/WebCore/platform/wx/ClipboardWx.cpp
index 32216a652..161bce8aa 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.cpp
+++ b/Source/WebCore/platform/wx/ClipboardWx.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "ClipboardWx.h"
 
+#include "DOMStringList.h"
 #include "FileList.h"
 #include "HashTable.h"
 #include "IntPoint.h"
@@ -70,11 +71,10 @@ bool ClipboardWx::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardWx::types() const 
+PassRefPtr<DOMStringList> ClipboardWx::types() const 
 {
     notImplemented();
-    HashSet<String> result;
-    return result;
+    return DOMStringList::create();
 }
 
 PassRefPtr<FileList> ClipboardWx::files() const
diff --git a/Source/WebCore/platform/wx/ClipboardWx.h b/Source/WebCore/platform/wx/ClipboardWx.h
index 138635aae..f92726ae6 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.h
+++ b/Source/WebCore/platform/wx/ClipboardWx.h
@@ -46,7 +46,7 @@ namespace WebCore {
         bool setData(const String& type, const String& data);
     
         // extensions beyond IE's API
-        virtual HashSet<String> types() const;
+        virtual PassRefPtr<DOMStringList> types() const;
         virtual PassRefPtr<FileList> files() const;
     
         IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/wx/ContextMenuWx.cpp b/Source/WebCore/platform/wx/ContextMenuWx.cpp
index 73329a994..f722769fa 100644
--- a/Source/WebCore/platform/wx/ContextMenuWx.cpp
+++ b/Source/WebCore/platform/wx/ContextMenuWx.cpp
@@ -110,3 +110,11 @@ PlatformMenuDescription ContextMenu::releasePlatformDescription()
 
     return description;
 }
+
+unsigned ContextMenu::itemCount() const
+{
+    if (m_platformDescription)
+        return m_platformDescription->GetMenuItemCount();
+    
+    return 0;
+}
diff --git a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
index 4d1e19729..fa959314d 100644
--- a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
+++ b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
@@ -32,473 +32,9 @@
 
 namespace WebCore {
 
-String submitButtonDefaultLabel() 
-{ 
-    return String("Submit"); 
-}
-
-String inputElementAltText() 
-{ 
-    return String(); 
-}
-
-String resetButtonDefaultLabel() 
-{ 
-    return String("Reset"); 
-}
-
-String defaultDetailsSummaryText()
-{
-    return String("Details");
-}
-
-String platformDefaultLanguage() 
-{ 
-    return String("en"); 
-}
-
-String searchableIndexIntroduction() 
-{ 
-    return String("Searchable Index"); 
-}
-
-String fileButtonChooseFileLabel() 
-{ 
-    return String("Choose File"); 
-}
-
-String fileButtonChooseMultipleFilesLabel() 
-{ 
-    return String("Choose Files"); 
-}
-
-String fileButtonNoFileSelectedLabel() 
-{ 
-    return String("No file selected"); 
-}
-
-String fileButtonNoFilesSelectedLabel() 
-{ 
-    return String("No files selected"); 
-}
-
-String contextMenuItemTagOpenLinkInNewWindow() 
-{ 
-    return String("Open Link in New Window"); 
-}
-
-String contextMenuItemTagDownloadLinkToDisk() 
-{ 
-    return String("Download Link to Disk"); 
-}
-
-String contextMenuItemTagCopyLinkToClipboard() 
-{ 
-    return String("Copy Link to Clipboard"); 
-}
-
-String contextMenuItemTagOpenImageInNewWindow() 
-{ 
-    return String("Open Image in New Window"); 
-}
-
-String contextMenuItemTagDownloadImageToDisk() 
-{ 
-    return String("Download Image to Disk"); 
-}
-
-String contextMenuItemTagCopyImageToClipboard() 
-{ 
-    return String("Copy Image to Clipboard"); 
-}
-
-String contextMenuItemTagOpenVideoInNewWindow()
-{
-    return String("Open Video in New Window");
-}
-
-String contextMenuItemTagOpenAudioInNewWindow()
-{
-    return String("Open Audio in New Window");
-}
-
-String contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return String("Copy Video Link Location");
-}
-
-String contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return String("Copy Audio Link Location");
-}
-
-String contextMenuItemTagToggleMediaControls()
-{
-    return String("Toggle Media Controls");
-}
-
-String contextMenuItemTagToggleMediaLoop()
-{
-    return String("Toggle Media Loop Playback");
-}
-
-String contextMenuItemTagEnterVideoFullscreen()
-{
-    return String("Switch Video to Fullscreen");
-}
-
-String contextMenuItemTagMediaPlay()
-{
-    return String("Play");
-}
-
-String contextMenuItemTagMediaPause()
-{
-    return String("Pause");
-}
-
-String contextMenuItemTagMediaMute()
-{
-    return String("Mute");
-}
-
-String contextMenuItemTagOpenFrameInNewWindow() 
-{ 
-    return String("Open Frame in New Window"); 
-}
-
-String contextMenuItemTagCopy() 
-{
-    return String("Copy");
-}
-
-String contextMenuItemTagGoBack() 
-{
-    return String("Go Back");
-}
-
-String contextMenuItemTagGoForward() 
-{
-    return String("Go Forward");
-}
-
-String contextMenuItemTagStop() 
-{
-    return String("Stop");
-}
-
-String contextMenuItemTagReload() 
-{
-    return String("Reload");
-}
-
-String contextMenuItemTagCut() 
-{
-    return String("Cut");
-}
-
-String contextMenuItemTagPaste() 
-{
-    return String("Paste");
-}
-
-String contextMenuItemTagNoGuessesFound() 
-{
-    return String("No Guesses Found");
-}
-
-String contextMenuItemTagIgnoreSpelling() 
-{
-    return String("Ignore Spelling");
-}
-
-String contextMenuItemTagLearnSpelling() 
-{
-    return String("Learn Spelling");
-}
-
-String contextMenuItemTagSearchWeb() 
-{
-    return String("Search Web");
-}
-
-String contextMenuItemTagLookUpInDictionary(const String&)
-{
-    return String("Look Up in Dictionary");
-}
-
-String contextMenuItemTagOpenLink() 
-{
-    return String("Open Link");
-}
-
-String contextMenuItemTagIgnoreGrammar() 
-{
-    return String("Ignore Grammar");
-}
-
-String contextMenuItemTagSpellingMenu() 
-{
-    return String("Spelling");
-}
-
-String contextMenuItemTagShowSpellingPanel(bool show) 
-{
-    return String("Show Spelling Panel");
-}
-
-String contextMenuItemTagCheckSpelling() 
-{
-    return String("Check Spelling");
-}
-
-String contextMenuItemTagCheckSpellingWhileTyping() 
-{
-    return String("Check Spelling While Typing");
-}
-
-String contextMenuItemTagCheckGrammarWithSpelling() 
-{
-    return String("Check Grammar with Spelling");
-}
-
-String contextMenuItemTagFontMenu() 
-{
-    return String("Font");
-}
-
-String contextMenuItemTagBold() 
+String localizedString(const char* key)
 {
-    return String("Bold");
+    return String::fromUTF8(key, strlen(key));
 }
 
-String contextMenuItemTagItalic() 
-{
-    return String("Italic");
-}
-
-String contextMenuItemTagUnderline() 
-{
-    return String("Underline");
-}
-
-String contextMenuItemTagOutline() 
-{
-    return String("Outline");
-}
-
-String contextMenuItemTagWritingDirectionMenu() 
-{
-    return String("Writing Direction");
-}
-
-String contextMenuItemTagTextDirectionMenu()
-{
-    return String("Text Direction");
-}
-
-String contextMenuItemTagDefaultDirection() 
-{
-    return String("Default Direction");
 }
-
-String contextMenuItemTagLeftToRight() 
-{
-    return String("Left to Right");
-}
-
-String contextMenuItemTagRightToLeft() 
-{
-    return String("Right to Left");
-}
-
-String searchMenuNoRecentSearchesText() 
-{
-    return String("No recent searches");
-}
-
-String searchMenuRecentSearchesText() 
-{
-    return String("Recent searches");
-}
-
-String searchMenuClearRecentSearchesText() 
-{
-    return String("Clear recent searches");
-}
-
-String contextMenuItemTagInspectElement() 
-{
-    return String("Inspect Element");
-}
-
-String multipleFileUploadText(unsigned numberOfFiles)
-{
-    // FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
-    return String::number(numberOfFiles) + String(" files");
-}
-
-String unknownFileSizeText() 
-{
-    return String("Unknown");
-}
-
-String imageTitle(const String& filename, const IntSize& size)
-{
-    return String();
-}
-
-// accessibility related strings
-String AXButtonActionVerb()
-{
-    return String();
-}
-
-String AXRadioButtonActionVerb()
-{
-    return String();
-}
-
-String AXTextFieldActionVerb()
-{
-    return String();
-}
-
-String AXCheckedCheckBoxActionVerb()
-{
-    return String();
-}
-
-String AXUncheckedCheckBoxActionVerb()
-{
-    return String();
-}
-
-String AXLinkActionVerb()
-{
-    return String();
-}
-
-String AXDefinitionListTermText()
-{
-    return String();
-}
-
-String AXDefinitionListDefinitionText()
-{
-    return String();
-}
-
-String AXMenuListPopupActionVerb()
-{
-    return String();
-}
-
-String AXMenuListActionVerb()
-{
-    return String();
-}
-
-String validationMessageValueMissingText()
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageValueMissingForCheckboxText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForFileText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForMultipleFileText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForRadioText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForSelectText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageTypeMismatchText()
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageTypeMismatchForEmailText()
-{
-    notImplemented();
-    return validationMessageTypeMismatchText();
-}
-
-String validationMessageTypeMismatchForMultipleEmailText()
-{
-    notImplemented();
-    return validationMessageTypeMismatchText();
-}
-
-String validationMessageTypeMismatchForURLText()
-{
-    notImplemented();
-    return validationMessageTypeMismatchText();
-}
-
-String validationMessagePatternMismatchText()
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageTooLongText(int, int)
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageRangeUnderflowText(const String&)
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageRangeOverflowText(const String&)
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageStepMismatchText(const String&, const String&)
-{
-    notImplemented();
-    return String();
-}
-
-String missingPluginText()
-{
-    notImplemented();
-    return String("Missing Plug-in");
-}
-
-String crashedPluginText()
-{
-    notImplemented();
-    return String("Plug-in Failure");
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/plugins/DOMMimeType.idl b/Source/WebCore/plugins/DOMMimeType.idl
index 1d97a6b61..942060f10 100644
--- a/Source/WebCore/plugins/DOMMimeType.idl
+++ b/Source/WebCore/plugins/DOMMimeType.idl
@@ -20,7 +20,9 @@
 
 module window {
 
-    interface DOMMimeType {
+    interface [
+        InterfaceName=MimeType
+    ] DOMMimeType {
         readonly attribute DOMString type;
         readonly attribute DOMString suffixes;
         readonly attribute DOMString description;
diff --git a/Source/WebCore/plugins/DOMMimeTypeArray.idl b/Source/WebCore/plugins/DOMMimeTypeArray.idl
index 3e2eff2de..3de7f8d6d 100644
--- a/Source/WebCore/plugins/DOMMimeTypeArray.idl
+++ b/Source/WebCore/plugins/DOMMimeTypeArray.idl
@@ -23,11 +23,12 @@ module window {
     interface [
         JSGenerateIsReachable=ImplFrame,
         NamedGetter,
-        IndexedGetter
+        IndexedGetter,
+        InterfaceName=MimeTypeArray
     ] DOMMimeTypeArray {
         readonly attribute unsigned long length;
-        DOMMimeType item(in [Optional=CallWithDefaultValue] unsigned long index);
-        DOMMimeType namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        DOMMimeType item(in [Optional=DefaultIsUndefined] unsigned long index);
+        DOMMimeType namedItem(in [Optional=DefaultIsUndefined] DOMString name);
     };
 
 }
diff --git a/Source/WebCore/plugins/DOMPlugin.idl b/Source/WebCore/plugins/DOMPlugin.idl
index bf3542d0c..f645a0b6e 100644
--- a/Source/WebCore/plugins/DOMPlugin.idl
+++ b/Source/WebCore/plugins/DOMPlugin.idl
@@ -22,14 +22,15 @@ module window {
 
     interface [
         NamedGetter,
-        IndexedGetter
+        IndexedGetter,
+        InterfaceName=Plugin
     ] DOMPlugin {
         readonly attribute DOMString name;
         readonly attribute DOMString filename;
         readonly attribute DOMString description;
         readonly attribute unsigned long length;
-        DOMMimeType item(in [Optional=CallWithDefaultValue] unsigned long index);
-        DOMMimeType namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        DOMMimeType item(in [Optional=DefaultIsUndefined] unsigned long index);
+        DOMMimeType namedItem(in [Optional=DefaultIsUndefined] DOMString name);
     };
 
 }
diff --git a/Source/WebCore/plugins/DOMPluginArray.idl b/Source/WebCore/plugins/DOMPluginArray.idl
index 32aa34263..f042f924c 100644
--- a/Source/WebCore/plugins/DOMPluginArray.idl
+++ b/Source/WebCore/plugins/DOMPluginArray.idl
@@ -23,12 +23,13 @@ module window {
     interface [
         JSGenerateIsReachable=ImplFrame,
         NamedGetter,
-        IndexedGetter
+        IndexedGetter,
+        InterfaceName=PluginArray
     ] DOMPluginArray {
         readonly attribute unsigned long length;
-        DOMPlugin item(in [Optional=CallWithDefaultValue] unsigned long index);
-        DOMPlugin namedItem(in [Optional=CallWithDefaultValue] DOMString name);
-        void refresh(in [Optional=CallWithDefaultValue] boolean reload);
+        DOMPlugin item(in [Optional=DefaultIsUndefined] unsigned long index);
+        DOMPlugin namedItem(in [Optional=DefaultIsUndefined] DOMString name);
+        void refresh(in [Optional=DefaultIsUndefined] boolean reload);
     };
 
 }
diff --git a/Source/WebCore/plugins/PluginView.h b/Source/WebCore/plugins/PluginView.h
index cb3ee42ca..1128522d0 100644
--- a/Source/WebCore/plugins/PluginView.h
+++ b/Source/WebCore/plugins/PluginView.h
@@ -61,7 +61,6 @@ typedef PlatformWidget PlatformPluginWidget;
 #include "TextureMapperPlatformLayer.h"
 #endif
 
-#include <QGraphicsItem>
 #include <QImage>
 QT_BEGIN_NAMESPACE
 class QPainter;
diff --git a/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h b/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h
index 0beedd566..3f2878fdf 100644
--- a/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h
+++ b/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h
@@ -20,6 +20,9 @@
 #define PluginViewPrivateBlackBerry_h
 
 #include "PluginView.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <BlackBerryPlatformIntRectRegion.h>
 #include <pthread.h>
 
 #define PLUGIN_BUFFERS 2
diff --git a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
index a6016d9e7..7b950d30a 100644
--- a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
+++ b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
@@ -69,16 +69,16 @@ bool PluginPackage::fetchInfo()
     NPError err = getValue(0, NPPVpluginNameString, static_cast<void*>(&buffer));
     if (err != NPERR_NO_ERROR)
         return false;
-    m_name = buffer;
+    m_name = String::fromUTF8(buffer);
 
     buffer = 0;
     err = getValue(0, NPPVpluginDescriptionString, static_cast<void*>(&buffer));
     if (err != NPERR_NO_ERROR)
         return false;
-    m_description = buffer;
+    m_description = String::fromUTF8(buffer);
     determineModuleVersionFromDescription();
 
-    String description = getMIMEDescription();
+    String description = String::fromUTF8(getMIMEDescription());
 
     Vector<String> types;
     description.split(UChar(';'), false, types);
diff --git a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
index 21d3c9ede..93abd320a 100644
--- a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
@@ -58,12 +58,12 @@ bool PluginPackage::fetchInfo()
     char* buffer = 0;
     NPError err = NPP_GetValue(0, NPPVpluginNameString, &buffer);
     if (err == NPERR_NO_ERROR)
-        m_name = buffer;
+        m_name = String::fromUTF8(buffer);
 
     buffer = 0;
     err = NPP_GetValue(0, NPPVpluginDescriptionString, &buffer);
     if (err == NPERR_NO_ERROR) {
-        m_description = buffer;
+        m_description = String::fromUTF8(buffer);
         determineModuleVersionFromDescription();
     }
 
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index abf4f196c..3ef203f54 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -165,6 +165,8 @@ void PluginView::updatePluginWidget()
 void PluginView::setFocus(bool focused)
 {
     ASSERT(platformPluginWidget() == platformWidget());
+    if (focused && platformWidget())
+        gtk_widget_grab_focus(platformWidget());
     Widget::setFocus(focused);
 }
 
diff --git a/Source/WebCore/plugins/mac/PluginViewMac.mm b/Source/WebCore/plugins/mac/PluginViewMac.mm
index 94fc8e628..901a359b5 100644
--- a/Source/WebCore/plugins/mac/PluginViewMac.mm
+++ b/Source/WebCore/plugins/mac/PluginViewMac.mm
@@ -104,7 +104,7 @@ static inline WindowRef nativeWindowFor(PlatformWidget widget)
 #if PLATFORM(QT)
     if (widget)
 #if QT_MAC_USE_COCOA
-        return static_cast<WindowRef>([qt_mac_window_for(widget) windowRef]);
+        return static_cast<WindowRef>([qt_mac_window_for(static_cast<QWidget*>(widget)) windowRef]);
 #else
         return static_cast<WindowRef>(qt_mac_window_for(widget));
 #endif
@@ -119,7 +119,7 @@ static inline CGContextRef cgHandleFor(PlatformWidget widget)
 {
 #if PLATFORM(QT)
     if (widget)
-        return (CGContextRef)widget->macCGHandle();
+        return (CGContextRef)static_cast<QWidget*>(widget)->macCGHandle();
 #endif
 #if PLATFORM(WX)
     if (widget)
@@ -132,8 +132,8 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
 {
 #if PLATFORM(QT)
     if (widget) {
-        PlatformWidget topLevel = widget->window();
-        return widget->mapTo(topLevel, QPoint(0, 0)) + topLevel->geometry().topLeft() - topLevel->pos();
+        QWidget* topLevel = static_cast<QWidget*>(widget)->window();
+        return static_cast<QWidget*>(widget)->mapTo(topLevel, QPoint(0, 0)) + topLevel->geometry().topLeft() - topLevel->pos();
     }
 #endif
 #if PLATFORM(WX)
@@ -348,7 +348,7 @@ void PluginView::setFocus(bool focused)
 
     if (platformPluginWidget())
 #if PLATFORM(QT)
-       platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+       static_cast<QWidget*>(platformPluginWidget())->setFocus(Qt::OtherFocusReason);
 #else
         platformPluginWidget()->SetFocus();
 #endif
@@ -535,7 +535,7 @@ void PluginView::invalidateRect(const IntRect& rect)
 {
     if (platformPluginWidget())
 #if PLATFORM(QT)
-        platformPluginWidget()->update(convertToContainingWindow(rect));
+        static_cast<QWidget*>(platformPluginWidget())->update(convertToContainingWindow(rect));
 #else
         platformPluginWidget()->RefreshRect(convertToContainingWindow(rect));
 #endif
diff --git a/Source/WebCore/plugins/qt/PluginPackageQt.cpp b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
index 72d83c4f7..4e9a717b8 100644
--- a/Source/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -51,16 +51,15 @@ bool PluginPackage::fetchInfo()
     if (err != NPERR_NO_ERROR)
         return false;
 
-    m_name = buf;
+    m_name = String::fromUTF8(buf);
     err = gv(0, NPPVpluginDescriptionString, (void*) &buf);
     if (err != NPERR_NO_ERROR)
         return false;
 
-    m_description = buf;
+    m_description = String::fromUTF8(buf);
     determineModuleVersionFromDescription();
 
-    String mimeDescription = gm();
-    setMIMEDescription(mimeDescription);
+    setMIMEDescription(String::fromUTF8(gm()));
     m_infoIsFromCache = false;
 
     return true;
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index e2c55cfef..ff912db56 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -189,7 +189,7 @@ void PluginView::setFocus(bool focused)
 {
     if (platformPluginWidget()) {
         if (focused)
-            platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+            static_cast<QWidget*>(platformPluginWidget())->setFocus(Qt::OtherFocusReason);
     } else {
         Widget::setFocus(focused);
     }
@@ -572,7 +572,8 @@ void PluginView::setNPWindowIfNeeded()
     m_hasPendingGeometryChange = false;
 
     if (m_isWindowed) {
-        platformPluginWidget()->setGeometry(m_windowRect);
+        QWidget* widget = static_cast<QWidget*>(platformPluginWidget());
+        widget->setGeometry(m_windowRect);
 
         // Cut out areas of the plugin occluded by iframe shims
         Vector<IntRect> cutOutRects;
@@ -584,8 +585,8 @@ void PluginView::setNPWindowIfNeeded()
         }
         // if setMask is set with an empty QRegion, no clipping will
         // be performed, so in that case we hide the plugin view
-        platformPluginWidget()->setVisible(!clipRegion.isEmpty());
-        platformPluginWidget()->setMask(clipRegion);
+        widget->setVisible(!clipRegion.isEmpty());
+        widget->setMask(clipRegion);
 
         m_npWindow.x = m_windowRect.x();
         m_npWindow.y = m_windowRect.y();
@@ -639,7 +640,7 @@ void PluginView::setParentVisible(bool visible)
     Widget::setParentVisible(visible);
 
     if (isSelfVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(visible);
+        static_cast<QWidget*>(platformPluginWidget())->setVisible(visible);
 }
 
 NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32_t len, const char* buf)
@@ -742,8 +743,9 @@ void PluginView::invalidateRect(const IntRect& rect)
         if (platformWidget()) {
             // update() will schedule a repaint of the widget so ensure
             // its knowledge of its position on the page is up to date.
-            platformWidget()->setGeometry(m_windowRect);
-            platformWidget()->update(rect);
+            QWidget* w = static_cast<QWidget*>(platformWidget());
+            w->setGeometry(m_windowRect);
+            w->update(rect);
         }
         return;
     }
@@ -892,7 +894,7 @@ bool PluginView::platformStart()
     wsi->type = 0;
 
     if (m_isWindowed) {
-        const QX11Info* x11Info = &platformPluginWidget()->x11Info();
+        const QX11Info* x11Info = &static_cast<QWidget*>(platformPluginWidget())->x11Info();
 
         wsi->display = x11Info->display();
         wsi->visual = (Visual*)x11Info->visual();
@@ -900,7 +902,7 @@ bool PluginView::platformStart()
         wsi->colormap = x11Info->colormap();
 
         m_npWindow.type = NPWindowTypeWindow;
-        m_npWindow.window = (void*)platformPluginWidget()->winId();
+        m_npWindow.window = (void*)static_cast<QWidget*>(platformPluginWidget())->winId();
         m_npWindow.width = -1;
         m_npWindow.height = -1;
     } else {
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.cpp b/Source/WebCore/rendering/FilterEffectRenderer.cpp
index cb20bc4bd..7d9873151 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.cpp
+++ b/Source/WebCore/rendering/FilterEffectRenderer.cpp
@@ -326,7 +326,8 @@ void FilterEffectRenderer::prepare()
         m_graphicsBufferAttached = true;
     }
     m_sourceGraphic->clearResult();
-    lastEffect()->clearResult();
+    for (size_t i = 0; i < m_effects.size(); ++i)
+        m_effects[i]->clearResult();
 }
 
 void FilterEffectRenderer::apply()
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index fb93b62c2..f799a1ae1 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -657,8 +657,8 @@ void InlineFlowBox::placeBoxesInBlockDirection(LayoutUnit top, LayoutUnit maxHei
 
                 RenderRubyRun* rubyRun = toRenderRubyRun(curr->renderer());
                 if (RenderRubyBase* rubyBase = rubyRun->rubyBase()) {
-                    LayoutUnit bottomRubyBaseLeading = (curr->logicalHeight() - rubyBase->logicalBottom()) + rubyBase->logicalHeight() - (rubyBase->lastRootBox() ? rubyBase->lastRootBox()->lineBottom() : 0);
-                    LayoutUnit topRubyBaseLeading = rubyBase->logicalTop() + (rubyBase->firstRootBox() ? rubyBase->firstRootBox()->lineTop() : 0);
+                    LayoutUnit bottomRubyBaseLeading = (curr->logicalHeight() - rubyBase->logicalBottom()) + rubyBase->logicalHeight() - (rubyBase->lastRootBox() ? rubyBase->lastRootBox()->lineBottom() : zeroLayoutUnit);
+                    LayoutUnit topRubyBaseLeading = rubyBase->logicalTop() + (rubyBase->firstRootBox() ? rubyBase->firstRootBox()->lineTop() : zeroLayoutUnit);
                     newLogicalTop += !renderer()->style()->isFlippedLinesWritingMode() ? topRubyBaseLeading : bottomRubyBaseLeading;
                     boxHeight -= (topRubyBaseLeading + bottomRubyBaseLeading);
                 }
@@ -787,8 +787,8 @@ inline void InlineFlowBox::addBorderOutsetVisualOverflow(LayoutRect& logicalVisu
     LayoutUnit borderOutsetLogicalRight;
     style->getBorderImageInlineDirectionOutsets(borderOutsetLogicalLeft, borderOutsetLogicalRight);
 
-    LayoutUnit outsetLogicalLeft = includeLogicalLeftEdge() ? borderOutsetLogicalLeft : 0;
-    LayoutUnit outsetLogicalRight = includeLogicalRightEdge() ? borderOutsetLogicalRight : 0;
+    LayoutUnit outsetLogicalLeft = includeLogicalLeftEdge() ? borderOutsetLogicalLeft : zeroLayoutUnit;
+    LayoutUnit outsetLogicalRight = includeLogicalRightEdge() ? borderOutsetLogicalRight : zeroLayoutUnit;
 
     LayoutUnit logicalLeftVisualOverflow = min(pixelSnappedLogicalLeft() - outsetLogicalLeft, logicalVisualOverflow.x());
     LayoutUnit logicalRightVisualOverflow = max(pixelSnappedLogicalRight() + outsetLogicalRight, logicalVisualOverflow.maxX());
@@ -1008,7 +1008,7 @@ void InlineFlowBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset,
     flipForWritingMode(overflowRect);
     overflowRect.moveBy(paintOffset);
     
-    if (!paintInfo.rect.intersects(overflowRect))
+    if (!paintInfo.rect.intersects(pixelSnappedIntRect(overflowRect)))
         return;
 
     if (paintInfo.phase != PaintPhaseChildOutlines) {
@@ -1079,6 +1079,15 @@ void InlineFlowBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c,
     paintFillLayer(paintInfo, c, fillLayer, rect, op);
 }
 
+bool InlineFlowBox::boxShadowCanBeAppliedToBackground(const FillLayer& lastBackgroundLayer) const
+{
+    // The checks here match how paintFillLayer() decides whether to clip (if it does, the shadow
+    // would be clipped out, so it has to be drawn separately).
+    StyleImage* image = lastBackgroundLayer.image();
+    bool hasFillImage = image && image->canRender(renderer(), renderer()->style()->effectiveZoom());
+    return (!hasFillImage && !renderer()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent();
+}
+
 void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, const LayoutRect& rect, CompositeOperator op)
 {
     StyleImage* img = fillLayer->image();
@@ -1107,8 +1116,8 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
             for (InlineFlowBox* curr = this; curr; curr = curr->prevLineBox())
                 totalLogicalWidth += curr->logicalWidth();
         }
-        LayoutUnit stripX = rect.x() - (isHorizontal() ? logicalOffsetOnLine : 0);
-        LayoutUnit stripY = rect.y() - (isHorizontal() ? 0 : logicalOffsetOnLine);
+        LayoutUnit stripX = rect.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
+        LayoutUnit stripY = rect.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
         LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : width();
         LayoutUnit stripHeight = isHorizontal() ? height() : totalLogicalWidth;
 
@@ -1203,7 +1212,8 @@ void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint&
     if ((!parent() && m_firstLine && styleToUse != renderer()->style()) || (parent() && renderer()->hasBoxDecorations())) {
         LayoutRect paintRect = LayoutRect(adjustedPaintoffset, frameRect.size());
         // Shadow comes first and is behind the background and border.
-        paintBoxShadow(paintInfo, styleToUse, Normal, paintRect);
+        if (!boxModelObject()->boxShadowShouldBeAppliedToBackground(BackgroundBleedNone, this))
+            paintBoxShadow(paintInfo, styleToUse, Normal, paintRect);
 
         Color c = styleToUse->visitedDependentColor(CSSPropertyBackgroundColor);
         paintFillLayers(paintInfo, c, styleToUse->backgroundLayers(), paintRect);
@@ -1237,8 +1247,8 @@ void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint&
                 LayoutUnit totalLogicalWidth = logicalOffsetOnLine;
                 for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
                     totalLogicalWidth += curr->logicalWidth();
-                LayoutUnit stripX = adjustedPaintoffset.x() - (isHorizontal() ? logicalOffsetOnLine : 0);
-                LayoutUnit stripY = adjustedPaintoffset.y() - (isHorizontal() ? 0 : logicalOffsetOnLine);
+                LayoutUnit stripX = adjustedPaintoffset.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
+                LayoutUnit stripY = adjustedPaintoffset.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
                 LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : frameRect.width();
                 LayoutUnit stripHeight = isHorizontal() ? frameRect.height() : totalLogicalWidth;
 
@@ -1308,8 +1318,8 @@ void InlineFlowBox::paintMask(PaintInfo& paintInfo, const LayoutPoint& paintOffs
         LayoutUnit totalLogicalWidth = logicalOffsetOnLine;
         for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
             totalLogicalWidth += curr->logicalWidth();
-        LayoutUnit stripX = adjustedPaintOffset.x() - (isHorizontal() ? logicalOffsetOnLine : 0);
-        LayoutUnit stripY = adjustedPaintOffset.y() - (isHorizontal() ? 0 : logicalOffsetOnLine);
+        LayoutUnit stripX = adjustedPaintOffset.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
+        LayoutUnit stripY = adjustedPaintOffset.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
         LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : frameRect.width();
         LayoutUnit stripHeight = isHorizontal() ? frameRect.height() : totalLogicalWidth;
 
@@ -1406,7 +1416,7 @@ LayoutUnit InlineFlowBox::computeOverAnnotationAdjustment(LayoutUnit allowedPosi
                 continue;
             
             if (!rubyRun->style()->isFlippedLinesWritingMode()) {
-                LayoutUnit topOfFirstRubyTextLine = rubyText->logicalTop() + (rubyText->firstRootBox() ? rubyText->firstRootBox()->lineTop() : 0);
+                LayoutUnit topOfFirstRubyTextLine = rubyText->logicalTop() + (rubyText->firstRootBox() ? rubyText->firstRootBox()->lineTop() : zeroLayoutUnit);
                 if (topOfFirstRubyTextLine >= 0)
                     continue;
                 topOfFirstRubyTextLine += curr->logicalTop();
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 2ea5c47ba..500de7ed9 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -114,6 +114,8 @@ public:
     virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
 
+    bool boxShadowCanBeAppliedToBackground(const FillLayer&) const;
+
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
     // logicalLeft = left in a horizontal line and top in a vertical line.
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index c9018c599..e89dcc5db 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -79,7 +79,7 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSiz
             m_clipped = true;
         }
 
-        m_paintOffset -= layer->scrolledContentOffset();
+        m_paintOffset -= renderer->scrolledContentOffset();
     }
 
     // If we establish a new page height, then cache the offset to the top of the first page.
@@ -156,10 +156,11 @@ LayoutState::LayoutState(RenderObject* root)
     m_paintOffset = LayoutSize(absContentPoint.x(), absContentPoint.y());
 
     if (container->hasOverflowClip()) {
-        RenderLayer* layer = toRenderBoxModelObject(container)->layer();
+        RenderBox* containerBox = toRenderBox(container);
+        RenderLayer* layer = containerBox->layer();
         m_clipped = true;
         m_clipRect = LayoutRect(toPoint(m_paintOffset), layer->size());
-        m_paintOffset -= layer->scrolledContentOffset();
+        m_paintOffset -= containerBox->scrolledContentOffset();
     }
 }
 
diff --git a/Source/WebCore/rendering/LayoutTypes.h b/Source/WebCore/rendering/LayoutTypes.h
index fc765d11f..72cbf2fd9 100644
--- a/Source/WebCore/rendering/LayoutTypes.h
+++ b/Source/WebCore/rendering/LayoutTypes.h
@@ -46,16 +46,38 @@ typedef IntPoint LayoutPoint;
 typedef IntSize LayoutSize;
 typedef IntRect LayoutRect;
 
+const LayoutUnit zeroLayoutUnit = 0;
+
 inline LayoutRect enclosingLayoutRect(const FloatRect& rect)
 {
     return enclosingIntRect(rect);
 }
 
+inline IntRect pixelSnappedIntRect(const LayoutRect& rect)
+{
+    return rect;
+}
+
+inline IntRect pixelSnappedIntRectFromEdges(LayoutUnit left, LayoutUnit top, LayoutUnit right, LayoutUnit bottom)
+{
+    return IntRect(left, top, right - left, bottom - top);
+}
+
+inline IntSize roundedIntSize(const LayoutSize& s)
+{
+    return s;
+}
+
 inline LayoutSize roundedLayoutSize(const FloatSize& s)
 {
     return roundedIntSize(s);
 }
 
+inline IntPoint roundedIntPoint(const LayoutPoint& p)
+{
+    return p;
+}
+
 inline LayoutPoint roundedLayoutPoint(const FloatPoint& p)
 {
     return roundedIntPoint(p);
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 9b2bca5a9..413c60ece 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -114,8 +114,8 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, LayoutUnit beforeBorderP
     m_quirkContainer = block->isTableCell() || block->isBody() || blockStyle->marginBeforeCollapse() == MDISCARD
         || blockStyle->marginAfterCollapse() == MDISCARD;
 
-    m_positiveMargin = m_canCollapseMarginBeforeWithChildren ? block->maxPositiveMarginBefore() : 0;
-    m_negativeMargin = m_canCollapseMarginBeforeWithChildren ? block->maxNegativeMarginBefore() : 0;
+    m_positiveMargin = m_canCollapseMarginBeforeWithChildren ? block->maxPositiveMarginBefore() : zeroLayoutUnit;
+    m_negativeMargin = m_canCollapseMarginBeforeWithChildren ? block->maxNegativeMarginBefore() : zeroLayoutUnit;
 }
 
 // -------------------------------------------------------------------------------------------------------
@@ -429,14 +429,24 @@ void RenderBlock::addChildToAnonymousColumnBlocks(RenderObject* newChild, Render
 
 RenderBlock* RenderBlock::containingColumnsBlock(bool allowAnonymousColumnBlock)
 {
+    RenderBlock* firstChildIgnoringAnonymousWrappers = 0;
     for (RenderObject* curr = this; curr; curr = curr->parent()) {
         if (!curr->isRenderBlock() || curr->isFloatingOrPositioned() || curr->isTableCell() || curr->isRoot() || curr->isRenderView() || curr->hasOverflowClip()
             || curr->isInlineBlockOrInlineTable())
             return 0;
+
+        // FIXME: Table manages its own table parts, most of which are RenderBoxes.
+        // Multi-column code cannot handle splitting the flow in table. Disabling it
+        // to prevent crashes.
+        if (curr->isTable())
+            return 0;
         
         RenderBlock* currBlock = toRenderBlock(curr);
+        if (!currBlock->createsAnonymousWrapper())
+            firstChildIgnoringAnonymousWrappers = currBlock;
+
         if (currBlock->style()->specifiesColumns() && (allowAnonymousColumnBlock || !currBlock->isAnonymousColumnsBlock()))
-            return currBlock;
+            return firstChildIgnoringAnonymousWrappers;
             
         if (currBlock->isAnonymousColumnSpanBlock())
             return 0;
@@ -447,15 +457,20 @@ RenderBlock* RenderBlock::containingColumnsBlock(bool allowAnonymousColumnBlock)
 RenderBlock* RenderBlock::clone() const
 {
     RenderBlock* cloneBlock;
-    if (isAnonymousBlock())
+    if (isAnonymousBlock()) {
         cloneBlock = createAnonymousBlock();
+        cloneBlock->setChildrenInline(childrenInline());
+    }
     else {
-        cloneBlock = new (renderArena()) RenderBlock(node());
+        RenderObject* cloneRenderer = node()->createRenderer(renderArena(), style());
+        cloneBlock = toRenderBlock(cloneRenderer);
         cloneBlock->setStyle(style());
-        if (!childrenInline() && cloneBlock->firstChild() && cloneBlock->firstChild()->isInline())
-            cloneBlock->makeChildrenNonInline();
+
+        // This takes care of setting the right value of childrenInline in case
+        // generated content is added to cloneBlock and 'this' does not have
+        // generated content added yet.
+        cloneBlock->setChildrenInline(cloneBlock->firstChild() ? cloneBlock->firstChild()->isInline() : childrenInline());
     }
-    cloneBlock->setChildrenInline(childrenInline());
     return cloneBlock;
 }
 
@@ -468,10 +483,16 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     if (!isAnonymousBlock())
         cloneBlock->setContinuation(oldCont);
 
-    // Now take all of the children from beforeChild to the end and remove
-    // them from |this| and place them in the clone.
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
+
+    // If we are moving inline children from |this| to cloneBlock, then we need
+    // to clear our line box tree.
+    if (beforeChild && childrenInline())
+        deleteLineBoxTree();
+
+    // Now take all of the children from beforeChild to the end and remove
+    // them from |this| and place them in the clone.
     moveChildrenTo(cloneBlock, beforeChild, 0, true);
     
     // Hook |clone| up as the continuation of the middle block.
@@ -494,7 +515,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
         cloneBlock = blockCurr->clone();
 
         // Insert our child clone as the first child.
-        cloneBlock->children()->appendChildNode(cloneBlock, cloneChild);
+        cloneBlock->addChildIgnoringContinuation(cloneChild, 0);
 
         // Hook the clone up as a continuation of |curr|.  Note we do encounter
         // anonymous blocks possibly as we walk up the block chain.  When we split an
@@ -585,6 +606,9 @@ void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
 
 RenderObject* RenderBlock::splitAnonymousBlocksAroundChild(RenderObject* beforeChild)
 {
+    if (beforeChild->isTablePart())
+        beforeChild = splitTablePartsAroundChild(beforeChild);
+
     while (beforeChild->parent() != this) {
         RenderBlock* blockToSplit = toRenderBlock(beforeChild->parent());
         if (blockToSplit->firstChild() != beforeChild) {
@@ -603,6 +627,71 @@ RenderObject* RenderBlock::splitAnonymousBlocksAroundChild(RenderObject* beforeC
     return beforeChild;
 }
 
+static void markTableForSectionAndCellRecalculation(RenderObject* child)
+{
+    RenderObject* curr = child;
+    while (!curr->isTable()) {
+        if (curr->isTableSection())
+            toRenderTableSection(curr)->setNeedsCellRecalc();
+        curr = curr->parent();
+    }
+
+    RenderTable* table = toRenderTable(curr);
+    table->setNeedsSectionRecalc();
+    table->setNeedsLayoutAndPrefWidthsRecalc();
+}
+
+static void moveAllTableChildrenTo(RenderObject* fromTablePart, RenderTable* toTable, RenderObject* startChild)
+{
+    for (RenderObject* curr = startChild; curr;) {
+        // Need to store next sibling as we won't have access to it
+        // after we are removed from table.
+        RenderObject* next = curr->nextSibling();
+        fromTablePart->removeChild(curr);
+        toTable->addChild(curr);
+        if (curr->isTableSection())
+            toRenderTableSection(curr)->setNeedsCellRecalc();
+        curr->setNeedsLayoutAndPrefWidthsRecalc();
+        curr = next; 
+    }
+
+    // This marks fromTable for section and cell recalculation.
+    markTableForSectionAndCellRecalculation(fromTablePart);
+
+    // startChild is now part of toTable. This marks toTable for section and cell recalculation.
+    markTableForSectionAndCellRecalculation(startChild);
+}
+
+RenderObject* RenderBlock::splitTablePartsAroundChild(RenderObject* beforeChild)
+{
+    ASSERT(beforeChild->isTablePart());
+
+    while (beforeChild->parent() != this) {
+        RenderObject* tablePartToSplit = beforeChild->parent();
+        if (!tablePartToSplit->isTablePart() && !tablePartToSplit->isTable())
+            break;
+        if (tablePartToSplit->firstChild() != beforeChild) {
+            // Get our table container.
+            RenderObject* curr = tablePartToSplit;
+            while (!curr->isTable())
+                curr = curr->parent();
+            RenderTable* table = toRenderTable(curr);
+
+            // Create an anonymous table container next to our table container.
+            RenderBlock* parentBlock = toRenderBlock(table->parent());
+            RenderTable* postTable = parentBlock->createAnonymousTable();
+            parentBlock->children()->insertChildNode(parentBlock, postTable, table->nextSibling());
+            
+            // Move all the children from beforeChild to the newly created anonymous table container.
+            moveAllTableChildrenTo(tablePartToSplit, postTable, beforeChild);
+
+            beforeChild = postTable;
+        } else
+            beforeChild = tablePartToSplit;
+    }
+    return beforeChild;
+}
+
 void RenderBlock::makeChildrenAnonymousColumnBlocks(RenderObject* beforeChild, RenderBlock* newBlockBox, RenderObject* newChild)
 {
     RenderBlock* pre = 0;
@@ -669,22 +758,17 @@ RenderBlock* RenderBlock::columnsBlockForSpanningElement(RenderObject* newChild)
     RenderBlock* columnsBlockAncestor = 0;
     if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isBeforeOrAfterContent()
         && !newChild->isFloatingOrPositioned() && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
-        if (style()->specifiesColumns())
-            columnsBlockAncestor = this;
-        else if (!isInline() && parent() && parent()->isRenderBlock()) {
-            columnsBlockAncestor = toRenderBlock(parent())->containingColumnsBlock(false);
-            
-            if (columnsBlockAncestor) {
-                // Make sure that none of the parent ancestors have a continuation.
-                // If yes, we do not want split the block into continuations.
-                RenderObject* curr = this;
-                while (curr && curr != columnsBlockAncestor) {
-                    if (curr->isRenderBlock() && toRenderBlock(curr)->continuation()) {
-                        columnsBlockAncestor = 0;
-                        break;
-                    }
-                    curr = curr->parent();
+        columnsBlockAncestor = containingColumnsBlock(false);
+        if (columnsBlockAncestor) {
+            // Make sure that none of the parent ancestors have a continuation.
+            // If yes, we do not want split the block into continuations.
+            RenderObject* curr = this;
+            while (curr && curr != columnsBlockAncestor) {
+                if (curr->isRenderBlock() && toRenderBlock(curr)->continuation()) {
+                    columnsBlockAncestor = 0;
+                    break;
                 }
+                curr = curr->parent();
             }
         }
     }
@@ -697,35 +781,48 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
     if (!beforeChild)
         beforeChild = afterPseudoElementRenderer();
 
-    // If the requested beforeChild is not one of our children, then this is because
-    // there is an anonymous container within this object that contains the beforeChild.
     if (beforeChild && beforeChild->parent() != this) {
-        RenderObject* beforeChildAnonymousContainer = anonymousContainer(beforeChild);
-        ASSERT(beforeChildAnonymousContainer);
-        ASSERT(beforeChildAnonymousContainer->isAnonymous());
-
-        if (beforeChildAnonymousContainer->isAnonymousBlock()) {
-            // Insert the child into the anonymous block box instead of here.
-            if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
-                beforeChild->parent()->addChild(newChild, beforeChild);
-            else
-                addChild(newChild, beforeChild->parent());
-            return;
-        }
+        RenderObject* beforeChildContainer = beforeChild->parent();
+        while (beforeChildContainer->parent() != this)
+            beforeChildContainer = beforeChildContainer->parent();
+        ASSERT(beforeChildContainer);
+
+        if (beforeChildContainer->isAnonymous()) {
+            // If the requested beforeChild is not one of our children, then this is because
+            // there is an anonymous container within this object that contains the beforeChild.
+            RenderObject* beforeChildAnonymousContainer = beforeChildContainer;
+            if (beforeChildAnonymousContainer->isAnonymousBlock()) {
+                // Insert the child into the anonymous block box instead of here.
+                if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
+                    beforeChild->parent()->addChild(newChild, beforeChild);
+                else
+                    addChild(newChild, beforeChild->parent());
+                return;
+            }
 
-        ASSERT(beforeChildAnonymousContainer->isTable());
-        if ((newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP)
-                || (newChild->isTableCaption())
-                || newChild->isTableSection()
-                || newChild->isTableRow()
-                || newChild->isTableCell()) {
-            // Insert into the anonymous table.
-            beforeChildAnonymousContainer->addChild(newChild, beforeChild);
-            return;
-        }
+            ASSERT(beforeChildAnonymousContainer->isTable());
+            if (newChild->isTablePart()) {
+                // Insert into the anonymous table.
+                beforeChildAnonymousContainer->addChild(newChild, beforeChild);
+                return;
+            }
+
+            beforeChild = splitTablePartsAroundChild(beforeChild);
 
-        // Go on to insert before the anonymous table.
-        beforeChild = beforeChildAnonymousContainer;
+            ASSERT(beforeChild->parent() == this);
+            if (beforeChild->parent() != this) {
+                // We should never reach here. If we do, we need to use the
+                // safe fallback to use the topmost beforeChild container.
+                beforeChild = beforeChildContainer;
+            }
+        } else {
+            // We will reach here when beforeChild is a run-in element.
+            // If run-in element precedes a block-level element, it becomes the
+            // the first inline child of that block level element. The insertion
+            // point will be before that block-level element.
+            ASSERT(beforeChild->isRunIn());
+            beforeChild = beforeChildContainer;
+        }
     }
 
     // Check for a spanning element in columns.
@@ -885,23 +982,27 @@ RootInlineBox* RenderBlock::createAndAppendRootInlineBox()
     return rootBox;
 }
 
-void RenderBlock::moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
 {
     ASSERT(this == child->parent());
-    ASSERT(!beforeChild || to == beforeChild->parent());
-    to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
+    ASSERT(!beforeChild || toBlock == beforeChild->parent());
+    if (fullRemoveInsert) {
+        // Takes care of adding the new child correctly if toBlock and fromBlock
+        // have different kind of children (block vs inline).
+        toBlock->addChildIgnoringContinuation(children()->removeChildNode(this, child), beforeChild);
+    } else
+        toBlock->children()->insertChildNode(toBlock, children()->removeChildNode(this, child, false), beforeChild, false);
 }
 
-void RenderBlock::moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
 {
-    ASSERT(!beforeChild || to == beforeChild->parent());
-    RenderObject* nextChild = startChild;
-    while (nextChild && nextChild != endChild) {
-        RenderObject* child = nextChild;
-        nextChild = child->nextSibling();
-        to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
-        if (child == endChild)
-            return;
+    ASSERT(!beforeChild || toBlock == beforeChild->parent());
+
+    for (RenderObject* child = startChild; child && child != endChild; ) {
+        // Save our next sibling as moveChildTo will clear it.
+        RenderObject* nextSibling = child->nextSibling();
+        moveChildTo(toBlock, child, beforeChild, fullRemoveInsert);
+        child = nextSibling;
     }
 }
 
@@ -1025,11 +1126,15 @@ void RenderBlock::collapseAnonymousBoxChild(RenderBlock* parent, RenderObject* c
     parent->setNeedsLayoutAndPrefWidthsRecalc();
     parent->setChildrenInline(child->childrenInline());
     RenderObject* nextSibling = child->nextSibling();
+
+    RenderFlowThread* childFlowThread = child->enclosingRenderFlowThread();
     RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
     anonBlock->moveAllChildrenTo(parent, nextSibling, child->hasLayer());
     // Delete the now-empty block's lines and nuke it.
     if (!parent->documentBeingDestroyed())
         anonBlock->deleteLineBoxTree();
+    if (childFlowThread && !parent->documentBeingDestroyed())
+        childFlowThread->removeFlowChildInfo(anonBlock);
     anonBlock->destroy();
 }
 
@@ -1419,7 +1524,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
         
         if (hasOverflowClip()) {
             // Adjust repaint rect for scroll offset
-            repaintRect.move(-layer()->scrolledContentOffset());
+            repaintRect.move(-scrolledContentOffset());
 
             // Don't allow this rect to spill out of our overflow box.
             repaintRect.intersect(LayoutRect(LayoutPoint(), size()));
@@ -1427,7 +1532,6 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
 
         // Make sure the rect is still non-empty after intersecting for overflow above
         if (!repaintRect.isEmpty()) {
-            // FIXME: Might need rounding once we switch to float, see https://bugs.webkit.org/show_bug.cgi?id=64021
             repaintRectangle(repaintRect); // We need to do a partial repaint of our content.
             if (hasReflection())
                 repaintRectangle(reflectedRect(repaintRect));
@@ -1488,6 +1592,9 @@ void RenderBlock::computeOverflow(LayoutUnit oldClientAfterEdge, bool recomputeF
 
     // Add visual overflow from theme.
     addVisualOverflowFromTheme();
+
+    if (isRenderFlowThread())
+        enclosingRenderFlowThread()->computeOverflowStateForRegions(oldClientAfterEdge);
 }
 
 void RenderBlock::addOverflowFromBlockChildren()
@@ -1591,7 +1698,7 @@ void RenderBlock::adjustFloatingBlock(const MarginInfo& marginInfo)
     // for by simply calling canCollapseWithMarginBefore.  See
     // http://www.hixie.ch/tests/adhoc/css/box/block/margin-collapse/046.html for
     // an example of this scenario.
-    LayoutUnit marginOffset = marginInfo.canCollapseWithMarginBefore() ? 0 : marginInfo.margin();
+    LayoutUnit marginOffset = marginInfo.canCollapseWithMarginBefore() ? zeroLayoutUnit : marginInfo.margin();
     setLogicalHeight(logicalHeight() + marginOffset);
     positionNewFloats();
     setLogicalHeight(logicalHeight() - marginOffset);
@@ -1893,7 +2000,6 @@ LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const Re
         if (childMarginStart < 0)
             startOff += childMarginStart;
         newPosition = max(newPosition, startOff); // Let the float sit in the child's margin if it can fit.
-        // FIXME: Needs to use epsilon once we switch to float, see https://bugs.webkit.org/show_bug.cgi?id=64021
     } else if (startOff != startPosition) {
         // The object is shifting to the "end" side of the block. The object might be centered, so we need to
         // recalculate our inline direction margins. Note that the containing block content
@@ -2440,7 +2546,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
     if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && paintInfo.shouldPaintWithinRoot(this))
-        layer()->paintOverflowControls(paintInfo.context, adjustedPaintOffset, paintInfo.rect);
+        layer()->paintOverflowControls(paintInfo.context, roundedIntPoint(adjustedPaintOffset), paintInfo.rect);
 }
 
 void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
@@ -2463,9 +2569,9 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& pain
     bool antialias = shouldAntialiasLines(paintInfo.context);
 
     if (colInfo->progressionAxis() == ColumnInfo::InlineAxis) {
-        LayoutUnit currLogicalLeftOffset = style()->isLeftToRightDirection() ? 0 : contentLogicalWidth();
+        LayoutUnit currLogicalLeftOffset = style()->isLeftToRightDirection() ? zeroLayoutUnit : contentLogicalWidth();
         LayoutUnit ruleAdd = logicalLeftOffsetForContent();
-        LayoutUnit ruleLogicalLeft = style()->isLeftToRightDirection() ? 0 : contentLogicalWidth();
+        LayoutUnit ruleLogicalLeft = style()->isLeftToRightDirection() ? zeroLayoutUnit : contentLogicalWidth();
         LayoutUnit inlineDirectionSize = colInfo->desiredColumnWidth();
         BoxSide boxSide = isHorizontalWritingMode()
             ? style()->isLeftToRightDirection() ? BSLeft : BSRight
@@ -2487,7 +2593,8 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& pain
                 LayoutUnit ruleRight = isHorizontalWritingMode() ? ruleLeft + ruleThickness : ruleLeft + contentWidth();
                 LayoutUnit ruleTop = isHorizontalWritingMode() ? paintOffset.y() + borderTop() + paddingTop() : paintOffset.y() + ruleLogicalLeft - ruleThickness / 2 + ruleAdd;
                 LayoutUnit ruleBottom = isHorizontalWritingMode() ? ruleTop + contentHeight() : ruleTop + ruleThickness;
-                drawLineForBoxSide(paintInfo.context, ruleLeft, ruleTop, ruleRight, ruleBottom, boxSide, ruleColor, ruleStyle, 0, 0, antialias);
+                IntRect pixelSnappedRuleRect = pixelSnappedIntRectFromEdges(ruleLeft, ruleTop, ruleRight, ruleBottom);
+                drawLineForBoxSide(paintInfo.context, pixelSnappedRuleRect.x(), pixelSnappedRuleRect.y(), pixelSnappedRuleRect.maxX(), pixelSnappedRuleRect.maxY(), boxSide, ruleColor, ruleStyle, 0, 0, antialias);
             }
             
             ruleLogicalLeft = currLogicalLeftOffset;
@@ -2512,7 +2619,8 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& pain
 
         for (unsigned i = 1; i < colCount; i++) {
             ruleRect.move(step);
-            drawLineForBoxSide(paintInfo.context, ruleRect.x(), ruleRect.y(), ruleRect.maxX(), ruleRect.maxY(), boxSide, ruleColor, ruleStyle, 0, 0, antialias);
+            IntRect pixelSnappedRuleRect = pixelSnappedIntRect(ruleRect);
+            drawLineForBoxSide(paintInfo.context, pixelSnappedRuleRect.x(), pixelSnappedRuleRect.y(), pixelSnappedRuleRect.maxX(), pixelSnappedRuleRect.maxY(), boxSide, ruleColor, ruleStyle, 0, 0, antialias);
         }
     }
 }
@@ -2540,7 +2648,7 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, const LayoutPoint& p
         }
         colRect.moveBy(paintOffset);
         PaintInfo info(paintInfo);
-        info.rect.intersect(colRect);
+        info.rect.intersect(pixelSnappedIntRect(colRect));
         
         if (!info.rect.isEmpty()) {
             GraphicsContextStateSaver stateSaver(*context);
@@ -2680,7 +2788,7 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffs
     // Adjust our painting position if we're inside a scrolled layer (e.g., an overflow:auto div).
     LayoutPoint scrolledOffset = paintOffset;
     if (hasOverflowClip())
-        scrolledOffset.move(-layer()->scrolledContentOffset());
+        scrolledOffset.move(-scrolledContentOffset());
 
     // 2. paint contents
     if (paintPhase != PaintPhaseSelfOutline) {
@@ -2928,7 +3036,7 @@ GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* repaintC
     LayoutPoint offsetFromRepaintContainer = roundedLayoutPoint(transformState.mappedPoint());
 
     if (hasOverflowClip())
-        offsetFromRepaintContainer -= layer()->scrolledContentOffset();
+        offsetFromRepaintContainer -= scrolledContentOffset();
 
     LayoutUnit lastTop = 0;
     LayoutUnit lastLeft = logicalLeftSelectionOffset(this, lastTop);
@@ -2953,7 +3061,8 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, const LayoutPoint& paintO
                     LayoutRect localBounds(gapRectsBounds);
                     flipForWritingMode(localBounds);
                     gapRectsBounds = localToContainerQuad(FloatRect(localBounds), layer->renderer()).enclosingBoundingBox();
-                    gapRectsBounds.move(layer->scrolledContentOffset());
+                    if (layer->renderer()->hasOverflowClip())
+                        gapRectsBounds.move(layer->renderBox()->scrolledContentOffset());
                 }
                 layer->addBlockSelectionGapsBounds(gapRectsBounds);
             }
@@ -3019,7 +3128,7 @@ GapRects RenderBlock::selectionGaps(RenderBlock* rootBlock, const LayoutPoint& r
                                     r->m_renderer->width(), r->m_renderer->height());
                 rootBlock->flipForWritingMode(floatBox);
                 floatBox.move(rootBlockPhysicalPosition.x(), rootBlockPhysicalPosition.y());
-                paintInfo->context->clipOut(floatBox);
+                paintInfo->context->clipOut(pixelSnappedIntRect(floatBox));
             }
         }
     }
@@ -3769,7 +3878,7 @@ LayoutUnit RenderBlock::nextFloatLogicalBottomBelow(LayoutUnit logicalHeight) co
             bottom = min(floatBottom, bottom);
     }
 
-    return bottom == numeric_limits<LayoutUnit>::max() ? 0 : bottom;
+    return bottom == numeric_limits<LayoutUnit>::max() ? zeroLayoutUnit : bottom;
 }
 
 LayoutUnit RenderBlock::lowestFloatLogicalBottom(FloatingObject::Type floatType) const
@@ -4087,7 +4196,7 @@ bool RenderBlock::avoidsFloats() const
     return RenderBox::avoidsFloats() || !style()->hasAutoColumnCount() || !style()->hasAutoColumnWidth();
 }
 
-bool RenderBlock::containsFloat(RenderBox* renderer)
+bool RenderBlock::containsFloat(RenderBox* renderer) const
 {
     return m_floatingObjects && m_floatingObjects->set().contains<RenderBox*, FloatingObjectHashTranslator>(renderer);
 }
@@ -4166,13 +4275,11 @@ LayoutUnit RenderBlock::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
     }
 
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
-    LayoutUnit result = clearSet ? max<LayoutUnit>(0, logicalBottom - logicalTop) : 0;
+    LayoutUnit result = clearSet ? max<LayoutUnit>(0, logicalBottom - logicalTop) : zeroLayoutUnit;
     if (!result && child->avoidsFloats()) {
         LayoutUnit newLogicalTop = logicalTop;
         while (true) {
             LayoutUnit availableLogicalWidthAtNewLogicalTopOffset = availableLogicalWidthForLine(newLogicalTop, false);
-            // FIXME: Change to use roughlyEquals when we move to float.
-            // See https://bugs.webkit.org/show_bug.cgi?id=66148
             if (availableLogicalWidthAtNewLogicalTopOffset == availableLogicalWidthForContent(newLogicalTop))
                 return newLogicalTop - logicalTop;
 
@@ -4193,8 +4300,6 @@ LayoutUnit RenderBlock::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
             child->setMarginLeft(childOldMarginLeft);
             child->setMarginRight(childOldMarginRight);
             
-            // FIXME: Change to use roughlyEquals when we move to float.
-            // See https://bugs.webkit.org/show_bug.cgi?id=66148
             if (childLogicalWidthAtNewLogicalTopOffset <= availableLogicalWidthAtNewLogicalTopOffset)
                 return newLogicalTop - logicalTop;
 
@@ -4245,9 +4350,8 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     if (checkChildren) {
         // Hit test descendants first.
         LayoutSize scrolledOffset(localOffset);
-        if (hasOverflowClip()) {
-            scrolledOffset -= layer()->scrolledContentOffset();
-        }
+        if (hasOverflowClip())
+            scrolledOffset -= scrolledContentOffset();
 
         // Hit test contents if we don't have columns.
         if (!hasColumns()) {
@@ -4594,7 +4698,7 @@ VisiblePosition RenderBlock::positionForPoint(const LayoutPoint& point)
 void RenderBlock::offsetForContents(LayoutPoint& offset) const
 {
     if (hasOverflowClip())
-        offset += layer()->scrolledContentOffset();
+        offset += scrolledContentOffset();
 
     if (hasColumns())
         adjustPointToColumnContents(offset);
@@ -5005,6 +5109,8 @@ void RenderBlock::computePreferredLogicalWidths()
         }
 
         int scrollbarWidth = 0;
+        // FIXME: This should only be done for horizontal writing mode.
+        // For vertical writing mode, this should check overflowX and use the horizontalScrollbarHeight.
         if (hasOverflowClip() && styleToUse->overflowY() == OSCROLL) {
             layer()->setHasVerticalScrollbar(true);
             scrollbarWidth = verticalScrollbarWidth();
@@ -5150,7 +5256,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
 
     RenderStyle* styleToUse = style();
     RenderBlock* containingBlock = this->containingBlock();
-    LayoutUnit cw = containingBlock ? containingBlock->contentLogicalWidth() : 0;
+    LayoutUnit cw = containingBlock ? containingBlock->contentLogicalWidth() : zeroLayoutUnit;
 
     // If we are at the start of a line, we want to ignore all white-space.
     // Also strip spaces if we previously had text that ended in a trailing space.
@@ -5704,6 +5810,36 @@ static inline bool shouldSkipForFirstLetter(UChar c)
     return isSpaceOrNewline(c) || c == noBreakSpace || isPunctuationForFirstLetter(c);
 }
 
+// We only honor first-letter if 
+// - the firstLetterBlock can have children in the DOM and
+// - the block doesn't have any special assumption on its text children.
+// This correctly prevents form controls from honoring first-letter.
+static inline bool isSafeToCreateFirstLetterRendererOn(RenderObject* renderer)
+{
+    return (renderer->canHaveChildren()
+            && !(renderer->isDeprecatedFlexibleBox()
+                 && static_cast<RenderDeprecatedFlexibleBox*>(renderer)->buttonText()));
+}
+
+static inline RenderObject* findFirstLetterBlock(RenderBlock* start)
+{
+    RenderObject* firstLetterBlock = start;
+    while (true) {
+        bool canHaveFirstLetterRenderer = firstLetterBlock->style()->hasPseudoStyle(FIRST_LETTER)
+            && isSafeToCreateFirstLetterRendererOn(firstLetterBlock);
+        if (canHaveFirstLetterRenderer)
+            return firstLetterBlock;
+
+        RenderObject* parentBlock = firstLetterBlock->parent();
+        if (firstLetterBlock->isReplaced() || !parentBlock || parentBlock->firstChild() != firstLetterBlock || 
+            !parentBlock->isBlockFlow())
+            return 0;
+        firstLetterBlock = parentBlock;
+    } 
+
+    return 0;
+}
+   
 void RenderBlock::updateFirstLetter()
 {
     if (!document()->usesFirstLetterRules())
@@ -5714,23 +5850,8 @@ void RenderBlock::updateFirstLetter()
 
     // FIXME: We need to destroy the first-letter object if it is no longer the first child.  Need to find
     // an efficient way to check for that situation though before implementing anything.
-    RenderObject* firstLetterBlock = this;
-    bool hasPseudoStyle = false;
-    while (true) {
-        // We only honor first-letter if the firstLetterBlock can have children in the DOM. This correctly 
-        // prevents form controls from honoring first-letter.
-        hasPseudoStyle = firstLetterBlock->style()->hasPseudoStyle(FIRST_LETTER) 
-            && firstLetterBlock->canHaveChildren();
-        if (hasPseudoStyle)
-            break;
-        RenderObject* parentBlock = firstLetterBlock->parent();
-        if (firstLetterBlock->isReplaced() || !parentBlock || parentBlock->firstChild() != firstLetterBlock || 
-            !parentBlock->isBlockFlow())
-            break;
-        firstLetterBlock = parentBlock;
-    } 
-
-    if (!hasPseudoStyle) 
+    RenderObject* firstLetterBlock = findFirstLetterBlock(this);
+    if (!firstLetterBlock)
         return;
 
     // Drill into inlines looking for our first text child.
@@ -5922,7 +6043,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
         if (block->childrenInline()) {
             for (RootInlineBox* box = block->firstRootBox(); box; box = box->nextRootBox()) {
                 if (++count == l)
-                    return box->lineBottom() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                    return box->lineBottom() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : zeroLayoutUnit);
             }
         }
         else {
@@ -5931,7 +6052,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
                 if (shouldCheckLines(obj)) {
                     int result = getHeightForLineCount(toRenderBlock(obj), l, false, count);
                     if (result != -1)
-                        return result + obj->y() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                        return result + obj->y() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : zeroLayoutUnit);
                 }
                 else if (!obj->isFloatingOrPositioned() && !obj->isRunIn())
                     normalFlowChildWithoutLines = obj;
@@ -6495,11 +6616,15 @@ LayoutUnit RenderBlock::pageRemainingLogicalHeightForOffset(LayoutUnit offset, P
 
 LayoutUnit RenderBlock::adjustForUnsplittableChild(RenderBox* child, LayoutUnit logicalOffset, bool includeMargins)
 {
-    bool isUnsplittable = child->isUnsplittableForPagination() || child->style()->columnBreakInside() == PBAVOID
-        || child->style()->regionBreakInside() == PBAVOID;
+    bool checkColumnBreaks = view()->layoutState()->isPaginatingColumns();
+    bool checkPageBreaks = !checkColumnBreaks && view()->layoutState()->m_pageLogicalHeight;
+    bool checkRegionBreaks = inRenderFlowThread();
+    bool isUnsplittable = child->isUnsplittableForPagination() || (checkColumnBreaks && child->style()->columnBreakInside() == PBAVOID)
+        || (checkPageBreaks && child->style()->pageBreakInside() == PBAVOID)
+        || (checkRegionBreaks && child->style()->regionBreakInside() == PBAVOID);
     if (!isUnsplittable)
         return logicalOffset;
-    LayoutUnit childLogicalHeight = logicalHeightForChild(child) + (includeMargins ? marginBeforeForChild(child) + marginAfterForChild(child) : 0);
+    LayoutUnit childLogicalHeight = logicalHeightForChild(child) + (includeMargins ? marginBeforeForChild(child) + marginAfterForChild(child) : zeroLayoutUnit);
     LayoutState* layoutState = view()->layoutState();
     if (layoutState->m_columnInfo)
         layoutState->m_columnInfo->updateMinimumColumnHeight(childLogicalHeight);
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 2ccf0aa25..8996da5ef 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -122,8 +122,8 @@ public:
     void markPositionedObjectsForLayout();
     virtual void markForPaginationRelayoutIfNeeded();
     
-    bool containsFloats() { return m_floatingObjects && !m_floatingObjects->set().isEmpty(); }
-    bool containsFloat(RenderBox*);
+    bool containsFloats() const { return m_floatingObjects && !m_floatingObjects->set().isEmpty(); }
+    bool containsFloat(RenderBox*) const;
 
     // Versions that can compute line offsets with the region and page offset passed in. Used for speed to avoid having to
     // compute the region all over again when you already know it.
@@ -145,6 +145,11 @@ public:
         return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage)
             : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage);
     }
+    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const
+    {
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage);
+    }
 
     LayoutUnit availableLogicalWidthForLine(LayoutUnit position, bool firstLine) const
     {
@@ -163,6 +168,11 @@ public:
         return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine)
             : logicalWidth() - logicalRightOffsetForLine(position, firstLine);
     }
+    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine) const
+    {
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine);
+    }
 
     // FIXME: The implementation for these functions will change once we move to subpixel layout. See bug 60318.
     int pixelSnappedLogicalRightOffsetForLine(LayoutUnit position, bool firstLine) const
@@ -242,12 +252,12 @@ public:
     unsigned columnCount(ColumnInfo*) const;
     LayoutRect columnRectAt(ColumnInfo*, unsigned) const;
 
-    LayoutUnit paginationStrut() const { return m_rareData ? m_rareData->m_paginationStrut : 0; }
+    LayoutUnit paginationStrut() const { return m_rareData ? m_rareData->m_paginationStrut : zeroLayoutUnit; }
     void setPaginationStrut(LayoutUnit);
     
     // The page logical offset is the object's offset from the top of the page in the page progression
     // direction (so an x-offset in vertical text and a y-offset for horizontal text).
-    int pageLogicalOffset() const { return m_rareData ? m_rareData->m_pageLogicalOffset : 0; }
+    LayoutUnit pageLogicalOffset() const { return m_rareData ? m_rareData->m_pageLogicalOffset : zeroLayoutUnit; }
     void setPageLogicalOffset(int);
 
     RootInlineBox* lineGridBox() const { return m_rareData ? m_rareData->m_lineGridBox : 0; }
@@ -326,6 +336,11 @@ public:
         return style()->isLeftToRightDirection() ? logicalLeftOffsetForContent(region, offsetFromLogicalTopOfFirstPage)
             : logicalWidth() - logicalRightOffsetForContent(region, offsetFromLogicalTopOfFirstPage);
     }
+    LayoutUnit endOffsetForContent(RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const
+    {
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForContent(region, offsetFromLogicalTopOfFirstPage)
+            : logicalWidth() - logicalRightOffsetForContent(region, offsetFromLogicalTopOfFirstPage);
+    }
     LayoutUnit logicalLeftOffsetForContent(LayoutUnit blockOffset) const
     {
         return logicalLeftOffsetForContent(regionAtBlockOffset(blockOffset), offsetFromLogicalTopOfFirstPage());
@@ -342,9 +357,14 @@ public:
     {
         return startOffsetForContent(regionAtBlockOffset(blockOffset), offsetFromLogicalTopOfFirstPage());
     }
+    LayoutUnit endOffsetForContent(LayoutUnit blockOffset) const
+    {
+        return endOffsetForContent(regionAtBlockOffset(blockOffset), offsetFromLogicalTopOfFirstPage());
+    }
     LayoutUnit logicalLeftOffsetForContent() const { return isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
     LayoutUnit logicalRightOffsetForContent() const { return logicalLeftOffsetForContent() + availableLogicalWidth(); }
     LayoutUnit startOffsetForContent() const { return style()->isLeftToRightDirection() ? logicalLeftOffsetForContent() : logicalWidth() - logicalRightOffsetForContent(); }
+    LayoutUnit endOffsetForContent() const { return !style()->isLeftToRightDirection() ? logicalLeftOffsetForContent() : logicalWidth() - logicalRightOffsetForContent(); }
     
     void setStaticInlinePositionForChild(RenderBox*, LayoutUnit blockOffset, LayoutUnit inlinePosition);
 
@@ -365,23 +385,23 @@ protected:
     {
         return moveChildTo(to, child, 0, fullRemoveInsert);
     }
-    void moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
-    void moveAllChildrenTo(RenderBlock* to, bool fullRemoveInsert = false)
+    void moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
+    void moveAllChildrenTo(RenderBlock* toBlock, bool fullRemoveInsert = false)
     {
-        return moveAllChildrenTo(to, 0, fullRemoveInsert);
+        return moveAllChildrenTo(toBlock, 0, fullRemoveInsert);
     }
-    void moveAllChildrenTo(RenderBlock* to, RenderObject* beforeChild, bool fullRemoveInsert = false)
+    void moveAllChildrenTo(RenderBlock* toBlock, RenderObject* beforeChild, bool fullRemoveInsert = false)
     {
-        return moveChildrenTo(to, firstChild(), 0, beforeChild, fullRemoveInsert);
+        return moveChildrenTo(toBlock, firstChild(), 0, beforeChild, fullRemoveInsert);
     }
     // Move all of the kids from |startChild| up to but excluding |endChild|.  0 can be passed as the endChild to denote
     // that all the kids from |startChild| onwards should be added.
-    void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
+    void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
     {
-        return moveChildrenTo(to, startChild, endChild, 0, fullRemoveInsert);
+        return moveChildrenTo(toBlock, startChild, endChild, 0, fullRemoveInsert);
     }
-    void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
-    
+    void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
+
     LayoutUnit maxPositiveMarginBefore() const { return m_rareData ? m_rareData->m_margins.positiveMarginBefore() : RenderBlockRareData::positiveMarginBeforeDefault(this); }
     LayoutUnit maxNegativeMarginBefore() const { return m_rareData ? m_rareData->m_margins.negativeMarginBefore() : RenderBlockRareData::negativeMarginBeforeDefault(this); }
     LayoutUnit maxPositiveMarginAfter() const { return m_rareData ? m_rareData->m_margins.positiveMarginAfter() : RenderBlockRareData::positiveMarginAfterDefault(this); }
@@ -822,6 +842,7 @@ private:
     void updateScrollInfoAfterLayout();
 
     RenderObject* splitAnonymousBlocksAroundChild(RenderObject* beforeChild);
+    RenderObject* splitTablePartsAroundChild(RenderObject* beforeChild);
     void splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock, RenderBlock* middleBlock,
                      RenderObject* beforeChild, RenderBoxModelObject* oldCont);
     void splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 406930fc1..47b632464 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -491,6 +491,9 @@ RootInlineBox* RenderBlock::constructLine(BidiRunList<BidiRun>& bidiRuns, const
         if (runCount == 2 && !r->m_object->isListMarker())
             isOnlyRun = (!style()->isLeftToRightDirection() ? bidiRuns.lastRun() : bidiRuns.firstRun())->m_object->isListMarker();
 
+        if (lineInfo.isEmpty())
+            continue;
+
         InlineBox* box = createInlineBoxForRenderer(r->m_object, false, isOnlyRun);
         r->m_box = box;
 
@@ -1093,8 +1096,8 @@ public:
     void updateRepaintRangeFromBox(RootInlineBox* box, LayoutUnit paginationDelta = 0)
     {
         m_usesRepaintBounds = true;
-        m_repaintLogicalTop = min(m_repaintLogicalTop, box->logicalTopVisualOverflow() + min(paginationDelta, 0));
-        m_repaintLogicalBottom = max(m_repaintLogicalBottom, box->logicalBottomVisualOverflow() + max(paginationDelta, 0));
+        m_repaintLogicalTop = min(m_repaintLogicalTop, box->logicalTopVisualOverflow() + min(paginationDelta, zeroLayoutUnit));
+        m_repaintLogicalBottom = max(m_repaintLogicalBottom, box->logicalBottomVisualOverflow() + max(paginationDelta, zeroLayoutUnit));
     }
     
     bool endLineMatched() const { return m_endLineMatched; }
@@ -1459,7 +1462,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
     LineLayoutState layoutState(isFullLayout, repaintLogicalTop, repaintLogicalBottom);
 
     if (isFullLayout)
-        lineBoxes()->deleteLineBoxes(renderArena());
+        deleteLineBoxTree();
 
     // Text truncation only kicks in if your overflow isn't visible and your text-overflow-mode isn't
     // clip.
@@ -1831,14 +1834,22 @@ static inline bool shouldCollapseWhiteSpace(const RenderStyle* style, const Line
         || (whitespacePosition == TrailingWhitespace && style->whiteSpace() == PRE_WRAP && (!lineInfo.isEmpty() || !lineInfo.previousLineBrokeCleanly()));
 }
 
-static bool inlineFlowRequiresLineBox(RenderInline* flow, const LineInfo& lineInfo)
+static bool requiresLineBoxForContent(RenderInline* flow, const LineInfo& lineInfo)
+{
+    RenderObject* parent = flow->parent();
+    if (flow->document()->inNoQuirksMode() 
+        && (flow->style(lineInfo.isFirstLine())->lineHeight() != parent->style(lineInfo.isFirstLine())->lineHeight()
+        || flow->style()->verticalAlign() != parent->style()->verticalAlign()
+        || !parent->style()->font().fontMetrics().hasIdenticalAscentDescentAndLineGap(flow->style()->font().fontMetrics())))
+        return true;
+    return false;
+}
+
+static bool alwaysRequiresLineBox(RenderInline* flow)
 {
     // FIXME: Right now, we only allow line boxes for inlines that are truly empty.
     // We need to fix this, though, because at the very least, inlines containing only
     // ignorable whitespace should should also have line boxes.
-    if (!flow->document()->inQuirksMode() && flow->style(lineInfo.isFirstLine())->lineHeight() != flow->parent()->style(lineInfo.isFirstLine())->lineHeight())
-        return true;
-
     return !flow->firstChild() && flow->hasInlineDirectionBordersPaddingOrMargin();
 }
 
@@ -1847,7 +1858,7 @@ static bool requiresLineBox(const InlineIterator& it, const LineInfo& lineInfo =
     if (it.m_obj->isFloatingOrPositioned())
         return false;
 
-    if (it.m_obj->isRenderInline() && !inlineFlowRequiresLineBox(toRenderInline(it.m_obj), lineInfo))
+    if (it.m_obj->isRenderInline() && !alwaysRequiresLineBox(toRenderInline(it.m_obj)) && !requiresLineBoxForContent(toRenderInline(it.m_obj), lineInfo))
         return false;
 
     if (!shouldCollapseWhiteSpace(it.m_obj->style(), lineInfo, whitespacePosition) || it.m_obj->isBR())
@@ -2235,8 +2246,12 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
             // to make sure that we stop to include this object and then start ignoring spaces again.
             // If this object is at the start of the line, we need to behave like list markers and
             // start ignoring spaces.
-            if (inlineFlowRequiresLineBox(flowBox, lineInfo)) {
-                lineInfo.setEmpty(false, m_block, &width);
+            bool requiresLineBox = alwaysRequiresLineBox(flowBox);
+            if (requiresLineBox || requiresLineBoxForContent(flowBox, lineInfo)) {
+                // An empty inline that only has line-height, vertical-align or font-metrics will only get a
+                // line box to affect the height of the line if the rest of the line is not empty.
+                if (requiresLineBox)
+                    lineInfo.setEmpty(false, m_block, &width);
                 if (ignoringSpaces) {
                     trailingObjects.clear();
                     addMidpoint(lineMidpointState, InlineIterator(0, current.m_obj, 0)); // Stop ignoring spaces.
@@ -2354,7 +2369,7 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
                     midWordBreak = width.committedWidth() + wrapW + charWidth > width.availableWidth();
                 }
 
-                if (lineBreakIteratorInfo.first != t) {
+                if ((lineBreakIteratorInfo.first != t) || (lineBreakIteratorInfo.second.string() != t->characters())) {
                     lineBreakIteratorInfo.first = t;
                     lineBreakIteratorInfo.second.reset(t->characters(), t->textLength(), style->locale());
                 }
@@ -2651,7 +2666,7 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
 
 void RenderBlock::addOverflowFromInlineChildren()
 {
-    LayoutUnit endPadding = hasOverflowClip() ? paddingEnd() : 0;
+    LayoutUnit endPadding = hasOverflowClip() ? paddingEnd() : zeroLayoutUnit;
     // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
     if (hasOverflowClip() && !endPadding && node() && node()->rendererIsEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection())
         endPadding = 1;
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index f3ca0b1d1..d21c2405d 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -746,6 +746,13 @@ bool RenderBox::needsPreferredWidthsRecalculation() const
     return style()->paddingStart().isPercent() || style()->paddingEnd().isPercent();
 }
 
+IntSize RenderBox::scrolledContentOffset() const
+{
+    ASSERT(hasOverflowClip());
+    ASSERT(hasLayer());
+    return layer()->scrolledContentOffset();
+}
+
 LayoutUnit RenderBox::minPreferredLogicalWidth() const
 {
     if (preferredLogicalWidthsDirty())
@@ -917,11 +924,12 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& pai
     // balloon layout is an example of this).
     borderFitAdjust(paintRect);
 
+    BackgroundBleedAvoidance bleedAvoidance = determineBackgroundBleedAvoidance(paintInfo.context);
+
     // FIXME: Should eventually give the theme control over whether the box shadow should paint, since controls could have
     // custom shadows of their own.
-    paintBoxShadow(paintInfo, paintRect, style(), Normal);
-
-    BackgroundBleedAvoidance bleedAvoidance = determineBackgroundBleedAvoidance(paintInfo.context);
+    if (!boxShadowShouldBeAppliedToBackground(bleedAvoidance))
+        paintBoxShadow(paintInfo, paintRect, style(), Normal);
 
     GraphicsContextStateSaver stateSaver(*paintInfo.context, false);
     if (bleedAvoidance == BackgroundBleedUseTransparencyLayer) {
@@ -941,12 +949,12 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& pai
         paintBackground(paintInfo, paintRect, bleedAvoidance);
 
         if (style()->hasAppearance())
-            theme()->paintDecorations(this, paintInfo, paintRect);
+            theme()->paintDecorations(this, paintInfo, pixelSnappedIntRect(paintRect));
     }
     paintBoxShadow(paintInfo, paintRect, style(), Inset);
 
     // The theme will tell us whether or not we should also paint the CSS border.
-    if ((!style()->hasAppearance() || (!themePainted && theme()->paintBorderOnly(this, paintInfo, paintRect))) && style()->hasBorder())
+    if ((!style()->hasAppearance() || (!themePainted && theme()->paintBorderOnly(this, paintInfo, pixelSnappedIntRect(paintRect)))) && style()->hasBorder())
         paintBorder(paintInfo, paintRect, style(), bleedAvoidance);
 
     if (bleedAvoidance == BackgroundBleedUseTransparencyLayer)
@@ -1186,7 +1194,7 @@ bool RenderBox::pushContentsClip(PaintInfo& paintInfo, const LayoutPoint& accumu
         paintObject(paintInfo, accumulatedOffset);
         paintInfo.phase = PaintPhaseChildBlockBackgrounds;
     }
-    IntRect clipRect(isControlClip ? controlClipRect(accumulatedOffset) : overflowClipRect(accumulatedOffset, paintInfo.renderRegion));
+    IntRect clipRect = pixelSnappedIntRect(isControlClip ? controlClipRect(accumulatedOffset) : overflowClipRect(accumulatedOffset, paintInfo.renderRegion));
     paintInfo.context->save();
     if (style()->hasBorderRadius())
         paintInfo.context->addRoundedRectClip(style()->getRoundedInnerBorderFor(LayoutRect(accumulatedOffset, size())));
@@ -1251,11 +1259,50 @@ LayoutRect RenderBox::clipRect(const LayoutPoint& location, RenderRegion* region
     return clipRect;
 }
 
+LayoutUnit RenderBox::shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStart, LayoutUnit childMarginEnd, const RenderBlock* cb, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage)
+{    
+    RenderRegion* containingBlockRegion = 0;
+    LayoutUnit logicalTopPosition = logicalTop();
+    LayoutUnit adjustedPageOffsetForContainingBlock = offsetFromLogicalTopOfFirstPage - logicalTop();
+    if (region) {
+        LayoutUnit offsetFromLogicalTopOfRegion = region ? region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage : 0;
+        logicalTopPosition = max(logicalTopPosition, logicalTopPosition + offsetFromLogicalTopOfRegion);
+        containingBlockRegion = cb->clampToStartAndEndRegions(region);
+    }
+
+    LayoutUnit result = cb->availableLogicalWidthForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock) - childMarginStart - childMarginEnd;
+
+    // We need to see if margins on either the start side or the end side can contain the floats in question. If they can,
+    // then just using the line width is inaccurate. In the case where a float completely fits, we don't need to use the line
+    // offset at all, but can instead push all the way to the content edge of the containing block. In the case where the float
+    // doesn't fit, we can use the line offset, but we need to grow it by the margin to reflect the fact that the margin was
+    // "consumed" by the float. Negative margins aren't consumed by the float, and so we ignore them.
+    if (childMarginStart > 0) {
+        LayoutUnit startContentSide = cb->startOffsetForContent(containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        LayoutUnit startContentSideWithMargin = startContentSide + childMarginStart;
+        LayoutUnit startOffset = cb->startOffsetForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        if (startOffset > startContentSideWithMargin)
+            result += childMarginStart;
+        else
+            result += startOffset - startContentSide;
+    }
+    
+    if (childMarginEnd > 0) {
+        LayoutUnit endContentSide = cb->endOffsetForContent(containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        LayoutUnit endContentSideWithMargin = endContentSide + childMarginEnd;
+        LayoutUnit endOffset = cb->endOffsetForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        if (endOffset > endContentSideWithMargin)
+            result += childMarginEnd;
+        else
+            result += endOffset - endContentSide;
+    }
+
+    return result;
+}
+
 LayoutUnit RenderBox::containingBlockLogicalWidthForContent() const
 {
     RenderBlock* cb = containingBlock();
-    if (shrinkToAvoidFloats() && !inRenderFlowThread())
-        return cb->availableLogicalWidthForLine(logicalTop(), false);
     return cb->availableLogicalWidth();
 }
 
@@ -1266,10 +1313,6 @@ LayoutUnit RenderBox::containingBlockLogicalWidthForContentInRegion(RenderRegion
 
     RenderBlock* cb = containingBlock();
     RenderRegion* containingBlockRegion = cb->clampToStartAndEndRegions(region);
-    if (shrinkToAvoidFloats()) {
-        LayoutUnit offsetFromLogicalTopOfRegion = region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage;
-        return cb->availableLogicalWidthForLine(max(logicalTop(), logicalTop() + offsetFromLogicalTopOfRegion), false, containingBlockRegion, offsetFromLogicalTopOfFirstPage - logicalTop());
-    }
     LayoutUnit result = cb->availableLogicalWidth();
     RenderBoxRegionInfo* boxInfo = cb->renderBoxRegionInfo(containingBlockRegion, offsetFromLogicalTopOfFirstPage - logicalTop());
     if (!boxInfo)
@@ -1397,7 +1440,7 @@ LayoutSize RenderBox::offsetFromContainer(RenderObject* o, const LayoutPoint& po
     }
 
     if (o->hasOverflowClip())
-        offset -= toRenderBox(o)->layer()->scrolledContentOffset();
+        offset -= toRenderBox(o)->scrolledContentOffset();
 
     if (style()->position() == AbsolutePosition && o->isRelPositioned() && o->isRenderInline())
         offset += toRenderInline(o)->relativePositionedInlineOffset(this);
@@ -1596,7 +1639,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
         // o->height() is inaccurate if we're in the middle of a layout of |o|, so use the
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
-        topLeft -= containerBox->layer()->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
+        topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
         LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
@@ -1691,11 +1734,11 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         setLogicalWidth(logicalWidthLength.value() + borderAndPaddingLogicalWidth());
     else {
         // Calculate LogicalWidth
-        setLogicalWidth(computeLogicalWidthUsing(LogicalWidth, containerWidthInInlineDirection));
+        setLogicalWidth(computeLogicalWidthInRegionUsing(LogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage));
 
         // Calculate MaxLogicalWidth
         if (!styleToUse->logicalMaxWidth().isUndefined()) {
-            LayoutUnit maxLogicalWidth = computeLogicalWidthUsing(MaxLogicalWidth, containerWidthInInlineDirection);
+            LayoutUnit maxLogicalWidth = computeLogicalWidthInRegionUsing(MaxLogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
             if (logicalWidth() > maxLogicalWidth) {
                 setLogicalWidth(maxLogicalWidth);
                 logicalWidthLength = styleToUse->logicalMaxWidth();
@@ -1703,7 +1746,7 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         }
 
         // Calculate MinLogicalWidth
-        LayoutUnit minLogicalWidth = computeLogicalWidthUsing(MinLogicalWidth, containerWidthInInlineDirection);
+        LayoutUnit minLogicalWidth = computeLogicalWidthInRegionUsing(MinLogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
         if (logicalWidth() < minLogicalWidth) {
             setLogicalWidth(minLogicalWidth);
             logicalWidthLength = styleToUse->logicalMinWidth();
@@ -1728,7 +1771,8 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         cb->setMarginEndForChild(this, containerLogicalWidth - logicalWidth() - cb->marginStartForChild(this));
 }
 
-LayoutUnit RenderBox::computeLogicalWidthUsing(LogicalWidthType widthType, LayoutUnit availableLogicalWidth)
+LayoutUnit RenderBox::computeLogicalWidthInRegionUsing(LogicalWidthType widthType, LayoutUnit availableLogicalWidth,
+    const RenderBlock* cb, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage)
 {
     LayoutUnit logicalWidthResult = logicalWidth();
     RenderStyle* styleToUse = style();
@@ -1745,6 +1789,9 @@ LayoutUnit RenderBox::computeLogicalWidthUsing(LogicalWidthType widthType, Layou
         LayoutUnit marginEnd = styleToUse->marginEnd().calcMinValue(availableLogicalWidth);
         logicalWidthResult = availableLogicalWidth - marginStart - marginEnd;
 
+        if (shrinkToAvoidFloats() && cb->containsFloats())
+            logicalWidthResult = shrinkLogicalWidthToAvoidFloats(marginStart, marginEnd, cb, region, offsetFromLogicalTopOfFirstPage);
+
         if (sizesToIntrinsicLogicalWidth(widthType)) {
             logicalWidthResult = max(logicalWidthResult, minPreferredLogicalWidth());
             logicalWidthResult = min(logicalWidthResult, maxPreferredLogicalWidth());
@@ -1997,7 +2044,6 @@ void RenderBox::computeLogicalHeight()
         LayoutUnit heightResult;
         if (checkMinMaxHeight) {
             heightResult = computeLogicalHeightUsing(styleToUse->logicalHeight());
-            // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
             if (heightResult == -1)
                 heightResult = logicalHeight();
             LayoutUnit minH = computeLogicalHeightUsing(styleToUse->logicalMinHeight()); // Leave as -1 if unset.
@@ -2056,7 +2102,6 @@ LayoutUnit RenderBox::computeLogicalHeightUsing(const Length& h)
             logicalHeight = h.value();
         else if (h.isPercent())
             logicalHeight = computePercentageLogicalHeight(h);
-        // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
         if (logicalHeight != -1) {
             logicalHeight = computeBorderBoxLogicalHeight(logicalHeight);
             return logicalHeight;
@@ -2123,7 +2168,6 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
     else if (cbstyle->logicalHeight().isPercent() && !isPositionedWithSpecifiedHeight) {
         // We need to recur and compute the percentage height for our containing block.
         result = cb->computePercentageLogicalHeight(cbstyle->logicalHeight());
-        // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
         if (result != -1)
             result = cb->computeContentBoxLogicalHeight(result);
     } else if (cb->isRenderView() || (cb->isBody() && document()->inQuirksMode()) || isPositionedWithSpecifiedHeight) {
@@ -2138,7 +2182,6 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
         // always.  Note we could only hit this case by recurring into computePercentageLogicalHeight on a positioned containing block.
         result = cb->computeContentBoxLogicalHeight(cb->availableLogicalHeight());
 
-    // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
     if (result != -1) {
         result = height.calcValue(result);
         if (includeBorderPadding) {
@@ -3444,9 +3487,9 @@ VisiblePosition RenderBox::positionForPoint(const LayoutPoint& point)
         
         RenderBox* renderer = toRenderBox(renderObject);
 
-        LayoutUnit top = renderer->borderTop() + renderer->paddingTop() + (isTableRow() ? 0 : renderer->y());
+        LayoutUnit top = renderer->borderTop() + renderer->paddingTop() + (isTableRow() ? zeroLayoutUnit : renderer->y());
         LayoutUnit bottom = top + renderer->contentHeight();
-        LayoutUnit left = renderer->borderLeft() + renderer->paddingLeft() + (isTableRow() ? 0 : renderer->x());
+        LayoutUnit left = renderer->borderLeft() + renderer->paddingLeft() + (isTableRow() ? zeroLayoutUnit : renderer->x());
         LayoutUnit right = left + renderer->contentWidth();
         
         if (point.x() <= right && point.x() >= left && point.y() <= top && point.y() >= bottom) {
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index f9b852c54..31ec39a20 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -151,6 +151,7 @@ public:
     // respectively are flipped when compared to their physical counterparts.  For example minX is on the left in vertical-lr,
     // but it is on the right in vertical-rl.
     LayoutRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : clientBoxRect(); }
+    IntRect pixelSnappedLayoutOverflowRect() const { return pixelSnappedIntRect(layoutOverflowRect()); }
     LayoutUnit minYLayoutOverflow() const { return m_overflow? m_overflow->minYLayoutOverflow() : borderTop(); }
     LayoutUnit maxYLayoutOverflow() const { return m_overflow ? m_overflow->maxYLayoutOverflow() : borderTop() + clientHeight(); }
     LayoutUnit minXLayoutOverflow() const { return m_overflow ? m_overflow->minXLayoutOverflow() : borderLeft(); }
@@ -160,9 +161,9 @@ public:
     LayoutUnit logicalRightLayoutOverflow() const { return style()->isHorizontalWritingMode() ? maxXLayoutOverflow() : maxYLayoutOverflow(); }
     
     virtual LayoutRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : borderBoxRect(); }
-    LayoutUnit minYVisualOverflow() const { return m_overflow? m_overflow->minYVisualOverflow() : 0; }
+    LayoutUnit minYVisualOverflow() const { return m_overflow? m_overflow->minYVisualOverflow() : zeroLayoutUnit; }
     LayoutUnit maxYVisualOverflow() const { return m_overflow ? m_overflow->maxYVisualOverflow() : height(); }
-    LayoutUnit minXVisualOverflow() const { return m_overflow ? m_overflow->minXVisualOverflow() : 0; }
+    LayoutUnit minXVisualOverflow() const { return m_overflow ? m_overflow->minXVisualOverflow() : zeroLayoutUnit; }
     LayoutUnit maxXVisualOverflow() const { return m_overflow ? m_overflow->maxXVisualOverflow() : width(); }
     LayoutUnit logicalLeftVisualOverflow() const { return style()->isHorizontalWritingMode() ? minXVisualOverflow() : minYVisualOverflow(); }
     LayoutUnit logicalRightVisualOverflow() const { return style()->isHorizontalWritingMode() ? maxXVisualOverflow() : maxYVisualOverflow(); }
@@ -313,7 +314,7 @@ public:
     virtual void computeLogicalHeight();
 
     RenderBoxRegionInfo* renderBoxRegionInfo(RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage, RenderBoxRegionInfoFlags = CacheRenderBoxRegionInfo) const;
-    void computeLogicalWidthInRegion(RenderRegion* = 0, LayoutUnit offsetFromLogicalTopOfFirstPage = 0);
+    void computeLogicalWidthInRegion(RenderRegion* = 0, LayoutUnit offsetFromLogicalTopOfFirstPage = zeroLayoutUnit);
 
     bool stretchesToViewport() const
     {
@@ -329,7 +330,9 @@ public:
     bool sizesToIntrinsicLogicalWidth(LogicalWidthType) const;
     virtual bool stretchesToMinIntrinsicLogicalWidth() const { return false; }
 
-    LayoutUnit computeLogicalWidthUsing(LogicalWidthType, LayoutUnit availableLogicalWidth);
+    LayoutUnit shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStart, LayoutUnit childMarginEnd, const RenderBlock* cb, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
+
+    LayoutUnit computeLogicalWidthInRegionUsing(LogicalWidthType, LayoutUnit availableLogicalWidth, const RenderBlock* containingBlock, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
     LayoutUnit computeLogicalHeightUsing(const Length& height);
     LayoutUnit computeReplacedLogicalWidthUsing(Length width) const;
     LayoutUnit computeReplacedLogicalWidthRespectingMinMaxWidth(LayoutUnit logicalWidth, bool includeMaxWidth = true) const;
@@ -444,6 +447,8 @@ public:
     virtual bool needsPreferredWidthsRecalculation() const;
     virtual void computeIntrinsicRatioInformation(FloatSize& /* intrinsicSize */, double& /* intrinsicRatio */, bool& /* isPercentageIntrinsicSize */) const { }
 
+    IntSize scrolledContentOffset() const;
+
 protected:
     virtual void willBeDestroyed();
 
@@ -459,6 +464,8 @@ protected:
 
     void paintMaskImages(const PaintInfo&, const LayoutRect&);
 
+    BackgroundBleedAvoidance determineBackgroundBleedAvoidance(GraphicsContext*) const;
+
 #if PLATFORM(MAC)
     void paintCustomHighlight(const LayoutPoint&, const AtomicString& type, bool behindText);
 #endif
@@ -503,8 +510,6 @@ private:
     // These include tables, positioned objects, floats and flexible boxes.
     virtual void computePreferredLogicalWidths() { setPreferredLogicalWidthsDirty(false); }
 
-    BackgroundBleedAvoidance determineBackgroundBleedAvoidance(GraphicsContext*) const;
-
 private:
     // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
     LayoutRect m_frameRect;
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index 3aadee902..e3ab32180 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -168,8 +168,6 @@ bool ImageQualityController::shouldPaintAtLowQuality(GraphicsContext* context, R
 
     const AffineTransform& currentTransform = context->getCTM();
     bool contextIsScaled = !currentTransform.isIdentityOrTranslationOrFlipped();
-    // FIXME: Change to use roughlyEquals when we move to float.
-    // See https://bugs.webkit.org/show_bug.cgi?id=66148
     if (!contextIsScaled && size == imageSize) {
         // There is no scale in effect. If we had a scale in effect before, we can just remove this object from the list.
         removeLayer(object, innerMap, layer);
@@ -192,8 +190,6 @@ bool ImageQualityController::shouldPaintAtLowQuality(GraphicsContext* context, R
     // If this is the first time resizing this image, or its size is the
     // same as the last resize, draw at high res, but record the paint
     // size and set the timer.
-    // FIXME: Change to use roughlyEquals when we move to float.
-    // See https://bugs.webkit.org/show_bug.cgi?id=66148
     if (isFirstResize || oldSize == size) {
         restartTimer();
         set(object, innerMap, layer, size);
@@ -362,7 +358,7 @@ void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyl
     updateBoxModelInfoFromStyle();
     
     if (requiresLayer()) {
-        if (!layer()) {
+        if (!layer() && layerCreationAllowedForSubtree()) {
             if (s_wasFloating && isFloating())
                 setChildNeedsLayout(true);
             m_layer = new (renderArena()) RenderLayer(this);
@@ -401,8 +397,26 @@ void RenderBoxModelObject::updateBoxModelInfoFromStyle()
     setHorizontalWritingMode(styleToUse->isHorizontalWritingMode());
 }
 
+enum RelPosAxis { RelPosX, RelPosY };
+
+static LayoutUnit accumulateRelativePositionOffsets(const RenderObject* child, RelPosAxis axis)
+{
+    if (!child->isAnonymousBlock() || !child->isRelPositioned())
+        return 0;
+    LayoutUnit offset = 0;
+    RenderObject* p = toRenderBlock(child)->inlineElementContinuation();
+    while (p && p->isRenderInline()) {
+        if (p->isRelPositioned())
+            offset += (axis == RelPosX) ? toRenderInline(p)->relativePositionOffsetX() : toRenderInline(p)->relativePositionOffsetY();
+        p = p->parent();
+    }
+    return offset;
+}
+
 LayoutUnit RenderBoxModelObject::relativePositionOffsetX() const
 {
+    LayoutUnit offset = accumulateRelativePositionOffsets(this, RelPosX);
+
     // Objects that shrink to avoid floats normally use available line width when computing containing block width.  However
     // in the case of relative positioning using percentages, we can't do this.  The offset should always be resolved using the
     // available width of the containing block.  Therefore we don't use containingBlockLogicalWidthForContent() here, but instead explicitly
@@ -411,19 +425,20 @@ LayoutUnit RenderBoxModelObject::relativePositionOffsetX() const
         RenderBlock* cb = containingBlock();
         if (!style()->right().isAuto() && !cb->style()->isLeftToRightDirection())
             return -style()->right().calcValue(cb->availableWidth());
-        return style()->left().calcValue(cb->availableWidth());
+        return offset + style()->left().calcValue(cb->availableWidth());
     }
     if (!style()->right().isAuto()) {
         RenderBlock* cb = containingBlock();
-        return -style()->right().calcValue(cb->availableWidth());
+        return offset + -style()->right().calcValue(cb->availableWidth());
     }
-    return 0;
+    return offset;
 }
 
 LayoutUnit RenderBoxModelObject::relativePositionOffsetY() const
 {
+    LayoutUnit offset = accumulateRelativePositionOffsets(this, RelPosY);
+    
     RenderBlock* containingBlock = this->containingBlock();
-
     // If the containing block of a relatively positioned element does not
     // specify a height, a percentage top or bottom offset should be resolved as
     // auto. An exception to this is if the containing block has the WinIE quirk
@@ -434,15 +449,15 @@ LayoutUnit RenderBoxModelObject::relativePositionOffsetY() const
         && (!containingBlock->style()->height().isAuto()
             || !style()->top().isPercent()
             || containingBlock->stretchesToViewport()))
-        return style()->top().calcValue(containingBlock->availableHeight());
+        return offset + style()->top().calcValue(containingBlock->availableHeight());
 
     if (!style()->bottom().isAuto()
         && (!containingBlock->style()->height().isAuto()
             || !style()->bottom().isPercent()
             || containingBlock->stretchesToViewport()))
-        return -style()->bottom().calcValue(containingBlock->availableHeight());
+        return offset + -style()->bottom().calcValue(containingBlock->availableHeight());
 
-    return 0;
+    return offset;
 }
 
 LayoutUnit RenderBoxModelObject::offsetLeft() const
@@ -453,7 +468,7 @@ LayoutUnit RenderBoxModelObject::offsetLeft() const
         return 0;
     
     RenderBoxModelObject* offsetPar = offsetParent();
-    LayoutUnit xPos = (isBox() ? toRenderBox(this)->left() : 0);
+    LayoutUnit xPos = (isBox() ? toRenderBox(this)->left() : zeroLayoutUnit);
     
     // If the offsetParent of the element is null, or is the HTML body element,
     // return the distance between the canvas origin and the left border edge 
@@ -487,7 +502,7 @@ LayoutUnit RenderBoxModelObject::offsetTop() const
         return 0;
     
     RenderBoxModelObject* offsetPar = offsetParent();
-    LayoutUnit yPos = (isBox() ? toRenderBox(this)->top() : 0);
+    LayoutUnit yPos = (isBox() ? toRenderBox(this)->top() : zeroLayoutUnit);
     
     // If the offsetParent of the element is null, or is the HTML body element,
     // return the distance between the canvas origin and the top border edge 
@@ -619,6 +634,19 @@ static LayoutRect backgroundRectAdjustedForBleedAvoidance(GraphicsContext* conte
     return adjustedRect;
 }
 
+static void applyBoxShadowForBackground(GraphicsContext* context, RenderStyle* style)
+{
+    const ShadowData* boxShadow = style->boxShadow();
+    while (boxShadow->style() != Normal)
+        boxShadow = boxShadow->next();
+
+    FloatSize shadowOffset(boxShadow->x(), boxShadow->y());
+    if (!boxShadow->isWebkitBoxShadow())
+        context->setShadow(shadowOffset, boxShadow->blur(), boxShadow->color(), style->colorSpace());
+    else
+        context->setLegacyShadow(shadowOffset, boxShadow->blur(), boxShadow->color(), style->colorSpace());
+}
+
 void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& color, const FillLayer* bgLayer, const LayoutRect& rect,
     BackgroundBleedAvoidance bleedAvoidance, InlineFlowBox* box, const LayoutSize& boxSize, CompositeOperator op, RenderObject* backgroundObject)
 {
@@ -669,11 +697,16 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         if (!colorVisible)
             return;
 
+        bool boxShadowShouldBeAppliedToBackground = this->boxShadowShouldBeAppliedToBackground(bleedAvoidance, box);
+        GraphicsContextStateSaver shadowStateSaver(*context, boxShadowShouldBeAppliedToBackground);
+        if (boxShadowShouldBeAppliedToBackground)
+            applyBoxShadowForBackground(context, style());
+
         if (hasRoundedBorder && bleedAvoidance != BackgroundBleedUseTransparencyLayer) {
             RoundedRect border = getBackgroundRoundedRect(backgroundRectAdjustedForBleedAvoidance(context, rect, bleedAvoidance), box, boxSize.width(), boxSize.height(), includeLeftEdge, includeRightEdge);
             context->fillRoundedRect(border, bgColor, style()->colorSpace());
         } else
-            context->fillRect(rect, bgColor, style()->colorSpace());
+            context->fillRect(pixelSnappedIntRect(rect), bgColor, style()->colorSpace());
         
         return;
     }
@@ -685,49 +718,53 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         context->addRoundedRectClip(border);
     }
     
-    LayoutUnit bLeft = includeLeftEdge ? borderLeft() : 0;
-    LayoutUnit bRight = includeRightEdge ? borderRight() : 0;
-    LayoutUnit pLeft = includeLeftEdge ? paddingLeft() : 0;
-    LayoutUnit pRight = includeRightEdge ? paddingRight() : 0;
+    LayoutUnit bLeft = includeLeftEdge ? borderLeft() : zeroLayoutUnit;
+    LayoutUnit bRight = includeRightEdge ? borderRight() : zeroLayoutUnit;
+    LayoutUnit pLeft = includeLeftEdge ? paddingLeft() : zeroLayoutUnit;
+    LayoutUnit pRight = includeRightEdge ? paddingRight() : zeroLayoutUnit;
 
     GraphicsContextStateSaver clipWithScrollingStateSaver(*context, clippedWithLocalScrolling);
     LayoutRect scrolledPaintRect = rect;
     if (clippedWithLocalScrolling) {
         // Clip to the overflow area.
-        context->clip(toRenderBox(this)->overflowClipRect(rect.location(), paintInfo.renderRegion));
+        RenderBox* thisBox = toRenderBox(this);
+        context->clip(thisBox->overflowClipRect(rect.location(), paintInfo.renderRegion));
         
         // Adjust the paint rect to reflect a scrolled content box with borders at the ends.
-        LayoutSize offset = layer()->scrolledContentOffset();
+        IntSize offset = thisBox->scrolledContentOffset();
         scrolledPaintRect.move(-offset);
         scrolledPaintRect.setWidth(bLeft + layer()->scrollWidth() + bRight);
         scrolledPaintRect.setHeight(borderTop() + layer()->scrollHeight() + borderBottom());
     }
     
     GraphicsContextStateSaver backgroundClipStateSaver(*context, false);
+    OwnPtr<ImageBuffer> maskImage;
+    IntRect maskRect;
+
     if (bgLayer->clip() == PaddingFillBox || bgLayer->clip() == ContentFillBox) {
         // Clip to the padding or content boxes as necessary.
         bool includePadding = bgLayer->clip() == ContentFillBox;
-        LayoutRect clipRect = LayoutRect(scrolledPaintRect.x() + bLeft + (includePadding ? pLeft : 0),
-                                   scrolledPaintRect.y() + borderTop() + (includePadding ? paddingTop() : 0),
-                                   scrolledPaintRect.width() - bLeft - bRight - (includePadding ? pLeft + pRight : 0),
-                                   scrolledPaintRect.height() - borderTop() - borderBottom() - (includePadding ? paddingTop() + paddingBottom() : 0));
+        LayoutRect clipRect = LayoutRect(scrolledPaintRect.x() + bLeft + (includePadding ? pLeft : zeroLayoutUnit),
+                                   scrolledPaintRect.y() + borderTop() + (includePadding ? paddingTop() : zeroLayoutUnit),
+                                   scrolledPaintRect.width() - bLeft - bRight - (includePadding ? pLeft + pRight : zeroLayoutUnit),
+                                   scrolledPaintRect.height() - borderTop() - borderBottom() - (includePadding ? paddingTop() + paddingBottom() : zeroLayoutUnit));
         backgroundClipStateSaver.save();
         context->clip(clipRect);
     } else if (bgLayer->clip() == TextFillBox) {
         // We have to draw our text into a mask that can then be used to clip background drawing.
         // First figure out how big the mask has to be.  It should be no bigger than what we need
         // to actually render, so we should intersect the dirty rect with the border box of the background.
-        LayoutRect maskRect = rect;
+        maskRect = pixelSnappedIntRect(rect);
         maskRect.intersect(paintInfo.rect);
-        
+
         // Now create the mask.
-        OwnPtr<ImageBuffer> maskImage = context->createCompatibleBuffer(maskRect.size());
+        maskImage = context->createCompatibleBuffer(maskRect.size());
         if (!maskImage)
             return;
-        
+
         GraphicsContext* maskImageContext = maskImage->context();
         maskImageContext->translate(-maskRect.x(), -maskRect.y());
-        
+
         // Now add the text to the clip.  We do this by painting using a special paint phase that signals to
         // InlineTextBoxes that they should just add their contents to the clip.
         PaintInfo info(maskImageContext, maskRect, PaintPhaseTextClip, true, 0, paintInfo.renderRegion, 0);
@@ -738,12 +775,13 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
             LayoutSize localOffset = isBox() ? toRenderBox(this)->locationOffset() : LayoutSize();
             paint(info, scrolledPaintRect.location() - localOffset);
         }
-        
+
         // The mask has been created.  Now we just need to clip to it.
         backgroundClipStateSaver.save();
-        context->clipToImageBuffer(maskImage.get(), maskRect);
+        context->clip(maskRect);
+        context->beginTransparencyLayer(1);
     }
-    
+
     // Only fill with a base color (e.g., white) if we're the root document, since iframes/frames with
     // no background in the child document should show the parent's background.
     bool isOpaqueRoot = false;
@@ -777,8 +815,11 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     // Paint the color first underneath all images.
     if (!bgLayer->next()) {
-        LayoutRect backgroundRect(scrolledPaintRect);
-        backgroundRect.intersect(paintInfo.rect);
+        IntRect backgroundRect(pixelSnappedIntRect(scrolledPaintRect));
+        bool boxShadowShouldBeAppliedToBackground = this->boxShadowShouldBeAppliedToBackground(bleedAvoidance, box);
+        if (!boxShadowShouldBeAppliedToBackground)
+            backgroundRect.intersect(paintInfo.rect);
+
         // If we have an alpha and we are painting the root element, go ahead and blend with the base background color.
         Color baseColor;
         bool shouldClearBackground = false;
@@ -788,6 +829,10 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
                 shouldClearBackground = true;
         }
 
+        GraphicsContextStateSaver shadowStateSaver(*context, boxShadowShouldBeAppliedToBackground);
+        if (boxShadowShouldBeAppliedToBackground)
+            applyBoxShadowForBackground(context, style());
+
         if (baseColor.alpha()) {
             if (bgColor.alpha())
                 baseColor = baseColor.blend(bgColor);
@@ -814,6 +859,11 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
                 compositeOp, useLowQualityScaling);
         }
     }
+
+    if (bgLayer->clip() == TextFillBox) {
+        context->drawImageBuffer(maskImage.get(), ColorSpaceDeviceRGB, maskRect, CompositeDestinationIn);
+        context->endTransparencyLayer();
+    }
 }
 
 static inline LayoutUnit resolveWidthForRatio(LayoutUnit height, const FloatSize& intrinsicRatio)
@@ -1064,7 +1114,7 @@ void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* fil
         } else
             positioningAreaSize = LayoutSize(paintRect.width() - left - right, paintRect.height() - top - bottom);
     } else {
-        geometry.setDestRect(viewRect());
+        geometry.setDestRect(pixelSnappedIntRect(viewRect()));
         positioningAreaSize = geometry.destRect().size();
     }
 
@@ -1404,6 +1454,14 @@ static inline bool includesEdge(BorderEdgeFlags flags, BoxSide side)
     return flags & edgeFlagForSide(side);
 }
 
+static inline bool includesAdjacentEdges(BorderEdgeFlags flags)
+{
+    return (flags & (TopBorderEdge | RightBorderEdge)) == (TopBorderEdge | RightBorderEdge)
+        || (flags & (RightBorderEdge | BottomBorderEdge)) == (RightBorderEdge | BottomBorderEdge)
+        || (flags & (BottomBorderEdge | LeftBorderEdge)) == (BottomBorderEdge | LeftBorderEdge)
+        || (flags & (LeftBorderEdge | TopBorderEdge)) == (LeftBorderEdge | TopBorderEdge);
+}
+
 inline bool edgesShareColor(const BorderEdge& firstEdge, const BorderEdge& secondEdge)
 {
     return firstEdge.color == secondEdge.color;
@@ -1527,7 +1585,7 @@ static bool joinRequiresMitre(BoxSide side, BoxSide adjacentSide, const BorderEd
 }
 
 void RenderBoxModelObject::paintOneBorderSide(GraphicsContext* graphicsContext, const RenderStyle* style, const RoundedRect& outerBorder, const RoundedRect& innerBorder,
-    const LayoutRect& sideRect, BoxSide side, BoxSide adjacentSide1, BoxSide adjacentSide2, const BorderEdge edges[], const Path* path,
+    const IntRect& sideRect, BoxSide side, BoxSide adjacentSide1, BoxSide adjacentSide2, const BorderEdge edges[], const Path* path,
     BackgroundBleedAvoidance bleedAvoidance, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias, const Color* overrideColor)
 {
     const BorderEdge& edgeToRender = edges[side];
@@ -1572,9 +1630,9 @@ void RenderBoxModelObject::paintOneBorderSide(GraphicsContext* graphicsContext,
     }
 }
 
-static LayoutRect calculateSideRect(const RoundedRect& outerBorder, const BorderEdge edges[], int side)
+static IntRect calculateSideRect(const RoundedRect& outerBorder, const BorderEdge edges[], int side)
 {
-    LayoutRect sideRect = outerBorder.rect();
+    IntRect sideRect = outerBorder.rect();
     int width = edges[side].width;
 
     if (side == BSTop)
@@ -1600,7 +1658,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
         roundedPath.addRoundedRect(outerBorder);
     
     if (edges[BSTop].shouldRender() && includesEdge(edgeSet, BSTop)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.setHeight(edges[BSTop].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSTop].style) || borderWillArcInnerEdge(innerBorder.radii().topLeft(), innerBorder.radii().topRight()));
@@ -1608,7 +1666,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
     }
 
     if (edges[BSBottom].shouldRender() && includesEdge(edgeSet, BSBottom)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.shiftYEdgeTo(sideRect.maxY() - edges[BSBottom].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSBottom].style) || borderWillArcInnerEdge(innerBorder.radii().bottomLeft(), innerBorder.radii().bottomRight()));
@@ -1616,7 +1674,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
     }
 
     if (edges[BSLeft].shouldRender() && includesEdge(edgeSet, BSLeft)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.setWidth(edges[BSLeft].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSLeft].style) || borderWillArcInnerEdge(innerBorder.radii().bottomLeft(), innerBorder.radii().topLeft()));
@@ -1624,7 +1682,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
     }
 
     if (edges[BSRight].shouldRender() && includesEdge(edgeSet, BSRight)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.shiftXEdgeTo(sideRect.maxX() - edges[BSRight].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSRight].style) || borderWillArcInnerEdge(innerBorder.radii().bottomRight(), innerBorder.radii().topRight()));
@@ -1657,7 +1715,7 @@ void RenderBoxModelObject::paintTranslucentBorderSides(GraphicsContext* graphics
                 commonColorEdgeSet |= edgeFlagForSide(currSide);
         }
 
-        bool useTransparencyLayer = commonColor.hasAlpha();
+        bool useTransparencyLayer = includesAdjacentEdges(commonColorEdgeSet) && commonColor.hasAlpha();
         if (useTransparencyLayer) {
             graphicsContext->beginTransparencyLayer(static_cast<float>(commonColor.alpha()) / 255);
             commonColor = Color(commonColor.red(), commonColor.green(), commonColor.blue());
@@ -1753,7 +1811,7 @@ void RenderBoxModelObject::paintBorder(const PaintInfo& info, const LayoutRect&
             for (int i = BSTop; i <= BSLeft; ++i) {
                 const BorderEdge& currEdge = edges[i];
                 if (currEdge.shouldRender()) {
-                    LayoutRect sideRect = calculateSideRect(outerBorder, edges, i);
+                    IntRect sideRect = calculateSideRect(outerBorder, edges, i);
                     path.addRect(sideRect);
                 }
             }
@@ -1933,7 +1991,7 @@ void RenderBoxModelObject::drawBoxSideFromPath(GraphicsContext* graphicsContext,
 
     graphicsContext->setStrokeStyle(NoStroke);
     graphicsContext->setFillColor(color, style->colorSpace());
-    graphicsContext->drawRect(borderRect);
+    graphicsContext->drawRect(pixelSnappedIntRect(borderRect));
 }
 #else
 void RenderBoxModelObject::paintBorder(const PaintInfo& info, const IntRect& rect, const RenderStyle* style,
@@ -2375,9 +2433,9 @@ void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContex
     graphicsContext->clipConvexPolygon(4, secondQuad, !secondEdgeMatches);
 }
 
-static LayoutRect calculateSideRectIncludingInner(const RoundedRect& outerBorder, const BorderEdge edges[], BoxSide side)
+static IntRect calculateSideRectIncludingInner(const RoundedRect& outerBorder, const BorderEdge edges[], BoxSide side)
 {
-    LayoutRect sideRect = outerBorder.rect();
+    IntRect sideRect = outerBorder.rect();
     int width;
 
     switch (side) {
@@ -2556,6 +2614,53 @@ bool RenderBoxModelObject::borderObscuresBackground() const
     return true;
 }
 
+bool RenderBoxModelObject::boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance bleedAvoidance, InlineFlowBox* inlineFlowBox) const
+{
+    if (bleedAvoidance != BackgroundBleedNone)
+        return false;
+
+    if (style()->hasAppearance())
+        return false;
+
+    bool hasOneNormalBoxShadow = false;
+    for (const ShadowData* currentShadow = style()->boxShadow(); currentShadow; currentShadow = currentShadow->next()) {
+        if (currentShadow->style() != Normal)
+            continue;
+
+        if (hasOneNormalBoxShadow)
+            return false;
+        hasOneNormalBoxShadow = true;
+
+        if (currentShadow->spread())
+            return false;
+    }
+
+    if (!hasOneNormalBoxShadow)
+        return false;
+
+    Color backgroundColor = style()->visitedDependentColor(CSSPropertyBackgroundColor);
+    if (!backgroundColor.isValid() || backgroundColor.alpha() < 255)
+        return false;
+
+    const FillLayer* lastBackgroundLayer = style()->backgroundLayers();
+    for (const FillLayer* next = lastBackgroundLayer->next(); next; next = lastBackgroundLayer->next())
+        lastBackgroundLayer = next;
+
+    if (lastBackgroundLayer->clip() != BorderFillBox)
+        return false;
+
+    if (lastBackgroundLayer->image() && style()->hasBorderRadius())
+        return false;
+
+    if (inlineFlowBox && !inlineFlowBox->boxShadowCanBeAppliedToBackground(*lastBackgroundLayer))
+        return false;
+
+    if (hasOverflowClip() && lastBackgroundLayer->attachment() == LocalBackgroundAttachment)
+        return false;
+
+    return true;
+}
+
 static inline LayoutRect areaCastingShadowInHole(const LayoutRect& holeRect, int shadowBlur, int shadowSpread, const LayoutSize& shadowOffset)
 {
     LayoutRect bounds(holeRect);
@@ -2634,7 +2739,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
                 if (!rectToClipOut.isEmpty())
                     context->clipOutRoundedRect(rectToClipOut);
 
-                RoundedRect influenceRect(shadowRect, border.radii());
+                RoundedRect influenceRect(pixelSnappedIntRect(shadowRect), border.radii());
                 influenceRect.expandRadii(2 * shadowBlur + shadowSpread);
                 if (allCornersClippedOut(influenceRect, info.rect))
                     context->fillRect(fillRect.rect(), Color::black, s->colorSpace());
@@ -2658,7 +2763,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
                 }
 
                 if (!rectToClipOut.isEmpty())
-                    context->clipOut(rectToClipOut);
+                    context->clipOut(pixelSnappedIntRect(rectToClipOut));
                 context->fillRect(fillRect.rect(), Color::black, s->colorSpace());
             }
         } else {
@@ -2693,7 +2798,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
             Color fillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), 255);
 
             LayoutRect outerRect = areaCastingShadowInHole(border.rect(), shadowBlur, shadowSpread, shadowOffset);
-            RoundedRect roundedHole(holeRect, border.radii());
+            RoundedRect roundedHole(pixelSnappedIntRect(holeRect), border.radii());
 
             GraphicsContextStateSaver stateSaver(*context);
             if (hasBorderRadius) {
@@ -2713,7 +2818,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
             else
                 context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
 
-            context->fillRectWithRoundedHole(outerRect, roundedHole, fillColor, s->colorSpace());
+            context->fillRectWithRoundedHole(pixelSnappedIntRect(outerRect), roundedHole, fillColor, s->colorSpace());
         }
     }
 }
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index 027b1fb89..11e97c3fd 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -127,6 +127,8 @@ public:
     void paintBoxShadow(const PaintInfo&, const LayoutRect&, const RenderStyle*, ShadowStyle, bool includeLogicalLeftEdge = true, bool includeLogicalRightEdge = true);
     void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, const LayoutRect&, BackgroundBleedAvoidance, InlineFlowBox* = 0, const LayoutSize& = LayoutSize(), CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
     
+    virtual bool boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance, InlineFlowBox* = 0) const;
+
     // Overridden by subclasses to determine line height and baseline position.
     virtual LayoutUnit lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const = 0;
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const = 0;
@@ -218,7 +220,7 @@ private:
                                BoxSide, bool firstEdgeMatches, bool secondEdgeMatches);
     void clipBorderSideForComplexInnerPath(GraphicsContext*, const RoundedRect&, const RoundedRect&, BoxSide, const class BorderEdge[]);
     void paintOneBorderSide(GraphicsContext*, const RenderStyle*, const RoundedRect& outerBorder, const RoundedRect& innerBorder,
-                                const LayoutRect& sideRect, BoxSide, BoxSide adjacentSide1, BoxSide adjacentSide2, const class BorderEdge[],
+                                const IntRect& sideRect, BoxSide, BoxSide adjacentSide1, BoxSide adjacentSide2, const class BorderEdge[],
                                 const Path*, BackgroundBleedAvoidance, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias, const Color* overrideColor = 0);
     void paintTranslucentBorderSides(GraphicsContext*, const RenderStyle*, const RoundedRect& outerBorder, const RoundedRect& innerBorder,
                           const class BorderEdge[], BackgroundBleedAvoidance, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias = false);
diff --git a/Source/WebCore/rendering/RenderButton.cpp b/Source/WebCore/rendering/RenderButton.cpp
index e6d1920fe..dd23130a6 100644
--- a/Source/WebCore/rendering/RenderButton.cpp
+++ b/Source/WebCore/rendering/RenderButton.cpp
@@ -118,14 +118,6 @@ void RenderButton::updateFromElement()
     }
 }
 
-bool RenderButton::canHaveChildren() const
-{
-    // Input elements can't have children, but button elements can.  We'll
-    // write the code assuming any other button types that might emerge in the future
-    // can also have children.
-    return !node()->hasTagName(inputTag);
-}
-
 void RenderButton::setText(const String& str)
 {
     if (str.isEmpty()) {
@@ -157,6 +149,11 @@ void RenderButton::updateBeforeAfterContent(PseudoId type)
         children()->updateBeforeAfterContent(this, type);
 }
 
+RenderText* RenderButton::buttonText() const
+{
+    return m_buttonText;
+}
+
 LayoutRect RenderButton::controlClipRect(const LayoutPoint& additionalOffset) const
 {
     // Clip to the padding box to at least give content the extra padding space.
diff --git a/Source/WebCore/rendering/RenderButton.h b/Source/WebCore/rendering/RenderButton.h
index 24cecd2f2..c851abc7d 100644
--- a/Source/WebCore/rendering/RenderButton.h
+++ b/Source/WebCore/rendering/RenderButton.h
@@ -50,14 +50,13 @@ public:
 
     virtual void updateBeforeAfterContent(PseudoId);
 
+    virtual RenderText* buttonText() const OVERRIDE;
     virtual bool hasControlClip() const { return true; }
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
 
     void setText(const String&);
     String text() const;
 
-    virtual bool canHaveChildren() const;
-
 private:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
index 417ebac75..101bedbe3 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
@@ -49,6 +49,7 @@ public:
     virtual bool isDeprecatedFlexibleBox() const { return true; }
     virtual bool isFlexingChildren() const { return m_flexingChildren; }
     virtual bool isStretchingChildren() const { return m_stretchingChildren; }
+    virtual RenderText* buttonText() const { return 0; }
 
     void placeChild(RenderBox* child, const LayoutPoint& location);
 
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index 0b1de6973..c1468b543 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -132,7 +132,7 @@ void RenderDetailsMarker::paint(PaintInfo& paintInfo, const LayoutPoint& paintOf
     overflowRect.moveBy(boxOrigin);
     overflowRect.inflate(maximalOutlineSize(paintInfo.phase));
 
-    if (!paintInfo.rect.intersects(overflowRect))
+    if (!paintInfo.rect.intersects(pixelSnappedIntRect(overflowRect)))
         return;
 
     const Color color(style()->visitedDependentColor(CSSPropertyColor));
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index 0140c1ed6..bdafd62d5 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -190,7 +190,7 @@ void RenderEmbeddedObject::paintReplaced(PaintInfo& paintInfo, const LayoutPoint
 bool RenderEmbeddedObject::getReplacementTextGeometry(const LayoutPoint& accumulatedOffset, FloatRect& contentRect, Path& path, FloatRect& replacementTextRect, Font& font, TextRun& run, float& textWidth) const
 {
     contentRect = contentBoxRect();
-    contentRect.moveBy(accumulatedOffset);
+    contentRect.moveBy(roundedIntPoint(accumulatedOffset));
     
     FontDescription fontDescription;
     RenderTheme::defaultTheme()->systemFont(CSSValueWebkitSmallControl, fontDescription);
diff --git a/Source/WebCore/rendering/RenderFieldset.cpp b/Source/WebCore/rendering/RenderFieldset.cpp
index 3a70866e2..1d18bb9df 100644
--- a/Source/WebCore/rendering/RenderFieldset.cpp
+++ b/Source/WebCore/rendering/RenderFieldset.cpp
@@ -132,16 +132,17 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint
     // cases the legend is embedded in the right and bottom borders respectively.
     // https://bugs.webkit.org/show_bug.cgi?id=47236
     if (style()->isHorizontalWritingMode()) {
-        LayoutUnit yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
+        LayoutUnit yOff = (legend->y() > 0) ? zeroLayoutUnit : (legend->height() - borderTop()) / 2;
         paintRect.setHeight(paintRect.height() - yOff);
         paintRect.setY(paintRect.y() + yOff);
     } else {
-        LayoutUnit xOff = (legend->x() > 0) ? 0 : (legend->width() - borderLeft()) / 2;
+        LayoutUnit xOff = (legend->x() > 0) ? zeroLayoutUnit : (legend->width() - borderLeft()) / 2;
         paintRect.setWidth(paintRect.width() - xOff);
         paintRect.setX(paintRect.x() + xOff);
     }
-    
-    paintBoxShadow(paintInfo, paintRect, style(), Normal);
+
+    if (!boxShadowShouldBeAppliedToBackground(determineBackgroundBleedAvoidance(paintInfo.context)))
+        paintBoxShadow(paintInfo, paintRect, style(), Normal);
     paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), paintRect);
     paintBoxShadow(paintInfo, paintRect, style(), Inset);
 
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index a1ae15b5c..a927f3fae 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,6 +32,7 @@
 #include "RenderText.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "TextRun.h"
 #include "VisiblePosition.h"
 #include <math.h>
@@ -85,7 +86,7 @@ void RenderFileUploadControl::updateFromElement()
 
 static int nodeWidth(Node* node)
 {
-    return node ? node->renderBox()->width() : 0;
+    return node ? node->renderBox()->width() : zeroLayoutUnit;
 }
 
 int RenderFileUploadControl::maxFilenameWidth() const
@@ -177,10 +178,15 @@ void RenderFileUploadControl::computePreferredLogicalWidths()
     else {
         // Figure out how big the filename space needs to be for a given number of characters
         // (using "0" as the nominal character).
-        const UChar ch = '0';
-        const String str = String(&ch, 1);
-        float charWidth = font.width(constructTextRun(this, font, str, style, TextRun::AllowTrailingExpansion));
-        m_maxPreferredLogicalWidth = (int)ceilf(charWidth * defaultWidthNumChars);
+        const UChar character = '0';
+        const String characterAsString = String(&character, 1);
+        float minDefaultLabelWidth = defaultWidthNumChars * font.width(constructTextRun(this, font, characterAsString, style, TextRun::AllowTrailingExpansion));
+
+        const String label = theme()->fileListDefaultLabel(node()->toInputElement()->multiple());
+        float defaultLabelWidth = font.width(constructTextRun(this, font, label, style, TextRun::AllowTrailingExpansion));
+        if (HTMLInputElement* button = uploadButton())
+            defaultLabelWidth += button->renderer()->maxPreferredLogicalWidth() + afterButtonSpacing;
+        m_maxPreferredLogicalWidth = static_cast<int>(ceilf(max(minDefaultLabelWidth, defaultLabelWidth)));
     }
 
     if (style->minWidth().isFixed() && style->minWidth().value() > 0) {
@@ -212,9 +218,9 @@ HTMLInputElement* RenderFileUploadControl::uploadButton() const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
 
-    ASSERT(input->shadowRoot());
+    ASSERT(input->hasShadowRoot());
 
-    Node* buttonNode = input->shadowRoot()->firstChild();
+    Node* buttonNode = input->shadowRootList()->oldestShadowRoot()->firstChild();
     return buttonNode && buttonNode->isHTMLElement() && buttonNode->hasTagName(inputTag) ? static_cast<HTMLInputElement*>(buttonNode) : 0;
 }
 
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.h b/Source/WebCore/rendering/RenderFileUploadControl.h
index 30ee6231c..11d959dac 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.h
+++ b/Source/WebCore/rendering/RenderFileUploadControl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index b025cd317..f2f993d7b 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -40,55 +40,13 @@ namespace WebCore {
 // Normally, -1 and 0 are not valid in a HashSet, but these are relatively likely flex-order values. Instead,
 // we make the two smallest int values invalid flex-order values (in the css parser code we clamp them to
 // int min + 2).
-struct FlexOrderHashTraits : WTF::GenericHashTraits<int> {
+struct RenderFlexibleBox::FlexOrderHashTraits : WTF::GenericHashTraits<int> {
     static const bool emptyValueIsZero = false;
     static int emptyValue() { return std::numeric_limits<int>::min(); }
     static void constructDeletedValue(int& slot) { slot = std::numeric_limits<int>::min() + 1; }
     static bool isDeletedValue(int value) { return value == std::numeric_limits<int>::min() + 1; }
 };
 
-typedef HashSet<int, DefaultHash<int>::Hash, FlexOrderHashTraits> FlexOrderHashSet;
-
-class RenderFlexibleBox::TreeOrderIterator {
-public:
-    explicit TreeOrderIterator(RenderFlexibleBox* flexibleBox)
-        : m_flexibleBox(flexibleBox)
-        , m_currentChild(0)
-    {
-    }
-
-    RenderBox* first()
-    {
-        reset();
-        return next();
-    }
-
-    RenderBox* next()
-    {
-        m_currentChild = m_currentChild ? m_currentChild->nextSiblingBox() : m_flexibleBox->firstChildBox();
-
-        if (m_currentChild)
-            m_flexOrderValues.add(m_currentChild->style()->flexOrder());
-
-        return m_currentChild;
-    }
-
-    void reset()
-    {
-        m_currentChild = 0;
-    }
-
-    const FlexOrderHashSet& flexOrderValues()
-    {
-        return m_flexOrderValues;
-    }
-
-private:
-    RenderFlexibleBox* m_flexibleBox;
-    RenderBox* m_currentChild;
-    FlexOrderHashSet m_flexOrderValues;
-};
-
 class RenderFlexibleBox::FlexOrderIterator {
 public:
     FlexOrderIterator(RenderFlexibleBox* flexibleBox, const FlexOrderHashSet& flexOrderValues)
@@ -156,6 +114,84 @@ const char* RenderFlexibleBox::renderName() const
     return "RenderFlexibleBox";
 }
 
+static LayoutUnit marginLogicalWidthForChild(RenderBox* child, RenderStyle* parentStyle)
+{
+    // A margin has three types: fixed, percentage, and auto (variable).
+    // Auto and percentage margins become 0 when computing min/max width.
+    // Fixed margins can be added in as is.
+    Length marginLeft = child->style()->marginStartUsing(parentStyle);
+    Length marginRight = child->style()->marginEndUsing(parentStyle);
+    LayoutUnit margin = 0;
+    if (marginLeft.isFixed())
+        margin += marginLeft.value();
+    if (marginRight.isFixed())
+        margin += marginRight.value();
+    return margin;
+}
+
+void RenderFlexibleBox::computePreferredLogicalWidths()
+{
+    ASSERT(preferredLogicalWidthsDirty());
+
+    RenderStyle* styleToUse = style();
+    if (styleToUse->logicalWidth().isFixed() && styleToUse->logicalWidth().value() > 0)
+        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = computeContentBoxLogicalWidth(styleToUse->logicalWidth().value());
+    else {
+        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = 0;
+
+        for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+            if (child->isPositioned())
+                continue;
+
+            LayoutUnit margin = marginLogicalWidthForChild(child, style());
+            bool hasOrthogonalWritingMode = child->isHorizontalWritingMode() != isHorizontalWritingMode();
+            LayoutUnit minPreferredLogicalWidth = hasOrthogonalWritingMode ? child->logicalHeight() : child->minPreferredLogicalWidth();
+            LayoutUnit maxPreferredLogicalWidth = hasOrthogonalWritingMode ? child->logicalHeight() : child->maxPreferredLogicalWidth();
+            minPreferredLogicalWidth += margin;
+            maxPreferredLogicalWidth += margin;
+            if (!isColumnFlow()) {
+                m_minPreferredLogicalWidth += minPreferredLogicalWidth;
+                m_maxPreferredLogicalWidth += maxPreferredLogicalWidth;
+            } else {
+                m_minPreferredLogicalWidth = std::max(minPreferredLogicalWidth, m_minPreferredLogicalWidth);
+                m_maxPreferredLogicalWidth = std::max(maxPreferredLogicalWidth, m_maxPreferredLogicalWidth);
+            }
+        }
+
+        m_maxPreferredLogicalWidth = std::max(m_minPreferredLogicalWidth, m_maxPreferredLogicalWidth);
+    }
+
+    LayoutUnit scrollbarWidth = 0;
+    if (hasOverflowClip()) {
+        if (isHorizontalWritingMode() && styleToUse->overflowY() == OSCROLL) {
+            layer()->setHasVerticalScrollbar(true);
+            scrollbarWidth = verticalScrollbarWidth();
+        } else if (!isHorizontalWritingMode() && styleToUse->overflowX() == OSCROLL) {
+            layer()->setHasHorizontalScrollbar(true);
+            scrollbarWidth = horizontalScrollbarHeight();
+        }
+    }
+
+    m_maxPreferredLogicalWidth += scrollbarWidth;
+    m_minPreferredLogicalWidth += scrollbarWidth;
+
+    if (styleToUse->logicalMinWidth().isFixed() && styleToUse->logicalMinWidth().value() > 0) {
+        m_maxPreferredLogicalWidth = std::max(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMinWidth().value()));
+        m_minPreferredLogicalWidth = std::max(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMinWidth().value()));
+    }
+
+    if (styleToUse->logicalMaxWidth().isFixed()) {
+        m_maxPreferredLogicalWidth = std::min(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMaxWidth().value()));
+        m_minPreferredLogicalWidth = std::min(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMaxWidth().value()));
+    }
+
+    LayoutUnit borderAndPadding = borderAndPaddingLogicalWidth();
+    m_minPreferredLogicalWidth += borderAndPadding;
+    m_maxPreferredLogicalWidth += borderAndPadding;
+
+    setPreferredLogicalWidthsDirty(false);
+}
+
 void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int, BlockLayoutPass)
 {
     ASSERT(needsLayout());
@@ -465,26 +501,25 @@ LayoutUnit RenderFlexibleBox::preferredMainAxisContentExtentForChild(RenderBox*
 
 void RenderFlexibleBox::layoutFlexItems(bool relayoutChildren)
 {
+    FlexOrderHashSet flexOrderValues;
+    computeMainAxisPreferredSizes(relayoutChildren, flexOrderValues);
+
+    OrderedFlexItemList orderedChildren;
+    LayoutUnit preferredMainAxisExtent;
     float totalPositiveFlexibility;
     float totalNegativeFlexibility;
-    TreeOrderIterator treeIterator(this);
+    FlexOrderIterator flexIterator(this, flexOrderValues);
+    computeFlexOrder(flexIterator, orderedChildren, preferredMainAxisExtent, totalPositiveFlexibility, totalNegativeFlexibility);
 
-    WTF::Vector<LayoutUnit> preferredSizes;
-    computeMainAxisPreferredSizes(relayoutChildren, treeIterator, preferredSizes, totalPositiveFlexibility, totalNegativeFlexibility);
-    LayoutUnit preferredMainAxisExtent = 0;
-    for (size_t i = 0; i < preferredSizes.size(); ++i)
-        preferredMainAxisExtent += preferredSizes[i];
     LayoutUnit availableFreeSpace = mainAxisContentExtent() - preferredMainAxisExtent;
-
-    FlexOrderIterator flexIterator(this, treeIterator.flexOrderValues());
     InflexibleFlexItemSize inflexibleItems;
     WTF::Vector<LayoutUnit> childSizes;
-    while (!runFreeSpaceAllocationAlgorithm(flexIterator, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
+    while (!runFreeSpaceAllocationAlgorithm(orderedChildren, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
         ASSERT(totalPositiveFlexibility >= 0 && totalNegativeFlexibility >= 0);
         ASSERT(inflexibleItems.size() > 0);
     }
 
-    layoutAndPlaceChildren(flexIterator, childSizes, availableFreeSpace, totalPositiveFlexibility);
+    layoutAndPlaceChildren(orderedChildren, childSizes, availableFreeSpace);
 }
 
 float RenderFlexibleBox::positiveFlexForChild(RenderBox* child) const
@@ -512,16 +547,14 @@ LayoutUnit RenderFlexibleBox::marginBoxAscent(RenderBox* child)
     return ascent + flowAwareMarginBeforeForChild(child);
 }
 
-void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, TreeOrderIterator& iterator, WTF::Vector<LayoutUnit>& preferredSizes, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
+void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, FlexOrderHashSet& flexOrderValues)
 {
-    totalPositiveFlexibility = totalNegativeFlexibility = 0;
-
     LayoutUnit flexboxAvailableContentExtent = mainAxisContentExtent();
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-        if (child->isPositioned()) {
-            preferredSizes.append(0);
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        flexOrderValues.add(child->style()->flexOrder());
+
+        if (child->isPositioned())
             continue;
-        }
 
         child->clearOverrideSize();
         if (mainAxisLengthForChild(child).isAuto()) {
@@ -530,35 +563,51 @@ void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, Tre
             child->layoutIfNeeded();
         }
 
-        LayoutUnit preferredSize = mainAxisBorderAndPaddingExtentForChild(child) + preferredMainAxisContentExtentForChild(child);
-
         // We set the margins because we want to make sure 'auto' has a margin
         // of 0 and because if we're not auto sizing, we don't do a layout that
         // computes the start/end margins.
         if (isHorizontalFlow()) {
             child->setMarginLeft(child->style()->marginLeft().calcMinValue(flexboxAvailableContentExtent));
             child->setMarginRight(child->style()->marginRight().calcMinValue(flexboxAvailableContentExtent));
-            preferredSize += child->marginLeft() + child->marginRight();
         } else {
             child->setMarginTop(child->style()->marginTop().calcMinValue(flexboxAvailableContentExtent));
             child->setMarginBottom(child->style()->marginBottom().calcMinValue(flexboxAvailableContentExtent));
-            preferredSize += child->marginTop() + child->marginBottom();
         }
+    }
+}
+
+void RenderFlexibleBox::computeFlexOrder(FlexOrderIterator& iterator, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
+{
+    orderedChildren.clear();
+    preferredMainAxisExtent = 0;
+    totalPositiveFlexibility = totalNegativeFlexibility = 0;
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        orderedChildren.append(child);
+        if (child->isPositioned())
+            continue;
 
-        preferredSizes.append(preferredSize);
+        LayoutUnit childMainAxisExtent = mainAxisBorderAndPaddingExtentForChild(child) + preferredMainAxisContentExtentForChild(child);
+        if (isHorizontalFlow())
+            childMainAxisExtent += child->marginLeft() + child->marginRight();
+        else
+            childMainAxisExtent += child->marginTop() + child->marginBottom();
 
+        // FIXME: When implementing multiline, we would return here if adding
+        // the child's main axis extent would cause us to overflow.
+        preferredMainAxisExtent += childMainAxisExtent;
         totalPositiveFlexibility += positiveFlexForChild(child);
         totalNegativeFlexibility += negativeFlexForChild(child);
     }
 }
 
 // Returns true if we successfully ran the algorithm and sized the flex items.
-bool RenderFlexibleBox::runFreeSpaceAllocationAlgorithm(FlexOrderIterator& iterator, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize& inflexibleItems, WTF::Vector<LayoutUnit>& childSizes)
+bool RenderFlexibleBox::runFreeSpaceAllocationAlgorithm(const OrderedFlexItemList& children, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize& inflexibleItems, WTF::Vector<LayoutUnit>& childSizes)
 {
     childSizes.clear();
 
     LayoutUnit flexboxAvailableContentExtent = mainAxisContentExtent();
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         if (child->isPositioned()) {
             childSizes.append(0);
             continue;
@@ -600,27 +649,25 @@ bool RenderFlexibleBox::runFreeSpaceAllocationAlgorithm(FlexOrderIterator& itera
     return true;
 }
 
-static bool hasPackingSpace(LayoutUnit availableFreeSpace, float totalPositiveFlexibility)
-{
-    return availableFreeSpace > 0 && !totalPositiveFlexibility;
-}
-
-static LayoutUnit initialPackingOffset(LayoutUnit availableFreeSpace, float totalPositiveFlexibility, EFlexPack flexPack, size_t numberOfChildren)
+static LayoutUnit initialPackingOffset(LayoutUnit availableFreeSpace, EFlexPack flexPack, size_t numberOfChildren)
 {
-    if (hasPackingSpace(availableFreeSpace, totalPositiveFlexibility)) {
+    if (availableFreeSpace > 0) {
         if (flexPack == PackEnd)
             return availableFreeSpace;
         if (flexPack == PackCenter)
             return availableFreeSpace / 2;
         if (flexPack == PackDistribute && numberOfChildren)
             return availableFreeSpace / (2 * numberOfChildren);
+    } else if (availableFreeSpace < 0) {
+        if (flexPack == PackCenter || flexPack == PackDistribute)
+            return availableFreeSpace / 2;
     }
     return 0;
 }
 
-static LayoutUnit packingSpaceBetweenChildren(LayoutUnit availableFreeSpace, float totalPositiveFlexibility, EFlexPack flexPack, size_t numberOfChildren)
+static LayoutUnit packingSpaceBetweenChildren(LayoutUnit availableFreeSpace, EFlexPack flexPack, size_t numberOfChildren)
 {
-    if (hasPackingSpace(availableFreeSpace, totalPositiveFlexibility) && numberOfChildren > 1) {
+    if (availableFreeSpace > 0 && numberOfChildren > 1) {
         if (flexPack == PackJustify)
             return availableFreeSpace / (numberOfChildren - 1);
         if (flexPack == PackDistribute)
@@ -664,10 +711,10 @@ static EFlexAlign flexAlignForChild(RenderBox* child)
     return align;
 }
 
-void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility)
+void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
 {
     LayoutUnit mainAxisOffset = flowAwareBorderStart() + flowAwarePaddingStart();
-    mainAxisOffset += initialPackingOffset(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+    mainAxisOffset += initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     if (style()->flexDirection() == FlowRowReverse)
         mainAxisOffset += isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
@@ -675,11 +722,11 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
     LayoutUnit totalMainExtent = mainAxisExtent();
     LayoutUnit maxAscent = 0, maxDescent = 0; // Used when flex-align: baseline.
     bool shouldFlipMainAxis = !isColumnFlow() && !isLeftToRightFlow();
-    size_t i = 0;
-    for (RenderBox* child = iterator.first(); child; child = iterator.next(), ++i) {
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         if (child->isPositioned()) {
             prepareChildForPositionedLayout(child, mainAxisOffset, crossAxisOffset);
-            mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+            mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
             continue;
         }
         LayoutUnit childPreferredSize = childSizes[i] + mainAxisBorderAndPaddingExtentForChild(child);
@@ -687,6 +734,7 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
         child->setChildNeedsLayout(true);
         child->layoutIfNeeded();
 
+        LayoutUnit childCrossAxisExtent;
         if (flexAlignForChild(child) == AlignBaseline) {
             LayoutUnit ascent = marginBoxAscent(child);
             LayoutUnit descent = (crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child)) - ascent;
@@ -694,10 +742,11 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
             maxAscent = std::max(maxAscent, ascent);
             maxDescent = std::max(maxDescent, descent);
 
-            if (crossAxisLength().isAuto())
-                setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + maxAscent + maxDescent + crossAxisScrollbarExtent()));
-        } else if (crossAxisLength().isAuto())
-            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child) + crossAxisScrollbarExtent()));
+            childCrossAxisExtent = maxAscent + maxDescent;
+        } else
+            childCrossAxisExtent =  crossAxisExtentForChild(child);
+        if (crossAxisLength().isAuto())
+            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + childCrossAxisExtent + crossAxisScrollbarExtent()));
 
         mainAxisOffset += flowAwareMarginStartForChild(child);
 
@@ -709,7 +758,7 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
         setFlowAwareLocationForChild(child, childLocation);
         mainAxisOffset += childMainExtent + flowAwareMarginEndForChild(child);
 
-        mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+        mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
 
         if (isColumnFlow())
             setLogicalHeight(mainAxisOffset + flowAwareBorderEnd() + flowAwarePaddingEnd() + scrollbarLogicalHeight());
@@ -719,27 +768,27 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
         // We have to do an extra pass for column-reverse to reposition the flex items since the start depends
         // on the height of the flexbox, which we only know after we've positioned all the flex items.
         computeLogicalHeight();
-        layoutColumnReverse(iterator, childSizes, availableFreeSpace, totalPositiveFlexibility);
+        layoutColumnReverse(children, childSizes, availableFreeSpace);
     }
 
-    alignChildren(iterator, maxAscent);
+    alignChildren(children, maxAscent);
 }
 
-void RenderFlexibleBox::layoutColumnReverse(FlexOrderIterator& iterator, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility)
+void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
 {
     // This is similar to the logic in layoutAndPlaceChildren, except we place the children
     // starting from the end of the flexbox. We also don't need to layout anything since we're
     // just moving the children to a new position.
     LayoutUnit mainAxisOffset = logicalHeight() - flowAwareBorderEnd() - flowAwarePaddingEnd();
-    mainAxisOffset -= initialPackingOffset(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+    mainAxisOffset -= initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     mainAxisOffset -= isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
     LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
-    size_t i = 0;
-    for (RenderBox* child = iterator.first(); child; child = iterator.next(), ++i) {
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         if (child->isPositioned()) {
             child->layer()->setStaticBlockPosition(mainAxisOffset);
-            mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+            mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
             continue;
         }
         mainAxisOffset -= mainAxisExtentForChild(child) + flowAwareMarginEndForChild(child);
@@ -750,7 +799,7 @@ void RenderFlexibleBox::layoutColumnReverse(FlexOrderIterator& iterator, const W
             child->repaintDuringLayoutIfMoved(oldRect);
 
         mainAxisOffset -= flowAwareMarginStartForChild(child);
-        mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+        mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
     }
 }
 
@@ -767,19 +816,12 @@ void RenderFlexibleBox::adjustAlignmentForChild(RenderBox* child, LayoutUnit del
         child->repaintDuringLayoutIfMoved(oldRect);
 }
 
-void RenderFlexibleBox::alignChildren(FlexOrderIterator& iterator, LayoutUnit maxAscent)
+void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, LayoutUnit maxAscent)
 {
     LayoutUnit crossExtent = crossAxisExtent();
 
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-        // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
-        if (!style()->isLeftToRightDirection() && isColumnFlow()) {
-            LayoutPoint location = flowAwareLocationForChild(child);
-            location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
-            setFlowAwareLocationForChild(child, location);
-        }
-
-        // FIXME: Make sure this does the right thing with column flows.
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         switch (flexAlignForChild(child)) {
         case AlignAuto:
             ASSERT_NOT_REACHED();
@@ -814,6 +856,14 @@ void RenderFlexibleBox::alignChildren(FlexOrderIterator& iterator, LayoutUnit ma
             break;
         }
         }
+
+        // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
+        if (!style()->isLeftToRightDirection() && isColumnFlow()) {
+            LayoutPoint location = flowAwareLocationForChild(child);
+            location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
+            setFlowAwareLocationForChild(child, location);
+        }
+
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.h b/Source/WebCore/rendering/RenderFlexibleBox.h
index 0833217b6..0ee715f7e 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderFlexibleBox.h
@@ -43,15 +43,18 @@ public:
     virtual const char* renderName() const;
 
     virtual bool isFlexibleBox() const { return true; }
-
+    virtual void computePreferredLogicalWidths();
     virtual void layoutBlock(bool relayoutChildren, int pageLogicalHeight = 0, BlockLayoutPass = NormalLayoutPass);
 
     bool isHorizontalFlow() const;
 
 private:
-    class TreeOrderIterator;
+    struct FlexOrderHashTraits;
+    typedef HashSet<int, DefaultHash<int>::Hash, FlexOrderHashTraits> FlexOrderHashSet;
+
     class FlexOrderIterator;
     typedef WTF::HashMap<const RenderBox*, LayoutUnit> InflexibleFlexItemSize;
+    typedef WTF::Vector<RenderBox*> OrderedFlexItemList;
 
     bool hasOrthogonalFlow(RenderBox* child) const;
     bool isColumnFlow() const;
@@ -95,13 +98,14 @@ private:
     LayoutUnit availableAlignmentSpaceForChild(RenderBox*);
     LayoutUnit marginBoxAscent(RenderBox*);
 
-    void computeMainAxisPreferredSizes(bool relayoutChildren, TreeOrderIterator&, WTF::Vector<LayoutUnit>&, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
-    bool runFreeSpaceAllocationAlgorithm(FlexOrderIterator&, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize&, WTF::Vector<LayoutUnit>& childSizes);
+    void computeMainAxisPreferredSizes(bool relayoutChildren, FlexOrderHashSet&);
+    void computeFlexOrder(FlexOrderIterator&, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
+    bool runFreeSpaceAllocationAlgorithm(const OrderedFlexItemList&, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize&, WTF::Vector<LayoutUnit>& childSizes);
     void setLogicalOverrideSize(RenderBox* child, LayoutUnit childPreferredSize);
     void prepareChildForPositionedLayout(RenderBox* child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset);
-    void layoutAndPlaceChildren(FlexOrderIterator&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility);
-    void layoutColumnReverse(FlexOrderIterator&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility);
-    void alignChildren(FlexOrderIterator&, LayoutUnit maxAscent);
+    void layoutAndPlaceChildren(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
+    void layoutColumnReverse(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
+    void alignChildren(const OrderedFlexItemList&, LayoutUnit maxAscent);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index 9e39d9607..9e47d4dc9 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -51,7 +51,9 @@ RenderFlowThread::RenderFlowThread(Node* node, const AtomicString& flowThread)
     , m_regionsInvalidated(false)
     , m_regionsHaveUniformLogicalWidth(true)
     , m_regionsHaveUniformLogicalHeight(true)
+    , m_overflow(false)
 {
+    ASSERT(node->document()->cssRegionsEnabled());
     setIsAnonymous(false);
     setInRenderFlowThread();
 }
@@ -137,6 +139,15 @@ void RenderFlowThread::removeFlowChild(RenderObject* child)
     m_flowThreadChildList.remove(child);
 }
 
+void RenderFlowThread::removeFlowChildInfo(RenderObject* child)
+{
+    if (child->isBox()) {
+        removeRenderBoxRegionInfo(toRenderBox(child));
+        if (child->canHaveRegionStyle())
+            clearRenderBoxCustomStyle(toRenderBox(child));
+    }
+}
+
 // Compare two regions to determine in which one the content should flow first.
 // The function returns true if the first passed region is "less" than the second passed region.
 // If the first region appears before second region in DOM,
@@ -373,10 +384,10 @@ void RenderFlowThread::layout()
                     continue;
                 LayoutRect regionRect;
                 if (isHorizontalWritingMode()) {
-                    regionRect = LayoutRect(style()->direction() == LTR ? 0 : logicalWidth() - region->contentWidth(), logicalHeight, region->contentWidth(), region->contentHeight());
+                    regionRect = LayoutRect(style()->direction() == LTR ? zeroLayoutUnit : logicalWidth() - region->contentWidth(), logicalHeight, region->contentWidth(), region->contentHeight());
                     logicalHeight += regionRect.height();
                 } else {
-                    regionRect = LayoutRect(logicalHeight, style()->direction() == LTR ? 0 : logicalWidth() - region->contentHeight(), region->contentWidth(), region->contentHeight());
+                    regionRect = LayoutRect(logicalHeight, style()->direction() == LTR ? zeroLayoutUnit : logicalWidth() - region->contentHeight(), region->contentWidth(), region->contentHeight());
                     logicalHeight += regionRect.width();
                 }
                 region->setRegionRect(regionRect);
@@ -410,7 +421,7 @@ void RenderFlowThread::computeLogicalWidth()
         
         LayoutUnit regionLogicalWidth = isHorizontalWritingMode() ? region->contentWidth() : region->contentHeight();
         if (regionLogicalWidth != logicalWidth) {
-            LayoutUnit logicalLeft = style()->direction() == LTR ? 0 : logicalWidth - regionLogicalWidth;
+            LayoutUnit logicalLeft = style()->direction() == LTR ? zeroLayoutUnit : logicalWidth - regionLogicalWidth;
             region->setRenderBoxRegionInfo(this, logicalLeft, regionLogicalWidth, false);
         }
     }
@@ -445,7 +456,7 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
     LayoutRect regionClippingRect(paintOffset + (regionOverflowRect.location() - regionRect.location()), regionOverflowRect.size());
 
     PaintInfo info(paintInfo);
-    info.rect.intersect(regionClippingRect);
+    info.rect.intersect(pixelSnappedIntRect(regionClippingRect));
 
     if (!info.rect.isEmpty()) {
         context->save();
@@ -464,7 +475,7 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
             renderFlowThreadOffset = LayoutPoint(paintOffset - regionRect.location());
 
         context->translate(renderFlowThreadOffset.x(), renderFlowThreadOffset.y());
-        info.rect.moveBy(-renderFlowThreadOffset);
+        info.rect.moveBy(-roundedIntPoint(renderFlowThreadOffset));
         
         layer()->paint(context, info.rect, 0, 0, region, RenderLayer::PaintLayerTemporaryClipRects);
 
@@ -491,7 +502,7 @@ bool RenderFlowThread::hitTestRegion(RenderRegion* region, const HitTestRequest&
     LayoutPoint transformedPoint(pointInContainer.x() - renderFlowThreadOffset.x(), pointInContainer.y() - renderFlowThreadOffset.y());
     
     // Always ignore clipping, since the RenderFlowThread has nothing to do with the bounds of the FrameView.
-    HitTestRequest newRequest(request.type() & HitTestRequest::IgnoreClipping);
+    HitTestRequest newRequest(request.type() | HitTestRequest::IgnoreClipping);
 
     RenderRegion* oldRegion = result.region();
     result.setRegion(region);
@@ -531,14 +542,14 @@ void RenderFlowThread::repaintRectangleInRegions(const LayoutRect& repaintRect,
         flipForWritingMode(flippedRegionRect); // Put the region rects into physical coordinates.
         flipForWritingMode(flippedRegionOverflowRect);
 
-        LayoutRect clippedRect(flippedRegionOverflowRect);
-        clippedRect.intersect(repaintRect);
+        LayoutRect clippedRect(repaintRect);
+        clippedRect.intersect(flippedRegionOverflowRect);
         if (clippedRect.isEmpty())
             continue;
-        
+
         // Put the region rect into the region's physical coordinate space.
-        clippedRect.setLocation(region->contentBoxRect().location() + (repaintRect.location() - flippedRegionRect.location()));
-        
+        clippedRect.setLocation(region->contentBoxRect().location() + (clippedRect.location() - flippedRegionRect.location()));
+
         // Now switch to the region's writing mode coordinate space and let it repaint itself.
         region->flipForWritingMode(clippedRect);
         LayoutStateDisabler layoutStateDisabler(view()); // We can't use layout state to repaint, since the region is somewhere else.
@@ -806,6 +817,9 @@ void RenderFlowThread::clearRenderBoxCustomStyle(const RenderBox* box,
 
 void RenderFlowThread::setRegionRangeForBox(const RenderBox* box, LayoutUnit offsetFromLogicalTopOfFirstPage)
 {
+    if (!hasRegions())
+        return;
+
     // FIXME: Not right for differing writing-modes.
     RenderRegion* startRegion = renderRegionForLine(offsetFromLogicalTopOfFirstPage, true);
     RenderRegion* endRegion = renderRegionForLine(offsetFromLogicalTopOfFirstPage + box->logicalHeight(), true);
@@ -855,9 +869,40 @@ void RenderFlowThread::getRegionRangeForBox(const RenderBox* box, RenderRegion*&
 WebKitNamedFlow* RenderFlowThread::ensureNamedFlow()
 {
     if (!m_namedFlow)
-        m_namedFlow = WebKitNamedFlow::create();
+        m_namedFlow = WebKitNamedFlow::create(this);
 
     return m_namedFlow.get();
 }
 
+void RenderFlowThread::computeOverflowStateForRegions(LayoutUnit oldClientAfterEdge)
+{
+    LayoutUnit height = oldClientAfterEdge;
+    // FIXME: the visual overflow of middle region (if it is the last one to contain any content in a render flow thread)
+    // might not be taken into account because the render flow thread height is greater that that regions height + its visual overflow
+    // because of how computeLogicalHeight is implemented for RenderFlowThread (as a sum of all regions height).
+    // This means that the middle region will be marked as fit (even if it has visual overflow flowing into the next region)
+    if (hasRenderOverflow())
+        height = isHorizontalWritingMode() ? visualOverflowRect().maxY() : visualOverflowRect().maxX();
+
+    for (RenderRegionList::iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
+        RenderRegion* region = *iter;
+        if (!region->isValid()) {
+            region->setRegionState(RenderRegion::RegionUndefined);
+            continue;
+        }
+        LayoutUnit flowMin = height - (isHorizontalWritingMode() ? region->regionRect().y() : region->regionRect().x());
+        LayoutUnit flowMax = height - (isHorizontalWritingMode() ? region->regionRect().maxY() : region->regionRect().maxX());
+        RenderRegion::RegionState state = RenderRegion::RegionFit;
+        if (flowMin <= 0)
+            state = RenderRegion::RegionEmpty;
+        if (flowMax > 0)
+            state = RenderRegion::RegionOverflow;
+        region->setRegionState(state);
+    }
+
+    // With the regions overflow state computed we can also set the overflow for the named flow.
+    RenderRegion* lastReg = lastRegion();
+    m_overflow = lastReg && (lastReg->regionState() == RenderRegion::RegionOverflow);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderFlowThread.h b/Source/WebCore/rendering/RenderFlowThread.h
index 4b1b36663..d05938891 100644
--- a/Source/WebCore/rendering/RenderFlowThread.h
+++ b/Source/WebCore/rendering/RenderFlowThread.h
@@ -74,7 +74,12 @@ public:
     
     void addFlowChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     void removeFlowChild(RenderObject*);
+    void removeFlowChildInfo(RenderObject*);
     bool hasChildren() const { return !m_flowThreadChildList.isEmpty(); }
+#ifndef NDEBUG
+    bool hasChild(RenderObject* child) const { return m_flowThreadChildList.contains(child); }
+    bool hasChildInfo(RenderObject* child) const { return child && child->isBox() && m_regionRangeMap.contains(toRenderBox(child)); }
+#endif
 
     void addRegionToThread(RenderRegion*);
     void removeRegionFromThread(RenderRegion*);
@@ -128,7 +133,9 @@ public:
                                       const RenderRegion* oldStartRegion = 0, const RenderRegion* oldEndRegion = 0,
                                       const RenderRegion* newStartRegion = 0, const RenderRegion* newEndRegion = 0);
     WebKitNamedFlow* ensureNamedFlow();
+    void computeOverflowStateForRegions(LayoutUnit oldClientAfterEdge);
 
+    bool overflow() const { return m_overflow; }
 private:
     virtual const char* renderName() const { return "RenderFlowThread"; }
 
@@ -189,6 +196,7 @@ private:
     bool m_regionsInvalidated;
     bool m_regionsHaveUniformLogicalWidth;
     bool m_regionsHaveUniformLogicalHeight;
+    bool m_overflow;
     RefPtr<WebKitNamedFlow> m_namedFlow;
 };
 
diff --git a/Source/WebCore/rendering/RenderFrameSet.cpp b/Source/WebCore/rendering/RenderFrameSet.cpp
index fc2c97f17..bcce93ef8 100644
--- a/Source/WebCore/rendering/RenderFrameSet.cpp
+++ b/Source/WebCore/rendering/RenderFrameSet.cpp
@@ -80,7 +80,7 @@ static Color borderFillColor()
     return Color(208, 208, 208);
 }
 
-void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const LayoutRect& borderRect)
+void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const IntRect& borderRect)
 {
     if (!paintInfo.rect.intersects(borderRect))
         return;
@@ -100,7 +100,7 @@ void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const LayoutR
     }
 }
 
-void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const LayoutRect& borderRect)
+void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const IntRect& borderRect)
 {
     if (!paintInfo.rect.intersects(borderRect))
         return;
@@ -142,7 +142,7 @@ void RenderFrameSet::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
             child->paint(paintInfo, adjustedPaintOffset);
             xPos += m_cols.m_sizes[c];
             if (borderThickness && m_cols.m_allowBorder[c + 1]) {
-                paintColumnBorder(paintInfo, LayoutRect(adjustedPaintOffset.x() + xPos, adjustedPaintOffset.y() + yPos, borderThickness, height()));
+                paintColumnBorder(paintInfo, pixelSnappedIntRect(LayoutRect(adjustedPaintOffset.x() + xPos, adjustedPaintOffset.y() + yPos, borderThickness, height())));
                 xPos += borderThickness;
             }
             child = child->nextSibling();
@@ -151,7 +151,7 @@ void RenderFrameSet::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
         }
         yPos += m_rows.m_sizes[r];
         if (borderThickness && m_rows.m_allowBorder[r + 1]) {
-            paintRowBorder(paintInfo, LayoutRect(adjustedPaintOffset.x(), adjustedPaintOffset.y() + yPos, width(), borderThickness));
+            paintRowBorder(paintInfo, pixelSnappedIntRect(LayoutRect(adjustedPaintOffset.x(), adjustedPaintOffset.y() + yPos, width(), borderThickness)));
             yPos += borderThickness;
         }
     }
@@ -571,7 +571,7 @@ void RenderFrameSet::positionFramesWithFlattening()
         int height = m_rows.m_sizes[r];
 
         for (int c = 0; c < cols; c++) {
-            IntRect oldFrameRect = child->frameRect();
+            IntRect oldFrameRect = pixelSnappedIntRect(child->frameRect());
 
             int width = m_cols.m_sizes[c];
 
@@ -619,7 +619,7 @@ void RenderFrameSet::positionFramesWithFlattening()
         xPos = 0;
         for (int c = 0; c < cols; c++) {
             // ensure the rows and columns are filled
-            IntRect oldRect = child->frameRect();
+            IntRect oldRect = pixelSnappedIntRect(child->frameRect());
 
             child->setLocation(IntPoint(xPos, yPos));
             child->setHeight(m_rows.m_sizes[r]);
@@ -802,11 +802,12 @@ bool RenderFrameSet::isChildAllowed(RenderObject* child, RenderStyle*) const
 
 CursorDirective RenderFrameSet::getCursor(const LayoutPoint& point, Cursor& cursor) const
 {
-    if (canResizeRow(point)) {
+    IntPoint roundedPoint = roundedIntPoint(point);
+    if (canResizeRow(roundedPoint)) {
         cursor = rowResizeCursor();
         return SetCursor;
     }
-    if (canResizeColumn(point)) {
+    if (canResizeColumn(roundedPoint)) {
         cursor = columnResizeCursor();
         return SetCursor;
     }
diff --git a/Source/WebCore/rendering/RenderFrameSet.h b/Source/WebCore/rendering/RenderFrameSet.h
index 373d0d02c..97be97428 100644
--- a/Source/WebCore/rendering/RenderFrameSet.h
+++ b/Source/WebCore/rendering/RenderFrameSet.h
@@ -68,8 +68,8 @@ public:
     bool isResizingRow() const;
     bool isResizingColumn() const;
 
-    bool canResizeRow(const LayoutPoint&) const;
-    bool canResizeColumn(const LayoutPoint&) const;
+    bool canResizeRow(const IntPoint&) const;
+    bool canResizeColumn(const IntPoint&) const;
 
     void notifyFrameEdgeInfoChanged();
 
@@ -119,8 +119,8 @@ private:
     void startResizing(GridAxis&, int position);
     void continueResizing(GridAxis&, int position);
 
-    void paintRowBorder(const PaintInfo&, const LayoutRect&);
-    void paintColumnBorder(const PaintInfo&, const LayoutRect&);
+    void paintRowBorder(const PaintInfo&, const IntRect&);
+    void paintColumnBorder(const PaintInfo&, const IntRect&);
 
     RenderObjectChildList m_children;
 
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 9a0e576ad..de3e7e190 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -273,7 +273,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
             context->setStrokeStyle(SolidStroke);
             context->setStrokeColor(Color::lightGray, style()->colorSpace());
             context->setFillColor(Color::transparent, style()->colorSpace());
-            context->drawRect(LayoutRect(paintOffset.x() + leftBorder + leftPad, paintOffset.y() + topBorder + topPad, cWidth, cHeight));
+            context->drawRect(pixelSnappedIntRect(LayoutRect(paintOffset.x() + leftBorder + leftPad, paintOffset.y() + topBorder + topPad, cWidth, cHeight)));
 
             bool errorPictureDrawn = false;
             LayoutSize imageOffset;
@@ -299,7 +299,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
                 if (centerY < 0)
                     centerY = 0;
                 imageOffset = LayoutSize(leftBorder + leftPad + centerX + 1, topBorder + topPad + centerY + 1);
-                context->drawImage(image.get(), style()->colorSpace(), IntRect(paintOffset + imageOffset, imageSize));
+                context->drawImage(image.get(), style()->colorSpace(), IntRect(roundedIntPoint(paintOffset + imageOffset), imageSize));
                 errorPictureDrawn = true;
             }
 
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index a4d95c003..3be57ae0a 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -126,6 +126,33 @@ void RenderInline::updateBoxModelInfoFromStyle()
     setHasReflection(false);    
 }
 
+static bool hasRelPositionedInlineAncestor(RenderObject* p)
+{
+    while (p && p->isRenderInline()) {
+        if (p->isRelPositioned())
+            return true;
+        p = p->parent();
+    }
+    return false;
+}
+
+static void updateStyleOfAnonymousBlockContinuations(RenderObject* block, const RenderStyle* newStyle, const RenderStyle* oldStyle)
+{
+    for (;block && block->isAnonymousBlock(); block = block->nextSibling()) {
+        if (!toRenderBlock(block)->isAnonymousBlockContinuation() || block->style()->position() == newStyle->position())
+            continue;
+        // If we are no longer relatively positioned but our descendant block(s) still have a relatively positioned ancestor then 
+        // their containing anonymous block should keep its relative positioning. 
+        RenderInline* cont = toRenderBlock(block)->inlineElementContinuation();
+        if (oldStyle->position() == RelativePosition && hasRelPositionedInlineAncestor(cont))
+            continue;
+        RefPtr<RenderStyle> blockStyle = RenderStyle::createAnonymousStyle(block->style());
+        blockStyle->setPosition(newStyle->position());
+        blockStyle->setDisplay(BLOCK);
+        block->setStyle(blockStyle);
+    }
+}
+
 void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBoxModelObject::styleDidChange(diff, oldStyle);
@@ -137,13 +164,24 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     // and after the block share the same style, but the block doesn't
     // need to pass its style on to anyone else.
     RenderStyle* newStyle = style();
-    for (RenderInline* currCont = inlineElementContinuation(); currCont; currCont = currCont->inlineElementContinuation()) {
+    RenderInline* continuation = inlineElementContinuation();
+    for (RenderInline* currCont = continuation; currCont; currCont = currCont->inlineElementContinuation()) {
         RenderBoxModelObject* nextCont = currCont->continuation();
         currCont->setContinuation(0);
         currCont->setStyle(newStyle);
         currCont->setContinuation(nextCont);
     }
 
+    // If an inline's relative positioning has changed then any descendant blocks will need to change their relative positioning accordingly.
+    // Do this by updating the position of the descendant blocks' containing anonymous blocks - there may be more than one.
+    if (continuation && oldStyle && newStyle->position() != oldStyle->position() 
+        && (newStyle->position() == RelativePosition || (oldStyle->position() == RelativePosition))) {
+        // If any descendant blocks exist then they will be in the next anonymous block and its siblings.
+        RenderObject* block = containingBlock()->nextSibling();
+        ASSERT(block && block->isAnonymousBlock());
+        updateStyleOfAnonymousBlockContinuations(block, newStyle, oldStyle);
+    }
+
     if (!m_alwaysCreateLineBoxes) {
         bool alwaysCreateLineBoxes = hasSelfPaintingLayer() || hasBoxDecorations() || newStyle->hasPadding() || newStyle->hasMargin() || hasOutline();
         if (oldStyle && alwaysCreateLineBoxes) {
@@ -245,6 +283,11 @@ void RenderInline::addChildIgnoringContinuation(RenderObject* newChild, RenderOb
         // the children after |beforeChild| and put them in a clone of this object.
         RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
         newStyle->setDisplay(BLOCK);
+        
+        // If inside an inline affected by relative positioning the block needs to be affected by it too.
+        // Giving the block a layer like this allows it to collect the x/y offsets from inline parents later.
+        if (hasRelPositionedInlineAncestor(this))
+            newStyle->setPosition(RelativePosition);
 
         RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
         newBox->setStyle(newStyle.release());
@@ -988,7 +1031,7 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
         LayoutRect repaintRect(r);
-        repaintRect.move(-cb->layer()->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
+        repaintRect.move(-cb->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
         LayoutRect boxRect(LayoutPoint(), cb->layer()->size());
         r = intersection(repaintRect, boxRect);
@@ -1089,7 +1132,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
         // o->height() is inaccurate if we're in the middle of a layout of |o|, so use the
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
-        topLeft -= containerBox->layer()->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
+        topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
         LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
@@ -1120,7 +1163,7 @@ LayoutSize RenderInline::offsetFromContainer(RenderObject* container, const Layo
     container->adjustForColumns(offset, point);
 
     if (container->hasOverflowClip())
-        offset -= toRenderBox(container)->layer()->scrolledContentOffset();
+        offset -= toRenderBox(container)->scrolledContentOffset();
 
     return offset;
 }
@@ -1403,24 +1446,24 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
                                        const Color outlineColor)
 {
     RenderStyle* styleToUse = style();
-    LayoutUnit outlineWidth = styleToUse->outlineWidth();
+    int outlineWidth = styleToUse->outlineWidth();
     EBorderStyle outlineStyle = styleToUse->outlineStyle();
 
     bool antialias = shouldAntialiasLines(graphicsContext);
 
-    LayoutUnit offset = style()->outlineOffset();
+    int offset = style()->outlineOffset();
+
+    LayoutRect box(LayoutPoint(paintOffset.x() + thisline.x() - offset, paintOffset.y() + thisline.y() - offset),
+        LayoutSize(thisline.width() + offset, thisline.height() + offset));
 
-    LayoutUnit top = paintOffset.y() + thisline.y() - offset;
-    LayoutUnit left = paintOffset.x() + thisline.x() - offset;
-    LayoutUnit bottom = paintOffset.y() + thisline.maxY() + offset;
-    LayoutUnit right = paintOffset.x() + thisline.maxX() + offset;
+    IntRect pixelSnappedBox = pixelSnappedIntRect(box);
     
     // left edge
     drawLineForBoxSide(graphicsContext,
-        left - outlineWidth,
-        top - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
-        left,
-        bottom + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
+        pixelSnappedBox.x() - outlineWidth,
+        pixelSnappedBox.y() - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
+        pixelSnappedBox.x(),
+        pixelSnappedBox.maxY() + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
         BSLeft,
         outlineColor, outlineStyle,
         (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? outlineWidth : -outlineWidth),
@@ -1429,10 +1472,10 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
     
     // right edge
     drawLineForBoxSide(graphicsContext,
-        right,
-        top - (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? outlineWidth : 0),
-        right + outlineWidth,
-        bottom + (nextline.isEmpty() || nextline.maxX() <= thisline.maxX() || (thisline.maxX() - 1) <= nextline.x() ? outlineWidth : 0),
+        pixelSnappedBox.maxX(),
+        pixelSnappedBox.y() - (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? outlineWidth : 0),
+        pixelSnappedBox.maxX() + outlineWidth,
+        pixelSnappedBox.maxY() + (nextline.isEmpty() || nextline.maxX() <= thisline.maxX() || (thisline.maxX() - 1) <= nextline.x() ? outlineWidth : 0),
         BSRight,
         outlineColor, outlineStyle,
         (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? outlineWidth : -outlineWidth),
@@ -1441,31 +1484,31 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
     // upper edge
     if (thisline.x() < lastline.x())
         drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            top - outlineWidth,
-            min(right + outlineWidth, (lastline.isEmpty() ? 1000000 : paintOffset.x() + lastline.x())),
-            top,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.y() - outlineWidth,
+            min(pixelSnappedBox.maxX() + outlineWidth, (lastline.isEmpty() ? 1000000 : paintOffset.x() + lastline.x())),
+            pixelSnappedBox.y(),
             BSTop, outlineColor, outlineStyle,
             outlineWidth,
-            (!lastline.isEmpty() && paintOffset.x() + lastline.x() + 1 < right + outlineWidth) ? -outlineWidth : outlineWidth,
+            (!lastline.isEmpty() && paintOffset.x() + lastline.x() + 1 < pixelSnappedBox.maxX() + outlineWidth) ? -outlineWidth : outlineWidth,
             antialias);
     
     if (lastline.maxX() < thisline.maxX())
         drawLineForBoxSide(graphicsContext,
-            max(lastline.isEmpty() ? -1000000 : paintOffset.x() + lastline.maxX(), left - outlineWidth),
-            top - outlineWidth,
-            right + outlineWidth,
-            top,
+            max(lastline.isEmpty() ? -1000000 : paintOffset.x() + lastline.maxX(), pixelSnappedBox.x() - outlineWidth),
+            pixelSnappedBox.y() - outlineWidth,
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.y(),
             BSTop, outlineColor, outlineStyle,
-            (!lastline.isEmpty() && left - outlineWidth < paintOffset.x() + lastline.maxX()) ? -outlineWidth : outlineWidth,
+            (!lastline.isEmpty() && pixelSnappedBox.x() - outlineWidth < paintOffset.x() + lastline.maxX()) ? -outlineWidth : outlineWidth,
             outlineWidth, antialias);
 
     if (thisline.x() == thisline.maxX())
           drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            top - outlineWidth,
-            right + outlineWidth,
-            top,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.y() - outlineWidth,
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.y(),
             BSTop, outlineColor, outlineStyle,
             outlineWidth,
             outlineWidth,
@@ -1474,31 +1517,31 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
     // lower edge
     if (thisline.x() < nextline.x())
         drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            bottom,
-            min(right + outlineWidth, !nextline.isEmpty() ? paintOffset.x() + nextline.x() + 1 : 1000000),
-            bottom + outlineWidth,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.maxY(),
+            min(pixelSnappedBox.maxX() + outlineWidth, !nextline.isEmpty() ? paintOffset.x() + nextline.x() + 1 : 1000000),
+            pixelSnappedBox.maxY() + outlineWidth,
             BSBottom, outlineColor, outlineStyle,
             outlineWidth,
-            (!nextline.isEmpty() && paintOffset.x() + nextline.x() + 1 < right + outlineWidth) ? -outlineWidth : outlineWidth,
+            (!nextline.isEmpty() && paintOffset.x() + nextline.x() + 1 < pixelSnappedBox.maxX() + outlineWidth) ? -outlineWidth : outlineWidth,
             antialias);
     
     if (nextline.maxX() < thisline.maxX())
         drawLineForBoxSide(graphicsContext,
-            max(!nextline.isEmpty() ? paintOffset.x() + nextline.maxX() : -1000000, left - outlineWidth),
-            bottom,
-            right + outlineWidth,
-            bottom + outlineWidth,
+            max(!nextline.isEmpty() ? paintOffset.x() + nextline.maxX() : -1000000, pixelSnappedBox.x() - outlineWidth),
+            pixelSnappedBox.maxY(),
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.maxY() + outlineWidth,
             BSBottom, outlineColor, outlineStyle,
-            (!nextline.isEmpty() && left - outlineWidth < paintOffset.x() + nextline.maxX()) ? -outlineWidth : outlineWidth,
+            (!nextline.isEmpty() && pixelSnappedBox.x() - outlineWidth < paintOffset.x() + nextline.maxX()) ? -outlineWidth : outlineWidth,
             outlineWidth, antialias);
 
     if (thisline.x() == thisline.maxX())
           drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            bottom,
-            right + outlineWidth,
-            bottom + outlineWidth,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.maxY(),
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.maxY() + outlineWidth,
             BSBottom, outlineColor, outlineStyle,
             outlineWidth,
             outlineWidth,
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index ee6e8beea..a5b028b65 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -77,6 +77,7 @@
 #include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "RenderArena.h"
+#include "RenderFlowThread.h"
 #include "RenderInline.h"
 #include "RenderMarquee.h"
 #include "RenderReplica.h"
@@ -357,7 +358,7 @@ void RenderLayer::updateLayerPositions(LayoutPoint* offsetFromRoot, UpdateLayerP
         // as canUseConvertToLayerCoords may be true for an ancestor layer.
         convertToLayerCoords(root(), offset);
     }
-    positionOverflowControls(toSize(offset));
+    positionOverflowControls(toSize(roundedIntPoint(offset)));
 
     updateVisibilityStatus();
 
@@ -375,8 +376,8 @@ void RenderLayer::updateLayerPositions(LayoutPoint* offsetFromRoot, UpdateLayerP
         ASSERT(!view->layoutStateEnabled());
 
         RenderBoxModelObject* repaintContainer = renderer()->containerForRepaint();
-        IntRect oldRepaintRect = m_repaintRect;
-        IntRect oldOutlineBox = m_outlineBox;
+        LayoutRect oldRepaintRect = m_repaintRect;
+        LayoutRect oldOutlineBox = m_outlineBox;
         computeRepaintRects(offsetFromRoot);
         // FIXME: Should ASSERT that value calculated for m_outlineBox using the cached offset is the same
         // as the value not using the cached offset, but we can't due to https://bugs.webkit.org/show_bug.cgi?id=37048
@@ -433,7 +434,7 @@ LayoutRect RenderLayer::repaintRectIncludingDescendants() const
     return repaintRect;
 }
 
-void RenderLayer::computeRepaintRects(IntPoint* offsetFromRoot)
+void RenderLayer::computeRepaintRects(LayoutPoint* offsetFromRoot)
 {
     ASSERT(!m_visibleContentStatusDirty);
 
@@ -453,8 +454,9 @@ void RenderLayer::clearRepaintRects()
 
 void RenderLayer::updateLayerPositionsAfterScroll(UpdateLayerPositionsAfterScrollFlags flags)
 {
-    ASSERT(!m_visibleDescendantStatusDirty);
-    ASSERT(!m_visibleContentStatusDirty);
+    // FIXME: This shouldn't be needed, but there are some corner cases where
+    // these flags are still dirty. Update so that the check below is valid.
+    updateVisibilityStatus();
 
     // If we have no visible content and no visible descendants, there is no point recomputing
     // our rectangles as they will be empty. If our visibility changes, we are expected to
@@ -1191,22 +1193,16 @@ void RenderLayer::removeOnlyThisLayer()
     // Dirty the clip rects.
     clearClipRectsIncludingDescendants();
 
-    // Remove us from the parent.
-    RenderLayer* parent = m_parent;
     RenderLayer* nextSib = nextSibling();
     bool hasLayerOffset;
     const LayoutPoint offsetFromRootBeforeMove = computeOffsetFromRoot(hasLayerOffset);
-    parent->removeChild(this);
-    
-    if (reflection())
-        removeChild(reflectionLayer());
 
     // Now walk our kids and reattach them to our parent.
     RenderLayer* current = m_first;
     while (current) {
         RenderLayer* next = current->nextSibling();
         removeChild(current);
-        parent->addChild(current, nextSib);
+        m_parent->addChild(current, nextSib);
         current->setRepaintStatus(NeedsFullRepaint);
         LayoutPoint offsetFromRoot = offsetFromRootBeforeMove;
         // updateLayerPositions depends on hasLayer() already being false for proper layout.
@@ -1215,6 +1211,11 @@ void RenderLayer::removeOnlyThisLayer()
         current = next;
     }
 
+    // Remove us from the parent.
+    if (reflection())
+        removeChild(reflectionLayer());
+    m_parent->removeChild(this);
+
     m_renderer->destroyLayer();
 }
 
@@ -1237,8 +1238,21 @@ void RenderLayer::insertOnlyThisLayer()
     clearClipRectsIncludingDescendants();
 }
 
-void 
-RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint& location) const
+void RenderLayer::convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntPoint& roundedLocation) const
+{
+    LayoutPoint location = roundedLocation;
+    convertToLayerCoords(ancestorLayer, location);
+    roundedLocation = roundedIntPoint(location);
+}
+
+void RenderLayer::convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntRect& roundedRect) const
+{
+    LayoutRect rect = roundedRect;
+    convertToLayerCoords(ancestorLayer, rect);
+    roundedRect = pixelSnappedIntRect(rect);
+}
+
+void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint& location) const
 {
     if (ancestorLayer == this)
         return;
@@ -1325,8 +1339,7 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint&
     location += toSize(m_topLeft);
 }
 
-void
-RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutRect& rect) const
+void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutRect& rect) const
 {
     LayoutPoint delta;
     convertToLayerCoords(ancestorLayer, delta);
@@ -1578,7 +1591,7 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
                 LayoutRect viewRect = frameView->visibleContentRect();
                 LayoutRect r = getRectToExpose(viewRect, rect, alignX, alignY);
                 
-                frameView->setScrollPosition(r.location());
+                frameView->setScrollPosition(roundedIntPoint(r.location()));
 
                 // This is the outermost view of a web page, so after scrolling this view we
                 // scroll its container by calling Page::scrollRectIntoView.
@@ -1587,7 +1600,7 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
                 // The canAutoscroll function in EventHandler also knows about this.
                 if (Frame* frame = frameView->frame()) {
                     if (Page* page = frame->page())
-                        page->chrome()->scrollRectIntoView(rect);
+                        page->chrome()->scrollRectIntoView(pixelSnappedIntRect(rect));
                 }
             }
         }
@@ -1725,29 +1738,29 @@ void RenderLayer::resize(const PlatformMouseEvent& evt, const LayoutSize& oldOff
     LayoutSize difference = (currentSize + newOffset - adjustedOldOffset).expandedTo(minimumSize) - currentSize;
 
     ASSERT(element->isStyledElement());
-    StylePropertySet* styleDeclaration = static_cast<StyledElement*>(element)->ensureInlineStyleDecl();
+    StyledElement* styledElement = static_cast<StyledElement*>(element);
     bool isBoxSizingBorder = renderer->style()->boxSizing() == BORDER_BOX;
 
     if (resize != RESIZE_VERTICAL && difference.width()) {
         if (element->isFormControlElement()) {
             // Make implicit margins from the theme explicit (see <http://bugs.webkit.org/show_bug.cgi?id=9547>).
-            styleDeclaration->setProperty(CSSPropertyMarginLeft, String::number(renderer->marginLeft() / zoomFactor) + "px", false);
-            styleDeclaration->setProperty(CSSPropertyMarginRight, String::number(renderer->marginRight() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginLeft, String::number(renderer->marginLeft() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginRight, String::number(renderer->marginRight() / zoomFactor) + "px", false);
         }
-        LayoutUnit baseWidth = renderer->width() - (isBoxSizingBorder ? 0 : renderer->borderAndPaddingWidth());
+        LayoutUnit baseWidth = renderer->width() - (isBoxSizingBorder ? zeroLayoutUnit : renderer->borderAndPaddingWidth());
         baseWidth = baseWidth / zoomFactor;
-        styleDeclaration->setProperty(CSSPropertyWidth, String::number(baseWidth + difference.width()) + "px", false);
+        styledElement->setInlineStyleProperty(CSSPropertyWidth, String::number(baseWidth + difference.width()) + "px", false);
     }
 
     if (resize != RESIZE_HORIZONTAL && difference.height()) {
         if (element->isFormControlElement()) {
             // Make implicit margins from the theme explicit (see <http://bugs.webkit.org/show_bug.cgi?id=9547>).
-            styleDeclaration->setProperty(CSSPropertyMarginTop, String::number(renderer->marginTop() / zoomFactor) + "px", false);
-            styleDeclaration->setProperty(CSSPropertyMarginBottom, String::number(renderer->marginBottom() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginTop, String::number(renderer->marginTop() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginBottom, String::number(renderer->marginBottom() / zoomFactor) + "px", false);
         }
-        LayoutUnit baseHeight = renderer->height() - (isBoxSizingBorder ? 0 : renderer->borderAndPaddingHeight());
+        LayoutUnit baseHeight = renderer->height() - (isBoxSizingBorder ? zeroLayoutUnit : renderer->borderAndPaddingHeight());
         baseHeight = baseHeight / zoomFactor;
-        styleDeclaration->setProperty(CSSPropertyHeight, String::number(baseHeight + difference.height()) + "px", false);
+        styledElement->setInlineStyleProperty(CSSPropertyHeight, String::number(baseHeight + difference.height()) + "px", false);
     }
 
     document->updateLayout();
@@ -1788,7 +1801,7 @@ IntPoint RenderLayer::minimumScrollPosition() const
 IntPoint RenderLayer::maximumScrollPosition() const
 {
     // FIXME: m_scrollSize may not be up-to-date if m_scrollDimensionsDirty is true.
-    return scrollOrigin() + m_scrollSize - visibleContentRect(true).size();
+    return scrollOrigin() + roundedIntSize(m_scrollSize) - visibleContentRect(true).size();
 }
 
 IntRect RenderLayer::visibleContentRect(bool includeScrollbars) const
@@ -1850,7 +1863,7 @@ IntRect RenderLayer::scrollCornerRect() const
     bool hasVerticalBar = verticalScrollbar();
     bool hasResizer = renderer()->style()->resize() != RESIZE_NONE;
     if ((hasHorizontalBar && hasVerticalBar) || (hasResizer && (hasHorizontalBar || hasVerticalBar)))
-        return cornerRect(this, renderBox()->borderBoxRect());
+        return cornerRect(this, pixelSnappedIntRect(renderBox()->borderBoxRect()));
     return IntRect();
 }
 
@@ -1869,7 +1882,7 @@ IntRect RenderLayer::scrollCornerAndResizerRect() const
         return IntRect();
     IntRect scrollCornerAndResizer = scrollCornerRect();
     if (scrollCornerAndResizer.isEmpty())
-        scrollCornerAndResizer = resizerCornerRect(this, box->borderBoxRect());
+        scrollCornerAndResizer = resizerCornerRect(this, pixelSnappedIntRect(box->borderBoxRect()));
     return scrollCornerAndResizer;
 }
 
@@ -2131,12 +2144,12 @@ int RenderLayer::horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevan
     return m_hBar->height();
 }
 
-LayoutSize RenderLayer::offsetFromResizeCorner(const LayoutPoint& absolutePoint) const
+IntSize RenderLayer::offsetFromResizeCorner(const IntPoint& absolutePoint) const
 {
     // Currently the resize corner is always the bottom right corner
     // FIXME: This assumes the location is 0, 0. Is this guaranteed to always be the case?
-    LayoutPoint bottomRight = toPoint(size());
-    LayoutPoint localPoint = absoluteToContents(absolutePoint);
+    IntPoint bottomRight = toPoint(size());
+    IntPoint localPoint = roundedIntPoint(absoluteToContents(absolutePoint));
     return localPoint - bottomRight;
 }
 
@@ -2145,7 +2158,7 @@ bool RenderLayer::hasOverflowControls() const
     return m_hBar || m_vBar || m_scrollCorner || renderer()->style()->resize() != RESIZE_NONE;
 }
 
-void RenderLayer::positionOverflowControls(const LayoutSize& offsetFromLayer)
+void RenderLayer::positionOverflowControls(const IntSize& offsetFromLayer)
 {
     if (!m_hBar && !m_vBar && (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE))
         return;
@@ -2154,7 +2167,7 @@ void RenderLayer::positionOverflowControls(const LayoutSize& offsetFromLayer)
     if (!box)
         return;
 
-    const IntRect borderBox = box->borderBoxRect();
+    const IntRect borderBox = pixelSnappedIntRect(box->borderBoxRect());
     const IntRect& scrollCorner = scrollCornerRect();
     IntRect absBounds(borderBox.location() + offsetFromLayer, borderBox.size());
     if (m_vBar)
@@ -2397,7 +2410,7 @@ void RenderLayer::updateScrollInfoAfterLayout()
         updateOverflowStatus(horizontalOverflow, verticalOverflow);
 }
 
-void RenderLayer::paintOverflowControls(GraphicsContext* context, const LayoutPoint& paintOffset, const LayoutRect& damageRect, bool paintingOverlayControls)
+void RenderLayer::paintOverflowControls(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect, bool paintingOverlayControls)
 {
     // Don't do anything if we have no overflow.
     if (!renderer()->hasOverflowClip())
@@ -2421,7 +2434,7 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, const LayoutPo
     if (paintingOverlayControls && !hasOverlayScrollbars())
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset;
+    IntPoint adjustedPaintOffset = paintOffset;
     if (paintingOverlayControls)
         adjustedPaintOffset = m_cachedOverlayScrollbarOffset;
 
@@ -2457,12 +2470,12 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, const LayoutPo
     paintResizer(context, adjustedPaintOffset, damageRect);
 }
 
-void RenderLayer::paintScrollCorner(GraphicsContext* context, const LayoutPoint& paintOffset, const LayoutRect& damageRect)
+void RenderLayer::paintScrollCorner(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect)
 {
     RenderBox* box = renderBox();
     ASSERT(box);
 
-    LayoutRect absRect = scrollCornerRect();
+    IntRect absRect = scrollCornerRect();
     absRect.moveBy(paintOffset);
     if (!absRect.intersects(damageRect))
         return;
@@ -2483,7 +2496,7 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, const LayoutPoint&
         context->fillRect(absRect, Color::white, box->style()->colorSpace());
 }
 
-void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, LayoutRect resizerCornerRect)
+void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, IntRect resizerCornerRect)
 {
     float deviceScaleFactor = WebCore::deviceScaleFactor(renderer()->frame());
 
@@ -2504,7 +2517,7 @@ void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, LayoutRect
     context->drawImage(resizeCornerImage.get(), renderer()->style()->colorSpace(), imageRect);
 }
 
-void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& paintOffset, const LayoutRect& damageRect)
+void RenderLayer::paintResizer(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect)
 {
     if (renderer()->style()->resize() == RESIZE_NONE)
         return;
@@ -2512,7 +2525,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& pain
     RenderBox* box = renderBox();
     ASSERT(box);
 
-    LayoutRect absRect = resizerCornerRect(this, box->borderBoxRect());
+    IntRect absRect = resizerCornerRect(this, pixelSnappedIntRect(box->borderBoxRect()));
     absRect.moveBy(paintOffset);
     if (!absRect.intersects(damageRect))
         return;
@@ -2534,8 +2547,8 @@ void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& pain
     if (!hasOverlayScrollbars() && (m_vBar || m_hBar)) {
         GraphicsContextStateSaver stateSaver(*context);
         context->clip(absRect);
-        LayoutRect largerCorner = absRect;
-        largerCorner.setSize(LayoutSize(largerCorner.width() + 1, largerCorner.height() + 1));
+        IntRect largerCorner = absRect;
+        largerCorner.setSize(IntSize(largerCorner.width() + 1, largerCorner.height() + 1));
         context->setStrokeColor(Color(makeRGB(217, 217, 217)), ColorSpaceDeviceRGB);
         context->setStrokeThickness(1.0f);
         context->setFillColor(Color::transparent, ColorSpaceDeviceRGB);
@@ -2543,7 +2556,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& pain
     }
 }
 
-bool RenderLayer::isPointInResizeControl(const LayoutPoint& absolutePoint) const
+bool RenderLayer::isPointInResizeControl(const IntPoint& absolutePoint) const
 {
     if (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE)
         return false;
@@ -2551,13 +2564,13 @@ bool RenderLayer::isPointInResizeControl(const LayoutPoint& absolutePoint) const
     RenderBox* box = renderBox();
     ASSERT(box);
 
-    LayoutPoint localPoint = absoluteToContents(absolutePoint);
+    IntPoint localPoint = roundedIntPoint(absoluteToContents(absolutePoint));
 
-    LayoutRect localBounds(0, 0, box->width(), box->height());
+    IntRect localBounds(0, 0, box->pixelSnappedWidth(), box->pixelSnappedHeight());
     return resizerCornerRect(this, localBounds).contains(localPoint);
 }
     
-bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const LayoutPoint& localPoint)
+bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const IntPoint& localPoint)
 {
     if (!m_hBar && !m_vBar && (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE))
         return false;
@@ -2567,7 +2580,7 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const LayoutPoi
     
     IntRect resizeControlRect;
     if (renderer()->style()->resize() != RESIZE_NONE) {
-        resizeControlRect = resizerCornerRect(this, box->borderBoxRect());
+        resizeControlRect = resizerCornerRect(this, pixelSnappedIntRect(box->borderBoxRect()));
         if (resizeControlRect.contains(localPoint))
             return true;
     }
@@ -2645,7 +2658,7 @@ void RenderLayer::clipToRect(RenderLayer* rootLayer, GraphicsContext* context, c
     if (clipRect.rect() == paintDirtyRect)
         return;
     context->save();
-    context->clip(clipRect.rect());
+    context->clip(pixelSnappedIntRect(clipRect.rect()));
     
     if (!clipRect.hasRadius())
         return;
@@ -2946,7 +2959,7 @@ void RenderLayer::paintLayerContents(RenderLayer* rootLayer, GraphicsContext* co
 
     if (isPaintingOverlayScrollbars) {
         clipToRect(rootLayer, context, paintDirtyRect, damageRect);
-        paintOverflowControls(context, paintOffset, damageRect.rect(), true);
+        paintOverflowControls(context, roundedIntPoint(paintOffset), pixelSnappedIntRect(damageRect.rect()), true);
         restoreClip(context, paintDirtyRect, damageRect);
     }
 
@@ -3110,9 +3123,9 @@ bool RenderLayer::hitTest(const HitTestRequest& request, HitTestResult& result)
 {
     renderer()->document()->updateLayout();
     
-    LayoutRect hitTestArea = renderer()->view()->documentRect();
+    IntRect hitTestArea = renderer()->isRenderFlowThread() ? toRenderFlowThread(renderer())->borderBoxRect() : renderer()->view()->documentRect();
     if (!request.ignoreClipping())
-        hitTestArea.intersect(frameVisibleRect(renderer()));
+        hitTestArea.intersect(pixelSnappedIntRect(frameVisibleRect(renderer())));
 
     RenderLayer* insideLayer = hitTestLayer(this, 0, request, result, hitTestArea, result.point(), false);
     if (!insideLayer) {
@@ -3747,7 +3760,7 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, RenderRegion* reg
             backgroundRect.intersect(layerBoundsWithVisualOverflow);
         } else {
             // Shift the bounds to be for our region only.
-            LayoutRect bounds = renderBox()->borderBoxRectInRegion(region);
+            LayoutRect bounds = pixelSnappedIntRect(renderBox()->borderBoxRectInRegion(region));
             bounds.moveBy(offset);
             backgroundRect.intersect(bounds);
         }
@@ -4269,7 +4282,7 @@ void RenderLayer::setBackingNeedsRepaintInRect(const LayoutRect& r)
         if (view)
             view->repaintViewRectangle(absRect);
     } else
-        backing()->setContentsNeedDisplayInRect(r);
+        backing()->setContentsNeedDisplayInRect(pixelSnappedIntRect(r));
 }
 
 // Since we're only painting non-composited layers, we know that they all share the same repaintContainer.
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index bb4797bb2..4c5be0cdc 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -295,8 +295,6 @@ public:
     // Scrolling methods for layers that can scroll their overflow.
     void scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, ScrollOffsetClamping = ScrollOffsetUnclamped);
 
-    LayoutSize scrolledContentOffset() const { return scrollOffset() + m_scrollOverflow; }
-
     int scrollXOffset() const { return m_scrollOffset.width() + scrollOrigin().x(); }
     int scrollYOffset() const { return m_scrollOffset.height() + scrollOrigin().y(); }
     IntSize scrollOffset() const { return IntSize(scrollXOffset(), scrollYOffset()); }
@@ -327,13 +325,13 @@ public:
     int horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
 
     bool hasOverflowControls() const;
-    bool isPointInResizeControl(const LayoutPoint& absolutePoint) const;
-    bool hitTestOverflowControls(HitTestResult&, const LayoutPoint& localPoint);
-    LayoutSize offsetFromResizeCorner(const LayoutPoint& absolutePoint) const;
+    bool isPointInResizeControl(const IntPoint& absolutePoint) const;
+    bool hitTestOverflowControls(HitTestResult&, const IntPoint& localPoint);
+    IntSize offsetFromResizeCorner(const IntPoint& absolutePoint) const;
 
-    void paintOverflowControls(GraphicsContext*, const LayoutPoint&, const LayoutRect& damageRect, bool paintingOverlayControls = false);
-    void paintScrollCorner(GraphicsContext*, const LayoutPoint&, const LayoutRect& damageRect);
-    void paintResizer(GraphicsContext*, const LayoutPoint&, const LayoutRect& damageRect);
+    void paintOverflowControls(GraphicsContext*, const IntPoint&, const IntRect& damageRect, bool paintingOverlayControls = false);
+    void paintScrollCorner(GraphicsContext*, const IntPoint&, const IntRect& damageRect);
+    void paintResizer(GraphicsContext*, const IntPoint&, const IntRect& damageRect);
 
     void updateScrollInfoAfterLayout();
 
@@ -425,6 +423,8 @@ public:
     RenderLayer* ancestorCompositingLayer() const { return enclosingCompositingLayer(false); }
 #endif
 
+    void convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntPoint& location) const;
+    void convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntRect&) const;
     void convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint& location) const;
     void convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutRect&) const;
 
@@ -524,6 +524,9 @@ public:
 
 #if ENABLE(CSS_FILTERS)
     virtual void filterNeedsRepaint();
+    bool hasFilter() const { return renderer()->hasFilter(); }
+#else
+    bool hasFilter() const { return false; }
 #endif
 
     // Overloaded new operator. Derived classes must override operator new
@@ -565,7 +568,7 @@ public:
 private:
     void updateZOrderListsSlowCase();
 
-    void computeRepaintRects(IntPoint* offsetFromRoot = 0);
+    void computeRepaintRects(LayoutPoint* offsetFromRoot = 0);
     void clearRepaintRects();
 
     void clipToRect(RenderLayer* rootLayer, GraphicsContext*, const LayoutRect& paintDirtyRect, const ClipRect&,
@@ -574,6 +577,9 @@ private:
 
     bool shouldRepaintAfterLayout() const;
 
+    friend IntSize RenderBox::scrolledContentOffset() const;
+    IntSize scrolledContentOffset() const { return scrollOffset() + m_scrollOverflow; }
+
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
 
@@ -710,11 +716,11 @@ private:
     // Convert a point in absolute coords into layer coords, taking transforms into account
     LayoutPoint absoluteToContents(const LayoutPoint&) const;
 
-    void positionOverflowControls(const LayoutSize&);
+    void positionOverflowControls(const IntSize&);
     void updateScrollCornerStyle();
     void updateResizerStyle();
 
-    void drawPlatformResizerImage(GraphicsContext*, LayoutRect resizerCornerRect);
+    void drawPlatformResizerImage(GraphicsContext*, IntRect resizerCornerRect);
 
     void updatePagination();
     bool isPaginated() const { return m_isPaginated; }
@@ -818,7 +824,7 @@ protected:
     LayoutSize m_scrollOverflow;
     
     // The width/height of our scrolled area.
-    IntSize m_scrollSize;
+    LayoutSize m_scrollSize;
 
     // For layers with overflow, we have a pair of scrollbars.
     RefPtr<Scrollbar> m_hBar;
@@ -840,7 +846,7 @@ protected:
     const RenderLayer* m_clipRectsRoot;   // Root layer used to compute clip rects.
 #endif
 
-    LayoutPoint m_cachedOverlayScrollbarOffset;
+    IntPoint m_cachedOverlayScrollbarOffset;
 
     RenderMarquee* m_marquee; // Used by layers with overflow:marquee
     
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 9503a8275..f559970b4 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -70,7 +70,7 @@ using namespace HTMLNames;
 static bool hasBoxDecorations(const RenderStyle*);
 static bool hasBoxDecorationsOrBackground(const RenderObject*);
 static bool hasBoxDecorationsOrBackgroundImage(const RenderStyle*);
-static LayoutRect clipBox(RenderBox* renderer);
+static IntRect clipBox(RenderBox* renderer);
 
 static inline bool isAcceleratedCanvas(RenderObject* renderer)
 {
@@ -101,7 +101,7 @@ RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
         if (page && frame && page->mainFrame() == frame) {
             m_isMainFrameRenderViewLayer = true;
 
-#if ENABLE(THREADED_SCROLLING)
+#if PLATFORM(MAC)
             // FIXME: It's a little weird that we base this decision on whether there's a scrolling coordinator or not.
             if (page->scrollingCoordinator())
                 m_usingTiledCacheLayer = true;
@@ -229,7 +229,7 @@ static bool layerOrAncestorIsFullScreen(RenderLayer* layer)
 
 void RenderLayerBacking::updateCompositedBounds()
 {
-    LayoutRect layerBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
+    IntRect layerBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
 
     // Clip to the size of the document or enclosing overflow-scroll layer.
     // If this or an ancestor is transformed, we can't currently compute the correct rect to intersect with.
@@ -254,7 +254,7 @@ void RenderLayerBacking::updateCompositedBounds()
         m_owningLayer->convertToLayerCoords(rootLayer, delta);
         clippingBounds.move(-delta.x(), -delta.y());
 
-        layerBounds.intersect(clippingBounds);
+        layerBounds.intersect(pixelSnappedIntRect(clippingBounds));
     }
     
     // If the element has a transform-origin that has fixed lengths, and the renderer has zero size,
@@ -371,7 +371,7 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     return layerConfigChanged;
 }
 
-static LayoutRect clipBox(RenderBox* renderer)
+static IntRect clipBox(RenderBox* renderer)
 {
     LayoutRect result = PaintInfo::infiniteRect();
     if (renderer->hasOverflowClip())
@@ -380,7 +380,7 @@ static LayoutRect clipBox(RenderBox* renderer)
     if (renderer->hasClip())
         result.intersect(renderer->clipRect(LayoutPoint(), 0)); // FIXME: Incorrect for CSS regions.
 
-    return result;
+    return pixelSnappedIntRect(result);
 }
 
 void RenderLayerBacking::updateGraphicsLayerGeometry()
@@ -416,24 +416,24 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     RenderLayer* compAncestor = m_owningLayer->ancestorCompositingLayer();
     
     // We compute everything relative to the enclosing compositing layer.
-    LayoutRect ancestorCompositingBounds;
+    IntRect ancestorCompositingBounds;
     if (compAncestor) {
         ASSERT(compAncestor->backing());
-        ancestorCompositingBounds = compAncestor->backing()->compositedBounds();
+        ancestorCompositingBounds = pixelSnappedIntRect(compAncestor->backing()->compositedBounds());
     }
 
-    LayoutRect localCompositingBounds = compositedBounds();
+    IntRect localCompositingBounds = pixelSnappedIntRect(compositedBounds());
 
-    LayoutRect relativeCompositingBounds(localCompositingBounds);
-    LayoutPoint delta;
-    m_owningLayer->convertToLayerCoords(compAncestor, delta);
+    IntRect relativeCompositingBounds(localCompositingBounds);
+    IntPoint delta;
+    m_owningLayer->convertToPixelSnappedLayerCoords(compAncestor, delta);
     relativeCompositingBounds.moveBy(delta);
 
-    LayoutPoint graphicsLayerParentLocation;
+    IntPoint graphicsLayerParentLocation;
     if (compAncestor && compAncestor->backing()->hasClippingLayer()) {
         // If the compositing ancestor has a layer to clip children, we parent in that, and therefore
         // position relative to it.
-        LayoutRect clippingBox = clipBox(toRenderBox(compAncestor->renderer()));
+        IntRect clippingBox = clipBox(toRenderBox(compAncestor->renderer()));
         graphicsLayerParentLocation = clippingBox.location();
     } else if (compAncestor)
         graphicsLayerParentLocation = ancestorCompositingBounds.location();
@@ -444,7 +444,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         // Call calculateRects to get the backgroundRect which is what is used to clip the contents of this
         // layer. Note that we call it with temporaryClipRects = true because normally when computing clip rects
         // for a compositing layer, rootLayer is the layer itself.
-        LayoutRect parentClipRect = m_owningLayer->backgroundClipRect(compAncestor, 0, true).rect(); // FIXME: Incorrect for CSS regions.
+        IntRect parentClipRect = pixelSnappedIntRect(m_owningLayer->backgroundClipRect(compAncestor, 0, true).rect()); // FIXME: Incorrect for CSS regions.
         ASSERT(parentClipRect != PaintInfo::infiniteRect());
         m_ancestorClippingLayer->setPosition(FloatPoint() + (parentClipRect.location() - graphicsLayerParentLocation));
         m_ancestorClippingLayer->setSize(parentClipRect.size());
@@ -457,7 +457,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     m_graphicsLayer->setPosition(FloatPoint() + (relativeCompositingBounds.location() - graphicsLayerParentLocation));
-    m_graphicsLayer->setOffsetFromRenderer(localCompositingBounds.location() - LayoutPoint());
+    m_graphicsLayer->setOffsetFromRenderer(localCompositingBounds.location() - IntPoint());
     
     FloatSize oldSize = m_graphicsLayer->size();
     FloatSize newSize = relativeCompositingBounds.size();
@@ -470,12 +470,12 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     // If we have a layer that clips children, position it.
-    LayoutRect clippingBox;
+    IntRect clippingBox;
     if (m_clippingLayer) {
         clippingBox = clipBox(toRenderBox(renderer()));
         m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
         m_clippingLayer->setSize(clippingBox.size());
-        m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - LayoutPoint());
+        m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
     }
     
     if (m_maskLayer) {
@@ -488,10 +488,10 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
     
     if (m_owningLayer->hasTransform()) {
-        const LayoutRect borderBox = toRenderBox(renderer())->borderBoxRect();
+        const IntRect borderBox = pixelSnappedIntRect(toRenderBox(renderer())->borderBoxRect());
 
         // Get layout bounds in the coords of compAncestor to match relativeCompositingBounds.
-        LayoutRect layerBounds = LayoutRect(delta, borderBox.size());
+        IntRect layerBounds = IntRect(delta, borderBox.size());
 
         // Update properties that depend on layer dimensions
         FloatPoint3D transformOrigin = computeTransformOrigin(borderBox);
@@ -524,12 +524,12 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     if (m_foregroundLayer) {
         FloatPoint foregroundPosition;
         FloatSize foregroundSize = newSize;
-        LayoutSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
+        IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
         if (m_clippingLayer) {
             // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
             // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
             foregroundSize = FloatSize(clippingBox.size());
-            foregroundOffset = clippingBox.location() - LayoutPoint();
+            foregroundOffset = clippingBox.location() - IntPoint();
         }
 
         m_foregroundLayer->setPosition(foregroundPosition);
@@ -1002,7 +1002,7 @@ void RenderLayerBacking::updateImageContents()
     image->startAnimation();
 }
 
-FloatPoint3D RenderLayerBacking::computeTransformOrigin(const LayoutRect& borderBox) const
+FloatPoint3D RenderLayerBacking::computeTransformOrigin(const IntRect& borderBox) const
 {
     RenderStyle* style = renderer()->style();
 
@@ -1014,7 +1014,7 @@ FloatPoint3D RenderLayerBacking::computeTransformOrigin(const LayoutRect& border
     return origin;
 }
 
-FloatPoint RenderLayerBacking::computePerspectiveOrigin(const LayoutRect& borderBox) const
+FloatPoint RenderLayerBacking::computePerspectiveOrigin(const IntRect& borderBox) const
 {
     RenderStyle* style = renderer()->style();
 
@@ -1029,26 +1029,26 @@ FloatPoint RenderLayerBacking::computePerspectiveOrigin(const LayoutRect& border
 }
 
 // Return the offset from the top-left of this compositing layer at which the renderer's contents are painted.
-LayoutSize RenderLayerBacking::contentOffsetInCompostingLayer() const
+IntSize RenderLayerBacking::contentOffsetInCompostingLayer() const
 {
-    return LayoutSize(-m_compositedBounds.x(), -m_compositedBounds.y());
+    return IntSize(-m_compositedBounds.x(), -m_compositedBounds.y());
 }
 
-LayoutRect RenderLayerBacking::contentsBox() const
+IntRect RenderLayerBacking::contentsBox() const
 {
     if (!renderer()->isBox())
-        return LayoutRect();
+        return IntRect();
 
-    LayoutRect contentsRect;
+    IntRect contentsRect;
 #if ENABLE(VIDEO)
     if (renderer()->isVideo()) {
         RenderVideo* videoRenderer = toRenderVideo(renderer());
         contentsRect = videoRenderer->videoBox();
     } else
 #endif
-        contentsRect = toRenderBox(renderer())->contentBoxRect();
+        contentsRect = pixelSnappedIntRect(toRenderBox(renderer())->contentBoxRect());
 
-    LayoutSize contentOffset = contentOffsetInCompostingLayer();
+    IntSize contentOffset = contentOffsetInCompostingLayer();
     contentsRect.move(contentOffset);
     return contentsRect;
 }
@@ -1077,29 +1077,29 @@ void RenderLayerBacking::setContentsNeedDisplay()
 }
 
 // r is in the coordinate space of the layer's render object
-void RenderLayerBacking::setContentsNeedDisplayInRect(const LayoutRect& r)
+void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        LayoutRect layerDirtyRect = r;
+        IntRect layerDirtyRect = r;
         layerDirtyRect.move(-m_graphicsLayer->offsetFromRenderer());
         m_graphicsLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_foregroundLayer && m_foregroundLayer->drawsContent()) {
-        LayoutRect layerDirtyRect = r;
+        IntRect layerDirtyRect = r;
         layerDirtyRect.move(-m_foregroundLayer->offsetFromRenderer());
         m_foregroundLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_maskLayer && m_maskLayer->drawsContent()) {
-        LayoutRect layerDirtyRect = r;
+        IntRect layerDirtyRect = r;
         layerDirtyRect.move(-m_maskLayer->offsetFromRenderer());
         m_maskLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 }
 
 void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext* context,
-                    const LayoutRect& paintDirtyRect, // In the coords of rootLayer.
+                    const IntRect& paintDirtyRect, // In the coords of rootLayer.
                     PaintBehavior paintBehavior, GraphicsLayerPaintingPhase paintingPhase,
                     RenderObject* paintingRoot)
 {
@@ -1124,28 +1124,28 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     ASSERT(!m_owningLayer->m_usedTransparency);
 }
 
-static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const LayoutRect& clip)
+static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const IntRect& clip)
 {
     if (!scrollbar)
         return;
 
     context.save();
-    const LayoutRect& scrollbarRect = scrollbar->frameRect();
+    const IntRect& scrollbarRect = scrollbar->frameRect();
     context.translate(-scrollbarRect.x(), -scrollbarRect.y());
-    LayoutRect transformedClip = clip;
+    IntRect transformedClip = clip;
     transformedClip.moveBy(scrollbarRect.location());
     scrollbar->paint(&context, transformedClip);
     context.restore();
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const LayoutRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
     if (graphicsLayer == m_graphicsLayer.get() || graphicsLayer == m_foregroundLayer.get() || graphicsLayer == m_maskLayer.get()) {
-        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), clip);
+        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), &context, clip);
 
         // The dirtyRect is in the coords of the painting root.
-        LayoutRect dirtyRect = compositedBounds();
+        IntRect dirtyRect = compositedBounds();
         dirtyRect.intersect(clip);
 
         // We have to use the same root as for hit testing, because both methods can compute and cache clipRects.
@@ -1157,13 +1157,13 @@ void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, Graph
     } else if (graphicsLayer == layerForVerticalScrollbar()) {
         paintScrollbar(m_owningLayer->verticalScrollbar(), context, clip);
     } else if (graphicsLayer == layerForScrollCorner()) {
-        const LayoutRect& scrollCornerAndResizer = m_owningLayer->scrollCornerAndResizerRect();
+        const IntRect& scrollCornerAndResizer = m_owningLayer->scrollCornerAndResizerRect();
         context.save();
         context.translate(-scrollCornerAndResizer.x(), -scrollCornerAndResizer.y());
-        LayoutRect transformedClip = clip;
+        IntRect transformedClip = clip;
         transformedClip.moveBy(scrollCornerAndResizer.location());
-        m_owningLayer->paintScrollCorner(&context, LayoutPoint(), transformedClip);
-        m_owningLayer->paintResizer(&context, LayoutPoint(), transformedClip);
+        m_owningLayer->paintScrollCorner(&context, IntPoint(), transformedClip);
+        m_owningLayer->paintResizer(&context, IntPoint(), transformedClip);
         context.restore();
     }
 }
@@ -1197,12 +1197,20 @@ bool RenderLayerBacking::startAnimation(double timeOffset, const Animation* anim
 {
     bool hasOpacity = keyframes.containsProperty(CSSPropertyOpacity);
     bool hasTransform = renderer()->isBox() && keyframes.containsProperty(CSSPropertyWebkitTransform);
-    
-    if (!hasOpacity && !hasTransform)
+#if ENABLE(CSS_FILTERS)
+    bool hasFilter = keyframes.containsProperty(CSSPropertyWebkitFilter);
+#else
+    bool hasFilter = false;
+#endif
+
+    if (!hasOpacity && !hasTransform && !hasFilter)
         return false;
     
     KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
     KeyframeValueList opacityVector(AnimatedPropertyOpacity);
+#if ENABLE(CSS_FILTERS)
+    KeyframeValueList filterVector(AnimatedPropertyWebkitFilter);
+#endif
 
     size_t numKeyframes = keyframes.size();
     for (size_t i = 0; i < numKeyframes; ++i) {
@@ -1222,22 +1230,41 @@ bool RenderLayerBacking::startAnimation(double timeOffset, const Animation* anim
         
         if ((hasOpacity && isFirstOrLastKeyframe) || currentKeyframe.containsProperty(CSSPropertyOpacity))
             opacityVector.insert(new FloatAnimationValue(key, keyframeStyle->opacity(), tf));
+
+#if ENABLE(CSS_FILTERS)
+        if ((hasFilter && isFirstOrLastKeyframe) || currentKeyframe.containsProperty(CSSPropertyWebkitFilter))
+            filterVector.insert(new FilterAnimationValue(key, &(keyframeStyle->filter()), tf));
+#endif
     }
 
     bool didAnimateTransform = false;
     bool didAnimateOpacity = false;
+#if ENABLE(CSS_FILTERS)
+    bool didAnimateFilter = false;
+#endif
     
-    if (hasTransform && m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), anim, keyframes.animationName(), timeOffset)) {
+    if (hasTransform && m_graphicsLayer->addAnimation(transformVector, pixelSnappedIntRect(toRenderBox(renderer())->borderBoxRect()).size(), anim, keyframes.animationName(), timeOffset)) {
         didAnimateTransform = true;
         compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitTransform);
     }
 
-    if (hasOpacity && m_graphicsLayer->addAnimation(opacityVector, LayoutSize(), anim, keyframes.animationName(), timeOffset)) {
+    if (hasOpacity && m_graphicsLayer->addAnimation(opacityVector, IntSize(), anim, keyframes.animationName(), timeOffset)) {
         didAnimateOpacity = true;
         compositor()->didStartAcceleratedAnimation(CSSPropertyOpacity);
     }
 
+#if ENABLE(CSS_FILTERS)
+    if (hasFilter && m_graphicsLayer->addAnimation(filterVector, IntSize(), anim, keyframes.animationName(), timeOffset)) {
+        didAnimateFilter = true;
+        compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitFilter);
+    }
+#endif
+
+#if ENABLE(CSS_FILTERS)
+    return didAnimateTransform || didAnimateOpacity || didAnimateFilter;
+#else
     return didAnimateTransform || didAnimateOpacity;
+#endif
 }
 
 void RenderLayerBacking::animationPaused(double timeOffset, const String& animationName)
@@ -1254,6 +1281,10 @@ bool RenderLayerBacking::startTransition(double timeOffset, int property, const
 {
     bool didAnimateOpacity = false;
     bool didAnimateTransform = false;
+#if ENABLE(CSS_FILTERS)
+    bool didAnimateFilter = false;
+#endif
+
     ASSERT(property != cAnimateAll);
 
     if (property == (int)CSSPropertyOpacity) {
@@ -1263,7 +1294,7 @@ bool RenderLayerBacking::startTransition(double timeOffset, int property, const
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
             // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
-            if (m_graphicsLayer->addAnimation(opacityVector, LayoutSize(), opacityAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyOpacity), timeOffset)) {
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyOpacity), timeOffset)) {
                 // To ensure that the correct opacity is visible when the animation ends, also set the final opacity.
                 updateLayerOpacity(toStyle);
                 didAnimateOpacity = true;
@@ -1277,21 +1308,46 @@ bool RenderLayerBacking::startTransition(double timeOffset, int property, const
             KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
             transformVector.insert(new TransformAnimationValue(0, &fromStyle->transform()));
             transformVector.insert(new TransformAnimationValue(1, &toStyle->transform()));
-            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyWebkitTransform), timeOffset)) {
-                // To ensure that the correct transform is visible when the animation ends, also set the final opacity.
+            if (m_graphicsLayer->addAnimation(transformVector, pixelSnappedIntRect(toRenderBox(renderer())->borderBoxRect()).size(), transformAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyWebkitTransform), timeOffset)) {
+                // To ensure that the correct transform is visible when the animation ends, also set the final transform.
                 updateLayerTransform(toStyle);
                 didAnimateTransform = true;
             }
         }
     }
 
+#if ENABLE(CSS_FILTERS)
+    if (property == (int)CSSPropertyWebkitFilter && m_owningLayer->hasFilter()) {
+        const Animation* filterAnim = toStyle->transitionForProperty(CSSPropertyWebkitFilter);
+        if (filterAnim && !filterAnim->isEmptyOrZeroDuration()) {
+            KeyframeValueList filterVector(AnimatedPropertyWebkitFilter);
+            filterVector.insert(new FilterAnimationValue(0, &fromStyle->filter()));
+            filterVector.insert(new FilterAnimationValue(1, &toStyle->filter()));
+            if (m_graphicsLayer->addAnimation(filterVector, IntSize(), filterAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyWebkitFilter), timeOffset)) {
+                // To ensure that the correct filter is visible when the animation ends, also set the final filter.
+                updateLayerFilters(toStyle);
+                didAnimateFilter = true;
+            }
+        }
+    }
+#endif
+
     if (didAnimateOpacity)
         compositor()->didStartAcceleratedAnimation(CSSPropertyOpacity);
 
     if (didAnimateTransform)
         compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitTransform);
     
+#if ENABLE(CSS_FILTERS)
+    if (didAnimateFilter)
+        compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitFilter);
+#endif
+
+#if ENABLE(CSS_FILTERS)
+    return didAnimateOpacity || didAnimateTransform || didAnimateFilter;
+#else
     return didAnimateOpacity || didAnimateTransform;
+#endif
 }
 
 void RenderLayerBacking::transitionPaused(double timeOffset, int property)
@@ -1330,12 +1386,12 @@ void RenderLayerBacking::resumeAnimations()
     m_graphicsLayer->resumeAnimations();
 }
 
-LayoutRect RenderLayerBacking::compositedBounds() const
+IntRect RenderLayerBacking::compositedBounds() const
 {
     return m_compositedBounds;
 }
 
-void RenderLayerBacking::setCompositedBounds(const LayoutRect& bounds)
+void RenderLayerBacking::setCompositedBounds(const IntRect& bounds)
 {
     m_compositedBounds = bounds;
 
@@ -1353,6 +1409,13 @@ int RenderLayerBacking::graphicsLayerToCSSProperty(AnimatedPropertyID property)
         case AnimatedPropertyBackgroundColor:
             cssProperty = CSSPropertyBackgroundColor;
             break;
+        case AnimatedPropertyWebkitFilter:
+#if ENABLE(CSS_FILTERS)
+            cssProperty = CSSPropertyWebkitFilter;
+#else
+            ASSERT_NOT_REACHED();
+#endif
+            break;
         case AnimatedPropertyInvalid:
             ASSERT_NOT_REACHED();
     }
@@ -1368,6 +1431,10 @@ AnimatedPropertyID RenderLayerBacking::cssToGraphicsLayerProperty(int cssPropert
             return AnimatedPropertyOpacity;
         case CSSPropertyBackgroundColor:
             return AnimatedPropertyBackgroundColor;
+#if ENABLE(CSS_FILTERS)
+        case CSSPropertyWebkitFilter:
+            return AnimatedPropertyWebkitFilter;
+#endif
         // It's fine if we see other css properties here; they are just not accelerated.
     }
     return AnimatedPropertyInvalid;
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index b2d481c57..e1fafc0ac 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -99,7 +99,7 @@ public:
 
     void setContentsNeedDisplay();
     // r is in the coordinate space of the layer's render object
-    void setContentsNeedDisplayInRect(const LayoutRect&);
+    void setContentsNeedDisplayInRect(const IntRect&);
 
     // Notification from the renderer that its content changed.
     void contentChanged(RenderLayer::ContentChangeType);
@@ -116,8 +116,8 @@ public:
     void suspendAnimations(double time = 0);
     void resumeAnimations();
 
-    LayoutRect compositedBounds() const;
-    void setCompositedBounds(const LayoutRect&);
+    IntRect compositedBounds() const;
+    void setCompositedBounds(const IntRect&);
     void updateCompositedBounds();
     
     void updateAfterWidgetResize();
@@ -127,7 +127,7 @@ public:
     virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime);
     virtual void notifySyncRequired(const GraphicsLayer*);
 
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const LayoutRect& clip);
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& clip);
 
     virtual float deviceScaleFactor() const;
     virtual float pageScaleFactor() const;
@@ -136,7 +136,7 @@ public:
     virtual bool showDebugBorders(const GraphicsLayer*) const;
     virtual bool showRepaintCounter(const GraphicsLayer*) const;
 
-    LayoutRect contentsBox() const;
+    IntRect contentsBox() const;
     
     // For informative purposes only.
     CompositingLayerType compositingLayerType() const;
@@ -169,11 +169,11 @@ private:
 
     GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
     
-    LayoutSize contentOffsetInCompostingLayer() const;
+    IntSize contentOffsetInCompostingLayer() const;
     // Result is transform origin in pixels.
-    FloatPoint3D computeTransformOrigin(const LayoutRect& borderBox) const;
+    FloatPoint3D computeTransformOrigin(const IntRect& borderBox) const;
     // Result is perspective origin in pixels.
-    FloatPoint computePerspectiveOrigin(const LayoutRect& borderBox) const;
+    FloatPoint computePerspectiveOrigin(const IntRect& borderBox) const;
 
     void updateLayerOpacity(const RenderStyle*);
     void updateLayerTransform(const RenderStyle*);
@@ -200,7 +200,7 @@ private:
     bool containsNonEmptyRenderers() const;
     bool hasVisibleNonCompositingDescendantLayers() const;
     
-    void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const LayoutRect& paintDirtyRect, PaintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
+    void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect, PaintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static int graphicsLayerToCSSProperty(AnimatedPropertyID);
     static AnimatedPropertyID cssToGraphicsLayerProperty(int);
@@ -221,7 +221,7 @@ private:
     OwnPtr<GraphicsLayer> m_layerForVerticalScrollbar;
     OwnPtr<GraphicsLayer> m_layerForScrollCorner;
 
-    LayoutRect m_compositedBounds;
+    IntRect m_compositedBounds;
 
     bool m_artificiallyInflatedBounds;      // bounds had to be made non-zero to make transform-origin work
     bool m_isMainFrameRenderViewLayer;
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 5c0ab779f..75a280c95 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -51,16 +51,13 @@
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScrollbarTheme.h"
+#include "ScrollingCoordinator.h"
 #include "Settings.h"
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 #include "HTMLMediaElement.h"
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 #if PROFILE_LAYER_REBUILD
 #include <wtf/CurrentTime.h>
 #endif
@@ -456,10 +453,10 @@ void RenderLayerCompositor::repaintOnCompositingChange(RenderLayer* layer)
 
 // The bounds of the GraphicsLayer created for a compositing layer is the union of the bounds of all the descendant
 // RenderLayers that are rendered by the composited RenderLayer.
-LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer)
+IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer)
 {
     if (!canBeComposited(layer))
-        return LayoutRect();
+        return IntRect();
 
     LayoutRect boundingBoxRect = layer->localBoundingBox();
     if (layer->renderer()->isRoot()) {
@@ -467,8 +464,8 @@ LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* l
         // then it has to be big enough to cover the viewport in order to display the background. This is akin
         // to the code in RenderBox::paintRootBoxFillLayers().
         if (m_renderView->frameView()) {
-            int rw = m_renderView->frameView()->contentsWidth();
-            int rh = m_renderView->frameView()->contentsHeight();
+            LayoutUnit rw = m_renderView->frameView()->contentsWidth();
+            LayoutUnit rh = m_renderView->frameView()->contentsHeight();
             
             boundingBoxRect.setWidth(max(boundingBoxRect.width(), rw - boundingBoxRect.x()));
             boundingBoxRect.setHeight(max(boundingBoxRect.height(), rh - boundingBoxRect.y()));
@@ -481,7 +478,7 @@ LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* l
         LayoutPoint ancestorRelOffset;
         layer->convertToLayerCoords(ancestorLayer, ancestorRelOffset);
         boundingBoxRect.moveBy(ancestorRelOffset);
-        return boundingBoxRect;
+        return pixelSnappedIntRect(boundingBoxRect);
     }
 
     if (RenderLayer* reflection = layer->reflectionLayer()) {
@@ -536,7 +533,7 @@ LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* l
     layer->convertToLayerCoords(ancestorLayer, ancestorRelOffset);
     unionBounds.moveBy(ancestorRelOffset);
 
-    return unionBounds;
+    return pixelSnappedIntRect(unionBounds);
 }
 
 void RenderLayerCompositor::layerWasAdded(RenderLayer* /*parent*/, RenderLayer* /*child*/)
@@ -582,7 +579,7 @@ RenderLayer* RenderLayerCompositor::enclosingNonStackingClippingLayer(const Rend
     return 0;
 }
 
-void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer* layer, LayoutRect& layerBounds, bool& boundsComputed)
+void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer* layer, IntRect& layerBounds, bool& boundsComputed)
 {
     if (layer->isRootLayer())
         return;
@@ -591,11 +588,11 @@ void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer*
         layerBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         // Empty rects never intersect, but we need them to for the purposes of overlap testing.
         if (layerBounds.isEmpty())
-            layerBounds.setSize(LayoutSize(1, 1));
+            layerBounds.setSize(IntSize(1, 1));
         boundsComputed = true;
     }
 
-    LayoutRect clipRect = layer->backgroundClipRect(rootRenderLayer(), 0, true).rect(); // FIXME: Incorrect for CSS regions.
+    IntRect clipRect = pixelSnappedIntRect(layer->backgroundClipRect(rootRenderLayer(), 0, true).rect()); // FIXME: Incorrect for CSS regions.
     clipRect.scale(pageScaleFactor());
     clipRect.intersect(layerBounds);
     overlapMap.add(layer, clipRect);
@@ -606,7 +603,7 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
     if (!canBeComposited(layer) || overlapMap.contains(layer))
         return;
 
-    LayoutRect bounds;
+    IntRect bounds;
     bool haveComputedBounds = false;
     addToOverlapMap(overlapMap, layer, bounds, haveComputedBounds);
 
@@ -640,11 +637,11 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
     }
 }
 
-bool RenderLayerCompositor::overlapsCompositedLayers(OverlapMap& overlapMap, const LayoutRect& layerBounds)
+bool RenderLayerCompositor::overlapsCompositedLayers(OverlapMap& overlapMap, const IntRect& layerBounds)
 {
     RenderLayerCompositor::OverlapMap::const_iterator end = overlapMap.end();
     for (RenderLayerCompositor::OverlapMap::const_iterator it = overlapMap.begin(); it != end; ++it) {
-        const LayoutRect& bounds = it->second;
+        const IntRect& bounds = it->second;
         if (layerBounds.intersects(bounds))
             return true;
     }
@@ -673,13 +670,13 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     bool mustOverlapCompositedLayers = compositingState.m_subtreeIsCompositing;
 
     bool haveComputedBounds = false;
-    LayoutRect absBounds;
+    IntRect absBounds;
     if (overlapMap && !overlapMap->isEmpty()) {
         // If we're testing for overlap, we only need to composite if we overlap something that is already composited.
         absBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         // Empty rects never intersect, but we need them to for the purposes of overlap testing.
         if (absBounds.isEmpty())
-            absBounds.setSize(LayoutSize(1, 1));
+            absBounds.setSize(IntSize(1, 1));
         haveComputedBounds = true;
         mustOverlapCompositedLayers = overlapsCompositedLayers(*overlapMap, absBounds);
     }
@@ -953,7 +950,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, Vect
     }
 }
 
-void RenderLayerCompositor::frameViewDidChangeLocation(const LayoutPoint& contentsOffset)
+void RenderLayerCompositor::frameViewDidChangeLocation(const IntPoint& contentsOffset)
 {
     if (m_overflowControlsHostLayer)
         m_overflowControlsHostLayer->setPosition(contentsOffset);
@@ -978,13 +975,22 @@ void RenderLayerCompositor::frameViewDidChangeSize()
 void RenderLayerCompositor::frameViewDidScroll()
 {
     FrameView* frameView = m_renderView->frameView();
-    LayoutPoint scrollPosition = frameView->scrollPosition();
+    IntPoint scrollPosition = frameView->scrollPosition();
 
     if (RenderLayerBacking* backing = rootRenderLayer()->backing())
         backing->graphicsLayer()->visibleRectChanged();
 
-    if (m_scrollLayer)
-        m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
+    if (!m_scrollLayer)
+        return;
+
+    // If there's a scrolling coordinator that manages scrolling for this frame view,
+    // it will also manage updating the scroll layer position.
+    if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator()) {
+        if (scrollingCoordinator->coordinatesScrollingForFrameView(frameView))
+            return;
+    }
+
+    m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
 }
 
 String RenderLayerCompositor::layerTreeAsText(bool showDebugInfo)
@@ -1126,12 +1132,12 @@ void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* com
 }
 
 
-void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const LayoutRect& absRect)
+void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& absRect)
 {
     recursiveRepaintLayerRect(rootRenderLayer(), absRect);
 }
 
-void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const LayoutRect& rect)
+void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect)
 {
     // FIXME: This method does not work correctly with transforms.
     if (layer->isComposited())
@@ -1142,8 +1148,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                LayoutRect childRect(rect);
-                curLayer->convertToLayerCoords(layer, childRect);
+                IntRect childRect(rect);
+                curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
                 recursiveRepaintLayerRect(curLayer, childRect);
             }
         }
@@ -1152,8 +1158,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                LayoutRect childRect(rect);
-                curLayer->convertToLayerCoords(layer, childRect);
+                IntRect childRect(rect);
+                curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
                 recursiveRepaintLayerRect(curLayer, childRect);
             }
         }
@@ -1162,8 +1168,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            LayoutRect childRect(rect);
-            curLayer->convertToLayerCoords(layer, childRect);
+            IntRect childRect(rect);
+            curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
             recursiveRepaintLayerRect(curLayer, childRect);
         }
     }
@@ -1223,7 +1229,7 @@ void RenderLayerCompositor::clearBackingForAllLayers()
 void RenderLayerCompositor::updateRootLayerPosition()
 {
     if (m_rootContentLayer) {
-        const LayoutRect& documentRect = m_renderView->documentRect();
+        const IntRect& documentRect = m_renderView->documentRect();
         m_rootContentLayer->setSize(documentRect.size());
         m_rootContentLayer->setPosition(documentRect.location());
     }
@@ -1463,7 +1469,7 @@ bool RenderLayerCompositor::requiresCompositingForPlugin(RenderObject* renderer)
         return pluginRenderer->hasLayer() && pluginRenderer->layer()->isComposited();
 
     // Don't go into compositing mode if height or width are zero, or size is 1x1.
-    LayoutRect contentBox = pluginRenderer->contentBoxRect();
+    IntRect contentBox = pixelSnappedIntRect(pluginRenderer->contentBoxRect());
     return contentBox.height() * contentBox.width() > 1;
 }
 
@@ -1488,7 +1494,7 @@ bool RenderLayerCompositor::requiresCompositingForFrame(RenderObject* renderer)
         return frameRenderer->hasLayer() && frameRenderer->layer()->isComposited();
     
     // Don't go into compositing mode if height or width are zero.
-    LayoutRect contentBox = frameRenderer->contentBoxRect();
+    IntRect contentBox = pixelSnappedIntRect(frameRenderer->contentBoxRect());
     return contentBox.height() * contentBox.width() > 0;
 }
 
@@ -1556,6 +1562,11 @@ bool RenderLayerCompositor::requiresCompositingForPosition(RenderObject* rendere
     if (container != m_renderView)
         return false;
 
+    // Fixed position elements that are invisible in the current view don't get their own layer.
+    FrameView* frameView = m_renderView->frameView();
+    if (frameView && !layer->absoluteBoundingBox().intersects(LayoutRect(frameView->scrollXForFixedPosition(), frameView->scrollYForFixedPosition(), frameView->layoutWidth(), frameView->layoutHeight())))
+        return false;
+
     return true;
 }
 
@@ -1592,31 +1603,31 @@ bool RenderLayerCompositor::requiresScrollLayer(RootLayerAttachment attachment)
         || attachment == RootLayerAttachedViaEnclosingFrame; // a composited frame on Mac
 }
 
-static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const LayoutRect& clip)
+static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const IntRect& clip)
 {
     if (!scrollbar)
         return;
 
     context.save();
-    const LayoutRect& scrollbarRect = scrollbar->frameRect();
+    const IntRect& scrollbarRect = scrollbar->frameRect();
     context.translate(-scrollbarRect.x(), -scrollbarRect.y());
-    LayoutRect transformedClip = clip;
+    IntRect transformedClip = clip;
     transformedClip.moveBy(scrollbarRect.location());
     scrollbar->paint(&context, transformedClip);
     context.restore();
 }
 
-void RenderLayerCompositor::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase, const LayoutRect& clip)
+void RenderLayerCompositor::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase, const IntRect& clip)
 {
     if (graphicsLayer == layerForHorizontalScrollbar())
         paintScrollbar(m_renderView->frameView()->horizontalScrollbar(), context, clip);
     else if (graphicsLayer == layerForVerticalScrollbar())
         paintScrollbar(m_renderView->frameView()->verticalScrollbar(), context, clip);
     else if (graphicsLayer == layerForScrollCorner()) {
-        const LayoutRect& scrollCorner = m_renderView->frameView()->scrollCornerRect();
+        const IntRect& scrollCorner = m_renderView->frameView()->scrollCornerRect();
         context.save();
         context.translate(-scrollCorner.x(), -scrollCorner.y());
-        LayoutRect transformedClip = clip;
+        IntRect transformedClip = clip;
         transformedClip.moveBy(scrollCorner.location());
         m_renderView->frameView()->paintScrollCorner(&context, transformedClip);
         context.restore();
@@ -1628,6 +1639,23 @@ void RenderLayerCompositor::paintContents(const GraphicsLayer* graphicsLayer, Gr
     }
 }
 
+void RenderLayerCompositor::documentBackgroundColorDidChange()
+{
+    RenderLayerBacking* backing = rootRenderLayer()->backing();
+    if (!backing)
+        return;
+
+    GraphicsLayer* graphicsLayer = backing->graphicsLayer();
+    if (!graphicsLayer->client()->shouldUseTileCache(graphicsLayer))
+        return;
+
+    Color backgroundColor = m_renderView->frameView()->documentBackgroundColor();
+    if (!backgroundColor.isValid() || backgroundColor.hasAlpha())
+        backgroundColor = Color::white;
+
+    graphicsLayer->setBackgroundColor(backgroundColor);
+}
+
 bool RenderLayerCompositor::showDebugBorders(const GraphicsLayer* layer) const
 {
     if (layer == m_layerForHorizontalScrollbar || layer == m_layerForVerticalScrollbar || layer == m_layerForScrollCorner)
@@ -1682,12 +1710,11 @@ static bool shouldCompositeOverflowControls(FrameView* view)
     if (view->platformWidget())
         return false;
 
-#if ENABLE(THREADED_SCROLLING)
     if (Page* page = view->frame()->page()) {
         if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
-            return scrollingCoordinator->coordinatesScrollingForFrameView(view);
+            if (scrollingCoordinator->coordinatesScrollingForFrameView(view))
+                return true;
     }
-#endif
 
 #if !PLATFORM(CHROMIUM)
     if (!view->hasOverlayScrollbars())
@@ -1722,10 +1749,8 @@ bool RenderLayerCompositor::requiresOverhangAreasLayer() const
         return false;
 
     // We do want a layer if we have a scrolling coordinator.
-#if ENABLE(THREADED_SCROLLING)
     if (scrollingCoordinator())
         return true;
-#endif
 
     // Chromium always wants a layer.
 #if PLATFORM(CHROMIUM)
@@ -1741,7 +1766,7 @@ bool RenderLayerCompositor::requiresContentShadowLayer() const
     if (m_renderView->document()->ownerElement())
         return false;
 
-#if PLATFORM(MAC) && ENABLE(THREADED_SCROLLING)
+#if PLATFORM(MAC)
     // On Mac, we want a content shadow layer if we have a scrolling coordinator.
     if (scrollingCoordinator())
         return true;
@@ -1800,19 +1825,15 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     #endif
             m_overflowControlsHostLayer->addChild(m_layerForHorizontalScrollbar.get());
 
-#if ENABLE(THREADED_SCROLLING)
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
                 scrollingCoordinator->frameViewHorizontalScrollbarLayerDidChange(m_renderView->frameView(), m_layerForHorizontalScrollbar.get());
-#endif
         }
     } else if (m_layerForHorizontalScrollbar) {
         m_layerForHorizontalScrollbar->removeFromParent();
         m_layerForHorizontalScrollbar = nullptr;
 
-#if ENABLE(THREADED_SCROLLING)
         if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
             scrollingCoordinator->frameViewHorizontalScrollbarLayerDidChange(m_renderView->frameView(), 0);
-#endif
     }
 
     if (requiresVerticalScrollbarLayer()) {
@@ -1823,19 +1844,15 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     #endif
             m_overflowControlsHostLayer->addChild(m_layerForVerticalScrollbar.get());
 
-#if ENABLE(THREADED_SCROLLING)
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
                 scrollingCoordinator->frameViewVerticalScrollbarLayerDidChange(m_renderView->frameView(), m_layerForVerticalScrollbar.get());
-#endif
         }
     } else if (m_layerForVerticalScrollbar) {
         m_layerForVerticalScrollbar->removeFromParent();
         m_layerForVerticalScrollbar = nullptr;
 
-#if ENABLE(THREADED_SCROLLING)
         if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
             scrollingCoordinator->frameViewVerticalScrollbarLayerDidChange(m_renderView->frameView(), 0);
-#endif
     }
 
     if (requiresScrollCornerLayer()) {
@@ -1865,7 +1882,8 @@ void RenderLayerCompositor::ensureRootLayer()
 #ifndef NDEBUG
         m_rootContentLayer->setName("content root");
 #endif
-        m_rootContentLayer->setSize(FloatSize(m_renderView->maxXLayoutOverflow(), m_renderView->maxYLayoutOverflow()));
+        IntRect overflowRect = m_renderView->pixelSnappedLayoutOverflowRect();
+        m_rootContentLayer->setSize(FloatSize(overflowRect.maxX(), overflowRect.maxY()));
         m_rootContentLayer->setPosition(FloatPoint());
 
         // Need to clip to prevent transformed content showing outside this frame
@@ -1902,11 +1920,6 @@ void RenderLayerCompositor::ensureRootLayer()
 
             frameViewDidChangeSize();
             frameViewDidScroll();
-
-#if ENABLE(THREADED_SCROLLING)
-            if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
-                scrollingCoordinator->frameViewScrollLayerDidChange(m_renderView->frameView(), m_scrollLayer.get());
-#endif
         }
     } else {
         if (m_overflowControlsHostLayer) {
@@ -1941,14 +1954,14 @@ void RenderLayerCompositor::destroyRootLayer()
         m_layerForHorizontalScrollbar->removeFromParent();
         m_layerForHorizontalScrollbar = nullptr;
         if (Scrollbar* horizontalScrollbar = m_renderView->frameView()->verticalScrollbar())
-            m_renderView->frameView()->invalidateScrollbar(horizontalScrollbar, LayoutRect(LayoutPoint(0, 0), horizontalScrollbar->frameRect().size()));
+            m_renderView->frameView()->invalidateScrollbar(horizontalScrollbar, IntRect(IntPoint(0, 0), horizontalScrollbar->frameRect().size()));
     }
 
     if (m_layerForVerticalScrollbar) {
         m_layerForVerticalScrollbar->removeFromParent();
         m_layerForVerticalScrollbar = nullptr;
         if (Scrollbar* verticalScrollbar = m_renderView->frameView()->verticalScrollbar())
-            m_renderView->frameView()->invalidateScrollbar(verticalScrollbar, LayoutRect(LayoutPoint(0, 0), verticalScrollbar->frameRect().size()));
+            m_renderView->frameView()->invalidateScrollbar(verticalScrollbar, IntRect(IntPoint(0, 0), verticalScrollbar->frameRect().size()));
     }
 
     if (m_layerForScrollCorner) {
@@ -1990,7 +2003,10 @@ void RenderLayerCompositor::attachRootLayer(RootLayerAttachment attachment)
             break;
         }
     }
-    
+
+    if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
+        scrollingCoordinator->frameViewRootLayerDidChange(m_renderView->frameView());
+
     m_rootLayerAttachment = attachment;
     rootLayerAttachmentChanged();
 }
@@ -2116,7 +2132,6 @@ void RenderLayerCompositor::deviceOrPageScaleFactorChanged()
         rootLayer->noteDeviceOrPageScaleFactorChangedIncludingDescendants();
 }
 
-#if ENABLE(THREADED_SCROLLING)
 ScrollingCoordinator* RenderLayerCompositor::scrollingCoordinator() const
 {
     if (Frame* frame = m_renderView->frameView()->frame()) {
@@ -2126,7 +2141,6 @@ ScrollingCoordinator* RenderLayerCompositor::scrollingCoordinator() const
 
     return 0;
 }
-#endif
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 00518f3df..86aea07a6 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -37,12 +37,10 @@ namespace WebCore {
 class GraphicsLayer;
 class RenderEmbeddedObject;
 class RenderPart;
+class ScrollingCoordinator;
 #if ENABLE(VIDEO)
 class RenderVideo;
 #endif
-#if ENABLE(THREADED_SCROLLING)
-class ScrollingCoordinator;
-#endif
 
 enum CompositingUpdateType {
     CompositingUpdateAfterLayoutOrStyleChange,
@@ -121,7 +119,7 @@ public:
     bool needsContentsCompositingLayer(const RenderLayer*) const;
     // Return the bounding box required for compositing layer and its childern, relative to ancestorLayer.
     // If layerBoundingBox is not 0, on return it contains the bounding box of this layer only.
-    LayoutRect calculateCompositedBounds(const RenderLayer*, const RenderLayer* ancestorLayer);
+    IntRect calculateCompositedBounds(const RenderLayer*, const RenderLayer* ancestorLayer);
 
     // Repaint the appropriate layers when the given RenderLayer starts or stops being composited.
     void repaintOnCompositingChange(RenderLayer*);
@@ -134,7 +132,7 @@ public:
     RenderLayer* enclosingNonStackingClippingLayer(const RenderLayer* layer) const;
 
     // Repaint parts of all composited layers that intersect the given absolute rectangle.
-    void repaintCompositedLayersAbsoluteRect(const LayoutRect&);
+    void repaintCompositedLayersAbsoluteRect(const IntRect&);
 
     RenderLayer* rootRenderLayer() const;
     GraphicsLayer* rootGraphicsLayer() const;
@@ -183,7 +181,7 @@ public:
     static bool parentFrameContentLayers(RenderPart*);
 
     // Update the geometry of the layers used for clipping and scrolling in frames.
-    void frameViewDidChangeLocation(const LayoutPoint& contentsOffset);
+    void frameViewDidChangeLocation(const IntPoint& contentsOffset);
     void frameViewDidChangeSize();
     void frameViewDidScroll();
 
@@ -209,11 +207,13 @@ public:
     GraphicsLayer* layerForOverhangAreas() const { return m_layerForOverhangAreas.get(); }
 #endif
 
+    void documentBackgroundColorDidChange();
+
 private:
     // GraphicsLayerClient Implementation
     virtual void notifyAnimationStarted(const GraphicsLayer*, double) { }
     virtual void notifySyncRequired(const GraphicsLayer*) { scheduleLayerFlush(); }
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const LayoutRect&);
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect&);
 
     virtual bool showDebugBorders(const GraphicsLayer*) const;
     virtual bool showRepaintCounter(const GraphicsLayer*) const;
@@ -231,12 +231,12 @@ private:
     void clearBackingForLayerIncludingDescendants(RenderLayer*);
 
     // Repaint the given rect (which is layer's coords), and regions of child layers that intersect that rect.
-    void recursiveRepaintLayerRect(RenderLayer*, const LayoutRect&);
+    void recursiveRepaintLayerRect(RenderLayer*, const IntRect&);
 
-    typedef HashMap<RenderLayer*, LayoutRect> OverlapMap;
-    void addToOverlapMap(OverlapMap&, RenderLayer*, LayoutRect& layerBounds, bool& boundsComputed);
+    typedef HashMap<RenderLayer*, IntRect> OverlapMap;
+    void addToOverlapMap(OverlapMap&, RenderLayer*, IntRect& layerBounds, bool& boundsComputed);
     void addToOverlapMapRecursive(OverlapMap&, RenderLayer*);
-    static bool overlapsCompositedLayers(OverlapMap&, const LayoutRect& layerBounds);
+    static bool overlapsCompositedLayers(OverlapMap&, const IntRect& layerBounds);
 
     void updateCompositingLayersTimerFired(Timer<RenderLayerCompositor>*);
 
@@ -272,6 +272,8 @@ private:
 
     bool isFlushingLayers() const { return m_flushingLayers; }
 
+    ScrollingCoordinator* scrollingCoordinator() const;
+
     // Whether a running transition or animation enforces the need for a compositing layer.
     bool requiresCompositingForAnimation(RenderObject*) const;
     bool requiresCompositingForTransform(RenderObject*) const;
@@ -294,10 +296,6 @@ private:
     bool requiresContentShadowLayer() const;
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-    ScrollingCoordinator* scrollingCoordinator() const;
-#endif
-
 private:
     RenderView* m_renderView;
     OwnPtr<GraphicsLayer> m_rootContentLayer;
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index d47a1801e..68ae283e3 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -255,7 +255,7 @@ void RenderListBox::computeLogicalHeight()
         m_vBar->setSteps(1, max(1, numVisibleItems() - 1), itemHeight);
         m_vBar->setProportion(numVisibleItems(), numItems());
         if (!enabled) {
-            scrollToYOffsetWithoutAnimation(0);
+            scrollToOffsetWithoutAnimation(VerticalScrollbar, 0);
             m_indexOffset = 0;
         }
     }
@@ -473,7 +473,7 @@ int RenderListBox::listIndexAtOffset(const LayoutSize& offset)
     if (offset.height() < borderTop() + paddingTop() || offset.height() > height() - paddingBottom() - borderBottom())
         return -1;
 
-    LayoutUnit scrollbarWidth = m_vBar ? m_vBar->width() : LayoutUnit(0);
+    int scrollbarWidth = m_vBar ? m_vBar->width() : 0;
     if (offset.width() < borderLeft() + paddingLeft() || offset.width() > width() - borderRight() - paddingRight() - scrollbarWidth)
         return -1;
 
@@ -579,7 +579,7 @@ bool RenderListBox::scrollToRevealElementAtListIndex(int index)
     else
         newOffset = index - numVisibleItems() + 1;
 
-    ScrollableArea::scrollToYOffsetWithoutAnimation(newOffset);
+    scrollToOffsetWithoutAnimation(VerticalScrollbar, newOffset);
 
     return true;
 }
@@ -638,7 +638,7 @@ LayoutUnit RenderListBox::itemHeight() const
 
 int RenderListBox::verticalScrollbarWidth() const
 {
-    return m_vBar && !m_vBar->isOverlayScrollbar() ? m_vBar->width() : LayoutUnit(0);
+    return m_vBar && !m_vBar->isOverlayScrollbar() ? m_vBar->width() : 0;
 }
 
 // FIXME: We ignore padding in the vertical direction as far as these values are concerned, since that's
@@ -675,7 +675,7 @@ void RenderListBox::setScrollTop(int newTop)
     if (index < 0 || index >= numItems() || index == m_indexOffset)
         return;
     
-    ScrollableArea::scrollToYOffsetWithoutAnimation(index);
+    scrollToOffsetWithoutAnimation(VerticalScrollbar, index);
 }
 
 bool RenderListBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index e63e00386..407fa5247 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -62,8 +62,6 @@ private:
 
     virtual void updateFromElement();
 
-    virtual bool canHaveChildren() const { return false; }
-
     virtual bool hasControlClip() const { return true; }
     virtual void paintObject(PaintInfo&, const LayoutPoint&);
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index a5b5b94e8..883218d4f 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -247,6 +247,9 @@ void RenderListItem::updateMarkerLocation()
             LayoutStateDisabler layoutStateDisabler(view());
             updateFirstLetter();
             m_marker->remove();
+            // If markerPar is an anonymous block that will lose all its children, destroy it
+            if (markerPar && (markerPar != lineBoxParent) && markerPar->isAnonymousBlock() && !(toRenderBlock(markerPar)->firstChild()))
+                markerPar->destroy();
             if (!lineBoxParent)
                 lineBoxParent = this;
             lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
diff --git a/Source/WebCore/rendering/RenderListMarker.cpp b/Source/WebCore/rendering/RenderListMarker.cpp
index e7f85283a..fe193987c 100644
--- a/Source/WebCore/rendering/RenderListMarker.cpp
+++ b/Source/WebCore/rendering/RenderListMarker.cpp
@@ -1110,7 +1110,7 @@ void RenderListMarker::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffse
     if (style()->visibility() != VISIBLE)
         return;
 
-    LayoutPoint boxOrigin(paintOffset + location());
+    IntPoint boxOrigin(paintOffset + location());
     LayoutRect overflowRect(visualOverflowRect());
     overflowRect.moveBy(boxOrigin);
     overflowRect.inflate(maximalOutlineSize(paintInfo.phase));
diff --git a/Source/WebCore/rendering/RenderMarquee.cpp b/Source/WebCore/rendering/RenderMarquee.cpp
index ad5892cc6..fe5dbaa22 100644
--- a/Source/WebCore/rendering/RenderMarquee.cpp
+++ b/Source/WebCore/rendering/RenderMarquee.cpp
@@ -125,13 +125,13 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
         }
         if (dir == MRIGHT) {
             if (stopAtContentEdge)
-                return max(0, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
+                return max(zeroLayoutUnit, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
             else
                 return ltr ? contentWidth : clientWidth;
         }
         else {
             if (stopAtContentEdge)
-                return min(0, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
+                return min(zeroLayoutUnit, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
             else
                 return ltr ? -clientWidth : -contentWidth;
         }
diff --git a/Source/WebCore/rendering/RenderMedia.h b/Source/WebCore/rendering/RenderMedia.h
index 78e36c4ce..54e625af3 100644
--- a/Source/WebCore/rendering/RenderMedia.h
+++ b/Source/WebCore/rendering/RenderMedia.h
@@ -51,6 +51,7 @@ protected:
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    virtual bool canHaveChildren() const { return true; }
 
     virtual const char* renderName() const { return "RenderMedia"; }
     virtual bool isMedia() const { return true; }
diff --git a/Source/WebCore/rendering/RenderMenuList.h b/Source/WebCore/rendering/RenderMenuList.h
index b6f44364f..27872eba2 100644
--- a/Source/WebCore/rendering/RenderMenuList.h
+++ b/Source/WebCore/rendering/RenderMenuList.h
@@ -62,12 +62,12 @@ private:
     virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject*);
     virtual bool createsAnonymousWrapper() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
 
     virtual void updateFromElement();
 
-    virtual bool hasControlClip() const { return true; }
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
+    virtual bool hasControlClip() const { return true; }
+    virtual RenderText* buttonText() const OVERRIDE { return m_buttonText; }
 
     virtual const char* renderName() const { return "RenderMenuList"; }
 
diff --git a/Source/WebCore/rendering/RenderMeter.h b/Source/WebCore/rendering/RenderMeter.h
index 6eb171761..c4deb12b2 100644
--- a/Source/WebCore/rendering/RenderMeter.h
+++ b/Source/WebCore/rendering/RenderMeter.h
@@ -42,7 +42,6 @@ private:
     virtual const char* renderName() const { return "RenderMeter"; }
     virtual bool isMeter() const { return true; }
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
     virtual void updateFromElement();
 
     double valueRatio() const;
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 73d874416..a91b7f89c 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -158,7 +158,7 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     case RUN_IN:
     case COMPACT:
         // Only non-replaced block elements can become a region.
-        if (!style->regionThread().isEmpty() && doc->renderView())
+        if (doc->cssRegionsEnabled() && !style->regionThread().isEmpty() && doc->renderView())
             return new (arena) RenderRegion(node, doc->renderView()->ensureRenderFlowThreadWithName(style->regionThread()));
         return new (arena) RenderBlock(node);
     case LIST_ITEM:
@@ -266,6 +266,16 @@ static bool isBeforeAfterContentGeneratedByAncestor(RenderObject* renderer, Rend
     return false;
 }
 
+RenderTable* RenderObject::createAnonymousTable() const
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
+    newStyle->setDisplay(TABLE);
+
+    RenderTable* table = new (renderArena()) RenderTable(document() /* is anonymous */);
+    table->setStyle(newStyle.release());
+    return table;
+}
+
 void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     RenderObjectChildList* children = virtualChildren();
@@ -310,11 +320,7 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
         if (afterChild && afterChild->isAnonymous() && afterChild->isTable() && !afterChild->isBeforeContent())
             table = toRenderTable(afterChild);
         else {
-            table = new (renderArena()) RenderTable(document() /* is anonymous */);
-            RefPtr<RenderStyle> newStyle = RenderStyle::create();
-            newStyle->inheritFrom(style());
-            newStyle->setDisplay(TABLE);
-            table->setStyle(newStyle.release());
+            table = createAnonymousTable();
             addChild(table, beforeChild);
         }
         table->addChild(newChild);
@@ -329,6 +335,17 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
             toRenderText(newChild)->setText(textToTransform.release(), true);
     }
 
+    // SVG creates renderers for <g display="none">, as SVG requires children of hidden
+    // <g>s to have renderers - at least that's how our implementation works. Consider:
+    // <g display="none"><foreignObject><body style="position: relative">FOO...
+    // - requiresLayer() would return true for the <body>, creating a new RenderLayer
+    // - when the document is painted, both layers are painted. The <body> layer doesn't
+    //   know that it's inside a "hidden SVG subtree", and thus paints, even if it shouldn't.
+    // To avoid the problem alltogether, detect early if we're inside a hidden SVG subtree
+    // and stop creating layers at all for these cases - they're not used anyways.
+    if (newChild->hasLayer() && !layerCreationAllowedForSubtree())
+        toRenderBoxModelObject(newChild)->layer()->removeOnlyThisLayer();
+
     if (beforeChildHasBeforeAndAfterContent)
         children->updateBeforeAfterContent(this, BEFORE);
 }
@@ -790,7 +807,7 @@ bool RenderObject::mustRepaintBackgroundOrBorder() const
     return false;
 }
 
-void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, LayoutUnit x1, LayoutUnit y1, LayoutUnit x2, LayoutUnit y2,
+void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1, int y1, int x2, int y2,
                                       BoxSide side, Color color, EBorderStyle style,
                                       int adjacentWidth1, int adjacentWidth2, bool antialias)
 {
@@ -1110,7 +1127,7 @@ void RenderObject::addPDFURLRect(GraphicsContext* context, const LayoutRect& rec
     const AtomicString& href = static_cast<Element*>(n)->getAttribute(hrefAttr);
     if (href.isNull())
         return;
-    context->setURLForRect(n->document()->completeURL(href), rect);
+    context->setURLForRect(n->document()->completeURL(href), pixelSnappedIntRect(rect));
 }
 
 void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRect& paintRect)
@@ -1124,7 +1141,7 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
 
     Color outlineColor = styleToUse->visitedDependentColor(CSSPropertyOutlineColor);
 
-    LayoutUnit outlineOffset = styleToUse->outlineOffset();
+    int outlineOffset = styleToUse->outlineOffset();
 
     if (styleToUse->outlineStyleIsAuto() || hasOutlineAnnotation()) {
         if (!theme()->supportsFocusRing(styleToUse)) {
@@ -1136,10 +1153,10 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
     if (styleToUse->outlineStyleIsAuto() || styleToUse->outlineStyle() == BNONE)
         return;
 
-    LayoutRect inner = paintRect;
+    IntRect inner = pixelSnappedIntRect(paintRect);
     inner.inflate(outlineOffset);
 
-    LayoutRect outer = inner;
+    IntRect outer = pixelSnappedIntRect(inner);
     outer.inflate(outlineWidth);
 
     // FIXME: This prevents outlines from painting inside the object. See bug 12042
@@ -1161,14 +1178,14 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
         outlineColor = Color(outlineColor.red(), outlineColor.green(), outlineColor.blue());
     }
 
-    LayoutUnit leftOuter = outer.x();
-    LayoutUnit leftInner = inner.x();
-    LayoutUnit rightOuter = outer.maxX();
-    LayoutUnit rightInner = inner.maxX();
-    LayoutUnit topOuter = outer.y();
-    LayoutUnit topInner = inner.y();
-    LayoutUnit bottomOuter = outer.maxY();
-    LayoutUnit bottomInner = inner.maxY();
+    int leftOuter = outer.x();
+    int leftInner = inner.x();
+    int rightOuter = outer.maxX();
+    int rightInner = inner.maxX();
+    int topOuter = outer.y();
+    int topInner = inner.y();
+    int bottomOuter = outer.maxY();
+    int bottomInner = inner.maxY();
     
     drawLineForBoxSide(graphicsContext, leftOuter, topOuter, leftInner, bottomOuter, BSLeft, outlineColor, outlineStyle, outlineWidth, outlineWidth);
     drawLineForBoxSide(graphicsContext, leftOuter, topOuter, rightOuter, topInner, BSTop, outlineColor, outlineStyle, outlineWidth, outlineWidth);
@@ -1417,8 +1434,8 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
         LayoutUnit shadowRight;
         style()->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
 
-        LayoutUnit borderRight = isBox() ? toRenderBox(this)->borderRight() : LayoutUnit(0);
-        LayoutUnit boxWidth = isBox() ? toRenderBox(this)->width() : LayoutUnit(0);
+        LayoutUnit borderRight = isBox() ? toRenderBox(this)->borderRight() : zeroLayoutUnit;
+        LayoutUnit boxWidth = isBox() ? toRenderBox(this)->width() : zeroLayoutUnit;
         LayoutUnit borderWidth = max<LayoutUnit>(-outlineStyle->outlineOffset(), max(borderRight, max<LayoutUnit>(style()->borderTopRightRadius().width().calcValue(boxWidth), style()->borderBottomRightRadius().width().calcValue(boxWidth)))) + max(ow, shadowRight);
         LayoutRect rightRect(newOutlineBox.x() + min(newOutlineBox.width(), oldOutlineBox.width()) - borderWidth,
             newOutlineBox.y(),
@@ -1436,8 +1453,8 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
         LayoutUnit shadowBottom;
         style()->getBoxShadowVerticalExtent(shadowTop, shadowBottom);
 
-        LayoutUnit borderBottom = isBox() ? toRenderBox(this)->borderBottom() : LayoutUnit(0);
-        LayoutUnit boxHeight = isBox() ? toRenderBox(this)->height() : LayoutUnit(0);
+        LayoutUnit borderBottom = isBox() ? toRenderBox(this)->borderBottom() : zeroLayoutUnit;
+        LayoutUnit boxHeight = isBox() ? toRenderBox(this)->height() : zeroLayoutUnit;
         LayoutUnit borderHeight = max<LayoutUnit>(-outlineStyle->outlineOffset(), max(borderBottom, max<LayoutUnit>(style()->borderBottomLeftRadius().height().calcValue(boxHeight), style()->borderBottomRightRadius().height().calcValue(boxHeight)))) + max(ow, shadowBottom);
         LayoutRect bottomRect(newOutlineBox.x(),
             min(newOutlineBox.maxY(), oldOutlineBox.maxY()) - borderHeight,
@@ -1500,7 +1517,7 @@ void RenderObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
             RenderBox* boxParent = toRenderBox(o);
 
             LayoutRect repaintRect(rect);
-            repaintRect.move(-boxParent->layer()->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
+            repaintRect.move(-boxParent->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
             LayoutRect boxRect(LayoutPoint(), boxParent->layer()->size());
             rect = intersection(repaintRect, boxRect);
@@ -1931,6 +1948,12 @@ void RenderObject::propagateStyleToAnonymousChildren(bool blockChildrenOnly)
             if (child->style()->columnSpan())
                 newStyle->setColumnSpan(ColumnSpanAll);
         }
+
+        // Preserve the position style of anonymous block continuations as they can have relative position when
+        // they contain block descendants of relative positioned inlines.
+        if (child->isRelPositioned() && toRenderBlock(child)->isAnonymousBlockContinuation())
+            newStyle->setPosition(child->style()->position());
+
         newStyle->setDisplay(child->style()->display());
         child->setStyle(newStyle.release());
     }
@@ -2006,7 +2029,7 @@ void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
         transformState.move(columnOffset);
 
     if (o->hasOverflowClip())
-        transformState.move(-toRenderBox(o)->layer()->scrolledContentOffset());
+        transformState.move(-toRenderBox(o)->scrolledContentOffset());
 
     o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState, wasFixed);
 }
@@ -2017,7 +2040,7 @@ void RenderObject::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, Trans
     if (o) {
         o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
         if (o->hasOverflowClip())
-            transformState.move(toRenderBox(o)->layer()->scrolledContentOffset());
+            transformState.move(toRenderBox(o)->scrolledContentOffset());
     }
 }
 
@@ -2079,7 +2102,7 @@ LayoutSize RenderObject::offsetFromContainer(RenderObject* o, const LayoutPoint&
     o->adjustForColumns(offset, point);
 
     if (o->hasOverflowClip())
-        offset -= toRenderBox(o)->layer()->scrolledContentOffset();
+        offset -= toRenderBox(o)->scrolledContentOffset();
 
     return offset;
 }
@@ -2231,6 +2254,18 @@ void RenderObject::willBeDestroyed()
 
     remove();
 
+#ifndef NDEBUG
+    if (!documentBeingDestroyed() && view() && view()->hasRenderFlowThreads()) {
+        // After remove, the object and the associated information should not be in any flow thread.
+        const RenderFlowThreadList* flowThreadList = view()->renderFlowThreadList();
+        for (RenderFlowThreadList::const_iterator iter = flowThreadList->begin(); iter != flowThreadList->end(); ++iter) {
+            const RenderFlowThread* renderFlowThread = *iter;
+            ASSERT(!renderFlowThread->hasChild(this));
+            ASSERT(!renderFlowThread->hasChildInfo(this));
+        }
+    }
+#endif
+
     // If this renderer had a parent, remove should have destroyed any counters
     // attached to this renderer and marked the affected other counters for
     // reevaluation. This apparently redundant check is here for the case when
@@ -2247,6 +2282,33 @@ void RenderObject::willBeDestroyed()
     }
 }
 
+void RenderObject::destroyAndCleanupAnonymousWrappers()
+{
+    RenderObject* parent = this->parent();
+
+    // If the tree is destroyed or our parent is not anonymous, there is no need for a clean-up phase.
+    if (documentBeingDestroyed() || !parent || !parent->isAnonymous()) {
+        destroy();
+        return;
+    }
+
+    bool parentIsLeftOverAnonymousWrapper = false;
+
+    // Currently we only remove anonymous cells' wrapper but we should remove all unneeded
+    // wrappers. See http://webkit.org/b/52123 as an example where this is needed.
+    if (parent->isTableCell())
+        parentIsLeftOverAnonymousWrapper = parent->firstChild() == this && parent->lastChild() == this;
+
+    destroy();
+
+    // WARNING: |this| is deleted here.
+
+    if (parentIsLeftOverAnonymousWrapper) {
+        ASSERT(!parent->firstChild());
+        parent->destroyAndCleanupAnonymousWrappers();
+    }
+}
+
 void RenderObject::destroy()
 {
     willBeDestroyed();
@@ -2487,7 +2549,7 @@ void RenderObject::getTextDecorationColors(int decorations, Color& underline, Co
                 linethrough = decorationColor(curr);
             }
         }
-        if (curr->isFloating() || curr->isPositioned())
+        if (curr->isFloating() || curr->isPositioned() || curr->isRubyText())
             return;
         curr = curr->parent();
         if (curr && curr->isAnonymousBlock() && toRenderBlock(curr)->continuation())
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 1bcda46aa..ac1bfc76d 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -58,6 +58,7 @@ class RenderInline;
 class RenderBlock;
 class RenderFlowThread;
 class RenderLayer;
+class RenderTable;
 class RenderTheme;
 class TransformState;
 class VisiblePosition;
@@ -219,6 +220,8 @@ public:
     // normal flow object.
     void handleDynamicFloatPositionChange();
     
+    RenderTable* createAnonymousTable() const;
+    
     // RenderObject tree manipulation
     //////////////////////////////////////////
     virtual bool canHaveChildren() const { return virtualChildren(); }
@@ -352,6 +355,8 @@ public:
 
     bool isHTMLMarquee() const;
 
+    bool isTablePart() const { return isTableCell() || isTableCol() || isTableCaption() || isTableRow() || isTableSection(); }
+
     inline bool isBeforeContent() const;
     inline bool isAfterContent() const;
     inline bool isBeforeOrAfterContent() const;
@@ -359,16 +364,6 @@ public:
     static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
     static inline bool isBeforeOrAfterContent(const RenderObject* obj) { return obj && obj->isBeforeOrAfterContent(); }
 
-    inline RenderObject* anonymousContainer(RenderObject* child)
-    {
-         RenderObject* container = child;
-         while (container->parent() != this)
-             container = container->parent();
-
-         ASSERT(container->isAnonymous());
-         return container;
-    }
-
     bool hasCounterNodeMap() const { return m_bitfields.hasCounterNodeMap(); }
     void setHasCounterNodeMap(bool hasCounterNodeMap) { m_bitfields.setHasCounterNodeMap(hasCounterNodeMap); }
     bool everHadLayout() const { return m_bitfields.everHadLayout(); }
@@ -392,7 +387,8 @@ public:
     // to add SVG renderer methods to RenderObject with an ASSERT_NOT_REACHED() default implementation.
     virtual bool isSVGRoot() const { return false; }
     virtual bool isSVGContainer() const { return false; }
-    virtual bool isSVGViewportContainer() const { return false; } 
+    virtual bool isSVGTransformableContainer() const { return false; }
+    virtual bool isSVGViewportContainer() const { return false; }
     virtual bool isSVGGradientStop() const { return false; }
     virtual bool isSVGHiddenContainer() const { return false; }
     virtual bool isSVGPath() const { return false; }
@@ -801,6 +797,7 @@ public:
     // as a hook to detect the case of document destruction and don't waste time doing unnecessary work.
     bool documentBeingDestroyed() const;
 
+    void destroyAndCleanupAnonymousWrappers();
     virtual void destroy();
 
     // Virtual function helpers for the deprecated Flexible Box Layout (display: -webkit-box).
@@ -856,13 +853,15 @@ public:
     RenderObject* rendererForRootBackground();
 
 protected:
+    inline bool layerCreationAllowedForSubtree() const;
+
     // Overrides should call the superclass at the end
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     // Overrides should call the superclass at the start
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     void propagateStyleToAnonymousChildren(bool blockChildrenOnly = false);
 
-    void drawLineForBoxSide(GraphicsContext*, LayoutUnit x1, LayoutUnit y1, LayoutUnit x2, LayoutUnit y2, BoxSide,
+    void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
                             Color, EBorderStyle, int adjbw1, int adjbw2, bool antialias = false);
 
     void paintFocusRing(GraphicsContext*, const LayoutPoint&, RenderStyle*);
@@ -1107,6 +1106,20 @@ inline bool RenderObject::preservesNewline() const
     return style()->preserveNewline();
 }
 
+inline bool RenderObject::layerCreationAllowedForSubtree() const
+{
+#if ENABLE(SVG)
+    RenderObject* parentRenderer = parent();
+    while (parentRenderer) {
+        if (parentRenderer->isSVGHiddenContainer())
+            return false;
+        parentRenderer = parentRenderer->parent();
+    }
+#endif
+
+    return true;
+}
+
 inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
 {
 #if !ENABLE(3D_RENDERING)
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index 24055bb16..efe6b8520 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -520,7 +520,15 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                     renderer->destroy();
                     return;
                 }
-                owner->addChild(generatedContentContainer, insertBefore);
+
+                // When we don't have a first child and are part of a continuation chain,
+                // insertBefore is incorrectly set to zero above, which causes the :before
+                // child to end up at the end of continuation chain.
+                // See https://bugs.webkit.org/show_bug.cgi?id=78380.
+                if (!insertBefore && type == BEFORE && owner->virtualContinuation())
+                    owner->addChildIgnoringContinuation(generatedContentContainer, 0);
+                else
+                    owner->addChild(generatedContentContainer, insertBefore);
             }
             if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
                 generatedContentContainer->addChild(renderer);
diff --git a/Source/WebCore/rendering/RenderProgress.h b/Source/WebCore/rendering/RenderProgress.h
index 62436fdc0..fa92bb20b 100644
--- a/Source/WebCore/rendering/RenderProgress.h
+++ b/Source/WebCore/rendering/RenderProgress.h
@@ -45,7 +45,6 @@ private:
     virtual const char* renderName() const { return "RenderProgress"; }
     virtual bool isProgress() const { return true; }
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
     virtual void updateFromElement();
 
     void animationTimerFired(Timer<RenderProgress>*);
diff --git a/Source/WebCore/rendering/RenderRegion.cpp b/Source/WebCore/rendering/RenderRegion.cpp
index 8df1ced4c..42f7d2955 100644
--- a/Source/WebCore/rendering/RenderRegion.cpp
+++ b/Source/WebCore/rendering/RenderRegion.cpp
@@ -47,7 +47,9 @@ RenderRegion::RenderRegion(Node* node, RenderFlowThread* flowThread)
     , m_parentFlowThread(0)
     , m_isValid(false)
     , m_hasCustomRegionStyle(false)
+    , m_regionState(RegionUndefined)
 {
+    ASSERT(node->document()->cssRegionsEnabled());
 }
 
 LayoutRect RenderRegion::regionOverflowRect() const
@@ -157,7 +159,8 @@ bool RenderRegion::nodeAtPoint(const HitTestRequest& request, HitTestResult& res
 
     // Check our bounds next. For this purpose always assume that we can only be hit in the
     // foreground phase (which is true for replaced elements like images).
-    LayoutRect boundsRect(adjustedLocation, size());
+    LayoutRect boundsRect = borderBoxRectInRegion(result.region());
+    boundsRect.moveBy(adjustedLocation);
     if (visibleToHitTesting() && action == HitTestForeground && boundsRect.intersects(result.rectForPoint(pointInContainer))) {
         // Check the contents of the RenderFlowThread.
         if (m_flowThread && m_flowThread->hitTestRegion(this, request, result, pointInContainer, LayoutPoint(adjustedLocation.x() + borderLeft() + paddingLeft(), adjustedLocation.y() + borderTop() + paddingTop())))
diff --git a/Source/WebCore/rendering/RenderRegion.h b/Source/WebCore/rendering/RenderRegion.h
index 6bdcdf672..d46d6da67 100644
--- a/Source/WebCore/rendering/RenderRegion.h
+++ b/Source/WebCore/rendering/RenderRegion.h
@@ -81,6 +81,16 @@ public:
     bool isLastRegion() const;
 
     void clearBoxStyleInRegion(const RenderBox*);
+
+    enum RegionState {
+        RegionUndefined,
+        RegionEmpty,
+        RegionFit,
+        RegionOverflow
+    };
+
+    RegionState regionState() const { return isValid() ? m_regionState : RegionUndefined; }
+    void setRegionState(RegionState regionState) { m_regionState = regionState; }
 private:
     virtual const char* renderName() const { return "RenderRegion"; }
 
@@ -109,6 +119,7 @@ private:
 
     bool m_isValid;
     bool m_hasCustomRegionStyle;
+    RegionState m_regionState;
 };
 
 inline RenderRegion* toRenderRegion(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 82c344866..6bdb1831c 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -438,7 +438,7 @@ void RenderReplaced::computePreferredLogicalWidths()
     m_maxPreferredLogicalWidth = computeReplacedLogicalWidth(false) + borderAndPadding;
 
     if (style()->maxWidth().isFixed())
-        m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : 0));
+        m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : zeroLayoutUnit));
 
     if (style()->width().isPercent() || style()->height().isPercent()
         || style()->maxWidth().isPercent() || style()->maxHeight().isPercent()
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 5de2ddbda..1a42652db 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -232,14 +232,16 @@ void RenderTable::computeLogicalWidth()
         setLogicalWidth(convertStyleLogicalWidthToComputedWidth(styleLogicalWidth, containerWidthInInlineDirection));
     else {
         // Subtract out any fixed margins from our available width for auto width tables.
-        LayoutUnit marginTotal = 0;
-        if (!style()->marginStart().isAuto())
-            marginTotal += style()->marginStart().calcValue(availableLogicalWidth);
-        if (!style()->marginEnd().isAuto())
-            marginTotal += style()->marginEnd().calcValue(availableLogicalWidth);
-
+        LayoutUnit marginStart = style()->marginStart().calcMinValue(availableLogicalWidth);
+        LayoutUnit marginEnd = style()->marginEnd().calcMinValue(availableLogicalWidth);
+        LayoutUnit marginTotal = marginStart + marginEnd;
+        
         // Subtract out our margins to get the available content width.
         LayoutUnit availableContentLogicalWidth = max<LayoutUnit>(0, containerWidthInInlineDirection - marginTotal);
+        if (shrinkToAvoidFloats() && cb->containsFloats() && !hasPerpendicularContainingBlock) {
+            // FIXME: Work with regions someday.
+            availableContentLogicalWidth = shrinkLogicalWidthToAvoidFloats(marginStart, marginEnd, cb, 0, 0);
+        }
 
         // Ensure we aren't bigger than our available width.
         setLogicalWidth(min(availableContentLogicalWidth, maxPreferredLogicalWidth()));
@@ -272,7 +274,7 @@ LayoutUnit RenderTable::convertStyleLogicalWidthToComputedWidth(const Length& st
     bool isCSSTable = !node() || !node()->hasTagName(tableTag);
     if (isCSSTable && styleLogicalWidth.isFixed() && styleLogicalWidth.isPositive()) {
         recalcBordersInRowDirection();
-        borders = borderStart() + borderEnd() + (collapseBorders() ? 0 : paddingStart() + paddingEnd());
+        borders = borderStart() + borderEnd() + (collapseBorders() ? zeroLayoutUnit : paddingStart() + paddingEnd());
     }
     return styleLogicalWidth.calcMinValue(availableWidth) + borders;
 }
@@ -370,8 +372,8 @@ void RenderTable::layout()
         }
     }
 
-    LayoutUnit borderAndPaddingBefore = borderBefore() + (collapsing ? 0 : paddingBefore());
-    LayoutUnit borderAndPaddingAfter = borderAfter() + (collapsing ? 0 : paddingAfter());
+    LayoutUnit borderAndPaddingBefore = borderBefore() + (collapsing ? zeroLayoutUnit : paddingBefore());
+    LayoutUnit borderAndPaddingAfter = borderAfter() + (collapsing ? zeroLayoutUnit : paddingAfter());
 
     setLogicalHeight(logicalHeight() + borderAndPaddingBefore);
 
@@ -382,7 +384,7 @@ void RenderTable::layout()
     LayoutUnit computedLogicalHeight = 0;
     if (logicalHeightLength.isFixed()) {
         // HTML tables size as though CSS height includes border/padding, CSS tables do not.
-        LayoutUnit borders = node() && node()->hasTagName(tableTag) ? (borderAndPaddingBefore + borderAndPaddingAfter) : 0;
+        LayoutUnit borders = node() && node()->hasTagName(tableTag) ? (borderAndPaddingBefore + borderAndPaddingAfter) : zeroLayoutUnit;
         computedLogicalHeight = logicalHeightLength.value() - borders;
     } else if (logicalHeightLength.isPercent())
         computedLogicalHeight = computePercentageLogicalHeight(logicalHeightLength);
@@ -390,11 +392,11 @@ void RenderTable::layout()
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection())
-            // FIXME: Distribute extra height between all table body sections instead of giving it all to the first one.
-            toRenderTableSection(child)->layoutRows(child == m_firstBody ? max<LayoutUnit>(0, computedLogicalHeight - totalSectionLogicalHeight) : 0);
+            // FIXME: Distribute the extra logical height between all table sections instead of giving it all to the first one.
+            toRenderTableSection(child)->layoutRows(child == topSection() ? max<LayoutUnit>(0, computedLogicalHeight - totalSectionLogicalHeight) : 0);
     }
 
-    if (!m_firstBody && computedLogicalHeight > totalSectionLogicalHeight && !document()->inQuirksMode()) {
+    if (!topSection() && computedLogicalHeight > totalSectionLogicalHeight && !document()->inQuirksMode()) {
         // Completely empty tables (with no sections or anything) should at least honor specified height
         // in strict mode.
         setLogicalHeight(logicalHeight() + computedLogicalHeight);
@@ -617,7 +619,8 @@ void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& p
     LayoutRect rect(paintOffset, size());
     subtractCaptionRect(rect);
 
-    paintBoxShadow(paintInfo, rect, style(), Normal);
+    if (!boxShadowShouldBeAppliedToBackground(determineBackgroundBleedAvoidance(paintInfo.context)))
+        paintBoxShadow(paintInfo, rect, style(), Normal);
     paintBackground(paintInfo, rect);
     paintBoxShadow(paintInfo, rect, style(), Inset);
 
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index ba9fd3983..9a6557e03 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -172,7 +172,7 @@ public:
     LayoutUnit bordersPaddingAndSpacingInRowDirection() const
     {
         return borderStart() + borderEnd() +
-               (collapseBorders() ? 0 : (paddingStart() + paddingEnd() + (numEffCols() + 1) * hBorderSpacing()));
+               (collapseBorders() ? zeroLayoutUnit : (paddingStart() + paddingEnd() + (numEffCols() + 1) * hBorderSpacing()));
     }
 
     RenderTableCol* colElement(unsigned col, bool* startEdge = 0, bool* endEdge = 0) const;
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 5b690f4c7..434ac0d69 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -91,6 +91,25 @@ void RenderTableCell::colSpanOrRowSpanChanged()
         section()->setNeedsCellRecalc();
 }
 
+LayoutUnit RenderTableCell::logicalHeightForRowSizing() const
+{
+    LayoutUnit adjustedLogicalHeight = logicalHeight() - (intrinsicPaddingBefore() + intrinsicPaddingAfter());
+
+    LayoutUnit styleLogicalHeight = style()->logicalHeight().calcValue(0);
+    if (document()->inQuirksMode() || style()->boxSizing() == BORDER_BOX) {
+        // Explicit heights use the border box in quirks mode.
+        // Don't adjust height.
+    } else {
+        // In strict mode, box-sizing: content-box do the right
+        // thing and actually add in the border and padding.
+        LayoutUnit adjustedPaddingBefore = paddingBefore() - intrinsicPaddingBefore();
+        LayoutUnit adjustedPaddingAfter = paddingAfter() - intrinsicPaddingAfter();
+        styleLogicalHeight += adjustedPaddingBefore + adjustedPaddingAfter + borderBefore() + borderAfter();
+    }
+
+    return max(styleLogicalHeight, adjustedLogicalHeight);
+}
+
 Length RenderTableCell::styleOrColLogicalWidth() const
 {
     Length w = style()->logicalWidth();
@@ -1068,6 +1087,11 @@ void RenderTableCell::paintMask(PaintInfo& paintInfo, const LayoutPoint& paintOf
     paintMaskImages(paintInfo, LayoutRect(paintOffset, size()));
 }
 
+bool RenderTableCell::boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance, InlineFlowBox*) const
+{
+    return false;
+}
+
 void RenderTableCell::scrollbarsChanged(bool horizontalScrollbarChanged, bool verticalScrollbarChanged)
 {
     LayoutUnit scrollbarHeight = scrollbarLogicalHeight();
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
index 2548b4713..e0b4a0558 100644
--- a/Source/WebCore/rendering/RenderTableCell.h
+++ b/Source/WebCore/rendering/RenderTableCell.h
@@ -85,6 +85,8 @@ public:
 
     Length styleOrColLogicalWidth() const;
 
+    LayoutUnit logicalHeightForRowSizing() const;
+
     virtual void computePreferredLogicalWidths();
 
     void updateLogicalWidth(LayoutUnit);
@@ -151,6 +153,8 @@ private:
     virtual void paintBoxDecorations(PaintInfo&, const LayoutPoint&);
     virtual void paintMask(PaintInfo&, const LayoutPoint&);
 
+    virtual bool boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance, InlineFlowBox*) const OVERRIDE;
+
     virtual LayoutSize offsetFromContainer(RenderObject*, const LayoutPoint&) const;
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, LayoutRect&, bool fixed = false) const;
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index fd55a6321..844209c8d 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -334,14 +334,10 @@ int RenderTableSection::calcRowLogicalHeight()
     m_rowPos[0] = spacing;
 
     for (unsigned r = 0; r < m_grid.size(); r++) {
-        m_rowPos[r + 1] = 0;
-        m_grid[r].baseline = 0;
-        LayoutUnit baseline = 0;
-        int bdesc = 0;
-        int ch = m_grid[r].logicalHeight.calcMinValue(0);
-        int pos = m_rowPos[r] + ch + (m_grid[r].rowRenderer ? spacing : 0);
+        LayoutUnit baselineDescent = 0;
 
-        m_rowPos[r + 1] = max(m_rowPos[r + 1], pos);
+        // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
+        m_rowPos[r + 1] = max(m_rowPos[r] + m_grid[r].logicalHeight.calcMinValue(0), 0);
 
         Row& row = m_grid[r].row;
         unsigned totalCols = row.size();
@@ -353,10 +349,13 @@ int RenderTableSection::calcRowLogicalHeight()
             if (!cell || current.inColSpan)
                 continue;
 
-            if ((cell->row() + cell->rowSpan() - 1) > r)
+            // FIXME: We are always adding the height of a rowspan to the last rows which doesn't match
+            // other browsers. See webkit.org/b/52185 for example.
+            if ((cell->row() + cell->rowSpan() - 1) != r)
                 continue;
 
-            unsigned indx = max(r - cell->rowSpan() + 1, 0u);
+            // For row spanning cells, |r| is the last row in the span.
+            unsigned cellStartRow = cell->row();
 
             if (cell->hasOverrideHeight()) {
                 if (!statePusher.didPush()) {
@@ -370,43 +369,27 @@ int RenderTableSection::calcRowLogicalHeight()
                 cell->layoutIfNeeded();
             }
 
-            int adjustedLogicalHeight = cell->logicalHeight() - (cell->intrinsicPaddingBefore() + cell->intrinsicPaddingAfter());
-
-            ch = cell->style()->logicalHeight().calcValue(0);
-            if (document()->inQuirksMode() || cell->style()->boxSizing() == BORDER_BOX) {
-                // Explicit heights use the border box in quirks mode.
-                // Don't adjust height.
-            } else {
-                // In strict mode, box-sizing: content-box do the right
-                // thing and actually add in the border and padding.
-                int adjustedPaddingBefore = cell->paddingBefore() - cell->intrinsicPaddingBefore();
-                int adjustedPaddingAfter = cell->paddingAfter() - cell->intrinsicPaddingAfter();
-                ch += adjustedPaddingBefore + adjustedPaddingAfter + cell->borderBefore() + cell->borderAfter();
-            }
-            ch = max(ch, adjustedLogicalHeight);
-
-            pos = m_rowPos[indx] + ch + (m_grid[r].rowRenderer ? spacing : 0);
-
-            m_rowPos[r + 1] = max(m_rowPos[r + 1], pos);
+            int cellLogicalHeight = cell->logicalHeightForRowSizing();
+            m_rowPos[r + 1] = max(m_rowPos[r + 1], m_rowPos[cellStartRow] + cellLogicalHeight);
 
             // find out the baseline
             EVerticalAlign va = cell->style()->verticalAlign();
             if (va == BASELINE || va == TEXT_BOTTOM || va == TEXT_TOP || va == SUPER || va == SUB) {
-                int b = cell->cellBaselinePosition();
-                if (b > cell->borderBefore() + cell->paddingBefore()) {
-                    baseline = max<LayoutUnit>(baseline, b - cell->intrinsicPaddingBefore());
-                    bdesc = max(bdesc, m_rowPos[indx] + ch - (b - cell->intrinsicPaddingBefore()));
+                int baselinePosition = cell->cellBaselinePosition();
+                if (baselinePosition > cell->borderBefore() + cell->paddingBefore()) {
+                    m_grid[r].baseline = max(m_grid[r].baseline, baselinePosition - cell->intrinsicPaddingBefore());
+                    baselineDescent = max(baselineDescent, m_rowPos[cellStartRow] + cellLogicalHeight - (baselinePosition - cell->intrinsicPaddingBefore()));
                 }
             }
         }
 
         // do we have baseline aligned elements?
-        if (baseline) {
+        if (m_grid[r].baseline)
             // increase rowheight if baseline requires
-            m_rowPos[r + 1] = max(m_rowPos[r + 1], baseline + bdesc + (m_grid[r].rowRenderer ? spacing : 0));
-            m_grid[r].baseline = baseline;
-        }
+            m_rowPos[r + 1] = max(m_rowPos[r + 1], m_grid[r].baseline + baselineDescent);
 
+        // Add the border-spacing to our final position.
+        m_rowPos[r + 1] += m_grid[r].rowRenderer ? spacing : 0;
         m_rowPos[r + 1] = max(m_rowPos[r + 1], m_rowPos[r]);
     }
 
@@ -1306,6 +1289,9 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
     }
 
     LayoutUnit offsetInColumnDirection = style()->isHorizontalWritingMode() ? location.y() : location.x();
+    
+    recalcCellsIfNeeded();
+
     // Find the first row that starts after offsetInColumnDirection.
     unsigned nextRow = std::upper_bound(m_rowPos.begin(), m_rowPos.end(), offsetInColumnDirection) - m_rowPos.begin();
     if (nextRow == m_rowPos.size())
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index f6c0373eb..f2408dbcc 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -300,7 +300,7 @@ void RenderText::deleteTextBoxes()
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
     Node* e = node();
-    return (e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : 0;
+    return (e && e->isTextNode()) ? toText(e)->dataImpl() : 0;
 }
 
 void RenderText::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
diff --git a/Source/WebCore/rendering/RenderTextControl.h b/Source/WebCore/rendering/RenderTextControl.h
index 744878af4..aa936e7a0 100644
--- a/Source/WebCore/rendering/RenderTextControl.h
+++ b/Source/WebCore/rendering/RenderTextControl.h
@@ -70,7 +70,6 @@ private:
     virtual bool isTextControl() const { return true; }
     virtual void computePreferredLogicalWidths();
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
-    virtual bool canHaveChildren() const { return false; }
     virtual bool avoidsFloats() const { return true; }
     
     virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index a86850ce4..a44e2886c 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -60,7 +60,7 @@ VisiblePosition RenderTextControlInnerBlock::positionForPoint(const LayoutPoint&
     if (m_multiLine) {
         RenderTextControl* renderer = toRenderTextControl(node()->shadowAncestorNode()->renderer());
         if (renderer->hasOverflowClip())
-            contentsPoint += renderer->layer()->scrolledContentOffset();
+            contentsPoint += renderer->scrolledContentOffset();
     }
 
     return RenderBlock::positionForPoint(contentsPoint);
@@ -175,7 +175,7 @@ void RenderTextControlSingleLine::showPopup()
         m_searchPopup->saveRecentSearches(name, m_recentSearches);
     }
 
-    m_searchPopup->popupMenu()->show(absoluteBoundingBoxRect(), document()->view(), -1);
+    m_searchPopup->popupMenu()->show(pixelSnappedIntRect(absoluteBoundingBoxRect()), document()->view(), -1);
 }
 
 void RenderTextControlSingleLine::hidePopup()
@@ -196,7 +196,7 @@ void RenderTextControlSingleLine::paint(PaintInfo& paintInfo, const LayoutPoint&
 
         // Convert the rect into the coords used for painting the content
         contentsRect.moveBy(paintOffset + location());
-        theme()->paintCapsLockIndicator(this, paintInfo, contentsRect);
+        theme()->paintCapsLockIndicator(this, paintInfo, pixelSnappedIntRect(contentsRect));
     }
 }
 
@@ -332,7 +332,7 @@ void RenderTextControlSingleLine::styleDidChange(StyleDifference diff, const Ren
         containerRenderer->style()->setWidth(Length());
     }
     if (HTMLElement* placeholder = inputElement()->placeholderElement())
-        placeholder->ensureInlineStyleDecl()->setProperty(CSSPropertyTextOverflow, textShouldBeTruncated() ? CSSValueEllipsis : CSSValueClip);
+        placeholder->setInlineStyleProperty(CSSPropertyTextOverflow, textShouldBeTruncated() ? CSSValueEllipsis : CSSValueClip);
     setHasOverflowClip(false);
 }
 
diff --git a/Source/WebCore/rendering/RenderTextFragment.cpp b/Source/WebCore/rendering/RenderTextFragment.cpp
index 17c9d7b77..ff4082422 100644
--- a/Source/WebCore/rendering/RenderTextFragment.cpp
+++ b/Source/WebCore/rendering/RenderTextFragment.cpp
@@ -52,7 +52,7 @@ RenderTextFragment::~RenderTextFragment()
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
-    RefPtr<StringImpl> result = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
+    RefPtr<StringImpl> result = ((e && e->isTextNode()) ? toText(e)->dataImpl() : contentString());
     if (!result)
         return 0;
     return result->substring(start(), end());
@@ -95,7 +95,7 @@ UChar RenderTextFragment::previousCharacter() const
 {
     if (start()) {
         Node* e = node();
-        StringImpl*  original = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
+        StringImpl* original = ((e && e->isTextNode()) ? toText(e)->dataImpl() : contentString());
         if (original && start() <= original->length())
             return (*original)[start() - 1];
     }
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index d93a27e25..6be2f5efb 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -1,7 +1,7 @@
 /**
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -1125,18 +1125,21 @@ Color RenderTheme::focusRingColor()
     return customFocusRingColor().isValid() ? customFocusRingColor() : defaultTheme()->platformFocusRingColor();
 }
 
-String RenderTheme::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed)
+String RenderTheme::fileListDefaultLabel(bool multipleFilesAllowed) const
+{
+    if (multipleFilesAllowed)
+        return fileButtonNoFilesSelectedLabel();
+    return fileButtonNoFileSelectedLabel();
+}
+
+String RenderTheme::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed) const
 {
     if (width <= 0)
         return String();
 
     String string;
-    if (filenames.isEmpty()) {
-        if (multipleFilesAllowed)
-            string = fileButtonNoFilesSelectedLabel();
-        else
-            string = fileButtonNoFileSelectedLabel();
-    }
+    if (filenames.isEmpty())
+        string = fileListDefaultLabel(multipleFilesAllowed);
     else if (filenames.size() == 1)
         string = pathGetFileName(filenames[0]);
     else
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index c243b78a5..f65b8523f 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -1,7 +1,7 @@
 /*
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -214,7 +214,8 @@ public:
     virtual bool popsMenuByArrowKeys() const { return false; }
     virtual bool popsMenuBySpaceOrReturn() const { return false; }
 
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed);
+    virtual String fileListDefaultLabel(bool multipleFilesAllowed) const;
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed) const;
 
 protected:
     // The platform selection color.
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
index c45fc2086..88ac3a8d6 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
@@ -63,6 +63,12 @@ Color RenderThemeChromiumAndroid::systemColor(int cssValueId) const
     return RenderTheme::systemColor(cssValueId);
 }
 
+String RenderThemeChromiumAndroid::extraDefaultStyleSheet()
+{
+    return RenderThemeChromiumLinux::extraDefaultStyleSheet() +
+        String(themeChromiumAndroidUserAgentStyleSheet, sizeof(themeChromiumAndroidUserAgentStyleSheet));
+}
+
 void RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     if (PlatformSupport::layoutTestMode()) {
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
index e7b9d9885..5fb12bc02 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
@@ -33,14 +33,25 @@ namespace WebCore {
 class RenderThemeChromiumAndroid : public RenderThemeChromiumLinux {
 public:
     static PassRefPtr<RenderTheme> create();
+    virtual String extraDefaultStyleSheet() OVERRIDE;
 
-    virtual Color systemColor(int cssValidId) const;
+    virtual Color systemColor(int cssValidId) const OVERRIDE;
 
-    virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const OVERRIDE;
+
+    virtual bool delegatesMenuListRendering() const OVERRIDE { return true; }
+
+#if ENABLE(TOUCH_EVENTS)
+    virtual Color platformTapHighlightColor() const OVERRIDE
+    {
+        return RenderThemeChromiumAndroid::defaultTapHighlightColor;
+    }
+#endif
 
 private:
     virtual ~RenderThemeChromiumAndroid();
 
+    static const RGBA32 defaultTapHighlightColor = 0x6633b5e5;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index dc1af04d0..25065c422 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -1,7 +1,7 @@
 /*
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -175,7 +175,7 @@ protected:
     virtual bool shouldShowPlaceholderWhenFocused() const;
 
 private:
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed);
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed) const;
 
     LayoutRect inflateRect(const LayoutRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
 
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index e405f6ceb..cd566e859 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -2115,18 +2115,14 @@ NSTextFieldCell* RenderThemeMac::textField() const
     return m_textField.get();
 }
 
-String RenderThemeMac::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed)
+String RenderThemeMac::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed) const
 {
     if (width <= 0)
         return String();
 
     String strToTruncate;
-    if (filenames.isEmpty()) {
-        if (multipleFilesAllowed)
-            strToTruncate = fileButtonNoFilesSelectedLabel();
-        else
-            strToTruncate = fileButtonNoFileSelectedLabel();
-    }
+    if (filenames.isEmpty())
+        strToTruncate = fileListDefaultLabel(multipleFilesAllowed);
     else if (filenames.size() == 1)
         strToTruncate = [[NSFileManager defaultManager] displayNameAtPath:(filenames[0])];
     else
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index 06e0fe98e..4cb4c0e67 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -69,7 +69,7 @@
 #endif
 
 #if PLATFORM(QT)
-#include <QWidget>
+#include <QVariant>
 #endif
 
 namespace WebCore {
@@ -475,14 +475,13 @@ void RenderTreeAsText::writeRenderObject(TextStream& ts, const RenderObject& o,
     if (o.isRenderPart()) {
         const RenderPart* part = toRenderPart(const_cast<RenderObject*>(&o));
         if (part->widget() && part->widget()->platformWidget()) {
-            QWidget* wid = part->widget()->platformWidget();
+            QObject* wid = part->widget()->platformWidget();
 
             ts << " [QT: ";
-            ts << "geometry: {" << wid->geometry() << "} ";
-            ts << "isHidden: " << wid->isHidden() << " ";
+            ts << "geometry: {" << wid->property("geometry").toRect() << "} ";
+            ts << "isHidden: " << !wid->property("isVisible").toBool() << " ";
             ts << "isSelfVisible: " << part->widget()->isSelfVisible() << " ";
-            ts << "isParentVisible: " << part->widget()->isParentVisible() << " ";
-            ts << "mask: {" << wid->mask().boundingRect() << "} ] ";
+            ts << "isParentVisible: " << part->widget()->isParentVisible() << " ] ";
         }
     }
 #endif
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index 2c9565134..ad5a03fd2 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -308,7 +308,7 @@ void RenderWidget::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     // Paint a partially transparent wash over selected widgets.
     if (isSelected() && !document()->printing()) {
         // FIXME: selectionRect() is in absolute, not painting coordinates.
-        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
+        paintInfo.context->fillRect(pixelSnappedIntRect(selectionRect()), selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 2acfaf02c..8d84bfe61 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -286,7 +286,7 @@ LayoutUnit RootInlineBox::alignBoxesInBlockDirection(LayoutUnit heightOfBlock, G
         heightOfBlock += annotationsAdjustment;
     }
 
-    LayoutUnit gridSnapAdjustment = lineGridSnapAdjustment();
+    LayoutUnit gridSnapAdjustment = lineSnapAdjustment();
     if (gridSnapAdjustment) {
         adjustBlockDirectionPosition(gridSnapAdjustment);
         heightOfBlock += gridSnapAdjustment;
@@ -326,11 +326,11 @@ int RootInlineBox::beforeAnnotationsAdjustment() const
     return result;
 }
 
-LayoutUnit RootInlineBox::lineGridSnapAdjustment(LayoutUnit delta) const
+LayoutUnit RootInlineBox::lineSnapAdjustment(LayoutUnit delta) const
 {
     // If our block doesn't have snapping turned on, do nothing.
     // FIXME: Implement bounds snapping.
-    if (block()->style()->lineGridSnap() == LineGridSnapNone)
+    if (block()->style()->lineSnap() == LineSnapNone)
         return 0;
 
     // Get the current line grid and offset.
@@ -377,7 +377,7 @@ LayoutUnit RootInlineBox::lineGridSnapAdjustment(LayoutUnit delta) const
             firstTextTop = pageLogicalTop + lineGridBox->logicalTop() - lineGrid->borderBefore() - lineGrid->paddingBefore() + lineGridPaginationOrigin;
     }
 
-    if (block()->style()->lineGridSnap() == LineGridSnapContain) {
+    if (block()->style()->lineSnap() == LineSnapContain) {
         // Compute the desired offset from the text-top of a grid line.
         // Look at our height (logicalHeight()).
         // Look at the total available height. It's going to be (textBottom - textTop) + (n-1)*(multiple with leading)
@@ -414,7 +414,7 @@ LayoutUnit RootInlineBox::lineGridSnapAdjustment(LayoutUnit delta) const
         return result;
     
     // Put ourselves at the top of the next page to force a snap onto the new grid established by that page.
-    return lineGridSnapAdjustment(newPageLogicalTop - (blockOffset + lineTopWithLeading()));
+    return lineSnapAdjustment(newPageLogicalTop - (blockOffset + lineTopWithLeading()));
 }
 
 GapRects RootInlineBox::lineSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock, 
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index fef7ced22..901bcff24 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -183,7 +183,7 @@ public:
 private:
     void setHasEllipsisBox(bool hasEllipsisBox) { m_hasEllipsisBoxOrHyphen = hasEllipsisBox; }
     
-    LayoutUnit lineGridSnapAdjustment(LayoutUnit delta = 0) const;
+    LayoutUnit lineSnapAdjustment(LayoutUnit delta = 0) const;
 
     int beforeAnnotationsAdjustment() const;
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
index 2bdccec2c..167eeb21a 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
@@ -49,7 +49,7 @@ bool RenderMathMLBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
     return child->node() && child->node()->nodeType() == Node::ELEMENT_NODE;
 }
 
-PassRefPtr<RenderStyle> RenderMathMLBlock::makeBlockStyle()
+PassRefPtr<RenderStyle> RenderMathMLBlock::createBlockStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
@@ -57,14 +57,6 @@ PassRefPtr<RenderStyle> RenderMathMLBlock::makeBlockStyle()
     return newStyle;
 }
 
-int RenderMathMLBlock::nonOperatorHeight() const
-{
-    if (!isRenderMathMLOperator())
-        return offsetHeight();
-        
-    return 0;
-}
-
 void RenderMathMLBlock::stretchToHeight(int height) 
 {
     for (RenderObject* current = firstChild(); current; current = current->nextSibling())
@@ -82,7 +74,7 @@ void RenderMathMLBlock::paint(PaintInfo& info, const LayoutPoint& paintOffset)
     if (info.context->paintingDisabled() || info.phase != PaintPhaseForeground)
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
 
     GraphicsContextStateSaver stateSaver(*info.context);
     
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
index 4d8184bcf..5d4d780ed 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
@@ -34,6 +34,8 @@
 
 namespace WebCore {
     
+class RenderMathMLOperator;
+
 class RenderMathMLBlock : public RenderBlock {
 public:
     RenderMathMLBlock(Node* container);
@@ -43,8 +45,15 @@ public:
     virtual bool isRenderMathMLOperator() const { return false; }
     virtual bool isRenderMathMLRow() const { return false; }
     virtual bool isRenderMathMLMath() const { return false; }
-    virtual bool hasBase() const { return false; }
-    virtual int nonOperatorHeight() const;
+    
+    // MathML defines an "embellished operator" as roughly an <mo> that may have subscripts,
+    // superscripts, underscripts, overscripts, or a denominator (as in d/dx, where "d" is some
+    // differential operator). The padding, precedence, and stretchiness of the base <mo> should
+    // apply to the embellished operator as a whole. unembellishedOperator() checks for being an
+    // embellished operator, and omits any embellishments.
+    // FIXME: We don't yet handle all the cases in the MathML spec. See
+    // https://bugs.webkit.org/show_bug.cgi?id=78617.
+    virtual RenderMathMLOperator* unembellishedOperator() { return 0; }
     virtual void stretchToHeight(int height);
 
 #if ENABLE(DEBUG_MATH_LAYOUT)
@@ -70,7 +79,7 @@ protected:
         
         return 0;
     }
-    virtual PassRefPtr<RenderStyle> makeBlockStyle();
+    virtual PassRefPtr<RenderStyle> createBlockStyle();
 
 private:
     virtual const char* renderName() const { return isAnonymous() ? "RenderMathMLBlock (anonymous)" : "RenderMathMLBlock"; }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
index 55da1a5ec..c2f67ea93 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
@@ -44,8 +44,8 @@ enum Braces { OpeningBraceChar = 0x28, ClosingBraceChar = 0x29 };
     
 static const float gOperatorPadding = 0.1f;
 
-RenderMathMLFenced::RenderMathMLFenced(Node* fenced) 
-    : RenderMathMLRow(fenced)
+RenderMathMLFenced::RenderMathMLFenced(Element* element)
+    : RenderMathMLRow(element)
     , m_open(OpeningBraceChar)
     , m_close(ClosingBraceChar)
 {
@@ -63,7 +63,7 @@ void RenderMathMLFenced::updateFromElement()
     if (closeValue.length() > 0)
         m_close = closeValue[0];
     
-    AtomicString separators = static_cast<Element*>(fenced)->getAttribute(MathMLNames::separatorsAttr);
+    AtomicString separators = fenced->getAttribute(MathMLNames::separatorsAttr);
     if (!separators.isNull()) {
         StringBuilder characters;
         for (unsigned int i = 0; i < separators.length(); i++) {
@@ -80,22 +80,22 @@ void RenderMathMLFenced::updateFromElement()
         makeFences();
 }
 
-RefPtr<RenderStyle> RenderMathMLFenced::makeOperatorStyle() 
+PassRefPtr<RenderStyle> RenderMathMLFenced::createOperatorStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
     newStyle->setDisplay(INLINE_BLOCK);
     newStyle->setPaddingRight(Length(static_cast<int>(gOperatorPadding * style()->fontSize()), Fixed));
-    return newStyle;
+    return newStyle.release();
 }
 
 void RenderMathMLFenced::makeFences()
 {
     RenderObject* openFence = new (renderArena()) RenderMathMLOperator(node(), m_open);
-    openFence->setStyle(makeOperatorStyle().release());
+    openFence->setStyle(createOperatorStyle());
     RenderBlock::addChild(openFence, firstChild());
     RenderObject* closeFence = new (renderArena()) RenderMathMLOperator(node(), m_close);
-    closeFence->setStyle(makeOperatorStyle().release());
+    closeFence->setStyle(createOperatorStyle());
     RenderBlock::addChild(closeFence);
 }
 
@@ -122,7 +122,7 @@ void RenderMathMLFenced::addChild(RenderObject* child, RenderObject*)
                 separator = (*m_separators.get())[count - 2];
                 
             RenderObject* separatorObj = new (renderArena()) RenderMathMLOperator(node(), separator);
-            separatorObj->setStyle(makeOperatorStyle().release());
+            separatorObj->setStyle(createOperatorStyle());
             RenderBlock::addChild(separatorObj, lastChild());
         }
     }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFenced.h b/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
index 9707b3ae6..b2bca9971 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
@@ -34,15 +34,16 @@ namespace WebCore {
     
 class RenderMathMLFenced : public RenderMathMLRow {
 public:
-    RenderMathMLFenced(Node *fraction);
+    RenderMathMLFenced(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void updateFromElement();
     
 private:
     virtual const char* renderName() const { return "RenderMathMLFenced"; }
 
+    PassRefPtr<RenderStyle> createOperatorStyle();
     void makeFences();
-    RefPtr<RenderStyle> makeOperatorStyle();
+    
     UChar m_open;
     UChar m_close;
     RefPtr<StringImpl> m_separators;
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
index aeaab20f7..dd59bb998 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
@@ -46,8 +46,8 @@ static const float gLineThick = 3.f;
 static const float gFractionBarWidth = 0.05f;
 static const float gDenominatorPad = 0.1f;
 
-RenderMathMLFraction::RenderMathMLFraction(Element* fraction) 
-    : RenderMathMLBlock(fraction)
+RenderMathMLFraction::RenderMathMLFraction(Element* element)
+    : RenderMathMLBlock(element)
     , m_lineThickness(gLineMedium)
 {
     setChildrenInline(false);
@@ -101,7 +101,7 @@ void RenderMathMLFraction::updateFromElement()
 void RenderMathMLFraction::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     RenderBlock* row = new (renderArena()) RenderMathMLBlock(node());
-    RefPtr<RenderStyle> rowStyle = makeBlockStyle();
+    RefPtr<RenderStyle> rowStyle = createBlockStyle();
     
     rowStyle->setTextAlign(CENTER);
     Length pad(static_cast<int>(rowStyle->fontSize() * gHorizontalPad), Fixed);
@@ -119,6 +119,17 @@ void RenderMathMLFraction::addChild(RenderObject* child, RenderObject* beforeChi
     updateFromElement();
 }
 
+RenderMathMLOperator* RenderMathMLFraction::unembellishedOperator()
+{
+    RenderObject* numeratorWrapper = firstChild();
+    if (!numeratorWrapper)
+        return 0;
+    RenderObject* numerator = numeratorWrapper->firstChild();
+    if (!numerator || !numerator->isRenderMathMLBlock())
+        return 0;
+    return toRenderMathMLBlock(numerator)->unembellishedOperator();
+}
+
 void RenderMathMLFraction::layout()
 {
     updateFromElement();
@@ -153,7 +164,7 @@ void RenderMathMLFraction::paint(PaintInfo& info, const LayoutPoint& paintOffset
             verticalOffset = numerator->offsetHeight();        
     }
     
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
     adjustedPaintOffset.setY(adjustedPaintOffset.y() + verticalOffset);
     
     GraphicsContextStateSaver stateSaver(*info.context);
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFraction.h b/Source/WebCore/rendering/mathml/RenderMathMLFraction.h
index 3971a1e13..4756583b6 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFraction.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFraction.h
@@ -35,15 +35,20 @@ namespace WebCore {
 
 class RenderMathMLFraction : public RenderMathMLBlock {
 public:
-    RenderMathMLFraction(Element* fraction);
+    RenderMathMLFraction(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void updateFromElement();
+    
+    virtual RenderMathMLOperator* unembellishedOperator();
+    
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const; 
     virtual void paint(PaintInfo&, const LayoutPoint&);
 protected:
     virtual void layout();
+    
 private:
     virtual const char* renderName() const { return "RenderMathMLFraction"; }
+    
     float m_lineThickness;
 };
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp b/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp
index 006fea31c..15e2bbdbe 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp
@@ -35,8 +35,8 @@ namespace WebCore {
 
 using namespace MathMLNames;
 
-RenderMathMLMath::RenderMathMLMath(Node* math)
-    : RenderMathMLRow(math)
+RenderMathMLMath::RenderMathMLMath(Element* element)
+    : RenderMathMLRow(element)
 {
 }
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLMath.h b/Source/WebCore/rendering/mathml/RenderMathMLMath.h
index a81d5a890..aaa2f4f12 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLMath.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLMath.h
@@ -34,7 +34,7 @@ namespace WebCore {
     
 class RenderMathMLMath : public RenderMathMLRow {
 public:
-    RenderMathMLMath(Node* container);
+    RenderMathMLMath(Element*);
     virtual bool isRenderMathMLMath() const { return true; }
 
 private:
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
index 2702c0656..ad11d8bac 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
@@ -38,15 +38,15 @@ namespace WebCore {
     
 using namespace MathMLNames;
 
-RenderMathMLOperator::RenderMathMLOperator(Node* container)
-    : RenderMathMLBlock(container)
+RenderMathMLOperator::RenderMathMLOperator(Element* element)
+    : RenderMathMLBlock(element)
     , m_stretchHeight(0)
     , m_operator(0)
 {
 }
 
-RenderMathMLOperator::RenderMathMLOperator(Node* container, UChar operatorChar)
-    : RenderMathMLBlock(container)
+RenderMathMLOperator::RenderMathMLOperator(Node* node, UChar operatorChar)
+    : RenderMathMLBlock(node)
     , m_stretchHeight(0)
     , m_operator(convertHyphenMinusToMinusSign(operatorChar))
 {
@@ -139,7 +139,7 @@ void RenderMathMLOperator::updateFromElement()
     // This boolean indicates whether stretching is disabled via the markup.
     bool stretchDisabled = false;
     
-    // We made need the element later if we can't stretch.
+    // We may need the element later if we can't stretch.
     if (node()->nodeType() == Node::ELEMENT_NODE) {
         if (Element* mo = static_cast<Element*>(node())) {
             AtomicString stretchyAttr = mo->getAttribute(MathMLNames::stretchyAttr);
@@ -282,7 +282,7 @@ void RenderMathMLOperator::updateFromElement()
     }
 }
 
-RefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int size, int topRelative)
+PassRefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int size, int topRelative)
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
@@ -307,13 +307,13 @@ RefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int size, int top
         newStyle->setPosition(RelativePosition);
     }
 
-    return newStyle;
+    return newStyle.release();
 }
 
 RenderBlock* RenderMathMLOperator::createGlyph(UChar glyph, int size, int charRelative, int topRelative)
 {
     RenderBlock* container = new (renderArena()) RenderMathMLBlock(node());
-    container->setStyle(createStackableStyle(size, topRelative).release());
+    container->setStyle(createStackableStyle(size, topRelative));
     addChild(container);
     RenderBlock* parent = container;
     if (charRelative) {
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
index 5ee0660f5..42708724a 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
@@ -35,9 +35,10 @@ namespace WebCore {
     
 class RenderMathMLOperator : public RenderMathMLBlock {
 public:
-    RenderMathMLOperator(Node* container);
-    RenderMathMLOperator(Node* container, UChar operatorChar);
+    RenderMathMLOperator(Element*);
+    RenderMathMLOperator(Node*, UChar operatorChar);
     virtual bool isRenderMathMLOperator() const { return true; }
+    virtual RenderMathMLOperator* unembellishedOperator() { return this; }
     virtual void stretchToHeight(int pixelHeight);
     virtual void updateFromElement(); 
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
@@ -45,7 +46,7 @@ public:
         
 protected:
     virtual void layout();
-    virtual RefPtr<RenderStyle> createStackableStyle(int size, int topRelative);
+    virtual PassRefPtr<RenderStyle> createStackableStyle(int size, int topRelative);
     virtual RenderBlock* createGlyph(UChar glyph, int size = 0, int charRelative = 0, int topRelative = 0);
     
 private:
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
index 24e79ba7e..07e8ff911 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
@@ -64,8 +64,8 @@ const float gRadicalLineThickness = 0.02f;
 // Radical thick line thickness (%)
 const float gRadicalThickLineThickness = 0.1f;
     
-RenderMathMLRoot::RenderMathMLRoot(Node *expression) 
-: RenderMathMLBlock(expression) 
+RenderMathMLRoot::RenderMathMLRoot(Element* element)
+    : RenderMathMLBlock(element)
 {
 }
 
@@ -74,7 +74,7 @@ void RenderMathMLRoot::addChild(RenderObject* child, RenderObject* )
     if (isEmpty()) {
         // Add a block for the index
         RenderBlock* block = new (renderArena()) RenderBlock(node());
-        RefPtr<RenderStyle> indexStyle = makeBlockStyle();
+        RefPtr<RenderStyle> indexStyle = createBlockStyle();
         indexStyle->setDisplay(INLINE_BLOCK);
         block->setStyle(indexStyle.release());
         RenderBlock::addChild(block);
@@ -82,7 +82,7 @@ void RenderMathMLRoot::addChild(RenderObject* child, RenderObject* )
         // FIXME: the wrapping does not seem to be needed anymore.
         // this is the base, so wrap it so we can pad it
         block = new (renderArena()) RenderBlock(node());
-        RefPtr<RenderStyle> baseStyle = makeBlockStyle();
+        RefPtr<RenderStyle> baseStyle = createBlockStyle();
         baseStyle->setDisplay(INLINE_BLOCK);
         baseStyle->setPaddingLeft(Length(5 * gRadicalWidth , Percent));
         block->setStyle(baseStyle.release());
@@ -104,7 +104,7 @@ void RenderMathMLRoot::paint(PaintInfo& info, const LayoutPoint& paintOffset)
     if (!firstChild() || !lastChild())
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
     
     RenderBoxModelObject* indexBox = toRenderBoxModelObject(lastChild());
     
@@ -232,7 +232,8 @@ void RenderMathMLRoot::layout()
     
     LayoutUnit indexShift = indexBox->offsetWidth() + topStartShift;
     LayoutUnit radicalHeight = static_cast<LayoutUnit>((1 - gRadicalTopLeftPointYPos) * maxHeight);
-    LayoutUnit rootMarginTop = radicalHeight + style()->paddingBottom().value() + indexBox->offsetHeight() - (maxHeight + static_cast<LayoutUnit>(gRootPadding * style()->fontSize()));
+    LayoutUnit rootMarginTop = radicalHeight + style()->paddingBottom().value() + indexBox->offsetHeight()
+        - (maxHeight + static_cast<LayoutUnit>(gRootPadding * style()->fontSize()));
     
     style()->setPaddingLeft(Length(indexShift, Fixed));
     if (rootMarginTop > 0)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
index ab3e4f057..19b2ec6ec 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
@@ -34,7 +34,7 @@ namespace WebCore {
     
 class RenderMathMLRoot : public RenderMathMLBlock {
 public:
-    RenderMathMLRoot(Node* fraction);
+    RenderMathMLRoot(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void paint(PaintInfo&, const LayoutPoint&);
 protected:
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
index 922fa9245..203d194de 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
@@ -36,57 +36,23 @@ namespace WebCore {
 
 using namespace MathMLNames;
 
-RenderMathMLRow::RenderMathMLRow(Node* row)
-    : RenderMathMLBlock(row)
+RenderMathMLRow::RenderMathMLRow(Element* element)
+    : RenderMathMLBlock(element)
 {
 }
 
-int RenderMathMLRow::nonOperatorHeight() const
-{
-    int maxHeight = 0;
-    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
-        if (current->isRenderMathMLBlock()) {
-            RenderMathMLBlock* block = toRenderMathMLBlock(current);
-            int blockHeight = block->nonOperatorHeight();
-            // Check to see if this box has a larger height
-            if (blockHeight > maxHeight)
-                maxHeight = blockHeight;
-        } else if (current->isBoxModelObject()) {
-            RenderBoxModelObject* box = toRenderBoxModelObject(current);
-            // Check to see if this box has a larger height
-            if (box->offsetHeight() > maxHeight)
-                maxHeight = box->offsetHeight();
-        }
-        
-    }
-    return maxHeight;
-}
-
 void RenderMathMLRow::layout() 
 {
     RenderBlock::layout();
     
     LayoutUnit maxHeight = 0;
-    int childCount = 0;
-    int operatorCount = 0;
 
     // Calculate the non-operator max height of the row.
-    LayoutUnit operatorHeight = 0;
     for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
-        childCount++;
         if (current->isRenderMathMLBlock()) {
             RenderMathMLBlock* block = toRenderMathMLBlock(current);
-            // Check to see if the non-operator block has a greater height.
-            if (!block->hasBase() && !block->isRenderMathMLOperator() && block->offsetHeight() > maxHeight)
+            if (!block->unembellishedOperator() && block->offsetHeight() > maxHeight)
                 maxHeight = block->offsetHeight();
-            if (block->hasBase() && block->nonOperatorHeight() > maxHeight) 
-                maxHeight = block->nonOperatorHeight();
-            // If the block is an operator, capture the maximum height and increment the count.
-            if (block->isRenderMathMLOperator()) {
-                if (block->offsetHeight() > operatorHeight)
-                    operatorHeight = block->offsetHeight();
-                operatorCount++;
-            }
         } else if (current->isBoxModelObject()) {
             RenderBoxModelObject* box = toRenderBoxModelObject(current);
             // Check to see if this box has a larger height.
@@ -95,10 +61,8 @@ void RenderMathMLRow::layout()
         }
     }
     
-    if (childCount > 0 && childCount == operatorCount) {
-        // We have only operators and so set the max height to the operator height.
-        maxHeight = operatorHeight;
-    }
+    if (!maxHeight)
+        maxHeight = style()->fontSize();
     
     // Stretch everything to the same height (blocks can ignore the request).
     if (maxHeight > 0) {
@@ -118,17 +82,6 @@ void RenderMathMLRow::layout()
     }
     
 }    
-
-LayoutUnit RenderMathMLRow::baselinePosition(FontBaseline, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
-{
-    if (firstChild() && firstChild()->isRenderMathMLBlock()) {
-        RenderMathMLBlock* block = toRenderMathMLBlock(firstChild());
-        if (block->isRenderMathMLOperator())
-            return block->y() + block->baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode);
-    }
-    
-    return RenderBlock::baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode);
-}
     
 }
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRow.h b/Source/WebCore/rendering/mathml/RenderMathMLRow.h
index 73c5a26e5..2a520d07b 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRow.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRow.h
@@ -34,10 +34,8 @@ namespace WebCore {
     
 class RenderMathMLRow : public RenderMathMLBlock {
 public:
-    RenderMathMLRow(Node* container);
+    RenderMathMLRow(Element*);
     virtual bool isRenderMathMLRow() const { return true; }
-    virtual int nonOperatorHeight() const;
-    virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;    
     virtual void stretchToHeight(int) {}
 protected:
     virtual void layout();
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
index 38ab1c1c0..206426a13 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
@@ -61,8 +61,8 @@ const float gRadicalLineThickness = 0.02f;
 // Radical thick line thickness (%)
 const float gRadicalThickLineThickness = 0.1f;
     
-RenderMathMLSquareRoot::RenderMathMLSquareRoot(Node *expression) 
-    : RenderMathMLBlock(expression) 
+RenderMathMLSquareRoot::RenderMathMLSquareRoot(Element* element)
+    : RenderMathMLBlock(element)
 {
 }
 
@@ -73,7 +73,7 @@ void RenderMathMLSquareRoot::paint(PaintInfo& info, const LayoutPoint& paintOffs
     if (info.context->paintingDisabled())
         return;
     
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
 
     LayoutUnit maxHeight = 0;
     LayoutUnit width = 0;
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
index c8e41cdfb..ad81fdc56 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
@@ -34,7 +34,7 @@ namespace WebCore {
     
 class RenderMathMLSquareRoot : public RenderMathMLBlock {
 public:
-    RenderMathMLSquareRoot(Node* fraction);
+    RenderMathMLSquareRoot(Element*);
     virtual void paint(PaintInfo&, const LayoutPoint&);
 protected:
     virtual void layout();
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
index 9a06b0236..631266258 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
@@ -43,20 +43,30 @@ RenderMathMLSubSup::RenderMathMLSubSup(Element* element)
     : RenderMathMLBlock(element)
     , m_scripts(0)
 {
-    // Determine what kind of under/over expression we have by element name
+    // Determine what kind of sub/sup expression we have by element name
     if (element->hasLocalName(MathMLNames::msubTag))
         m_kind = Sub;
     else if (element->hasLocalName(MathMLNames::msupTag))
         m_kind = Sup;
-    else if (element->hasLocalName(MathMLNames::msubsupTag))
-        m_kind = SubSup;
-    else 
+    else {
+        ASSERT(element->hasLocalName(MathMLNames::msubsupTag));
         m_kind = SubSup;
+    }
+}
+
+RenderBoxModelObject* RenderMathMLSubSup::base() const
+{
+    RenderObject* baseWrapper = firstChild();
+    if (!baseWrapper)
+        return 0;
+    RenderObject* base = baseWrapper->firstChild();
+    if (!base || !base->isBoxModelObject())
+        return 0;
+    return toRenderBoxModelObject(base);
 }
 
 void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild)
 {
-    
     // Note: The RenderMathMLBlock only allows element children to be added.
     Element* childElement = toElement(child->node());
 
@@ -105,72 +115,49 @@ void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild
     }
 }
 
+RenderMathMLOperator* RenderMathMLSubSup::unembellishedOperator()
+{
+    RenderBoxModelObject* base = this->base();
+    if (!base || !base->isRenderMathMLBlock())
+        return 0;
+    return toRenderMathMLBlock(base)->unembellishedOperator();
+}
+
 void RenderMathMLSubSup::stretchToHeight(int height)
 {
-    RenderObject* base = firstChild();
-    if (!base || !base->firstChild())
-        return;
-    
-    if (base->firstChild() && base->firstChild()->isRenderMathMLBlock()) {
-        RenderMathMLBlock* block = toRenderMathMLBlock(base->firstChild());
-        block->stretchToHeight(static_cast<int>(gSubSupStretch * height));
+    RenderBoxModelObject* base = this->base();
+    if (base && base->isRenderMathMLBlock()) {
+        toRenderMathMLBlock(base)->stretchToHeight(static_cast<int>(gSubSupStretch * height));
         
         // Adjust the script placement after we stretch
         if (height > 0 && m_kind == SubSup && m_scripts) {
-            RenderObject* script = m_scripts->firstChild();
-            if (script) {
+            RenderObject* supWrapper = m_scripts->firstChild();
+            if (supWrapper) {
                 // Calculate the script height without the container margins.
-                RenderObject* top = script;
-                int topHeight = getBoxModelObjectHeight(top->firstChild());
-                int topAdjust = topHeight / gTopAdjustDivisor;
-                top->style()->setMarginTop(Length(-topAdjust, Fixed));
-                top->style()->setMarginBottom(Length(height - topHeight + topAdjust, Fixed));
-                if (top->isBoxModelObject()) {
-                    RenderBoxModelObject* topBox = toRenderBoxModelObject(top);
-                    topBox->updateBoxModelInfoFromStyle();
-                }
-                m_scripts->setNeedsLayout(true);
-                setNeedsLayout(true);
+                int supHeight = getBoxModelObjectHeight(supWrapper->firstChild());
+                int supTopAdjust = supHeight / gTopAdjustDivisor;
+                supWrapper->style()->setMarginTop(Length(-supTopAdjust, Fixed));
+                supWrapper->style()->setMarginBottom(Length(height - supHeight + supTopAdjust, Fixed));
+                supWrapper->setNeedsLayout(true);
             }
         }
-        
     }
 }
 
-int RenderMathMLSubSup::nonOperatorHeight() const 
-{
-    if (m_kind == SubSup) 
-       return static_cast<int>(style()->fontSize()*gSubSupStretch);
-    return static_cast<int>(style()->fontSize());
-}
-
-void RenderMathMLSubSup::layout() 
+void RenderMathMLSubSup::layout()
 {
-    if (firstChild())
-        firstChild()->setNeedsLayout(true);
-    if (m_scripts) 
-        m_scripts->setNeedsLayout(true);
-    
     RenderBlock::layout();
     
-    if (m_kind == SubSup) {
-        if (RenderObject* base = firstChild()) {
-            LayoutUnit maxHeight = 0;
-            RenderObject* current = base->firstChild();
-            while (current) {
-                LayoutUnit height = getBoxModelObjectHeight(current);
-                if (height > maxHeight)
-                    maxHeight = height;
-                current = current->nextSibling();
-            }
-            LayoutUnit heightDiff = m_scripts ? (m_scripts->offsetHeight() - maxHeight) / 2 : 0;
+    if (m_kind == SubSup && m_scripts) {
+        if (RenderBoxModelObject* base = this->base()) {
+            LayoutUnit heightDiff = (m_scripts->offsetHeight() - base->offsetHeight()) / 2;
             if (heightDiff < 0) 
                 heightDiff = 0;
-            base->style()->setPaddingTop(Length(heightDiff, Fixed));
-            base->setNeedsLayout(true);
+            RenderObject* baseWrapper = firstChild();
+            baseWrapper->style()->setPaddingTop(Length(heightDiff, Fixed));
+            baseWrapper->setNeedsLayout(true);
+            RenderBlock::layout();
         }
-        setNeedsLayout(true);
-        RenderBlock::layout();
     }    
 }
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
index 2ba466cb4..9c7d02c89 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
@@ -34,10 +34,10 @@ namespace WebCore {
     
 class RenderMathMLSubSup : public RenderMathMLBlock {
 public:
-    RenderMathMLSubSup(Element* fraction);
+    RenderMathMLSubSup(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
-    virtual bool hasBase() const { return true; }
-    virtual int nonOperatorHeight() const;
+    
+    virtual RenderMathMLOperator* unembellishedOperator();
     virtual void stretchToHeight(int pixelHeight);
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
@@ -47,6 +47,10 @@ protected:
 private:
     virtual const char* renderName() const { return "RenderMathMLSubSup"; }
 
+    // Omit our subscript and/or superscript. This may return 0 for a non-MathML base (which
+    // won't occur in valid MathML).
+    RenderBoxModelObject* base() const;
+    
     enum SubSupType { Sub, Sup, SubSup };
     SubSupType m_kind;
     RenderBlock* m_scripts;
@@ -57,4 +61,3 @@ private:
 #endif // ENABLE(MATHML)
 
 #endif // RenderMathMLSubSup_h
-
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
index 75911036a..0621cd6dd 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
@@ -38,27 +38,37 @@ using namespace MathMLNames;
     
 static const double gOverSpacingAdjustment = 0.5;
     
-RenderMathMLUnderOver::RenderMathMLUnderOver(Node* expression) 
-    : RenderMathMLBlock(expression) 
+RenderMathMLUnderOver::RenderMathMLUnderOver(Element* element)
+    : RenderMathMLBlock(element)
 {
-    Element* element = static_cast<Element*>(expression);
     // Determine what kind of under/over expression we have by element name
-    
     if (element->hasLocalName(MathMLNames::munderTag))
         m_kind = Under;
     else if (element->hasLocalName(MathMLNames::moverTag))
         m_kind = Over;
-    else if (element->hasLocalName(MathMLNames::munderoverTag))
+    else {
+        ASSERT(element->hasLocalName(MathMLNames::munderoverTag));
         m_kind = UnderOver;
-    else 
-        m_kind = Under;
-    
+    }
+}
+
+RenderBoxModelObject* RenderMathMLUnderOver::base() const
+{
+    RenderObject* baseWrapper = firstChild();
+    if ((m_kind == Over || m_kind == UnderOver) && baseWrapper)
+        baseWrapper = baseWrapper->nextSibling();
+    if (!baseWrapper)
+        return 0;
+    RenderObject* base = baseWrapper->firstChild();
+    if (!base || !base->isBoxModelObject())
+        return 0;
+    return toRenderBoxModelObject(base);
 }
 
 void RenderMathMLUnderOver::addChild(RenderObject* child, RenderObject* beforeChild)
 {    
     RenderMathMLBlock* row = new (renderArena()) RenderMathMLBlock(node());
-    RefPtr<RenderStyle> rowStyle = makeBlockStyle();
+    RefPtr<RenderStyle> rowStyle = createBlockStyle();
     row->setStyle(rowStyle.release());
     row->setIsAnonymous(true);
     
@@ -109,6 +119,14 @@ void RenderMathMLUnderOver::addChild(RenderObject* child, RenderObject* beforeCh
     row->addChild(child);    
 }
 
+RenderMathMLOperator* RenderMathMLUnderOver::unembellishedOperator()
+{
+    RenderBoxModelObject* base = this->base();
+    if (!base || !base->isRenderMathMLBlock())
+        return 0;
+    return toRenderMathMLBlock(base)->unembellishedOperator();
+}
+
 inline int getOffsetHeight(RenderObject* obj) 
 {
     if (obj->isBoxModelObject()) {
@@ -121,21 +139,7 @@ inline int getOffsetHeight(RenderObject* obj)
 
 void RenderMathMLUnderOver::stretchToHeight(int height)
 {
-
-    RenderObject* base = firstChild();
-    if (!base)
-        return;
-        
-    // For over or underover, the base is the sibling of the first child
-    if (m_kind != Under) 
-        base = base->nextSibling();
-        
-    if (!base)
-        return;
-        
-    // use the child of the row which is the actual base
-    base = base->firstChild();
-    
+    RenderBoxModelObject* base = this->base();
     if (base && base->isRenderMathMLBlock()) {
         RenderMathMLBlock* block = toRenderMathMLBlock(base);
         block->stretchToHeight(height);
@@ -275,21 +279,6 @@ LayoutUnit RenderMathMLUnderOver::baselinePosition(FontBaseline, bool firstLine,
     return baseline;
 }
 
-
-int RenderMathMLUnderOver::nonOperatorHeight() const 
-{
-    int nonOperators = 0;
-    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
-        if (current->firstChild() && current->firstChild()->isRenderMathMLBlock()) {
-            RenderMathMLBlock* block = toRenderMathMLBlock(current->firstChild());
-            if (!block->isRenderMathMLOperator()) 
-                nonOperators += getOffsetHeight(current);
-        } else
-            nonOperators += getOffsetHeight(current);
-    }
-    return nonOperators;
-}
-
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
index 2fe619821..e25e94768 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
@@ -34,16 +34,21 @@ namespace WebCore {
     
 class RenderMathMLUnderOver : public RenderMathMLBlock {
 public:
-    RenderMathMLUnderOver(Node* expression);
+    RenderMathMLUnderOver(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    
+    virtual RenderMathMLOperator* unembellishedOperator();
     virtual void layout();
-    virtual bool hasBase() const { return true; }
-    virtual int nonOperatorHeight() const;
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
     virtual void stretchToHeight(int pixelHeight);
+    
 private:
     virtual const char* renderName() const { return "RenderMathMLUnderOver"; }
 
+    // Omit our underscript and/or overscript. This may return 0 for a non-MathML base (which
+    // won't occur in valid MathML).
+    RenderBoxModelObject* base() const;
+    
     enum UnderOverType { Under, Over, UnderOver };
     UnderOverType m_kind;
 };
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 08bfbf90f..c62b3b198 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -466,7 +466,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             || rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark
             || rareInheritedData->m_lineBoxContain != other->rareInheritedData->m_lineBoxContain
             || rareInheritedData->m_lineGrid != other->rareInheritedData->m_lineGrid
-            || rareInheritedData->m_lineGridSnap != other->rareInheritedData->m_lineGridSnap)
+            || rareInheritedData->m_lineSnap != other->rareInheritedData->m_lineSnap
+            || rareInheritedData->m_lineAlign != other->rareInheritedData->m_lineAlign)
             return StyleDifferenceLayout;
 
         if (!rareInheritedData->shadowDataEquivalent(*other->rareInheritedData.get()))
@@ -886,7 +887,7 @@ static float calcConstraintScaleFor(const IntRect& rect, const RoundedRect::Radi
 
 RoundedRect RenderStyle::getRoundedBorderFor(const LayoutRect& borderRect, bool includeLogicalLeftEdge, bool includeLogicalRightEdge) const
 {
-    RoundedRect roundedRect(borderRect);
+    RoundedRect roundedRect(pixelSnappedIntRect(borderRect));
     if (hasBorderRadius()) {
         RoundedRect::Radii radii = calcRadiiFor(surround->border, borderRect.size());
         radii.scale(calcConstraintScaleFor(borderRect, radii));
@@ -915,7 +916,7 @@ RoundedRect RenderStyle::getRoundedInnerBorderFor(const LayoutRect& borderRect,
                borderRect.width() - leftWidth - rightWidth, 
                borderRect.height() - topWidth - bottomWidth);
 
-    RoundedRect roundedRect(innerRect);
+    RoundedRect roundedRect(pixelSnappedIntRect(innerRect));
 
     if (hasBorderRadius()) {
         RoundedRect::Radii radii = getRoundedBorderFor(borderRect).radii();
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 74fae1daf..647d3e9fc 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -791,9 +791,9 @@ public:
     float aspectRatioNumerator() const { return rareNonInheritedData->m_aspectRatioNumerator; }
     EBoxAlignment boxAlign() const { return static_cast<EBoxAlignment>(rareNonInheritedData->m_deprecatedFlexibleBox->align); }
     EBoxDirection boxDirection() const { return static_cast<EBoxDirection>(inherited_flags._box_direction); }
-    float boxFlex() { return rareNonInheritedData->m_deprecatedFlexibleBox->flex; }
+    float boxFlex() const { return rareNonInheritedData->m_deprecatedFlexibleBox->flex; }
     unsigned int boxFlexGroup() const { return rareNonInheritedData->m_deprecatedFlexibleBox->flex_group; }
-    EBoxLines boxLines() { return static_cast<EBoxLines>(rareNonInheritedData->m_deprecatedFlexibleBox->lines); }
+    EBoxLines boxLines() const { return static_cast<EBoxLines>(rareNonInheritedData->m_deprecatedFlexibleBox->lines); }
     unsigned int boxOrdinalGroup() const { return rareNonInheritedData->m_deprecatedFlexibleBox->ordinal_group; }
     EBoxOrient boxOrient() const { return static_cast<EBoxOrient>(rareNonInheritedData->m_deprecatedFlexibleBox->orient); }
     EBoxPack boxPack() const { return static_cast<EBoxPack>(rareNonInheritedData->m_deprecatedFlexibleBox->pack); }
@@ -903,7 +903,8 @@ public:
     RegionOverflow regionOverflow() const { return static_cast<RegionOverflow>(rareNonInheritedData->m_regionOverflow); }
 
     const AtomicString& lineGrid() const { return rareInheritedData->m_lineGrid; }
-    LineGridSnap lineGridSnap() const { return static_cast<LineGridSnap>(rareInheritedData->m_lineGridSnap); }
+    LineSnap lineSnap() const { return static_cast<LineSnap>(rareInheritedData->m_lineSnap); }
+    LineAlign lineAlign() const { return static_cast<LineAlign>(rareInheritedData->m_lineAlign); }
 
     WrapFlow wrapFlow() const { return static_cast<WrapFlow>(rareNonInheritedData->m_wrapFlow); }
     WrapThrough wrapThrough() const { return static_cast<WrapThrough>(rareNonInheritedData->m_wrapThrough); }
@@ -943,6 +944,9 @@ public:
 #if ENABLE(TOUCH_EVENTS)
     Color tapHighlightColor() const { return rareInheritedData->tapHighlightColor; }
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    bool useTouchOverflowScrolling() const { return rareInheritedData->useTouchOverflowScrolling; }
+#endif
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
 
@@ -1302,7 +1306,8 @@ public:
     // End CSS3 Setters
 
     void setLineGrid(const AtomicString& lineGrid) { SET_VAR(rareInheritedData, m_lineGrid, lineGrid); }
-    void setLineGridSnap(LineGridSnap lineGridSnap) { SET_VAR(rareInheritedData, m_lineGridSnap, lineGridSnap); }
+    void setLineSnap(LineSnap lineSnap) { SET_VAR(rareInheritedData, m_lineSnap, lineSnap); }
+    void setLineAlign(LineAlign lineAlign) { SET_VAR(rareInheritedData, m_lineAlign, lineAlign); }
 
     void setFlowThread(const AtomicString& flowThread) { SET_VAR(rareNonInheritedData, m_flowThread, flowThread); }
     void setRegionThread(const AtomicString& regionThread) { SET_VAR(rareNonInheritedData, m_regionThread, regionThread); }
@@ -1347,6 +1352,9 @@ public:
 #if ENABLE(TOUCH_EVENTS)
     void setTapHighlightColor(const Color& c) { SET_VAR(rareInheritedData, tapHighlightColor, c); }
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    void setUseTouchOverflowScrolling(bool v) { SET_VAR(rareInheritedData, useTouchOverflowScrolling, v); }
+#endif
     bool setTextSizeAdjust(bool);
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
 
@@ -1532,8 +1540,8 @@ public:
     static Length initialPadding() { return Length(Fixed); }
     static Length initialTextIndent() { return Length(Fixed); }
     static EVerticalAlign initialVerticalAlign() { return BASELINE; }
-    static int initialWidows() { return 2; }
-    static int initialOrphans() { return 2; }
+    static short initialWidows() { return 2; }
+    static short initialOrphans() { return 2; }
     static Length initialLineHeight() { return Length(-100.0, Percent); }
     static ETextAlign initialTextAlign() { return TAAUTO; }
     static ETextDecoration initialTextDecoration() { return TDNONE; }
@@ -1546,8 +1554,8 @@ public:
     static EBoxOrient initialBoxOrient() { return HORIZONTAL; }
     static EBoxPack initialBoxPack() { return Start; }
     static float initialBoxFlex() { return 0.0f; }
-    static int initialBoxFlexGroup() { return 1; }
-    static int initialBoxOrdinalGroup() { return 1; }
+    static unsigned int initialBoxFlexGroup() { return 1; }
+    static unsigned int initialBoxOrdinalGroup() { return 1; }
     static EBoxSizing initialBoxSizing() { return CONTENT_BOX; }
     static StyleReflection* initialBoxReflect() { return 0; }
     static float initialFlexboxWidthPositiveFlex() { return 0; }
@@ -1559,7 +1567,7 @@ public:
     static EFlexAlign initialFlexAlign() { return AlignStretch; }
     static EFlexAlign initialFlexItemAlign() { return AlignAuto; }
     static EFlexDirection initialFlexDirection() { return FlowRow; }
-    static EFlexWrap initialFlexWrap() { return FlexNoWrap; }
+    static EFlexWrap initialFlexWrap() { return FlexWrapNone; }
     static int initialMarqueeLoopCount() { return -1; }
     static int initialMarqueeSpeed() { return 85; }
     static Length initialMarqueeIncrement() { return Length(6, Fixed); }
@@ -1631,7 +1639,8 @@ public:
 #endif
 
     static const AtomicString& initialLineGrid() { return nullAtom; }
-    static LineGridSnap initialLineGridSnap() { return LineGridSnapNone; }
+    static LineSnap initialLineSnap() { return LineSnapNone; }
+    static LineAlign initialLineAlign() { return LineAlignNone; }
 
     static const AtomicString& initialFlowThread() { return nullAtom; }
     static const AtomicString& initialRegionThread() { return nullAtom; }
@@ -1647,6 +1656,9 @@ public:
 #if ENABLE(TOUCH_EVENTS)
     static Color initialTapHighlightColor();
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    static bool initialUseTouchOverflowScrolling() { return false; }
+#endif
 #if ENABLE(DASHBOARD_SUPPORT)
     static const Vector<StyleDashboardRegion>& initialDashboardRegions();
     static const Vector<StyleDashboardRegion>& noneDashboardRegions();
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 0ce3d8886..aee10813a 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -171,7 +171,7 @@ enum EBoxDirection { BNORMAL, BREVERSE };
 enum EFlexPack { PackStart, PackEnd, PackCenter, PackJustify, PackDistribute };
 enum EFlexAlign { AlignAuto, AlignStart, AlignEnd, AlignCenter, AlignStretch, AlignBaseline };
 enum EFlexDirection { FlowRow, FlowRowReverse, FlowColumn, FlowColumnReverse };
-enum EFlexWrap { FlexNoWrap, FlexWrap, FlexWrapReverse };
+enum EFlexWrap { FlexWrapNone, FlexWrap, FlexWrapReverse };
 
 enum ETextSecurity {
     TSNONE, TSDISC, TSCIRCLE, TSSQUARE
@@ -454,7 +454,9 @@ enum RegionOverflow { AutoRegionOverflow, BreakRegionOverflow };
 
 enum ColumnAxis { HorizontalColumnAxis, VerticalColumnAxis, AutoColumnAxis };
 
-enum LineGridSnap { LineGridSnapNone, LineGridSnapBaseline, LineGridSnapContain };
+enum LineSnap { LineSnapNone, LineSnapBaseline, LineSnapContain };
+
+enum LineAlign { LineAlignNone, LineAlignEdges };
 
 enum WrapFlow { WrapFlowAuto, WrapFlowBoth, WrapFlowLeft, WrapFlowRight, WrapFlowMaximum, WrapFlowClear };
 
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.cpp b/Source/WebCore/rendering/style/StyleCachedImage.cpp
index 1a7d9ef10..a7a1996fa 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedImage.cpp
@@ -24,11 +24,22 @@
 #include "config.h"
 #include "StyleCachedImage.h"
 
-#include "CachedImage.h"
 #include "RenderObject.h"
 
 namespace WebCore {
 
+StyleCachedImage::StyleCachedImage(CachedImage* image)
+    : m_image(image)
+{
+    m_isCachedImage = true;
+    m_image->addClient(this);
+}
+
+StyleCachedImage::~StyleCachedImage()
+{
+    m_image->removeClient(this);
+}
+
 PassRefPtr<CSSValue> StyleCachedImage::cssValue() const
 {
     return CSSPrimitiveValue::create(m_image->url(), CSSPrimitiveValue::CSS_URI);
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.h b/Source/WebCore/rendering/style/StyleCachedImage.h
index 06dfb25a6..c9913fd82 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.h
+++ b/Source/WebCore/rendering/style/StyleCachedImage.h
@@ -24,16 +24,18 @@
 #ifndef StyleCachedImage_h
 #define StyleCachedImage_h
 
+#include "CachedImage.h"
 #include "CachedResourceHandle.h"
 #include "StyleImage.h"
 
 namespace WebCore {
 
-class CachedImage;
-
-class StyleCachedImage : public StyleImage {
+class StyleCachedImage : public StyleImage, private CachedImageClient {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassRefPtr<StyleCachedImage> create(CachedImage* image) { return adoptRef(new StyleCachedImage(image)); }
+    virtual ~StyleCachedImage();
+
     virtual WrappedImagePtr data() const { return m_image.get(); }
 
     virtual PassRefPtr<CSSValue> cssValue() const;
@@ -54,11 +56,7 @@ public:
     virtual PassRefPtr<Image> image(RenderObject*, const IntSize&) const;
     
 private:
-    StyleCachedImage(CachedImage* image)
-        : m_image(image)
-    {
-         m_isCachedImage = true;
-    }
+    explicit StyleCachedImage(CachedImage*);
     
     CachedResourceHandle<CachedImage> m_image;
 };
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
index 9dda82d8b..5d73793ce 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -53,7 +53,11 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textEmphasisPosition(TextEmphasisPositionOver)
     , m_lineBoxContain(RenderStyle::initialLineBoxContain())
     , m_imageRendering(RenderStyle::initialImageRendering())
-    , m_lineGridSnap(RenderStyle::initialLineGridSnap())
+    , m_lineSnap(RenderStyle::initialLineSnap())
+    , m_lineAlign(RenderStyle::initialLineAlign())
+#if ENABLE(OVERFLOW_SCROLLING)
+    , useTouchOverflowScrolling(RenderStyle::initialUseTouchOverflowScrolling())
+#endif
     , hyphenationLimitBefore(-1)
     , hyphenationLimitAfter(-1)
     , hyphenationLimitLines(-1)
@@ -97,7 +101,11 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , textEmphasisPosition(o.textEmphasisPosition)
     , m_lineBoxContain(o.m_lineBoxContain)
     , m_imageRendering(o.m_imageRendering)
-    , m_lineGridSnap(o.m_lineGridSnap)
+    , m_lineSnap(o.m_lineSnap)
+    , m_lineAlign(o.m_lineAlign)
+#if ENABLE(OVERFLOW_SCROLLING)
+    , useTouchOverflowScrolling(o.useTouchOverflowScrolling)
+#endif
     , hyphenationString(o.hyphenationString)
     , hyphenationLimitBefore(o.hyphenationLimitBefore)
     , hyphenationLimitAfter(o.hyphenationLimitAfter)
@@ -149,6 +157,9 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && wordWrap == o.wordWrap
         && nbspMode == o.nbspMode
         && khtmlLineBreak == o.khtmlLineBreak
+#if ENABLE(OVERFLOW_SCROLLING)
+        && useTouchOverflowScrolling == o.useTouchOverflowScrolling
+#endif
         && textSizeAdjust == o.textSizeAdjust
         && resize == o.resize
         && userSelect == o.userSelect
@@ -168,7 +179,8 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && QuotesData::equal(quotes.get(), o.quotes.get())
         && m_lineGrid == o.m_lineGrid
         && m_imageRendering == o.m_imageRendering
-        && m_lineGridSnap == o.m_lineGridSnap;
+        && m_lineSnap == o.m_lineSnap
+        && m_lineAlign == o.m_lineAlign;
 }
 
 bool StyleRareInheritedData::shadowDataEquivalent(const StyleRareInheritedData& o) const
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
index fd5796936..570dbb573 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
@@ -91,7 +91,11 @@ public:
     unsigned m_lineBoxContain: 7; // LineBoxContain
     // CSS Image Values Level 3
     unsigned m_imageRendering : 2; // EImageRendering
-    unsigned m_lineGridSnap : 2; // LineGridSnap
+    unsigned m_lineSnap : 2; // LineSnap
+    unsigned m_lineAlign : 1; // LineAlign
+#if ENABLE(OVERFLOW_SCROLLING)
+    unsigned useTouchOverflowScrolling: 1;
+#endif
 
     AtomicString hyphenationString;
     short hyphenationLimitBefore;
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.h b/Source/WebCore/rendering/svg/RenderSVGContainer.h
index c7d9f205f..b3324703c 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.h
@@ -41,6 +41,7 @@ public:
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
     virtual void setNeedsBoundariesUpdate() { m_needsBoundariesUpdate = true; }
+    virtual bool didTransformToRootUpdate() { return false; }
 
 protected:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
index 74facc3cf..591316291 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
@@ -267,6 +267,8 @@ void RenderSVGInlineText::computeNewScaledFontForStyle(RenderObject* renderer, c
     }
 
     FontDescription fontDescription(style->fontDescription());
+
+    // FIXME: We need to better handle the case when we compute very small fonts below (below 1pt).
     fontDescription.setComputedSize(CSSStyleSelector::getComputedSizeFromSpecifiedSize(document, scalingFactor, fontDescription.isAbsoluteSize(), fontDescription.computedSize(), DoNotUseSmartMinimumForFontSize));
 
     scaledFont = Font(fontDescription, 0, 0);
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
index 5adb29950..2e03e9f59 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
@@ -38,7 +38,7 @@ static inline SVGDocumentExtensions* svgExtensionsFromNode(Node* node)
 
 RenderSVGResourceContainer::RenderSVGResourceContainer(SVGStyledElement* node)
     : RenderSVGHiddenContainer(node)
-    , m_id(node->hasID() ? node->getIdAttribute() : nullAtom)
+    , m_id(node->getIdAttribute())
     , m_registered(false)
     , m_isInvalidating(false)
 {
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index ba821cca2..7baa4fc38 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -306,7 +306,7 @@ void RenderSVGRoot::buildLocalToBorderBoxTransform()
     float scale = style()->effectiveZoom();
     FloatPoint translate = svg->currentTranslate();
     LayoutSize borderAndPadding(borderLeft() + paddingLeft(), borderTop() + paddingTop());
-    m_localToBorderBoxTransform = svg->viewBoxToViewTransform(width() / scale, height() / scale);
+    m_localToBorderBoxTransform = svg->viewBoxToViewTransform(contentWidth() / scale, contentHeight() / scale);
     if (borderAndPadding.isEmpty() && scale == 1 && translate == FloatPoint::zero())
         return;
     m_localToBorderBoxTransform = AffineTransform(scale, 0, 0, scale, borderAndPadding.width() + translate.x(), borderAndPadding.height() + translate.y()) * m_localToBorderBoxTransform;
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.h b/Source/WebCore/rendering/svg/RenderSVGRoot.h
index cb7a1b2e0..701137f44 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.h
@@ -56,7 +56,6 @@ public:
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
-    virtual bool canHaveChildren() const { return true; }
 
     virtual bool isSVGRoot() const { return true; }
     virtual const char* renderName() const { return "RenderSVGRoot"; }
@@ -87,6 +86,7 @@ private:
 
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, bool* wasFixed = 0) const;
     virtual bool canBeSelectionLeaf() const { return false; }
+    virtual bool canHaveChildren() const { return true; }
 
     void updateCachedBoundaries();
     void buildLocalToBorderBoxTransform();
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index ebf92e569..d9cdeccdf 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -58,6 +58,7 @@ RenderSVGText::RenderSVGText(SVGTextElement* node)
     , m_needsReordering(false)
     , m_needsPositioningValuesUpdate(true)
     , m_needsTransformUpdate(true)
+    , m_needsTextMetricsUpdate(true)
 {
 }
 
@@ -208,11 +209,13 @@ void RenderSVGText::layout()
         updateCachedBoundariesInParents = true;
     }
 
-    // If the root layout size changed (eg. window size changes) or the positioning values change, recompute the on-screen font size.
-    if (SVGRenderSupport::findTreeRootObject(this)->isLayoutSizeChanged()) {
+    // If the root layout size changed (eg. window size changes) or the positioning values change
+    // or the transform to the root context has changed then recompute the on-screen font size.
+    if (m_needsTextMetricsUpdate || SVGRenderSupport::findTreeRootObject(this)->isLayoutSizeChanged()) {
         recursiveUpdateScaledFont(this);
         rebuildLayoutAttributes(true);
         updateCachedBoundariesInParents = true;
+        m_needsTextMetricsUpdate = false;
     }
 
     if (m_needsPositioningValuesUpdate) {
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 864101695..7b0b5efa8 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -41,6 +41,7 @@ public:
 
     void setNeedsPositioningValuesUpdate() { m_needsPositioningValuesUpdate = true; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
+    void setNeedsTextMetricsUpdate() { m_needsTextMetricsUpdate = true; }
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
     static RenderSVGText* locateRenderSVGTextAncestor(RenderObject*);
@@ -90,6 +91,7 @@ private:
     bool m_needsReordering : 1;
     bool m_needsPositioningValuesUpdate : 1;
     bool m_needsTransformUpdate : 1;
+    bool m_needsTextMetricsUpdate : 1;
     AffineTransform m_localTransform;
     SVGTextLayoutAttributesBuilder m_layoutAttributesBuilder;
     Vector<SVGTextLayoutAttributes*> m_layoutAttributes;
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
index 1db6365b2..0a62f6885 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
@@ -25,6 +25,7 @@
 #include "RenderSVGTransformableContainer.h"
 
 #include "SVGNames.h"
+#include "SVGRenderSupport.h"
 #include "SVGShadowTreeElements.h"
 #include "SVGStyledTransformableElement.h"
 
@@ -33,6 +34,7 @@ namespace WebCore {
 RenderSVGTransformableContainer::RenderSVGTransformableContainer(SVGStyledTransformableElement* node)
     : RenderSVGContainer(node)
     , m_needsTransformUpdate(true)
+    , m_didTransformToRootUpdate(false)
 {
 }
 
@@ -41,6 +43,7 @@ bool RenderSVGTransformableContainer::calculateLocalTransform()
     SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
 
     bool needsUpdate = m_needsTransformUpdate;
+    m_didTransformToRootUpdate = m_needsTransformUpdate || SVGRenderSupport::transformToRootChanged(parent());
     if (needsUpdate) {
         m_localTransform = element->animatedLocalTransform();
         m_needsTransformUpdate = false;
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
index 401bfa858..c9c607ba2 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
@@ -31,14 +31,17 @@ class RenderSVGTransformableContainer : public RenderSVGContainer {
 public:
     explicit RenderSVGTransformableContainer(SVGStyledTransformableElement*);
 
+    virtual bool isSVGTransformableContainer() const { return true; }
     virtual const AffineTransform& localToParentTransform() const { return m_localTransform; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
+    virtual bool didTransformToRootUpdate() { return m_didTransformToRootUpdate; }
 
 private:
     virtual bool calculateLocalTransform();
     virtual AffineTransform localTransform() const { return m_localTransform; }
 
     bool m_needsTransformUpdate : 1;
+    bool m_didTransformToRootUpdate : 1;
     AffineTransform m_localTransform;
 };
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
index 1021aff00..3e0e3e4d9 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
@@ -34,7 +34,9 @@ namespace WebCore {
 
 RenderSVGViewportContainer::RenderSVGViewportContainer(SVGStyledElement* node)
     : RenderSVGContainer(node)
+    , m_didTransformToRootUpdate(false)
     , m_isLayoutSizeChanged(false)
+    , m_needsTransformUpdate(true)
 {
 }
 
@@ -63,8 +65,21 @@ void RenderSVGViewportContainer::calcViewport()
     SVGLengthContext lengthContext(element);
     m_viewport = FloatRect(svg->x().value(lengthContext), svg->y().value(lengthContext), svg->width().value(lengthContext), svg->height().value(lengthContext));
 
-    if (oldViewport != m_viewport)
+    if (oldViewport != m_viewport) {
+        m_didTransformToRootUpdate = true;
         setNeedsBoundariesUpdate();
+        setNeedsTransformUpdate();
+    }
+}
+
+bool RenderSVGViewportContainer::calculateLocalTransform() 
+{
+    if (!m_needsTransformUpdate)
+        return false;
+    
+    m_localToParentTransform = AffineTransform::translation(m_viewport.x(), m_viewport.y()) * viewportTransform();
+    m_needsTransformUpdate = false;
+    return true;
 }
 
 AffineTransform RenderSVGViewportContainer::viewportTransform() const
@@ -77,14 +92,6 @@ AffineTransform RenderSVGViewportContainer::viewportTransform() const
     return AffineTransform();
 }
 
-const AffineTransform& RenderSVGViewportContainer::localToParentTransform() const
-{
-    m_localToParentTransform = AffineTransform::translation(m_viewport.x(), m_viewport.y()) * viewportTransform();
-    return m_localToParentTransform;
-    // If this class were ever given a localTransform(), then the above would read:
-    // return viewportTranslation * localTransform() * viewportTransform()
-}
-
 bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& pointInParent)
 {
     // Respect the viewport clip (which is in parent coords)
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
index 808d6727b..b748fe6f0 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
@@ -36,8 +36,10 @@ public:
     FloatRect viewport() const { return m_viewport; }
 
     bool isLayoutSizeChanged() const { return m_isLayoutSizeChanged; }
+    virtual bool didTransformToRootUpdate() { return m_didTransformToRootUpdate; }
 
     virtual void determineIfLayoutSizeChanged();
+    virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
 
 private:
     virtual bool isSVGContainer() const { return true; }
@@ -45,16 +47,19 @@ private:
     virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
 
     AffineTransform viewportTransform() const;
-    virtual const AffineTransform& localToParentTransform() const;
+    virtual const AffineTransform& localToParentTransform() const { return m_localToParentTransform; }
 
     virtual void calcViewport();
+    virtual bool calculateLocalTransform();
 
     virtual void applyViewportClip(PaintInfo&);
     virtual bool pointIsInsideViewportClip(const FloatPoint& pointInParent);
 
     FloatRect m_viewport;
     mutable AffineTransform m_localToParentTransform;
+    bool m_didTransformToRootUpdate : 1;
     bool m_isLayoutSizeChanged : 1;
+    bool m_needsTransformUpdate : 1;
 };
   
 inline RenderSVGViewportContainer* toRenderSVGViewportContainer(RenderObject* object)
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
index 6457ac006..7feb88fec 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
@@ -39,6 +39,7 @@
 #include "RenderSVGResourceMarker.h"
 #include "RenderSVGResourceMasker.h"
 #include "RenderSVGRoot.h"
+#include "RenderSVGText.h"
 #include "RenderSVGViewportContainer.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
@@ -79,6 +80,13 @@ void SVGRenderSupport::mapLocalToContainer(const RenderObject* object, RenderBox
     object->parent()->mapLocalToContainer(repaintContainer, false, true, transformState, wasFixed);
 }
 
+static inline bool isRenderingMaskImage(RenderObject* object)
+{
+    if (object->frame() && object->frame()->view())
+        return object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
+    return false;
+}
+
 bool SVGRenderSupport::prepareToRenderSVGContent(RenderObject* object, PaintInfo& paintInfo)
 {
     ASSERT(object);
@@ -89,11 +97,8 @@ bool SVGRenderSupport::prepareToRenderSVGContent(RenderObject* object, PaintInfo
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    bool isRenderingMask = false;
-    if (object->frame() && object->frame()->view())
-        isRenderingMask = object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
-
     // Setup transparency layers before setting up SVG resources!
+    bool isRenderingMask = isRenderingMaskImage(object);
     float opacity = isRenderingMask ? 1 : style->opacity();
     const ShadowData* shadow = svgStyle->shadow();
     if (opacity < 1 || shadow) {
@@ -168,7 +173,7 @@ void SVGRenderSupport::finishRenderSVGContent(RenderObject* object, PaintInfo& p
     }
 #endif
 
-    if (style->opacity() < 1)
+    if (style->opacity() < 1 && !isRenderingMaskImage(object))
         paintInfo.context->endTransparencyLayer();
 
     if (svgStyle->shadow())
@@ -245,14 +250,35 @@ static inline bool layoutSizeOfNearestViewportChanged(const RenderObject* start)
     return toRenderSVGRoot(start)->isLayoutSizeChanged();
 }
 
+bool SVGRenderSupport::transformToRootChanged(RenderObject* ancestor)
+{
+    while (ancestor && !ancestor->isSVGRoot()) {
+        if (ancestor->isSVGTransformableContainer())
+            return toRenderSVGContainer(ancestor)->didTransformToRootUpdate();
+        if (ancestor->isSVGViewportContainer())
+            return toRenderSVGViewportContainer(ancestor)->didTransformToRootUpdate();
+        ancestor = ancestor->parent();
+    }
+
+    return false;
+}
+
 void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
 {
     bool layoutSizeChanged = layoutSizeOfNearestViewportChanged(start);
+    bool transformChanged = transformToRootChanged(start);
     HashSet<RenderObject*> notlayoutedObjects;
 
     for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
         bool needsLayout = selfNeedsLayout;
 
+        if (transformChanged) {
+            // If the transform changed we need to update the text metrics (note: this also happens for layoutSizeChanged=true).
+            if (child->isSVGText())
+                toRenderSVGText(child)->setNeedsTextMetricsUpdate();
+            needsLayout = true;
+        }
+
         if (layoutSizeChanged) {
             // When selfNeedsLayout is false and the layout size changed, we have to check whether this child uses relative lengths
             if (SVGElement* element = child->node()->isSVGElement() ? static_cast<SVGElement*>(child->node()) : 0) {
@@ -260,6 +286,8 @@ void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
                     // When the layout size changed and when using relative values tell the RenderSVGShape to update its shape object
                     if (child->isSVGShape())
                         toRenderSVGShape(child)->setNeedsShapeUpdate();
+                    else if (child->isSVGText())
+                        toRenderSVGText(child)->setNeedsPositioningValuesUpdate();
 
                     needsLayout = true;
                 }
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.h b/Source/WebCore/rendering/svg/SVGRenderSupport.h
index f5280ff24..c7b2fdcbf 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.h
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.h
@@ -72,6 +72,9 @@ public:
     // Shared between SVG renderers and resources.
     static void applyStrokeStyleToContext(GraphicsContext*, const RenderStyle*, const RenderObject*);
 
+    // Determines if any ancestor's transform has changed.
+    static bool transformToRootChanged(RenderObject*);
+
     // FIXME: These methods do not belong here.
     static const RenderSVGRoot* findTreeRootObject(const RenderObject*);
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
index a27f68cd7..02a2123eb 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -79,12 +79,12 @@ void SVGTextLayoutAttributesBuilder::rebuildMetricsForWholeTree(RenderSVGText* t
 bool SVGTextLayoutAttributesBuilder::buildLayoutAttributesIfNeeded(RenderSVGText* textRoot)
 {
     ASSERT(textRoot);
-    if (!m_textPositions.isEmpty())
-        return m_textLength;
 
-    m_textLength = 0;
-    const UChar* lastCharacter = 0;
-    collectTextPositioningElements(textRoot, lastCharacter);
+    if (m_textPositions.isEmpty()) {
+        m_textLength = 0;
+        const UChar* lastCharacter = 0;
+        collectTextPositioningElements(textRoot, lastCharacter);
+    }
 
     m_characterDataMap.clear();
     if (!m_textLength)
diff --git a/Source/WebCore/storage/Database.cpp b/Source/WebCore/storage/Database.cpp
index dd29ea4b7..d9911c919 100644
--- a/Source/WebCore/storage/Database.cpp
+++ b/Source/WebCore/storage/Database.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "ChangeVersionWrapper.h"
+#include "CrossThreadTask.h"
 #include "DatabaseCallback.h"
 #include "DatabaseTask.h"
 #include "DatabaseThread.h"
@@ -41,6 +42,7 @@
 #include "Logging.h"
 #include "NotImplemented.h"
 #include "Page.h"
+#include "SQLError.h"
 #include "SQLTransactionCallback.h"
 #include "SQLTransactionClient.h"
 #include "SQLTransactionCoordinator.h"
@@ -216,6 +218,7 @@ void Database::close()
         MutexLocker locker(m_transactionInProgressMutex);
         m_isTransactionQueueEnabled = false;
         m_transactionInProgress = false;
+        m_transactionQueue.clear();
     }
 
     closeDatabase();
@@ -229,9 +232,12 @@ void Database::close()
 
 void Database::closeImmediately()
 {
+    ASSERT(m_scriptExecutionContext->isContextThread());
     DatabaseThread* databaseThread = scriptExecutionContext()->databaseThread();
-    if (databaseThread && !databaseThread->terminationRequested() && opened())
+    if (databaseThread && !databaseThread->terminationRequested() && opened()) {
+        logErrorMessage("forcibly closing database");
         databaseThread->scheduleImmediateTask(DatabaseCloseTask::create(this, 0));
+    }
 }
 
 unsigned long long Database::maximumSize() const
@@ -255,30 +261,36 @@ void Database::changeVersion(const String& oldVersion, const String& newVersion,
                              PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                              PassRefPtr<VoidCallback> successCallback)
 {
-    RefPtr<SQLTransaction> transaction =
-        SQLTransaction::create(this, callback, errorCallback, successCallback, ChangeVersionWrapper::create(oldVersion, newVersion));
-    MutexLocker locker(m_transactionInProgressMutex);
-    m_transactionQueue.append(transaction.release());
-    if (!m_transactionInProgress)
-        scheduleTransaction();
+    runTransaction(callback, errorCallback, successCallback, ChangeVersionWrapper::create(oldVersion, newVersion), false);
 }
 
 void Database::transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback)
 {
-    runTransaction(callback, errorCallback, successCallback, false);
+    runTransaction(callback, errorCallback, successCallback, 0, false);
 }
 
 void Database::readTransaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback)
 {
-    runTransaction(callback, errorCallback, successCallback, true);
+    runTransaction(callback, errorCallback, successCallback, 0, true);
+}
+
+static void callTransactionErrorCallback(ScriptExecutionContext*, PassRefPtr<SQLTransactionErrorCallback> callback, PassRefPtr<SQLError> error)
+{
+    callback->handleEvent(error.get());
 }
 
 void Database::runTransaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                              PassRefPtr<VoidCallback> successCallback, bool readOnly)
+                              PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
 {
-    RefPtr<SQLTransaction> transaction =
-        SQLTransaction::create(this, callback, errorCallback, successCallback, 0, readOnly);
     MutexLocker locker(m_transactionInProgressMutex);
+    if (!m_isTransactionQueueEnabled) {
+        if (errorCallback) {
+            RefPtr<SQLError> error = SQLError::create(SQLError::UNKNOWN_ERR, "database has been closed");
+            scriptExecutionContext()->postTask(createCallbackTask(&callTransactionErrorCallback, errorCallback, error.release()));
+        }
+        return;
+    }
+    RefPtr<SQLTransaction> transaction = SQLTransaction::create(this, callback, errorCallback, successCallback, wrapper, readOnly);
     m_transactionQueue.append(transaction.release());
     if (!m_transactionInProgress)
         scheduleTransaction();
@@ -296,9 +308,8 @@ void Database::scheduleTransaction()
     ASSERT(!m_transactionInProgressMutex.tryLock()); // Locked by caller.
     RefPtr<SQLTransaction> transaction;
 
-    if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty()) {
+    if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty())
         transaction = m_transactionQueue.takeFirst();
-    }
 
     if (transaction && m_scriptExecutionContext->databaseThread()) {
         OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
diff --git a/Source/WebCore/storage/Database.h b/Source/WebCore/storage/Database.h
index 4db9a9c85..12b430e33 100644
--- a/Source/WebCore/storage/Database.h
+++ b/Source/WebCore/storage/Database.h
@@ -47,6 +47,7 @@ class SQLTransactionCallback;
 class SQLTransactionClient;
 class SQLTransactionCoordinator;
 class SQLTransactionErrorCallback;
+class SQLTransactionWrapper;
 class VoidCallback;
 
 typedef int ExceptionCode;
@@ -93,7 +94,7 @@ private:
     Database(ScriptExecutionContext*, const String& name, const String& expectedVersion,
              const String& displayName, unsigned long estimatedSize);
     void runTransaction(PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
-                        PassRefPtr<VoidCallback> successCallback, bool readOnly);
+                        PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper>, bool readOnly);
 
     bool openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode&, String& errorMessage);
     virtual bool performOpenAndVerify(bool setVersionInNewDatabase, ExceptionCode&, String& errorMessage);
diff --git a/Source/WebCore/storage/DatabaseSync.cpp b/Source/WebCore/storage/DatabaseSync.cpp
index 1d8129dc2..8b744b8c6 100644
--- a/Source/WebCore/storage/DatabaseSync.cpp
+++ b/Source/WebCore/storage/DatabaseSync.cpp
@@ -205,16 +205,13 @@ private:
 
 void DatabaseSync::closeImmediately()
 {
-    if (!m_scriptExecutionContext->isContextThread()) {
-        m_scriptExecutionContext->postTask(CloseSyncDatabaseOnContextThreadTask::create(this));
-        return;
-    }
+    ASSERT(m_scriptExecutionContext->isContextThread());
 
     if (!opened())
         return;
 
+    logErrorMessage("forcibly closing database");
     DatabaseTracker::tracker().removeOpenDatabase(this);
-
     closeDatabase();
 }
 
diff --git a/Source/WebCore/storage/DatabaseThread.cpp b/Source/WebCore/storage/DatabaseThread.cpp
index cbde324e0..d771b1ca1 100644
--- a/Source/WebCore/storage/DatabaseThread.cpp
+++ b/Source/WebCore/storage/DatabaseThread.cpp
@@ -88,13 +88,13 @@ bool DatabaseThread::terminationRequested(DatabaseTaskSynchronizer* taskSynchron
     return m_queue.killed();
 }
 
-void* DatabaseThread::databaseThreadStart(void* vDatabaseThread)
+void DatabaseThread::databaseThreadStart(void* vDatabaseThread)
 {
     DatabaseThread* dbThread = static_cast<DatabaseThread*>(vDatabaseThread);
-    return dbThread->databaseThread();
+    dbThread->databaseThread();
 }
 
-void* DatabaseThread::databaseThread()
+void DatabaseThread::databaseThread()
 {
     {
         // Wait for DatabaseThread::start() to complete.
@@ -134,8 +134,6 @@ void* DatabaseThread::databaseThread()
 
     if (cleanupSync) // Someone wanted to know when we were done cleaning up.
         cleanupSync->taskCompleted();
-
-    return 0;
 }
 
 void DatabaseThread::recordDatabaseOpen(Database* database)
diff --git a/Source/WebCore/storage/DatabaseThread.h b/Source/WebCore/storage/DatabaseThread.h
index d410edbce..fa4fd088f 100644
--- a/Source/WebCore/storage/DatabaseThread.h
+++ b/Source/WebCore/storage/DatabaseThread.h
@@ -72,8 +72,8 @@ public:
 private:
     DatabaseThread();
 
-    static void* databaseThreadStart(void*);
-    void* databaseThread();
+    static void databaseThreadStart(void*);
+    void databaseThread();
 
     Mutex m_threadCreationMutex;
     ThreadIdentifier m_threadID;
diff --git a/Source/WebCore/storage/DatabaseTracker.h b/Source/WebCore/storage/DatabaseTracker.h
index 492c14863..d94a41578 100644
--- a/Source/WebCore/storage/DatabaseTracker.h
+++ b/Source/WebCore/storage/DatabaseTracker.h
@@ -173,12 +173,15 @@ private:
     static void notifyDatabasesChanged(void*);
 #else
 public:
-    void getOpenDatabases(const String& originIdentifier, const String& name, HashSet<RefPtr<AbstractDatabase> >* databases);
+    void closeDatabasesImmediately(const String& originIdentifier, const String& name);
 
 private:
     typedef HashSet<AbstractDatabase*> DatabaseSet;
     typedef HashMap<String, DatabaseSet*> DatabaseNameMap;
     typedef HashMap<String, DatabaseNameMap*> DatabaseOriginMap;
+    class CloseOneDatabaseImmediatelyTask;
+
+    void closeOneDatabaseImmediately(const String& originIdentifier, const String& name, AbstractDatabase* database);
 
     Mutex m_openDatabaseMapGuard;
     mutable OwnPtr<DatabaseOriginMap> m_openDatabaseMap;
diff --git a/Source/WebCore/storage/IDBAny.idl b/Source/WebCore/storage/IDBAny.idl
index 66a5c2042..dd51c4daa 100644
--- a/Source/WebCore/storage/IDBAny.idl
+++ b/Source/WebCore/storage/IDBAny.idl
@@ -27,7 +27,7 @@ module storage {
 
     interface [
         Conditional=INDEXED_DATABASE,
-        JSCustomToJS
+        CustomToJSObject
     ] IDBAny {
         // This space is intentionally left blank.
     };
diff --git a/Source/WebCore/storage/IDBCursor.cpp b/Source/WebCore/storage/IDBCursor.cpp
index 166c2dd6d..1dd1e9ebe 100644
--- a/Source/WebCore/storage/IDBCursor.cpp
+++ b/Source/WebCore/storage/IDBCursor.cpp
@@ -33,6 +33,7 @@
 #include "IDBCursorBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBRequest.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 #include "ScriptExecutionContext.h"
 #include "SerializedScriptValue.h"
@@ -62,21 +63,25 @@ IDBCursor::~IDBCursor()
 
 unsigned short IDBCursor::direction() const
 {
+    IDB_TRACE("IDBCursor::direction");
     return m_backend->direction();
 }
 
 PassRefPtr<IDBKey> IDBCursor::key() const
 {
+    IDB_TRACE("IDBCursor::key");
     return m_backend->key();
 }
 
 PassRefPtr<IDBKey> IDBCursor::primaryKey() const
 {
+    IDB_TRACE("IDBCursor::primaryKey");
     return m_backend->primaryKey();
 }
 
 PassRefPtr<IDBAny> IDBCursor::value() const
 {
+    IDB_TRACE("IDBCursor::value");
     return IDBAny::create(m_backend->value());
 }
 
@@ -87,6 +92,7 @@ IDBAny* IDBCursor::source() const
 
 PassRefPtr<IDBRequest> IDBCursor::update(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursor::update");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->update(value, request, ec);
     if (ec) {
@@ -98,6 +104,7 @@ PassRefPtr<IDBRequest> IDBCursor::update(ScriptExecutionContext* context, PassRe
 
 void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursor::continue");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return;
@@ -114,6 +121,7 @@ void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
 
 PassRefPtr<IDBRequest> IDBCursor::deleteFunction(ScriptExecutionContext* context, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursor::delete");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->deleteFunction(request, ec);
     if (ec) {
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.cpp b/Source/WebCore/storage/IDBCursorBackendImpl.cpp
index ff756cede..cdbe707fc 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBCursorBackendImpl.cpp
@@ -36,6 +36,7 @@
 #include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendImpl.h"
 #include "IDBRequest.h"
+#include "IDBTracing.h"
 #include "IDBTransactionBackendInterface.h"
 #include "SerializedScriptValue.h"
 
@@ -64,21 +65,25 @@ IDBCursorBackendImpl::~IDBCursorBackendImpl()
 
 unsigned short IDBCursorBackendImpl::direction() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::direction");
     return m_direction;
 }
 
 PassRefPtr<IDBKey> IDBCursorBackendImpl::key() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::key");
     return m_cursor->key();
 }
 
 PassRefPtr<IDBKey> IDBCursorBackendImpl::primaryKey() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::primaryKey");
     return m_cursor->primaryKey();
 }
 
 PassRefPtr<SerializedScriptValue> IDBCursorBackendImpl::value() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::value");
     if (m_cursorType == IndexKeyCursor)
       return SerializedScriptValue::nullValue();
     return SerializedScriptValue::createFromWire(m_cursor->value());
@@ -86,6 +91,7 @@ PassRefPtr<SerializedScriptValue> IDBCursorBackendImpl::value() const
 
 void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::update");
     if (!m_cursor || m_cursorType == IndexKeyCursor) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return;
@@ -96,6 +102,7 @@ void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> value, PassR
 
 void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::continue");
     RefPtr<IDBKey> key = prpKey;
 
     if (m_cursor && key) {
@@ -121,6 +128,7 @@ void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPt
 //            IDBRequest::hasPendingActivity() will need to be modified to handle this!!!
 void IDBCursorBackendImpl::continueFunctionInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> prpCursor, PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBCursorBackendImpl::continueInternal");
     RefPtr<IDBCursorBackendImpl> cursor = prpCursor;
     RefPtr<IDBKey> key = prpKey;
 
@@ -135,6 +143,7 @@ void IDBCursorBackendImpl::continueFunctionInternal(ScriptExecutionContext*, Pas
 
 void IDBCursorBackendImpl::deleteFunction(PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::delete");
     if (!m_cursor || m_cursorType == IndexKeyCursor) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return;
@@ -145,12 +154,14 @@ void IDBCursorBackendImpl::deleteFunction(PassRefPtr<IDBCallbacks> prpCallbacks,
 
 void IDBCursorBackendImpl::prefetchContinue(int numberToFetch, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::prefetchContinue");
     if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::prefetchContinueInternal, this, numberToFetch, prpCallbacks)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
 void IDBCursorBackendImpl::prefetchContinueInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> prpCursor, int numberToFetch, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBCursorBackendImpl::prefetchContinueInternal");
     RefPtr<IDBCursorBackendImpl> cursor = prpCursor;
 
     Vector<RefPtr<IDBKey> > foundKeys;
@@ -197,6 +208,7 @@ void IDBCursorBackendImpl::prefetchContinueInternal(ScriptExecutionContext*, Pas
 
 void IDBCursorBackendImpl::prefetchReset(int usedPrefetches, int unusedPrefetches)
 {
+    IDB_TRACE("IDBCursorBackendImpl::prefetchReset");
     m_transaction->addPendingEvents(-unusedPrefetches);
     m_cursor = m_savedCursor;
     m_savedCursor = 0;
@@ -213,6 +225,7 @@ void IDBCursorBackendImpl::prefetchReset(int usedPrefetches, int unusedPrefetche
 
 void IDBCursorBackendImpl::close()
 {
+    IDB_TRACE("IDBCursorBackendImpl::close");
     m_closed = true;
     if (m_cursor)
         m_cursor->close();
diff --git a/Source/WebCore/storage/IDBDatabase.cpp b/Source/WebCore/storage/IDBDatabase.cpp
index c4b73cec5..cc53a882a 100644
--- a/Source/WebCore/storage/IDBDatabase.cpp
+++ b/Source/WebCore/storage/IDBDatabase.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "IDBDatabase.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "EventQueue.h"
 #include "ExceptionCode.h"
 #include "EventQueue.h"
@@ -38,19 +40,20 @@
 #include "IDBIndex.h"
 #include "IDBKeyPath.h"
 #include "IDBObjectStore.h"
+#include "IDBTracing.h"
+#include "IDBTransaction.h"
 #include "IDBVersionChangeEvent.h"
 #include "IDBVersionChangeRequest.h"
-#include "IDBTransaction.h"
 #include "ScriptExecutionContext.h"
 #include <limits>
 
-#if ENABLE(INDEXED_DATABASE)
-
 namespace WebCore {
 
 PassRefPtr<IDBDatabase> IDBDatabase::create(ScriptExecutionContext* context, PassRefPtr<IDBDatabaseBackendInterface> database)
 {
-    return adoptRef(new IDBDatabase(context, database));
+    RefPtr<IDBDatabase> idbDatabase(adoptRef(new IDBDatabase(context, database)));
+    idbDatabase->suspendIfNeeded();
+    return idbDatabase.release();
 }
 
 IDBDatabase::IDBDatabase(ScriptExecutionContext* context, PassRefPtr<IDBDatabaseBackendInterface> backend)
@@ -219,6 +222,7 @@ void IDBDatabase::enqueueEvent(PassRefPtr<Event> event)
 
 bool IDBDatabase::dispatchEvent(PassRefPtr<Event> event)
 {
+    IDB_TRACE("IDBDatabase::dispatchEvent");
     ASSERT(event->type() == eventNames().versionchangeEvent);
     for (size_t i = 0; i < m_enqueuedEvents.size(); ++i) {
         if (m_enqueuedEvents[i].get() == event.get())
diff --git a/Source/WebCore/storage/IDBDatabase.idl b/Source/WebCore/storage/IDBDatabase.idl
index f0b1d0c28..9abb38d89 100644
--- a/Source/WebCore/storage/IDBDatabase.idl
+++ b/Source/WebCore/storage/IDBDatabase.idl
@@ -45,11 +45,11 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBVersionChangeRequest setVersion(in DOMString version)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMStringList storeNames, in [Optional=CallWithDefaultValue] unsigned short mode)
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMStringList storeNames, in [Optional=DefaultIsUndefined] unsigned short mode)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString[] storeNames, in [Optional=CallWithDefaultValue] unsigned short mode)
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString[] storeNames, in [Optional=DefaultIsUndefined] unsigned short mode)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString storeName, in [Optional=CallWithDefaultValue] unsigned short mode)
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString storeName, in [Optional=DefaultIsUndefined] unsigned short mode)
             raises (IDBDatabaseException);
         void close();
 
diff --git a/Source/WebCore/storage/IDBIndex.cpp b/Source/WebCore/storage/IDBIndex.cpp
index bf2d38af2..a7c8dd3bb 100644
--- a/Source/WebCore/storage/IDBIndex.cpp
+++ b/Source/WebCore/storage/IDBIndex.cpp
@@ -35,6 +35,7 @@
 #include "IDBKeyRange.h"
 #include "IDBObjectStore.h"
 #include "IDBRequest.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 
 namespace WebCore {
@@ -57,6 +58,7 @@ IDBIndex::~IDBIndex()
 
 PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::openCursor");
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -75,6 +77,7 @@ PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, Pas
 
 PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::count");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->count(keyRange, request, m_transaction->backend(), ec);
     if (ec) {
@@ -86,6 +89,7 @@ PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefP
 
 PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::openKeyCursor");
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -104,6 +108,7 @@ PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context,
 
 PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::get");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -120,6 +125,7 @@ PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr
 
 PassRefPtr<IDBRequest> IDBIndex::getKey(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::getKey");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.cpp b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
index 85db158ae..cec43b98e 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
@@ -37,6 +37,7 @@
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendImpl.h"
+#include "IDBTracing.h"
 
 namespace WebCore {
 
@@ -72,6 +73,7 @@ IDBIndexBackendImpl::~IDBIndexBackendImpl()
 
 void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> range, unsigned short untypedDirection, IDBCursorBackendInterface::CursorType cursorType, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBIndexBackendImpl::openCursorInternal");
     IDBCursor::Direction direction = static_cast<IDBCursor::Direction>(untypedDirection);
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor;
@@ -104,6 +106,7 @@ void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr
 
 void IDBIndexBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::openCursor");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKeyRange> keyRange = prpKeyRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -114,6 +117,7 @@ void IDBIndexBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsign
 
 void IDBIndexBackendImpl::openKeyCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::openKeyCursor");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKeyRange> keyRange = prpKeyRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -124,6 +128,7 @@ void IDBIndexBackendImpl::openKeyCursor(PassRefPtr<IDBKeyRange> prpKeyRange, uns
 
 void IDBIndexBackendImpl::countInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBIndexBackendImpl::countInternal");
     uint32_t count = 0;
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor = index->m_backingStore->openIndexKeyCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), range.get(), IDBCursor::NEXT);
@@ -141,12 +146,14 @@ void IDBIndexBackendImpl::countInternal(ScriptExecutionContext*, PassRefPtr<IDBI
 
 void IDBIndexBackendImpl::count(PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::count");
     if (!transaction->scheduleTask(createCallbackTask(&countInternal, this, range, callbacks, transaction)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
 void IDBIndexBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKey> key, bool getObject, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBIndexBackendImpl::getInternal");
     // FIXME: Split getInternal into two functions, getting rid off |getObject|.
     if (getObject) {
         String value = index->m_backingStore->getObjectViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *key);
@@ -167,6 +174,7 @@ void IDBIndexBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBInd
 
 void IDBIndexBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::get");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKey> key = prpKey;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -176,6 +184,7 @@ void IDBIndexBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks
 
 void IDBIndexBackendImpl::getKey(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::getKey");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKey> key = prpKey;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
diff --git a/Source/WebCore/storage/IDBKey.idl b/Source/WebCore/storage/IDBKey.idl
index a213d721a..1464d9f73 100644
--- a/Source/WebCore/storage/IDBKey.idl
+++ b/Source/WebCore/storage/IDBKey.idl
@@ -27,7 +27,7 @@ module storage {
 
     interface [
         Conditional=INDEXED_DATABASE,
-        JSCustomToJS
+        CustomToJSObject
     ] IDBKey {
         // This space is intentionally left blank.
     };
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp b/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
index 528d1e912..f423bb007 100644
--- a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
@@ -968,7 +968,7 @@ public:
     virtual PassRefPtr<IDBKey> key() { return m_currentKey; }
     virtual PassRefPtr<IDBKey> primaryKey() { return m_currentKey; }
     virtual String value() = 0;
-    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() = 0; // FIXME: I don't think this is actually used, so drop it.
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() = 0;
     virtual int64_t indexDataId() = 0;
     virtual void close() { }
 
@@ -1117,7 +1117,10 @@ public:
 
     // CursorImplCommon
     virtual String value() { return m_currentValue; }
-    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { ASSERT_NOT_REACHED(); return 0; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() OVERRIDE
+    {
+        return m_identifier;
+    }
     virtual int64_t indexDataId() { ASSERT_NOT_REACHED(); return 0; }
     virtual bool loadCurrentRow();
 
@@ -1134,6 +1137,7 @@ private:
     }
 
     String m_currentValue;
+    RefPtr<LevelDBRecordIdentifier> m_identifier;
 };
 
 bool ObjectStoreCursorImpl::loadCurrentRow()
@@ -1154,7 +1158,9 @@ bool ObjectStoreCursorImpl::loadCurrentRow()
     ASSERT(q);
     if (!q)
         return false;
-    (void) version;
+
+    // FIXME: This re-encodes what was just decoded; try and optimize.
+    m_identifier = LevelDBRecordIdentifier::create(encodeIDBKey(*m_currentKey), version);
 
     m_currentValue = decodeString(q, m_iterator->value().end());
 
diff --git a/Source/WebCore/storage/IDBObjectStore.cpp b/Source/WebCore/storage/IDBObjectStore.cpp
index e4c965b14..6d4ffab7d 100644
--- a/Source/WebCore/storage/IDBObjectStore.cpp
+++ b/Source/WebCore/storage/IDBObjectStore.cpp
@@ -35,6 +35,7 @@
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
 #include "IDBKeyRange.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 #include "SerializedScriptValue.h"
 #include <wtf/UnusedParam.h>
@@ -55,26 +56,31 @@ IDBObjectStore::IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface> idbObj
 
 String IDBObjectStore::name() const
 {
+    IDB_TRACE("IDBObjectStore::name");
     return m_backend->name();
 }
 
 String IDBObjectStore::keyPath() const
 {
+    IDB_TRACE("IDBObjectStore::keyPath");
     return m_backend->keyPath();
 }
 
 PassRefPtr<DOMStringList> IDBObjectStore::indexNames() const
 {
+    IDB_TRACE("IDBObjectStore::indexNames");
     return m_backend->indexNames();
 }
 
 IDBTransaction* IDBObjectStore::transaction() const
 {
+    IDB_TRACE("IDBObjectStore::transaction");
     return m_transaction.get();
 }
 
 PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::get");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -91,6 +97,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, Pass
 
 PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::add");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -107,6 +114,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, Pass
 
 PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::put");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -121,9 +129,26 @@ PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, Pass
     return request.release();
 }
 
+PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
+{
+    if (!keyRange) {
+        ec = IDBDatabaseException::DATA_ERR;
+        return 0;
+    }
+
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->deleteFunction(keyRange, request, m_transaction->backend(), ec);
+    if (ec) {
+        request->markEarlyDeath();
+        return 0;
+    }
+    return request.release();
+}
+
 PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
-    if (key && (key->type() == IDBKey::InvalidType)) {
+    IDB_TRACE("IDBObjectStore::delete");
+    if (!key || !key->valid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -139,6 +164,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* co
 
 PassRefPtr<IDBRequest> IDBObjectStore::clear(ScriptExecutionContext* context, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::clear");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->clear(request, m_transaction->backend(), ec);
     if (ec) {
@@ -150,6 +176,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::clear(ScriptExecutionContext* context, Ex
 
 PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const String& keyPath, const OptionsObject& options, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::createIndex");
     if (!IDBIsValidKeyPath(keyPath)) {
         ec = IDBDatabaseException::NON_TRANSIENT_ERR;
         return 0;
@@ -174,6 +201,7 @@ PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const Strin
 
 PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::index");
     if (m_transaction->finished()) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return 0;
@@ -200,6 +228,7 @@ void IDBObjectStore::deleteIndex(const String& name, ExceptionCode& ec)
 
 PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> range, unsigned short direction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::openCursor");
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -218,6 +247,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* contex
 
 PassRefPtr<IDBRequest> IDBObjectStore::count(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> range, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::count");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->count(range, request, m_transaction->backend(), ec);
     if (ec) {
diff --git a/Source/WebCore/storage/IDBObjectStore.h b/Source/WebCore/storage/IDBObjectStore.h
index 2516663fa..60a9b1d3f 100644
--- a/Source/WebCore/storage/IDBObjectStore.h
+++ b/Source/WebCore/storage/IDBObjectStore.h
@@ -70,6 +70,7 @@ public:
     PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> add(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> put(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
+    PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, ExceptionCode&);
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, PassRefPtr<IDBKey> key, ExceptionCode&);
     PassRefPtr<IDBRequest> clear(ScriptExecutionContext*, ExceptionCode&);
 
diff --git a/Source/WebCore/storage/IDBObjectStore.idl b/Source/WebCore/storage/IDBObjectStore.idl
index 0a91253b8..5bcaf8ec4 100644
--- a/Source/WebCore/storage/IDBObjectStore.idl
+++ b/Source/WebCore/storage/IDBObjectStore.idl
@@ -28,8 +28,8 @@ module storage {
     interface [
         Conditional=INDEXED_DATABASE
     ] IDBObjectStore {
-        readonly attribute [ConvertNullStringTo=Null] DOMString name;
-        readonly attribute [ConvertNullStringTo=Null] DOMString keyPath;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString name;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString keyPath;
         readonly attribute DOMStringList indexNames;
         readonly attribute IDBTransaction transaction;
 
@@ -37,6 +37,8 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest add(in SerializedScriptValue value, in [Optional] IDBKey key)
             raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext, ImplementedAs=deleteFunction] IDBRequest delete(in IDBKeyRange keyRange)
+            raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext, ImplementedAs=deleteFunction] IDBRequest delete(in IDBKey key)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest clear()
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
index f07ea3eeb..b9ecce329 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
@@ -41,6 +41,7 @@
 #include "IDBKeyPath.h"
 #include "IDBKeyPathBackendImpl.h"
 #include "IDBKeyRange.h"
+#include "IDBTracing.h"
 #include "IDBTransactionBackendInterface.h"
 #include "ScriptExecutionContext.h"
 
@@ -83,6 +84,7 @@ PassRefPtr<DOMStringList> IDBObjectStoreBackendImpl::indexNames() const
 
 void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::get");
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
     RefPtr<IDBKey> key = prpKey;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -92,6 +94,7 @@ void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCal
 
 void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::getInternal");
     String wireData = objectStore->m_backingStore->getObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), *key);
     if (wireData.isNull()) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
@@ -103,6 +106,7 @@ void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<
 
 static PassRefPtr<IDBKey> fetchKeyFromKeyPath(SerializedScriptValue* value, const String& keyPath)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::fetchKeyFromKeyPath");
     Vector<RefPtr<SerializedScriptValue> > values;
     values.append(value);
     Vector<RefPtr<IDBKey> > keys;
@@ -115,11 +119,13 @@ static PassRefPtr<IDBKey> fetchKeyFromKeyPath(SerializedScriptValue* value, cons
 
 static PassRefPtr<SerializedScriptValue> injectKeyIntoKeyPath(PassRefPtr<IDBKey> key, PassRefPtr<SerializedScriptValue> value, const String& keyPath)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::injectKeyIntoKeyPath");
     return IDBKeyPathBackendImpl::injectIDBKeyIntoSerializedValue(key, value, keyPath);
 }
 
 void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::put");
     if (transactionPtr->mode() == IDBTransaction::READ_ONLY) {
         ec = IDBDatabaseException::READ_ONLY_ERR;
         return;
@@ -200,6 +206,7 @@ void IDBObjectStoreBackendImpl::revertAutoIncrementKeyCache(ScriptExecutionConte
 
 void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::putInternal");
     RefPtr<SerializedScriptValue> value = prpValue;
     RefPtr<IDBKey> key = prpKey;
 
@@ -326,45 +333,68 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
 
 void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::delete");
+    RefPtr<IDBKey> key = prpKey;
+    if (!key || !key->valid()) {
+        ec = IDBDatabaseException::DATA_ERR;
+        return;
+    }
+
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
+    if (ec)
+        return;
+
+    deleteFunction(keyRange.release(), prpCallbacks, transaction, ec);
+}
+
+void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKeyRange> prpKeyRange, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    IDB_TRACE("IDBObjectStoreBackendImpl::delete");
     if (transaction->mode() == IDBTransaction::READ_ONLY) {
         ec = IDBDatabaseException::READ_ONLY_ERR;
         return;
     }
 
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
-    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBKeyRange> keyRange = prpKeyRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
-    if (!key || !key->valid()) {
-        ec = IDBDatabaseException::DATA_ERR;
-        return;
-    }
 
-    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::deleteInternal, objectStore, key, callbacks)))
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::deleteInternal, objectStore, keyRange, callbacks)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
-void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> keyRange, PassRefPtr<IDBCallbacks> callbacks)
 {
-    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier = objectStore->m_backingStore->createInvalidRecordIdentifier();
-    if (!objectStore->m_backingStore->keyExistsInObjectStore(objectStore->m_databaseId, objectStore->id(), *key, recordIdentifier.get())) {
-        callbacks->onSuccess(SerializedScriptValue::booleanValue(false));
-        return;
-    }
+    IDB_TRACE("IDBObjectStoreBackendImpl::deleteInternal");
+    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier;
 
-    for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
-        if (!it->second->hasValidId())
-            continue; // The index object has been created, but does not exist in the database yet.
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), keyRange.get(), IDBCursor::NEXT);
+    if (backingStoreCursor) {
 
-        if (!objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), recordIdentifier.get()))
-            ASSERT_NOT_REACHED();
+        do {
+            recordIdentifier = backingStoreCursor->objectStoreRecordIdentifier();
+
+            for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
+                if (!it->second->hasValidId())
+                    continue; // The index object has been created, but does not exist in the database yet.
+
+                bool success = objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), recordIdentifier.get());
+                ASSERT_UNUSED(success, success);
+            }
+
+            objectStore->m_backingStore->deleteObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), recordIdentifier.get());
+
+        } while (backingStoreCursor->continueFunction(0));
+
+        backingStoreCursor->close();
     }
 
-    objectStore->m_backingStore->deleteObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), recordIdentifier.get());
-    callbacks->onSuccess(SerializedScriptValue::booleanValue(true));
+    callbacks->onSuccess(SerializedScriptValue::undefinedValue());
 }
 
 void IDBObjectStoreBackendImpl::clear(PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::clear");
     if (transaction->mode() == IDBTransaction::READ_ONLY) {
         ec = IDBDatabaseException::READ_ONLY_ERR;
         return;
@@ -531,6 +561,7 @@ void IDBObjectStoreBackendImpl::deleteIndexInternal(ScriptExecutionContext*, Pas
 
 void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::openCursor");
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
     RefPtr<IDBKeyRange> range = prpRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -544,6 +575,7 @@ void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpRange, uns
 
 void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> range, unsigned short tmpDirection, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::openCursorInternal");
     IDBCursor::Direction direction = static_cast<IDBCursor::Direction>(tmpDirection);
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), range.get(), direction);
@@ -558,12 +590,14 @@ void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, Pass
 
 void IDBObjectStoreBackendImpl::count(PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::count");
     if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::countInternal, this, range, callbacks, transaction)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
 void IDBObjectStoreBackendImpl::countInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::countInternal");
     uint32_t count = 0;
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), range.get(), IDBCursor::NEXT);
     if (!backingStoreCursor) {
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
index bdbf1f16a..cdf360cdf 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
@@ -68,7 +68,8 @@ public:
 
     virtual void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     virtual PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, bool multiEntry, IDBTransactionBackendInterface*, ExceptionCode&);
@@ -90,7 +91,7 @@ private:
 
     static void getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
     static void putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
-    static void deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    static void deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>);
     static void clearInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBCallbacks>);
     static void createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
     static void deleteIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
index 1d7125e64..5e6bf49c5 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
@@ -60,6 +60,7 @@ public:
     };
     virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
diff --git a/Source/WebCore/storage/IDBRequest.cpp b/Source/WebCore/storage/IDBRequest.cpp
index 968fb50ce..a04c0c668 100644
--- a/Source/WebCore/storage/IDBRequest.cpp
+++ b/Source/WebCore/storage/IDBRequest.cpp
@@ -39,13 +39,16 @@
 #include "IDBDatabase.h"
 #include "IDBEventDispatcher.h"
 #include "IDBPendingTransactionMonitor.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 
 namespace WebCore {
 
 PassRefPtr<IDBRequest> IDBRequest::create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransaction* transaction)
 {
-    return adoptRef(new IDBRequest(context, source, transaction));
+    RefPtr<IDBRequest> request(adoptRef(new IDBRequest(context, source, transaction)));
+    request->suspendIfNeeded();
+    return request.release();
 }
 
 IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransaction* transaction)
@@ -195,6 +198,7 @@ static PassRefPtr<Event> createSuccessEvent()
 
 void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 {
+    IDB_TRACE("IDBRequest::onSuccess(DOMStringList)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     m_result = IDBAny::create(domStringList);
     enqueueEvent(createSuccessEvent());
@@ -202,6 +206,7 @@ void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBCursor)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     ASSERT(m_cursorType != IDBCursorBackendInterface::InvalidCursorType);
     RefPtr<IDBCursor> cursor;
@@ -217,6 +222,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBDatabase)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     if (m_contextStopped || !scriptExecutionContext())
         return;
@@ -230,6 +236,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBKey)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     if (idbKey && idbKey->valid())
         m_result = IDBAny::create(idbKey);
@@ -240,6 +247,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBTransaction)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     RefPtr<IDBTransactionBackendInterface> backend = prpBackend;
 
@@ -264,6 +272,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend
 
 void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
+    IDB_TRACE("IDBRequest::onSuccess(SerializedScriptValue)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     m_result = IDBAny::create(serializedScriptValue);
     m_cursor.clear();
@@ -272,6 +281,7 @@ void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptVal
 
 void IDBRequest::onSuccessWithContinuation()
 {
+    IDB_TRACE("IDBRequest::onSuccessWithContinuation");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     ASSERT(m_cursor);
     setResultCursor(m_cursor, m_cursorType);
@@ -315,6 +325,7 @@ ScriptExecutionContext* IDBRequest::scriptExecutionContext() const
 
 bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
 {
+    IDB_TRACE("IDBRequest::dispatchEvent");
     ASSERT(!m_requestFinished);
     ASSERT(!m_contextStopped);
     ASSERT(m_enqueuedEvents.size());
diff --git a/Source/WebCore/storage/IDBRequest.idl b/Source/WebCore/storage/IDBRequest.idl
index 29f94cd16..8c3e38529 100644
--- a/Source/WebCore/storage/IDBRequest.idl
+++ b/Source/WebCore/storage/IDBRequest.idl
@@ -38,7 +38,7 @@ module storage {
             getter raises (IDBDatabaseException);
         readonly attribute unsigned short errorCode
             getter raises (IDBDatabaseException);
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString webkitErrorMessage
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString webkitErrorMessage
             getter raises (IDBDatabaseException);
         readonly attribute IDBAny source;
         readonly attribute IDBTransaction transaction;
diff --git a/Source/WebCore/storage/IDBTracing.h b/Source/WebCore/storage/IDBTracing.h
new file mode 100644
index 000000000..e1b3ef60f
--- /dev/null
+++ b/Source/WebCore/storage/IDBTracing.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBTracing_h
+#define IDBTracing_h
+
+#if ENABLE(INDEXED_DATABASE)
+
+#if PLATFORM(CHROMIUM)
+
+#include "TraceEvent.h"
+#define IDB_TRACE(a) TRACE_EVENT0("IndexedDB", (a));
+
+#else
+
+#define IDB_TRACE(a) ((void)0)
+
+#endif //  PLATFORM(CHROMIUM)
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBTracing_h
diff --git a/Source/WebCore/storage/IDBTransaction.cpp b/Source/WebCore/storage/IDBTransaction.cpp
index 140df05aa..ccdfb2b9e 100644
--- a/Source/WebCore/storage/IDBTransaction.cpp
+++ b/Source/WebCore/storage/IDBTransaction.cpp
@@ -37,12 +37,15 @@
 #include "IDBObjectStore.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBPendingTransactionMonitor.h"
+#include "IDBTracing.h"
 
 namespace WebCore {
 
 PassRefPtr<IDBTransaction> IDBTransaction::create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBDatabase* db)
 {
-    return adoptRef(new IDBTransaction(context, backend, db));
+    RefPtr<IDBTransaction> transaction(adoptRef(new IDBTransaction(context, backend, db)));
+    transaction->suspendIfNeeded();
+    return transaction.release();
 }
 
 IDBTransaction::IDBTransaction(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBDatabase* db)
@@ -184,6 +187,7 @@ ScriptExecutionContext* IDBTransaction::scriptExecutionContext() const
 
 bool IDBTransaction::dispatchEvent(PassRefPtr<Event> event)
 {
+    IDB_TRACE("IDBTransaction::dispatchEvent");
     ASSERT(!m_transactionFinished);
     ASSERT(scriptExecutionContext());
     ASSERT(event->target() == this);
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp b/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
index 24fa1c605..012e6b6dd 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
@@ -32,6 +32,7 @@
 #include "IDBCursorBackendImpl.h"
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBDatabaseException.h"
+#include "IDBTracing.h"
 #include "IDBTransactionCoordinator.h"
 
 namespace WebCore {
@@ -104,6 +105,7 @@ bool IDBTransactionBackendImpl::scheduleTask(PassOwnPtr<ScriptExecutionContext::
 
 void IDBTransactionBackendImpl::abort()
 {
+    IDB_TRACE("IDBTransactionBackendImpl::abort");
     if (m_state == Finished)
         return;
 
@@ -185,6 +187,7 @@ void IDBTransactionBackendImpl::start()
 
 void IDBTransactionBackendImpl::commit()
 {
+    IDB_TRACE("IDBTransactionBackendImpl::commit");
     // The last reference to this object may be released while performing the
     // commit steps below. We therefore take a self reference to keep ourselves
     // alive while executing this method.
@@ -203,6 +206,7 @@ void IDBTransactionBackendImpl::commit()
 
 void IDBTransactionBackendImpl::taskTimerFired(Timer<IDBTransactionBackendImpl>*)
 {
+    IDB_TRACE("IDBTransactionBackendImpl::taskTimerFired");
     ASSERT(!m_taskQueue.isEmpty());
 
     if (m_state == StartPending) {
@@ -223,6 +227,7 @@ void IDBTransactionBackendImpl::taskTimerFired(Timer<IDBTransactionBackendImpl>*
 
 void IDBTransactionBackendImpl::taskEventTimerFired(Timer<IDBTransactionBackendImpl>*)
 {
+    IDB_TRACE("IDBTransactionBackendImpl::taskEventTimerFired");
     ASSERT(m_state == Running);
 
     if (!m_pendingEvents && m_taskQueue.isEmpty()) {
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.cpp b/Source/WebCore/storage/IDBVersionChangeRequest.cpp
index 081d24ce1..f13ca9d3c 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.cpp
+++ b/Source/WebCore/storage/IDBVersionChangeRequest.cpp
@@ -35,7 +35,10 @@ namespace WebCore {
 
 PassRefPtr<IDBVersionChangeRequest> IDBVersionChangeRequest::create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, const String& version)
 {
-    return adoptRef(new IDBVersionChangeRequest(context, source, version));
+    RefPtr<IDBVersionChangeRequest> request(adoptRef(new IDBVersionChangeRequest(context, source, version)));
+    request->suspendIfNeeded();
+    return request.release();
+
 }
 
 IDBVersionChangeRequest::IDBVersionChangeRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, const String& version)
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.idl b/Source/WebCore/storage/IDBVersionChangeRequest.idl
index ffac73547..2aa238a8b 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.idl
+++ b/Source/WebCore/storage/IDBVersionChangeRequest.idl
@@ -27,6 +27,7 @@ module storage {
 
     interface [
         Conditional=INDEXED_DATABASE,
+        ActiveDOMObject,
         EventTarget
     ] IDBVersionChangeRequest : IDBRequest {
         attribute EventListener onblocked;
diff --git a/Source/WebCore/storage/LocalStorageTask.h b/Source/WebCore/storage/LocalStorageTask.h
deleted file mode 100644
index 3e8b6b17d..000000000
--- a/Source/WebCore/storage/LocalStorageTask.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef LocalStorageTask_h
-#define LocalStorageTask_h
-
-#include "PlatformString.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Threading.h>
-
-namespace WebCore {
-
-    class StorageAreaSync;
-    class LocalStorageThread;
-
-    // FIXME: Rename this class to StorageTask
-    class LocalStorageTask {
-        WTF_MAKE_NONCOPYABLE(LocalStorageTask); WTF_MAKE_FAST_ALLOCATED;
-    public:
-        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, SetOriginDetails, ImportOrigins, DeleteAllOrigins, DeleteOrigin, TerminateThread };
-
-        ~LocalStorageTask();
-
-        static PassOwnPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaImport, area)); }
-        static PassOwnPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaSync, area)); }
-        static PassOwnPtr<LocalStorageTask> createDeleteEmptyDatabase(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(DeleteEmptyDatabase, area)); }
-        static PassOwnPtr<LocalStorageTask> createOriginIdentifiersImport() { return adoptPtr(new LocalStorageTask(ImportOrigins)); }
-        static PassOwnPtr<LocalStorageTask> createSetOriginDetails(const String& originIdentifier, const String& databaseFilename) { return adoptPtr(new LocalStorageTask(SetOriginDetails, originIdentifier, databaseFilename)); }
-        static PassOwnPtr<LocalStorageTask> createDeleteOrigin(const String& originIdentifier) { return adoptPtr(new LocalStorageTask(DeleteOrigin, originIdentifier)); }
-        static PassOwnPtr<LocalStorageTask> createDeleteAllOrigins() { return adoptPtr(new LocalStorageTask(DeleteAllOrigins)); }
-        static PassOwnPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptPtr(new LocalStorageTask(TerminateThread, thread)); }
-
-        void performTask();
-
-    private:
-        LocalStorageTask(Type, StorageAreaSync*);
-        LocalStorageTask(Type, LocalStorageThread*);
-        LocalStorageTask(Type, const String& originIdentifier);
-        LocalStorageTask(Type, const String& originIdentifier, const String& databaseFilename);
-        LocalStorageTask(Type);
-
-        Type m_type;
-        StorageAreaSync* m_area;
-        LocalStorageThread* m_thread;
-        String m_originIdentifier;
-        String m_databaseFilename;
-    };
-
-} // namespace WebCore
-
-#endif // LocalStorageTask_h
diff --git a/Source/WebCore/storage/SQLCallbackWrapper.h b/Source/WebCore/storage/SQLCallbackWrapper.h
index 34c708563..3cb0e2dbc 100644
--- a/Source/WebCore/storage/SQLCallbackWrapper.h
+++ b/Source/WebCore/storage/SQLCallbackWrapper.h
@@ -30,7 +30,6 @@
 
 #if ENABLE(SQL_DATABASE)
 
-#include "CrossThreadTask.h"
 #include "ScriptExecutionContext.h"
 #include <wtf/ThreadingPrimitives.h>
 
@@ -74,7 +73,7 @@ public:
             context = m_scriptExecutionContext.release().leakRef();
             callback = m_callback.release().leakRef();
         }
-        context->postTask(createCallbackTask(&safeRelease, AllowAccessLater(callback)));
+        context->postTask(SafeReleaseTask::create(callback));
     }
 
     PassRefPtr<T> unwrap()
@@ -89,12 +88,30 @@ public:
     bool hasCallback() const { return m_callback; }
 
 private:
-    static void safeRelease(ScriptExecutionContext* context, T* callback)
-    {
-        ASSERT(callback && context && context->isContextThread());
-        callback->deref();
-        context->deref();
-    }
+    class SafeReleaseTask : public ScriptExecutionContext::Task {
+    public:
+        static PassOwnPtr<SafeReleaseTask> create(T* callbackToRelease)
+        {
+            return adoptPtr(new SafeReleaseTask(callbackToRelease));
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            ASSERT(m_callbackToRelease && context && context->isContextThread());
+            m_callbackToRelease->deref();
+            context->deref();
+        }
+
+        virtual bool isCleanupTask() const { return true; }
+
+    private:
+        SafeReleaseTask(T* callbackToRelease)
+            : m_callbackToRelease(callbackToRelease)
+        {
+        }
+
+        T* m_callbackToRelease;
+    };
 
     Mutex m_mutex;
     RefPtr<T> m_callback;
diff --git a/Source/WebCore/storage/Storage.idl b/Source/WebCore/storage/Storage.idl
index e656d52fd..1d5b327cb 100644
--- a/Source/WebCore/storage/Storage.idl
+++ b/Source/WebCore/storage/Storage.idl
@@ -29,12 +29,12 @@ module storage {
         NamedGetter,
         JSGenerateIsReachable=ImplFrame,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         CustomNamedSetter,
     ] Storage {
         readonly attribute [NotEnumerable] unsigned long length;
-        [NotEnumerable, ConvertNullStringTo=Null] DOMString key(in unsigned long index);
-        [NotEnumerable, ConvertNullStringTo=Null] DOMString getItem(in DOMString key);
+        [NotEnumerable, TreatReturnedNullStringAs=Null] DOMString key(in unsigned long index);
+        [NotEnumerable, TreatReturnedNullStringAs=Null] DOMString getItem(in DOMString key);
         [NotEnumerable] void setItem(in DOMString key, in DOMString data) 
             raises(DOMException);
         [NotEnumerable] void removeItem(in DOMString key);
diff --git a/Source/WebCore/storage/StorageEvent.idl b/Source/WebCore/storage/StorageEvent.idl
index 6414fcf11..6e4770a76 100644
--- a/Source/WebCore/storage/StorageEvent.idl
+++ b/Source/WebCore/storage/StorageEvent.idl
@@ -29,19 +29,19 @@ module storage {
         ConstructorTemplate=Event
     ] StorageEvent : Event {
         readonly attribute [InitializedByEventConstructor] DOMString key;
-        readonly attribute [InitializedByEventConstructor, ConvertNullStringTo=Null] DOMString oldValue;
-        readonly attribute [InitializedByEventConstructor, ConvertNullStringTo=Null] DOMString newValue;
+        readonly attribute [InitializedByEventConstructor, TreatReturnedNullStringAs=Null] DOMString oldValue;
+        readonly attribute [InitializedByEventConstructor, TreatReturnedNullStringAs=Null] DOMString newValue;
         readonly attribute [InitializedByEventConstructor] DOMString url;
         readonly attribute [InitializedByEventConstructor] Storage storageArea;
 
-        void initStorageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                              in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                              in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                              in [Optional=CallWithDefaultValue] DOMString keyArg, 
-                              in [Optional=CallWithDefaultValue,TreatNullAs=NullString] DOMString oldValueArg, 
-                              in [Optional=CallWithDefaultValue,TreatNullAs=NullString] DOMString newValueArg, 
-                              in [Optional=CallWithDefaultValue] DOMString urlArg, 
-                              in [Optional=CallWithDefaultValue] Storage storageAreaArg);
+        void initStorageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                              in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                              in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                              in [Optional=DefaultIsUndefined] DOMString keyArg, 
+                              in [Optional=DefaultIsUndefined,TreatNullAs=NullString] DOMString oldValueArg, 
+                              in [Optional=DefaultIsUndefined,TreatNullAs=NullString] DOMString newValueArg, 
+                              in [Optional=DefaultIsUndefined] DOMString urlArg, 
+                              in [Optional=DefaultIsUndefined] Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
         // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString urlArg, in Storage storageAreaArg);
diff --git a/Source/WebCore/storage/StorageSyncManager.cpp b/Source/WebCore/storage/StorageSyncManager.cpp
index c05de989f..c39fe0ddc 100644
--- a/Source/WebCore/storage/StorageSyncManager.cpp
+++ b/Source/WebCore/storage/StorageSyncManager.cpp
@@ -30,8 +30,8 @@
 #include "FileSystem.h"
 #include "Frame.h"
 #include "FrameTree.h"
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
+#include "StorageTask.h"
+#include "StorageThread.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "StorageAreaSync.h"
@@ -47,7 +47,7 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_thread(LocalStorageThread::create())
+    : m_thread(StorageThread::create())
     , m_path(path.isolatedCopy())
 {
     ASSERT(isMainThread());
@@ -87,7 +87,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
     ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleTask(LocalStorageTask::createImport(area.get()));
+        m_thread->scheduleTask(StorageTask::createImport(area.get()));
     return m_thread;
 }
 
@@ -96,7 +96,7 @@ void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
     ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleTask(LocalStorageTask::createSync(area.get()));
+        m_thread->scheduleTask(StorageTask::createSync(area.get()));
 }
 
 void StorageSyncManager::scheduleDeleteEmptyDatabase(PassRefPtr<StorageAreaSync> area)
@@ -104,7 +104,7 @@ void StorageSyncManager::scheduleDeleteEmptyDatabase(PassRefPtr<StorageAreaSync>
     ASSERT(isMainThread());
     ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleTask(LocalStorageTask::createDeleteEmptyDatabase(area.get()));
+        m_thread->scheduleTask(StorageTask::createDeleteEmptyDatabase(area.get()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/StorageSyncManager.h b/Source/WebCore/storage/StorageSyncManager.h
index 5e0f16589..e27833787 100644
--- a/Source/WebCore/storage/StorageSyncManager.h
+++ b/Source/WebCore/storage/StorageSyncManager.h
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-    class LocalStorageThread;
+    class StorageThread;
     class SecurityOrigin;
     class StorageAreaSync;
 
@@ -52,7 +52,7 @@ namespace WebCore {
     private:
         StorageSyncManager(const String& path);
 
-        OwnPtr<LocalStorageThread> m_thread;
+        OwnPtr<StorageThread> m_thread;
 
     // The following members are subject to thread synchronization issues
     public:
diff --git a/Source/WebCore/storage/LocalStorageTask.cpp b/Source/WebCore/storage/StorageTask.cpp
index 39b16b4d4..47aabe99e 100644
--- a/Source/WebCore/storage/LocalStorageTask.cpp
+++ b/Source/WebCore/storage/StorageTask.cpp
@@ -24,15 +24,15 @@
  */
 
 #include "config.h"
-#include "LocalStorageTask.h"
+#include "StorageTask.h"
 
-#include "LocalStorageThread.h"
+#include "StorageThread.h"
 #include "StorageAreaSync.h"
 #include "StorageTracker.h"
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
+StorageTask::StorageTask(Type type, StorageAreaSync* area)
     : m_type(type)
     , m_area(area)
     , m_thread(0)
@@ -41,7 +41,7 @@ LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
     ASSERT(m_type == AreaImport || m_type == AreaSync || m_type == DeleteEmptyDatabase);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
+StorageTask::StorageTask(Type type, StorageThread* thread)
     : m_type(type)
     , m_area(0)
     , m_thread(thread)
@@ -49,21 +49,21 @@ LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     ASSERT(m_thread);
     ASSERT(m_type == TerminateThread);
 }
-    
-LocalStorageTask::LocalStorageTask(Type type)
+
+StorageTask::StorageTask(Type type)
     : m_type(type)
 {
     ASSERT(m_type == ImportOrigins || m_type == DeleteAllOrigins);
 }
-    
-LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier)
+
+StorageTask::StorageTask(Type type, const String& originIdentifier)
     : m_type(type)
     , m_originIdentifier(originIdentifier)
 {
     ASSERT(m_type == DeleteOrigin);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier, const String& databaseFilename)
+StorageTask::StorageTask(Type type, const String& originIdentifier, const String& databaseFilename)
     : m_type(type)
     , m_originIdentifier(originIdentifier)
     , m_databaseFilename(databaseFilename)
@@ -71,11 +71,11 @@ LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier, co
     ASSERT(m_type == SetOriginDetails);
 }
 
-LocalStorageTask::~LocalStorageTask()
+StorageTask::~StorageTask()
 {
 }
 
-void LocalStorageTask::performTask()
+void StorageTask::performTask()
 {
     switch (m_type) {
         case AreaImport:
diff --git a/Source/WebCore/storage/StorageTask.h b/Source/WebCore/storage/StorageTask.h
new file mode 100644
index 000000000..7d0523fd1
--- /dev/null
+++ b/Source/WebCore/storage/StorageTask.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageTask_h
+#define StorageTask_h
+
+#include "PlatformString.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class StorageAreaSync;
+    class StorageThread;
+
+    class StorageTask {
+        WTF_MAKE_NONCOPYABLE(StorageTask); WTF_MAKE_FAST_ALLOCATED;
+    public:
+        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, SetOriginDetails, ImportOrigins, DeleteAllOrigins, DeleteOrigin, TerminateThread };
+
+        ~StorageTask();
+
+        static PassOwnPtr<StorageTask> createImport(StorageAreaSync* area) { return adoptPtr(new StorageTask(AreaImport, area)); }
+        static PassOwnPtr<StorageTask> createSync(StorageAreaSync* area) { return adoptPtr(new StorageTask(AreaSync, area)); }
+        static PassOwnPtr<StorageTask> createDeleteEmptyDatabase(StorageAreaSync* area) { return adoptPtr(new StorageTask(DeleteEmptyDatabase, area)); }
+        static PassOwnPtr<StorageTask> createOriginIdentifiersImport() { return adoptPtr(new StorageTask(ImportOrigins)); }
+        static PassOwnPtr<StorageTask> createSetOriginDetails(const String& originIdentifier, const String& databaseFilename) { return adoptPtr(new StorageTask(SetOriginDetails, originIdentifier, databaseFilename)); }
+        static PassOwnPtr<StorageTask> createDeleteOrigin(const String& originIdentifier) { return adoptPtr(new StorageTask(DeleteOrigin, originIdentifier)); }
+        static PassOwnPtr<StorageTask> createDeleteAllOrigins() { return adoptPtr(new StorageTask(DeleteAllOrigins)); }
+        static PassOwnPtr<StorageTask> createTerminate(StorageThread* thread) { return adoptPtr(new StorageTask(TerminateThread, thread)); }
+
+        void performTask();
+
+    private:
+        StorageTask(Type, StorageAreaSync*);
+        StorageTask(Type, StorageThread*);
+        StorageTask(Type, const String& originIdentifier);
+        StorageTask(Type, const String& originIdentifier, const String& databaseFilename);
+        StorageTask(Type);
+
+        Type m_type;
+        StorageAreaSync* m_area;
+        StorageThread* m_thread;
+        String m_originIdentifier;
+        String m_databaseFilename;
+    };
+
+} // namespace WebCore
+
+#endif // StorageTask_h
diff --git a/Source/WebCore/storage/LocalStorageThread.cpp b/Source/WebCore/storage/StorageThread.cpp
index ba1b0fa26..623d7ea82 100644
--- a/Source/WebCore/storage/LocalStorageThread.cpp
+++ b/Source/WebCore/storage/StorageThread.cpp
@@ -24,60 +24,58 @@
  */
 
 #include "config.h"
-#include "LocalStorageThread.h"
+#include "StorageThread.h"
 
-#include "LocalStorageTask.h"
+#include "StorageTask.h"
 #include "StorageAreaSync.h"
 #include <wtf/MainThread.h>
 
 namespace WebCore {
 
-PassOwnPtr<LocalStorageThread> LocalStorageThread::create()
+PassOwnPtr<StorageThread> StorageThread::create()
 {
-    return adoptPtr(new LocalStorageThread);
+    return adoptPtr(new StorageThread);
 }
 
-LocalStorageThread::LocalStorageThread()
+StorageThread::StorageThread()
     : m_threadID(0)
 {
 }
 
-LocalStorageThread::~LocalStorageThread()
+StorageThread::~StorageThread()
 {
     ASSERT(isMainThread());
     ASSERT(!m_threadID);
 }
 
-bool LocalStorageThread::start()
+bool StorageThread::start()
 {
     ASSERT(isMainThread());
     if (!m_threadID)
-        m_threadID = createThread(LocalStorageThread::threadEntryPointCallback, this, "WebCore: LocalStorage");
+        m_threadID = createThread(StorageThread::threadEntryPointCallback, this, "WebCore: LocalStorage");
     return m_threadID;
 }
 
-void* LocalStorageThread::threadEntryPointCallback(void* thread)
+void StorageThread::threadEntryPointCallback(void* thread)
 {
-    return static_cast<LocalStorageThread*>(thread)->threadEntryPoint();
+    static_cast<StorageThread*>(thread)->threadEntryPoint();
 }
 
-void* LocalStorageThread::threadEntryPoint()
+void StorageThread::threadEntryPoint()
 {
     ASSERT(!isMainThread());
-    while (OwnPtr<LocalStorageTask> task = m_queue.waitForMessage())
+    while (OwnPtr<StorageTask> task = m_queue.waitForMessage())
         task->performTask();
-
-    return 0;
 }
 
-void LocalStorageThread::scheduleTask(PassOwnPtr<LocalStorageTask> task)
+void StorageThread::scheduleTask(PassOwnPtr<StorageTask> task)
 {
     ASSERT(isMainThread());
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(task);
 }
 
-void LocalStorageThread::terminate()
+void StorageThread::terminate()
 {
     ASSERT(isMainThread());
     ASSERT(!m_queue.killed() && m_threadID);
@@ -85,14 +83,13 @@ void LocalStorageThread::terminate()
     if (!m_threadID)
         return;
 
-    void* returnValue;
-    m_queue.append(LocalStorageTask::createTerminate(this));
-    waitForThreadCompletion(m_threadID, &returnValue);
+    m_queue.append(StorageTask::createTerminate(this));
+    waitForThreadCompletion(m_threadID);
     ASSERT(m_queue.killed());
     m_threadID = 0;
 }
 
-void LocalStorageThread::performTerminate()
+void StorageThread::performTerminate()
 {
     ASSERT(!isMainThread());
     m_queue.kill();
diff --git a/Source/WebCore/storage/LocalStorageThread.h b/Source/WebCore/storage/StorageThread.h
index 46467afa7..a484118c4 100644
--- a/Source/WebCore/storage/LocalStorageThread.h
+++ b/Source/WebCore/storage/StorageThread.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef LocalStorageThread_h
-#define LocalStorageThread_h
+#ifndef StorageThread_h
+#define StorageThread_h
 
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
@@ -35,33 +35,32 @@
 namespace WebCore {
 
     class StorageAreaSync;
-    class LocalStorageTask;
+    class StorageTask;
 
-    // FIXME: Rename this class to StorageThread
-    class LocalStorageThread {
-        WTF_MAKE_NONCOPYABLE(LocalStorageThread); WTF_MAKE_FAST_ALLOCATED;
+    class StorageThread {
+        WTF_MAKE_NONCOPYABLE(StorageThread); WTF_MAKE_FAST_ALLOCATED;
     public:
-        static PassOwnPtr<LocalStorageThread> create();
-        ~LocalStorageThread();
+        static PassOwnPtr<StorageThread> create();
+        ~StorageThread();
 
         bool start();
         void terminate();
-        void scheduleTask(PassOwnPtr<LocalStorageTask>);
+        void scheduleTask(PassOwnPtr<StorageTask>);
 
         // Background thread part of the terminate procedure.
         void performTerminate();
 
     private:
-        LocalStorageThread();
+        StorageThread();
 
         // Called on background thread.
-        static void* threadEntryPointCallback(void*);
-        void* threadEntryPoint();
+        static void threadEntryPointCallback(void*);
+        void threadEntryPoint();
 
         ThreadIdentifier m_threadID;
-        MessageQueue<LocalStorageTask> m_queue;
+        MessageQueue<StorageTask> m_queue;
     };
 
 } // namespace WebCore
 
-#endif // LocalStorageThread_h
+#endif // StorageThread_h
diff --git a/Source/WebCore/storage/StorageTracker.cpp b/Source/WebCore/storage/StorageTracker.cpp
index f981e6bd0..9e18dd473 100644
--- a/Source/WebCore/storage/StorageTracker.cpp
+++ b/Source/WebCore/storage/StorageTracker.cpp
@@ -28,8 +28,8 @@
 
 #include "DatabaseThread.h"
 #include "FileSystem.h"
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
+#include "StorageTask.h"
+#include "StorageThread.h"
 #include "Logging.h"
 #include "PageGroup.h"
 #include "SQLiteFileSystem.h"
@@ -87,7 +87,7 @@ StorageTracker& StorageTracker::tracker()
 StorageTracker::StorageTracker(const String& storagePath)
     : m_storageDirectoryPath(storagePath.isolatedCopy())
     , m_client(0)
-    , m_thread(LocalStorageThread::create())
+    , m_thread(StorageThread::create())
     , m_isActive(false)
     , m_needsInitialization(false)
     , m_finishedImportingOriginIdentifiers(false)
@@ -163,7 +163,7 @@ void StorageTracker::importOriginIdentifiers()
     ASSERT(isMainThread());
     ASSERT(m_thread);
 
-    m_thread->scheduleTask(LocalStorageTask::createOriginIdentifiersImport());
+    m_thread->scheduleTask(StorageTask::createOriginIdentifiersImport());
 }
 
 void StorageTracker::notifyFinishedImportingOriginIdentifiersOnMainThread(void*)
@@ -297,7 +297,7 @@ void StorageTracker::setOriginDetails(const String& originIdentifier, const Stri
         m_originSet.add(originIdentifier);
     }
 
-    OwnPtr<LocalStorageTask> task = LocalStorageTask::createSetOriginDetails(originIdentifier.isolatedCopy(), databaseFile);
+    OwnPtr<StorageTask> task = StorageTask::createSetOriginDetails(originIdentifier.isolatedCopy(), databaseFile);
 
     if (isMainThread()) {
         ASSERT(m_thread);
@@ -311,7 +311,7 @@ void StorageTracker::scheduleTask(void* taskIn)
     ASSERT(isMainThread());
     ASSERT(StorageTracker::tracker().m_thread);
     
-    OwnPtr<LocalStorageTask> task = adoptPtr(reinterpret_cast<LocalStorageTask*>(taskIn));
+    OwnPtr<StorageTask> task = adoptPtr(reinterpret_cast<StorageTask*>(taskIn));
 
     StorageTracker::tracker().m_thread->scheduleTask(task.release());
 }
@@ -383,7 +383,7 @@ void StorageTracker::deleteAllOrigins()
 
     PageGroup::clearLocalStorageForAllOrigins();
     
-    m_thread->scheduleTask(LocalStorageTask::createDeleteAllOrigins());
+    m_thread->scheduleTask(StorageTask::createDeleteAllOrigins());
 }
     
 void StorageTracker::syncDeleteAllOrigins()
@@ -479,7 +479,7 @@ void StorageTracker::deleteOrigin(SecurityOrigin* origin)
         m_originSet.remove(originId);
     }
     
-    m_thread->scheduleTask(LocalStorageTask::createDeleteOrigin(originId));
+    m_thread->scheduleTask(StorageTask::createDeleteOrigin(originId));
 }
 
 void StorageTracker::syncDeleteOrigin(const String& originIdentifier)
diff --git a/Source/WebCore/storage/StorageTracker.h b/Source/WebCore/storage/StorageTracker.h
index d7cb82460..9e1945adb 100644
--- a/Source/WebCore/storage/StorageTracker.h
+++ b/Source/WebCore/storage/StorageTracker.h
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-class LocalStorageTask;
-class LocalStorageThread;
+class StorageTask;
+class StorageThread;
 class SecurityOrigin;
 class StorageTrackerClient;    
 
@@ -113,7 +113,7 @@ private:
     OriginSet m_originSet;
     OriginSet m_originsBeingDeleted;
 
-    OwnPtr<LocalStorageThread> m_thread;
+    OwnPtr<StorageThread> m_thread;
     
     bool m_isActive;
     bool m_needsInitialization;
diff --git a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp b/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
index c53661dc2..117fdbeed 100644
--- a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
+++ b/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
@@ -157,29 +157,6 @@ void DatabaseTracker::removeOpenDatabase(AbstractDatabase* database)
         DatabaseObserver::databaseClosed(database);
 }
 
-void DatabaseTracker::getOpenDatabases(SecurityOrigin* origin, const String& name, HashSet<RefPtr<AbstractDatabase> >* databases)
-{
-    getOpenDatabases(origin->databaseIdentifier(), name, databases);
-}
-
-void DatabaseTracker::getOpenDatabases(const String& originIdentifier, const String& name, HashSet<RefPtr<AbstractDatabase> >* databases)
-{
-    MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
-    if (!m_openDatabaseMap)
-        return;
-
-    DatabaseNameMap* nameMap = m_openDatabaseMap->get(originIdentifier);
-    if (!nameMap)
-        return;
-
-    DatabaseSet* databaseSet = nameMap->get(name);
-    if (!databaseSet)
-        return;
-
-    for (DatabaseSet::iterator it = databaseSet->begin(); it != databaseSet->end(); ++it)
-        databases->add(*it);
-}
-
 unsigned long long DatabaseTracker::getMaxSizeForDatabase(const AbstractDatabase* database)
 {
     unsigned long long spaceAvailable = 0;
@@ -212,6 +189,76 @@ void DatabaseTracker::interruptAllDatabasesForContext(const ScriptExecutionConte
     }
 }
 
+class DatabaseTracker::CloseOneDatabaseImmediatelyTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<CloseOneDatabaseImmediatelyTask> create(const String& originIdentifier, const String& name, AbstractDatabase* database)
+    {
+        return adoptPtr(new CloseOneDatabaseImmediatelyTask(originIdentifier, name, database));
+    }
+
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        DatabaseTracker::tracker().closeOneDatabaseImmediately(m_originIdentifier, m_name, m_database);
+    }
+
+private:
+    CloseOneDatabaseImmediatelyTask(const String& originIdentifier, const String& name, AbstractDatabase* database)
+        : m_originIdentifier(originIdentifier.isolatedCopy())
+        , m_name(name.isolatedCopy())
+        , m_database(database)
+    {
+    }
+
+    String m_originIdentifier;
+    String m_name;
+    AbstractDatabase* m_database;  // Intentionally a raw pointer.
+};
+
+void DatabaseTracker::closeDatabasesImmediately(const String& originIdentifier, const String& name) {
+    MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
+    if (!m_openDatabaseMap)
+        return;
+
+    DatabaseNameMap* nameMap = m_openDatabaseMap->get(originIdentifier);
+    if (!nameMap)
+        return;
+
+    DatabaseSet* databaseSet = nameMap->get(name);
+    if (!databaseSet)
+        return;
+
+    // We have to call closeImmediately() on the context thread and we cannot safely add a reference to
+    // the database in our collection when not on the context thread (which is always the case given
+    // current usage).
+    for (DatabaseSet::iterator it = databaseSet->begin(); it != databaseSet->end(); ++it)
+        (*it)->scriptExecutionContext()->postTask(CloseOneDatabaseImmediatelyTask::create(originIdentifier, name, *it));
+}
+
+void DatabaseTracker::closeOneDatabaseImmediately(const String& originIdentifier, const String& name, AbstractDatabase* database)
+{
+    // First we have to confirm the 'database' is still in our collection.
+    {
+        MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
+        if (!m_openDatabaseMap)
+            return;
+
+        DatabaseNameMap* nameMap = m_openDatabaseMap->get(originIdentifier);
+        if (!nameMap)
+            return;
+
+        DatabaseSet* databaseSet = nameMap->get(name);
+        if (!databaseSet)
+            return;
+
+        DatabaseSet::iterator found = databaseSet->find(database);
+        if (found == databaseSet->end())
+            return;
+    }
+
+    // And we have to call closeImmediately() without our collection lock being held.
+    database->closeImmediately();
+}
+
 }
 
 #endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.cpp b/Source/WebCore/storage/wince/StorageThreadWinCE.cpp
index 90c4e89a2..25e896f83 100644
--- a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.cpp
+++ b/Source/WebCore/storage/wince/StorageThreadWinCE.cpp
@@ -22,31 +22,31 @@
  */
 
 #include "config.h"
-#include "LocalStorageThread.h"
+#include "StorageThread.h"
 
-#include "LocalStorageTask.h"
+#include "StorageTask.h"
 #include "StorageAreaSync.h"
 
 namespace WebCore {
 
-LocalStorageThread::LocalStorageThread()
-: m_timer(this, &LocalStorageThread::timerFired)
+StorageThread::StorageThread()
+: m_timer(this, &StorageThread::timerFired)
 {
 }
 
-LocalStorageThread::~LocalStorageThread()
+StorageThread::~StorageThread()
 {
 }
 
-bool LocalStorageThread::start()
+bool StorageThread::start()
 {
     return true;
 }
 
-void LocalStorageThread::timerFired(Timer<LocalStorageThread>*)
+void StorageThread::timerFired(Timer<StorageThread>*)
 {
     if (!m_queue.isEmpty()) {
-        RefPtr<LocalStorageTask> task = m_queue.first();
+        RefPtr<StorageTask> task = m_queue.first();
         task->performTask();
         m_queue.removeFirst();
         if (!m_queue.isEmpty())
@@ -54,27 +54,27 @@ void LocalStorageThread::timerFired(Timer<LocalStorageThread>*)
     }
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
+void StorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
-    m_queue.append(LocalStorageTask::createImport(area));
+    m_queue.append(StorageTask::createImport(area));
     if (!m_timer.isActive())
         m_timer.startOneShot(0);
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
+void StorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
-    m_queue.append(LocalStorageTask::createSync(area));
+    m_queue.append(StorageTask::createSync(area));
     if (!m_timer.isActive())
         m_timer.startOneShot(0);
 }
 
-void LocalStorageThread::terminate()
+void StorageThread::terminate()
 {
     m_queue.clear();
     m_timer.stop();
 }
 
-void LocalStorageThread::performTerminate()
+void StorageThread::performTerminate()
 {
     m_queue.clear();
     m_timer.stop();
diff --git a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.h b/Source/WebCore/storage/wince/StorageThreadWinCE.h
index 06e7d4568..67573ae50 100644
--- a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.h
+++ b/Source/WebCore/storage/wince/StorageThreadWinCE.h
@@ -22,8 +22,8 @@
  */
 
 
-#ifndef LocalStorageThreadWinCE_h
-#define LocalStorageThreadWinCE_h
+#ifndef StorageThreadWinCE_h
+#define StorageThreadWinCE_h
 
 #include <wtf/Deque.h>
 #include <wtf/PassRefPtr.h>
@@ -31,13 +31,13 @@
 namespace WebCore {
 
     class StorageAreaSync;
-    class LocalStorageTask;
+    class StorageTask;
 
-    class LocalStorageThread : public RefCounted<LocalStorageThread> {
+    class StorageThread : public RefCounted<StorageThread> {
     public:
-        static PassRefPtr<LocalStorageThread> create() { return adoptRef(new LocalStorageThread); }
+        static PassRefPtr<StorageThread> create() { return adoptRef(new StorageThread); }
 
-        ~LocalStorageThread();
+        ~StorageThread();
         bool start();
         void scheduleImport(PassRefPtr<StorageAreaSync>);
         void scheduleSync(PassRefPtr<StorageAreaSync>);
@@ -45,14 +45,14 @@ namespace WebCore {
         void performTerminate();
 
     private:
-        LocalStorageThread();
+        StorageThread();
 
-        void timerFired(Timer<LocalStorageThread>*);
+        void timerFired(Timer<StorageThread>*);
 
-        Deque<RefPtr<LocalStorageTask> > m_queue;
-        Timer<LocalStorageThread> m_timer;
+        Deque<RefPtr<StorageTask> > m_queue;
+        Timer<StorageThread> m_timer;
     };
 
 } // namespace WebCore
 
-#endif // LocalStorageThreadWinCE_h
+#endif // StorageThreadWinCE_h
diff --git a/Source/WebCore/svg/DOMWindowSVG.idl b/Source/WebCore/svg/DOMWindowSVG.idl
new file mode 100644
index 000000000..cc907136b
--- /dev/null
+++ b/Source/WebCore/svg/DOMWindowSVG.idl
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    // FIXME: Most of this could/should be generated from make_names.pl/SVGNames.in
+    // to reduce the chance that we forget a constructor when adding a new element.
+    interface [
+        Conditional=SVG,
+        Supplemental=DOMWindow
+    ] DOMWindowSVG {
+
+        attribute SVGZoomEventConstructor SVGZoomEvent;
+
+        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
+        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
+        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
+        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
+        attribute SVGAElementConstructor SVGAElement;
+        attribute SVGAngleConstructor SVGAngle;
+        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
+        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
+        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
+        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
+        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
+        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
+        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
+        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
+        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
+        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
+        attribute SVGAnimatedStringConstructor SVGAnimatedString;
+        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
+        attribute SVGCircleElementConstructor SVGCircleElement;
+        attribute SVGClipPathElementConstructor SVGClipPathElement;
+        attribute SVGColorConstructor SVGColor;
+        attribute SVGCursorElementConstructor SVGCursorElement;
+//      attribute SVGCSSRuleConstructor SVGCSSRule;
+        attribute SVGDefsElementConstructor SVGDefsElement;
+        attribute SVGDescElementConstructor SVGDescElement;
+        attribute SVGDocumentConstructor SVGDocument;
+        attribute SVGElementConstructor SVGElement;
+        attribute SVGElementInstanceConstructor SVGElementInstance;
+        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
+        attribute SVGEllipseElementConstructor SVGEllipseElement;
+        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
+        attribute SVGExceptionConstructor SVGException;
+        attribute SVGGElementConstructor SVGGElement;
+        attribute SVGGradientElementConstructor SVGGradientElement;
+        attribute SVGImageElementConstructor SVGImageElement;
+        attribute SVGLengthConstructor SVGLength;
+        attribute SVGLengthListConstructor SVGLengthList;
+        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
+        attribute SVGLineElementConstructor SVGLineElement;
+        attribute SVGMarkerElementConstructor SVGMarkerElement;
+        attribute SVGMaskElementConstructor SVGMaskElement;
+        attribute SVGMatrixConstructor SVGMatrix;
+        attribute SVGMetadataElementConstructor SVGMetadataElement;
+        attribute SVGNumberConstructor SVGNumber;
+        attribute SVGNumberListConstructor SVGNumberList;
+        attribute SVGPaintConstructor SVGPaint;
+        attribute SVGPathElementConstructor SVGPathElement;
+        attribute SVGPathSegConstructor SVGPathSeg;
+        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
+        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
+        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
+        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
+        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
+        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
+        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
+        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
+        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
+        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
+        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
+        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
+        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
+        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
+        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
+        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
+        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
+        attribute SVGPathSegListConstructor SVGPathSegList;
+        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
+        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
+        attribute SVGPatternElementConstructor SVGPatternElement;
+        attribute SVGPointConstructor SVGPoint;
+        attribute SVGPointListConstructor SVGPointList;
+        attribute SVGPolygonElementConstructor SVGPolygonElement;
+        attribute SVGPolylineElementConstructor SVGPolylineElement;
+        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
+        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
+        attribute SVGRectConstructor SVGRect;
+        attribute SVGRectElementConstructor SVGRectElement;
+        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
+        attribute SVGScriptElementConstructor SVGScriptElement;
+        attribute SVGStopElementConstructor SVGStopElement;
+        attribute SVGStringListConstructor SVGStringList;
+        attribute SVGStyleElementConstructor SVGStyleElement;
+        attribute SVGSVGElementConstructor SVGSVGElement;
+        attribute SVGSwitchElementConstructor SVGSwitchElement;
+        attribute SVGSymbolElementConstructor SVGSymbolElement;
+        attribute SVGTextContentElementConstructor SVGTextContentElement;
+        attribute SVGTextElementConstructor SVGTextElement;
+        attribute SVGTextPathElementConstructor SVGTextPathElement;
+        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
+        attribute SVGTitleElementConstructor SVGTitleElement;
+        attribute SVGTransformConstructor SVGTransform;
+        attribute SVGTransformListConstructor SVGTransformList;
+        attribute SVGTRefElementConstructor SVGTRefElement;
+        attribute SVGTSpanElementConstructor SVGTSpanElement;
+        attribute SVGUnitTypesConstructor SVGUnitTypes;
+        attribute SVGUseElementConstructor SVGUseElement;
+        attribute SVGViewElementConstructor SVGViewElement;
+//      attribute SVGViewSpecConstructor SVGViewSpec;
+
+        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
+        attribute SVGAnimateElementConstructor SVGAnimateElement;
+        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
+        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
+        attribute SVGMPathElementConstructor SVGMPathElement;
+        attribute SVGSetElementConstructor SVGSetElement;
+
+#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
+        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
+        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
+        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
+//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
+        attribute SVGFontElementConstructor SVGFontElement;
+        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
+        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
+        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
+        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
+        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
+        attribute SVGGlyphElementConstructor SVGGlyphElement;
+        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
+        attribute SVGHKernElementConstructor SVGHKernElement;
+        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
+        attribute SVGVKernElementConstructor SVGVKernElement;
+#endif
+
+#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
+        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
+        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
+        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
+        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
+        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
+        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
+        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
+        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
+        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
+        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
+        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
+        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
+        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
+        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
+        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
+        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
+        attribute SVGFEImageElementConstructor SVGFEImageElement;
+        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
+        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
+        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
+        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
+        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
+        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
+        attribute SVGFETileElementConstructor SVGFETileElement;
+        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
+        attribute SVGFilterElementConstructor SVGFilterElement;
+#endif
+
+    };
+
+}
diff --git a/Source/WebCore/svg/ElementTimeControl.idl b/Source/WebCore/svg/ElementTimeControl.idl
index 70164abaf..9c748c92e 100644
--- a/Source/WebCore/svg/ElementTimeControl.idl
+++ b/Source/WebCore/svg/ElementTimeControl.idl
@@ -32,9 +32,9 @@ module svg {
         OmitConstructor
     ] ElementTimeControl { 
         void beginElement();
-        void beginElementAt(in [Optional=CallWithDefaultValue] float offset);
+        void beginElementAt(in [Optional=DefaultIsUndefined] float offset);
         void endElement();
-        void endElementAt(in [Optional=CallWithDefaultValue] float offset);
+        void endElementAt(in [Optional=DefaultIsUndefined] float offset);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index b3e0f8511..7ec617ae0 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -37,6 +37,7 @@
 #include "HTMLParserIdioms.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSVGInline.h"
 #include "RenderSVGTransformableContainer.h"
@@ -224,16 +225,16 @@ bool SVGAElement::isKeyboardFocusable(KeyboardEvent* event) const
     return document()->frame()->eventHandler()->tabsToLinks(event);
 }
 
-bool SVGAElement::childShouldCreateRenderer(Node* child) const
+bool SVGAElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // http://www.w3.org/2003/01/REC-SVG11-20030114-errata#linking-text-environment
     // The 'a' element may contain any element that its parent may contain, except itself.
-    if (child->hasTagName(SVGNames::aTag))
+    if (childContext.node()->hasTagName(SVGNames::aTag))
         return false;
     if (parentNode() && parentNode()->isSVGElement())
-        return parentNode()->childShouldCreateRenderer(child);
+        return parentNode()->childShouldCreateRenderer(childContext);
 
-    return SVGElement::childShouldCreateRenderer(child);
+    return SVGElement::childShouldCreateRenderer(childContext);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGAElement.h b/Source/WebCore/svg/SVGAElement.h
index f2af9a828..e3b8f2802 100644
--- a/Source/WebCore/svg/SVGAElement.h
+++ b/Source/WebCore/svg/SVGAElement.h
@@ -61,7 +61,7 @@ private:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isFocusable() const;
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGAElement)
         // This declaration used to define a non-virtual "String& target() const" method, that clashes with "virtual String Element::target() const".
diff --git a/Source/WebCore/svg/SVGAltGlyphElement.cpp b/Source/WebCore/svg/SVGAltGlyphElement.cpp
index 1baba8494..f03d1ff27 100644
--- a/Source/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/Source/WebCore/svg/SVGAltGlyphElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGAltGlyphElement.h"
 
 #include "ExceptionCode.h"
+#include "NodeRenderingContext.h"
 #include "RenderInline.h"
 #include "RenderSVGTSpan.h"
 #include "SVGAltGlyphDefElement.h"
@@ -75,9 +76,9 @@ const AtomicString& SVGAltGlyphElement::format() const
     return fastGetAttribute(SVGNames::formatAttr);
 }
 
-bool SVGAltGlyphElement::childShouldCreateRenderer(Node* child) const
+bool SVGAltGlyphElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode())
+    if (childContext.node()->isTextNode())
         return true;
     return false;
 }
diff --git a/Source/WebCore/svg/SVGAltGlyphElement.h b/Source/WebCore/svg/SVGAltGlyphElement.h
index 0ba229c46..179ed7734 100644
--- a/Source/WebCore/svg/SVGAltGlyphElement.h
+++ b/Source/WebCore/svg/SVGAltGlyphElement.h
@@ -47,7 +47,7 @@ private:
     SVGAltGlyphElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGAltGlyphElement)
         DECLARE_ANIMATED_STRING(Href, href)
diff --git a/Source/WebCore/svg/SVGAnimateElement.cpp b/Source/WebCore/svg/SVGAnimateElement.cpp
index c819e1e16..13f7cf96b 100644
--- a/Source/WebCore/svg/SVGAnimateElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateElement.cpp
@@ -59,7 +59,7 @@ SVGAnimateElement::~SVGAnimateElement()
 static inline void getPropertyValue(SVGElement* svgParent, const QualifiedName& attributeName, String& value)
 {
     ASSERT(svgParent->isStyled());
-    value = computedStyle(svgParent)->getPropertyValue(cssPropertyID(attributeName.localName()));
+    value = CSSComputedStyleDeclaration::create(svgParent)->getPropertyValue(cssPropertyID(attributeName.localName()));
 }
 
 static bool inheritsFromProperty(SVGElement* targetElement, const QualifiedName& attributeName, const String& value)
@@ -109,7 +109,7 @@ bool SVGAnimateElement::hasValidAttributeType()
     if (!targetElement)
         return false;
     
-    return determineAnimatedPropertyType(targetElement) != AnimatedUnknown;
+    return m_animatedPropertyType != AnimatedUnknown;
 }
 
 AnimatedPropertyType SVGAnimateElement::determineAnimatedPropertyType(SVGElement* targetElement) const
@@ -159,12 +159,20 @@ void SVGAnimateElement::determinePropertyValueTypes(const String& from, const St
 void SVGAnimateElement::calculateAnimatedValue(float percentage, unsigned repeat, SVGSMILElement* resultElement)
 {
     ASSERT(resultElement);
+    SVGElement* targetElement = this->targetElement();
+    if (!targetElement)
+        return;
+
+    ASSERT(m_animatedPropertyType == determineAnimatedPropertyType(targetElement));
+
     ASSERT(percentage >= 0 && percentage <= 1);
     ASSERT(m_animatedPropertyType != AnimatedEnumeration);
     ASSERT(m_animatedPropertyType != AnimatedTransformList);
     ASSERT(m_animatedPropertyType != AnimatedUnknown);
     ASSERT(m_animator);
+    ASSERT(m_animator->type() == m_animatedPropertyType);
     ASSERT(m_fromType);
+    ASSERT(m_fromType->type() == m_animatedPropertyType);
     ASSERT(m_toType);
 
     SVGAnimateElement* resultAnimationElement = static_cast<SVGAnimateElement*>(resultElement);
@@ -177,10 +185,6 @@ void SVGAnimateElement::calculateAnimatedValue(float percentage, unsigned repeat
     if (hasTagName(SVGNames::setTag))
         percentage = 1;
 
-    SVGElement* targetElement = this->targetElement();
-    if (!targetElement)
-        return;
-
     // Target element might have changed.
     m_animator->setContextElement(targetElement);
     m_animator->calculateAnimatedValue(percentage, repeat, m_fromType, m_toType, resultAnimationElement->m_animatedType);
@@ -192,9 +196,8 @@ bool SVGAnimateElement::calculateFromAndToValues(const String& fromString, const
     if (!targetElement)
         return false;
 
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
-
     ensureAnimator()->calculateFromAndToValues(m_fromType, m_toType, fromString, toString);
+    ASSERT(m_animatedPropertyType == m_animator->type());
     return true;
 }
 
@@ -205,22 +208,19 @@ bool SVGAnimateElement::calculateFromAndByValues(const String& fromString, const
         return false;
 
     ASSERT(!hasTagName(SVGNames::setTag));
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
 
     ensureAnimator()->calculateFromAndByValues(m_fromType, m_toType, fromString, byString);
+    ASSERT(m_animatedPropertyType == m_animator->type());
     return true;
 }
 
 void SVGAnimateElement::resetToBaseValue(const String& baseString)
 {
-    SVGElement* targetElement = this->targetElement();
-    ASSERT(targetElement);
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
-
     if (!m_animatedType)
         m_animatedType = ensureAnimator()->constructFromString(baseString);
     else
         m_animatedType->setValueAsString(attributeName(), baseString);
+    ASSERT(m_animatedPropertyType == m_animator->type());
 }
     
 void SVGAnimateElement::applyResultsToTarget()
@@ -239,15 +239,24 @@ float SVGAnimateElement::calculateDistance(const String& fromString, const Strin
     SVGElement* targetElement = this->targetElement();
     if (!targetElement)
         return -1;
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
-    
+
     return ensureAnimator()->calculateDistance(fromString, toString);
 }
 
+void SVGAnimateElement::targetElementDidChange(SVGElement* targetElement)
+{
+    m_animatedType.clear();
+    m_fromType.clear();
+    m_toType.clear();
+    m_animator.clear();
+    m_animatedPropertyType = targetElement ? determineAnimatedPropertyType(targetElement) : AnimatedString;
+}
+
 SVGAnimatedTypeAnimator* SVGAnimateElement::ensureAnimator()
 {
     if (!m_animator)
         m_animator = SVGAnimatorFactory::create(this, targetElement(), m_animatedPropertyType);
+    ASSERT(m_animatedPropertyType == m_animator->type());
     return m_animator.get();
 }
 
diff --git a/Source/WebCore/svg/SVGAnimateElement.h b/Source/WebCore/svg/SVGAnimateElement.h
index d9ae3a28c..69cb9a6ed 100644
--- a/Source/WebCore/svg/SVGAnimateElement.h
+++ b/Source/WebCore/svg/SVGAnimateElement.h
@@ -45,7 +45,7 @@ public:
     static PassRefPtr<SVGAnimateElement> create(const QualifiedName&, Document*);
 
     virtual ~SVGAnimateElement();
-    
+
     static void adjustForCurrentColor(SVGElement* targetElement, Color&);
     void adjustForInheritance(SVGElement* targetElement, const QualifiedName&, String& value);
     
@@ -65,6 +65,8 @@ protected:
     virtual void applyResultsToTarget();
     virtual float calculateDistance(const String& fromString, const String& toString);
 
+    virtual void targetElementDidChange(SVGElement* targetElement) OVERRIDE;
+
 private:
     SVGAnimatedTypeAnimator* ensureAnimator();
     
diff --git a/Source/WebCore/svg/SVGAnimatedTypeAnimator.h b/Source/WebCore/svg/SVGAnimatedTypeAnimator.h
index 1524ed8e4..f3218647d 100644
--- a/Source/WebCore/svg/SVGAnimatedTypeAnimator.h
+++ b/Source/WebCore/svg/SVGAnimatedTypeAnimator.h
@@ -41,7 +41,9 @@ public:
     virtual float calculateDistance(const String& fromString, const String& toString) = 0;
 
     void setContextElement(SVGElement* contextElement) { m_contextElement = contextElement; }
-    
+
+    AnimatedPropertyType type() const { return m_type; }
+
 protected:
     SVGAnimatedTypeAnimator(AnimatedPropertyType type, SVGAnimationElement* animationElement, SVGElement* contextElement)
         : m_type(type)
diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index bced2016d..2659dd9df 100644
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -232,7 +232,7 @@ void SVGAnimationElement::beginElement()
 void SVGAnimationElement::beginElementAt(float offset)
 {
     SMILTime elapsed = this->elapsed();
-    addBeginTime(elapsed, elapsed + offset);
+    addBeginTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }
 
 void SVGAnimationElement::endElement()
@@ -243,7 +243,7 @@ void SVGAnimationElement::endElement()
 void SVGAnimationElement::endElementAt(float offset)
 {
     SMILTime elapsed = this->elapsed();
-    addEndTime(elapsed, elapsed + offset);
+    addEndTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }
 
 AnimationMode SVGAnimationElement::animationMode() const
@@ -624,9 +624,5 @@ void SVGAnimationElement::updateAnimation(float percent, unsigned repeat, SVGSMI
     calculateAnimatedValue(effectivePercent, repeat, resultElement);
 }
 
-void SVGAnimationElement::endedActiveInterval()
-{
-}
-
 }
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAnimationElement.h b/Source/WebCore/svg/SVGAnimationElement.h
index 66c10d99e..495c1b244 100644
--- a/Source/WebCore/svg/SVGAnimationElement.h
+++ b/Source/WebCore/svg/SVGAnimationElement.h
@@ -104,7 +104,6 @@ protected:
     // from SVGSMILElement
     virtual void startedActiveInterval();
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement);
-    virtual void endedActiveInterval();
 
 private:
     virtual void attributeChanged(Attribute*) OVERRIDE;
diff --git a/Source/WebCore/svg/SVGDocument.cpp b/Source/WebCore/svg/SVGDocument.cpp
index f5439489a..c29ede369 100644
--- a/Source/WebCore/svg/SVGDocument.cpp
+++ b/Source/WebCore/svg/SVGDocument.cpp
@@ -25,6 +25,7 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FrameView.h"
+#include "NodeRenderingContext.h"
 #include "RenderView.h"
 #include "SVGElement.h"
 #include "SVGNames.h"
@@ -95,10 +96,10 @@ void SVGDocument::updatePan(const FloatPoint& pos) const
     }
 }
 
-bool SVGDocument::childShouldCreateRenderer(Node* node) const
+bool SVGDocument::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (node->hasTagName(SVGNames::svgTag))
-        return static_cast<SVGSVGElement*>(node)->isValid();
+    if (childContext.node()->hasTagName(SVGNames::svgTag))
+        return static_cast<SVGSVGElement*>(childContext.node())->isValid();
     return true;
 }
 
diff --git a/Source/WebCore/svg/SVGDocument.h b/Source/WebCore/svg/SVGDocument.h
index b93414526..a63787218 100644
--- a/Source/WebCore/svg/SVGDocument.h
+++ b/Source/WebCore/svg/SVGDocument.h
@@ -53,7 +53,7 @@ private:
 
     virtual bool isSVGDocument() const { return true; }
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     FloatPoint m_translate;
 };
diff --git a/Source/WebCore/svg/SVGDocument.idl b/Source/WebCore/svg/SVGDocument.idl
index c5059f82e..2f9abfc2e 100644
--- a/Source/WebCore/svg/SVGDocument.idl
+++ b/Source/WebCore/svg/SVGDocument.idl
@@ -22,12 +22,13 @@
 module svg {
 
     interface [
-        Conditional=SVG
+        Conditional=SVG,
+        V8CustomToJSObject
     ] SVGDocument : Document {
         readonly attribute SVGSVGElement        rootElement;
 
         // Overwrite the one in events::DocumentEvent
-        Event createEvent(in [Optional=CallWithDefaultValue] DOMString eventType)
+        Event createEvent(in [Optional=DefaultIsUndefined] DOMString eventType)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.cpp b/Source/WebCore/svg/SVGDocumentExtensions.cpp
index 6f19d800b..888bd5800 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/Source/WebCore/svg/SVGDocumentExtensions.cpp
@@ -132,17 +132,6 @@ void SVGDocumentExtensions::dispatchSVGLoadEventToOutermostSVGElements()
     }
 }
 
-bool SVGDocumentExtensions::sampleAnimationAtTime(const String& elementId, SVGSMILElement* element, double time)
-{
-    ASSERT(element);
-    SMILTimeContainer* container = element->timeContainer();
-    if (!container || container->isPaused())
-        return false;
-
-    container->sampleAnimationAtTime(elementId, time);
-    return true;
-}
-
 void SVGDocumentExtensions::addAnimationElementToTarget(SVGSMILElement* animationElement, SVGElement* targetElement)
 {
     ASSERT(targetElement);
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.h b/Source/WebCore/svg/SVGDocumentExtensions.h
index 36664c32c..48dae9737 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.h
+++ b/Source/WebCore/svg/SVGDocumentExtensions.h
@@ -56,7 +56,6 @@ public:
     void startAnimations();
     void pauseAnimations();
     void unpauseAnimations();
-    bool sampleAnimationAtTime(const String& elementId, SVGSMILElement*, double time);
     void dispatchSVGLoadEventToOutermostSVGElements();
     
     void addAnimationElementToTarget(SVGSMILElement*, SVGElement*);
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index f3d5874f3..24adcf794 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -36,6 +36,7 @@
 #include "EventNames.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "NodeRenderingContext.h"
 #include "RegisteredEventListener.h"
 #include "RenderObject.h"
 #include "SVGCursorElement.h"
@@ -386,10 +387,10 @@ void SVGElement::finishParsingChildren()
     sendSVGLoadEventIfPossible();
 }
 
-bool SVGElement::childShouldCreateRenderer(Node* child) const
+bool SVGElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isSVGElement())
-        return static_cast<SVGElement*>(child)->isValid();
+    if (childContext.node()->isSVGElement())
+        return static_cast<SVGElement*>(childContext.node())->isValid();
     return false;
 }
 
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index c5c5ac55f..4735690b3 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -114,7 +114,7 @@ protected:
 
     virtual void finishParsingChildren();
     virtual void attributeChanged(Attribute*) OVERRIDE;
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     
     virtual void removedFromDocument();
 
diff --git a/Source/WebCore/svg/SVGElement.idl b/Source/WebCore/svg/SVGElement.idl
index 5e9b8312c..41ae9c24d 100644
--- a/Source/WebCore/svg/SVGElement.idl
+++ b/Source/WebCore/svg/SVGElement.idl
@@ -24,7 +24,8 @@ module svg {
 
     interface [
         JSGenerateToNativeObject,
-        Conditional=SVG
+        Conditional=SVG,
+        V8CustomToJSObject
     ] SVGElement : Element {
         attribute [Reflect] DOMString id;
         attribute [TreatNullAs=NullString] DOMString xmlbase setter raises(DOMException);
diff --git a/Source/WebCore/svg/SVGElementInstanceList.idl b/Source/WebCore/svg/SVGElementInstanceList.idl
index e710839ce..9429da719 100644
--- a/Source/WebCore/svg/SVGElementInstanceList.idl
+++ b/Source/WebCore/svg/SVGElementInstanceList.idl
@@ -29,6 +29,6 @@ module svg {
     ] SVGElementInstanceList {
         readonly attribute unsigned long length;
 
-        SVGElementInstance item(in [Optional=CallWithDefaultValue] unsigned long index);
+        SVGElementInstance item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 }
diff --git a/Source/WebCore/svg/SVGFEDropShadowElement.idl b/Source/WebCore/svg/SVGFEDropShadowElement.idl
index 91f654d99..3c7d7ce6b 100644
--- a/Source/WebCore/svg/SVGFEDropShadowElement.idl
+++ b/Source/WebCore/svg/SVGFEDropShadowElement.idl
@@ -29,8 +29,8 @@ module svg {
         readonly attribute SVGAnimatedNumber stdDeviationX;
         readonly attribute SVGAnimatedNumber stdDeviationY;
 
-        void setStdDeviation(in [Optional=CallWithDefaultValue] float stdDeviationX, 
-                             in [Optional=CallWithDefaultValue] float stdDeviationY);
+        void setStdDeviation(in [Optional=DefaultIsUndefined] float stdDeviationX, 
+                             in [Optional=DefaultIsUndefined] float stdDeviationY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFEGaussianBlurElement.idl b/Source/WebCore/svg/SVGFEGaussianBlurElement.idl
index 5a01addd8..25858f80c 100644
--- a/Source/WebCore/svg/SVGFEGaussianBlurElement.idl
+++ b/Source/WebCore/svg/SVGFEGaussianBlurElement.idl
@@ -33,8 +33,8 @@ module svg {
         readonly attribute SVGAnimatedNumber stdDeviationX;
         readonly attribute SVGAnimatedNumber stdDeviationY;
 
-        void setStdDeviation(in [Optional=CallWithDefaultValue] float stdDeviationX, 
-                             in [Optional=CallWithDefaultValue] float stdDeviationY);
+        void setStdDeviation(in [Optional=DefaultIsUndefined] float stdDeviationX, 
+                             in [Optional=DefaultIsUndefined] float stdDeviationY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFEMorphologyElement.idl b/Source/WebCore/svg/SVGFEMorphologyElement.idl
index b31d74fb6..24c0a47a9 100644
--- a/Source/WebCore/svg/SVGFEMorphologyElement.idl
+++ b/Source/WebCore/svg/SVGFEMorphologyElement.idl
@@ -40,8 +40,8 @@ module svg {
         readonly attribute SVGAnimatedNumber      radiusX;
         readonly attribute SVGAnimatedNumber      radiusY;
 
-        void setRadius(in [Optional=CallWithDefaultValue] float radiusX, 
-                       in [Optional=CallWithDefaultValue] float radiusY);
+        void setRadius(in [Optional=DefaultIsUndefined] float radiusX, 
+                       in [Optional=DefaultIsUndefined] float radiusY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFilterElement.idl b/Source/WebCore/svg/SVGFilterElement.idl
index 4f984f469..ff2f49679 100644
--- a/Source/WebCore/svg/SVGFilterElement.idl
+++ b/Source/WebCore/svg/SVGFilterElement.idl
@@ -43,8 +43,8 @@ module svg {
         readonly attribute SVGAnimatedInteger     filterResX;
         readonly attribute SVGAnimatedInteger     filterResY;
 
-        void setFilterRes(in [Optional=CallWithDefaultValue] unsigned long filterResX, 
-                          in [Optional=CallWithDefaultValue] unsigned long filterResY);
+        void setFilterRes(in [Optional=DefaultIsUndefined] unsigned long filterResX, 
+                          in [Optional=DefaultIsUndefined] unsigned long filterResY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index 51fbc4447..98518de4d 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -51,7 +51,7 @@ inline SVGFontFaceElement::SVGFontFaceElement(const QualifiedName& tagName, Docu
     , m_fontFaceRule(CSSFontFaceRule::create())
 {
     ASSERT(hasTagName(font_faceTag));
-    RefPtr<StylePropertySet> styleDeclaration = StylePropertySet::create(m_fontFaceRule.get());
+    RefPtr<StylePropertySet> styleDeclaration = StylePropertySet::create();
     styleDeclaration->setStrictParsing(true);
     m_fontFaceRule->setDeclaration(styleDeclaration.release());
 }
@@ -328,6 +328,7 @@ void SVGFontFaceElement::removedFromDocument()
 {
     removeFromMappedElementSheet();
     SVGElement::removedFromDocument();
+    m_fontFaceRule->declaration()->parseDeclaration(emptyString(), 0);
 }
 
 void SVGFontFaceElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.cpp b/Source/WebCore/svg/SVGForeignObjectElement.cpp
index d792c47a1..1d7407931 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/Source/WebCore/svg/SVGForeignObjectElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGForeignObject.h"
 #include "RenderSVGResource.h"
 #include "SVGElementInstance.h"
@@ -137,14 +138,14 @@ RenderObject* SVGForeignObjectElement::createRenderer(RenderArena* arena, Render
     return new (arena) RenderSVGForeignObject(this);
 }
 
-bool SVGForeignObjectElement::childShouldCreateRenderer(Node* child) const
+bool SVGForeignObjectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // Disallow arbitary SVG content. Only allow proper <svg xmlns="svgNS"> subdocuments.
-    if (child->isSVGElement())
-        return child->hasTagName(SVGNames::svgTag);
+    if (childContext.node()->isSVGElement())
+        return childContext.node()->hasTagName(SVGNames::svgTag);
 
     // Skip over SVG rules which disallow non-SVG kids
-    return StyledElement::childShouldCreateRenderer(child);
+    return StyledElement::childShouldCreateRenderer(childContext);
 }
 
 bool SVGForeignObjectElement::selfHasRelativeLengths() const
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.h b/Source/WebCore/svg/SVGForeignObjectElement.h
index 67266d5da..057ba0507 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.h
+++ b/Source/WebCore/svg/SVGForeignObjectElement.h
@@ -46,7 +46,7 @@ private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGImageElement.cpp b/Source/WebCore/svg/SVGImageElement.cpp
index bf10a1ea9..6f7fe9d1e 100644
--- a/Source/WebCore/svg/SVGImageElement.cpp
+++ b/Source/WebCore/svg/SVGImageElement.cpp
@@ -91,6 +91,23 @@ bool SVGImageElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
+bool SVGImageElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == SVGNames::widthAttr || attr->name() == SVGNames::heightAttr)
+        return true;
+    return SVGStyledTransformableElement::isPresentationAttribute(attr);
+}
+
+void SVGImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (!isSupportedAttribute(attr->name()))
+        SVGStyledTransformableElement::collectStyleForAttribute(attr, style);
+    else if (attr->name() == SVGNames::widthAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == SVGNames::heightAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyHeight, attr->value());
+}
+
 void SVGImageElement::parseAttribute(Attribute* attr)
 {
     SVGParsingError parseError = NoError;
@@ -103,13 +120,11 @@ void SVGImageElement::parseAttribute(Attribute* attr)
         setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
     else if (attr->name() == SVGNames::preserveAspectRatioAttr)
         SVGPreserveAspectRatio::parsePreserveAspectRatio(this, attr->value());
-    else if (attr->name() == SVGNames::widthAttr) {
+    else if (attr->name() == SVGNames::widthAttr)
         setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-        addCSSProperty(CSSPropertyWidth, attr->value());
-    } else if (attr->name() == SVGNames::heightAttr) {
+    else if (attr->name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-        addCSSProperty(CSSPropertyHeight, attr->value());
-    } else if (SVGTests::parseAttribute(attr)
+    else if (SVGTests::parseAttribute(attr)
              || SVGLangSpace::parseAttribute(attr)
              || SVGExternalResourcesRequired::parseAttribute(attr)
              || SVGURIReference::parseAttribute(attr)) {
diff --git a/Source/WebCore/svg/SVGImageElement.h b/Source/WebCore/svg/SVGImageElement.h
index 1fbbb0fd7..fb1229e23 100644
--- a/Source/WebCore/svg/SVGImageElement.h
+++ b/Source/WebCore/svg/SVGImageElement.h
@@ -50,6 +50,8 @@ private:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual void attach();
diff --git a/Source/WebCore/svg/SVGLengthContext.cpp b/Source/WebCore/svg/SVGLengthContext.cpp
index 36deeff46..d33de3456 100755..100644
--- a/Source/WebCore/svg/SVGLengthContext.cpp
+++ b/Source/WebCore/svg/SVGLengthContext.cpp
@@ -203,14 +203,31 @@ float SVGLengthContext::convertValueFromPercentageToUserUnits(float value, SVGLe
     return 0;
 }
 
+static inline RenderStyle* renderStyleForLengthResolving(const SVGElement* context)
+{
+    if (!context)
+        return 0;
+
+    const ContainerNode* currentContext = context;
+    while (currentContext) {
+        if (currentContext->renderer())
+            return currentContext->renderer()->style();
+        currentContext = currentContext->parentNode();
+    }
+
+    // There must be at least a RenderSVGRoot renderer, carrying a style.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 float SVGLengthContext::convertValueFromUserUnitsToEMS(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
     float fontSize = style->fontSize();
     if (!fontSize) {
         ec = NOT_SUPPORTED_ERR;
@@ -222,24 +239,23 @@ float SVGLengthContext::convertValueFromUserUnitsToEMS(float value, ExceptionCod
 
 float SVGLengthContext::convertValueFromEMSToUserUnits(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
     return value * style->fontSize();
 }
 
 float SVGLengthContext::convertValueFromUserUnitsToEXS(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
-
     // Use of ceil allows a pixel match to the W3Cs expected output of coords-units-03-b.svg
     // if this causes problems in real world cases maybe it would be best to remove this
     float xHeight = ceilf(style->fontMetrics().xHeight());
@@ -253,12 +269,12 @@ float SVGLengthContext::convertValueFromUserUnitsToEXS(float value, ExceptionCod
 
 float SVGLengthContext::convertValueFromEXSToUserUnits(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
     // Use of ceil allows a pixel match to the W3Cs expected output of coords-units-03-b.svg
     // if this causes problems in real world cases maybe it would be best to remove this
     return value * ceilf(style->fontMetrics().xHeight());
diff --git a/Source/WebCore/svg/SVGLocatable.idl b/Source/WebCore/svg/SVGLocatable.idl
index a83bca099..f626976dd 100644
--- a/Source/WebCore/svg/SVGLocatable.idl
+++ b/Source/WebCore/svg/SVGLocatable.idl
@@ -37,7 +37,7 @@ module svg {
         SVGRect   getBBox();
         SVGMatrix getCTM();
         SVGMatrix getScreenCTM();
-        SVGMatrix getTransformToElement(in [Optional=CallWithDefaultValue] SVGElement element)
+        SVGMatrix getTransformToElement(in [Optional=DefaultIsUndefined] SVGElement element)
             raises(SVGException);
     };
 
diff --git a/Source/WebCore/svg/SVGMarkerElement.idl b/Source/WebCore/svg/SVGMarkerElement.idl
index 1b136852e..dd351e320 100644
--- a/Source/WebCore/svg/SVGMarkerElement.idl
+++ b/Source/WebCore/svg/SVGMarkerElement.idl
@@ -51,7 +51,7 @@ module svg {
         readonly attribute SVGAnimatedAngle       orientAngle;
 
         void setOrientToAuto();
-        void setOrientToAngle(in [Optional=CallWithDefaultValue] SVGAngle angle);
+        void setOrientToAngle(in [Optional=DefaultIsUndefined] SVGAngle angle);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGPathElement.idl b/Source/WebCore/svg/SVGPathElement.idl
index 89f637ed4..5f4f6cab6 100644
--- a/Source/WebCore/svg/SVGPathElement.idl
+++ b/Source/WebCore/svg/SVGPathElement.idl
@@ -37,77 +37,77 @@ module svg {
         readonly attribute SVGAnimatedNumber pathLength;
 
         float getTotalLength();
-        SVGPoint getPointAtLength(in [Optional=CallWithDefaultValue] float distance);
-        unsigned long getPathSegAtLength(in [Optional=CallWithDefaultValue] float distance);
+        SVGPoint getPointAtLength(in [Optional=DefaultIsUndefined] float distance);
+        unsigned long getPathSegAtLength(in [Optional=DefaultIsUndefined] float distance);
 
         SVGPathSegClosePath createSVGPathSegClosePath();
 
-        SVGPathSegMovetoAbs createSVGPathSegMovetoAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegMovetoRel createSVGPathSegMovetoRel(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegMovetoAbs createSVGPathSegMovetoAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegMovetoRel createSVGPathSegMovetoRel(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
 
-        SVGPathSegLinetoAbs createSVGPathSegLinetoAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegLinetoRel createSVGPathSegLinetoRel(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegLinetoAbs createSVGPathSegLinetoAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegLinetoRel createSVGPathSegLinetoRel(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
 
-        SVGPathSegCurvetoCubicAbs createSVGPathSegCurvetoCubicAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                  in [Optional=CallWithDefaultValue] float y, 
-                                                                  in [Optional=CallWithDefaultValue] float x1, 
-                                                                  in [Optional=CallWithDefaultValue] float y1, 
-                                                                  in [Optional=CallWithDefaultValue] float x2, 
-                                                                  in [Optional=CallWithDefaultValue] float y2);
-        SVGPathSegCurvetoCubicRel createSVGPathSegCurvetoCubicRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                  in [Optional=CallWithDefaultValue] float y, 
-                                                                  in [Optional=CallWithDefaultValue] float x1, 
-                                                                  in [Optional=CallWithDefaultValue] float y1, 
-                                                                  in [Optional=CallWithDefaultValue] float x2, 
-                                                                  in [Optional=CallWithDefaultValue] float y2);
+        SVGPathSegCurvetoCubicAbs createSVGPathSegCurvetoCubicAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                  in [Optional=DefaultIsUndefined] float y, 
+                                                                  in [Optional=DefaultIsUndefined] float x1, 
+                                                                  in [Optional=DefaultIsUndefined] float y1, 
+                                                                  in [Optional=DefaultIsUndefined] float x2, 
+                                                                  in [Optional=DefaultIsUndefined] float y2);
+        SVGPathSegCurvetoCubicRel createSVGPathSegCurvetoCubicRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                  in [Optional=DefaultIsUndefined] float y, 
+                                                                  in [Optional=DefaultIsUndefined] float x1, 
+                                                                  in [Optional=DefaultIsUndefined] float y1, 
+                                                                  in [Optional=DefaultIsUndefined] float x2, 
+                                                                  in [Optional=DefaultIsUndefined] float y2);
 
-        SVGPathSegCurvetoQuadraticAbs createSVGPathSegCurvetoQuadraticAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                          in [Optional=CallWithDefaultValue] float y, 
-                                                                          in [Optional=CallWithDefaultValue] float x1, 
-                                                                          in [Optional=CallWithDefaultValue] float y1);
-        SVGPathSegCurvetoQuadraticRel createSVGPathSegCurvetoQuadraticRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                          in [Optional=CallWithDefaultValue] float y, 
-                                                                          in [Optional=CallWithDefaultValue] float x1, 
-                                                                          in [Optional=CallWithDefaultValue] float y1);
+        SVGPathSegCurvetoQuadraticAbs createSVGPathSegCurvetoQuadraticAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                          in [Optional=DefaultIsUndefined] float y, 
+                                                                          in [Optional=DefaultIsUndefined] float x1, 
+                                                                          in [Optional=DefaultIsUndefined] float y1);
+        SVGPathSegCurvetoQuadraticRel createSVGPathSegCurvetoQuadraticRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                          in [Optional=DefaultIsUndefined] float y, 
+                                                                          in [Optional=DefaultIsUndefined] float x1, 
+                                                                          in [Optional=DefaultIsUndefined] float y1);
 
-        SVGPathSegArcAbs createSVGPathSegArcAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                in [Optional=CallWithDefaultValue] float y, 
-                                                in [Optional=CallWithDefaultValue] float r1, 
-                                                in [Optional=CallWithDefaultValue] float r2, 
-                                                in [Optional=CallWithDefaultValue] float angle, 
-                                                in [Optional=CallWithDefaultValue] boolean largeArcFlag, 
-                                                in [Optional=CallWithDefaultValue] boolean sweepFlag);
-        SVGPathSegArcRel createSVGPathSegArcRel(in [Optional=CallWithDefaultValue] float x, 
-                                                in [Optional=CallWithDefaultValue] float y, 
-                                                in [Optional=CallWithDefaultValue] float r1, 
-                                                in [Optional=CallWithDefaultValue] float r2, 
-                                                in [Optional=CallWithDefaultValue] float angle, 
-                                                in [Optional=CallWithDefaultValue] boolean largeArcFlag, 
-                                                in [Optional=CallWithDefaultValue] boolean sweepFlag);
+        SVGPathSegArcAbs createSVGPathSegArcAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                in [Optional=DefaultIsUndefined] float y, 
+                                                in [Optional=DefaultIsUndefined] float r1, 
+                                                in [Optional=DefaultIsUndefined] float r2, 
+                                                in [Optional=DefaultIsUndefined] float angle, 
+                                                in [Optional=DefaultIsUndefined] boolean largeArcFlag, 
+                                                in [Optional=DefaultIsUndefined] boolean sweepFlag);
+        SVGPathSegArcRel createSVGPathSegArcRel(in [Optional=DefaultIsUndefined] float x, 
+                                                in [Optional=DefaultIsUndefined] float y, 
+                                                in [Optional=DefaultIsUndefined] float r1, 
+                                                in [Optional=DefaultIsUndefined] float r2, 
+                                                in [Optional=DefaultIsUndefined] float angle, 
+                                                in [Optional=DefaultIsUndefined] boolean largeArcFlag, 
+                                                in [Optional=DefaultIsUndefined] boolean sweepFlag);
 
-        SVGPathSegLinetoHorizontalAbs createSVGPathSegLinetoHorizontalAbs(in [Optional=CallWithDefaultValue] float x);
-        SVGPathSegLinetoHorizontalRel createSVGPathSegLinetoHorizontalRel(in [Optional=CallWithDefaultValue] float x);
+        SVGPathSegLinetoHorizontalAbs createSVGPathSegLinetoHorizontalAbs(in [Optional=DefaultIsUndefined] float x);
+        SVGPathSegLinetoHorizontalRel createSVGPathSegLinetoHorizontalRel(in [Optional=DefaultIsUndefined] float x);
 
-        SVGPathSegLinetoVerticalAbs createSVGPathSegLinetoVerticalAbs(in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegLinetoVerticalRel createSVGPathSegLinetoVerticalRel(in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegLinetoVerticalAbs createSVGPathSegLinetoVerticalAbs(in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegLinetoVerticalRel createSVGPathSegLinetoVerticalRel(in [Optional=DefaultIsUndefined] float y);
 
-        SVGPathSegCurvetoCubicSmoothAbs createSVGPathSegCurvetoCubicSmoothAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                              in [Optional=CallWithDefaultValue] float y, 
-                                                                              in [Optional=CallWithDefaultValue] float x2, 
-                                                                              in [Optional=CallWithDefaultValue] float y2);
-        SVGPathSegCurvetoCubicSmoothRel createSVGPathSegCurvetoCubicSmoothRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                              in [Optional=CallWithDefaultValue] float y, 
-                                                                              in [Optional=CallWithDefaultValue] float x2, 
-                                                                              in [Optional=CallWithDefaultValue] float y2);
+        SVGPathSegCurvetoCubicSmoothAbs createSVGPathSegCurvetoCubicSmoothAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                              in [Optional=DefaultIsUndefined] float y, 
+                                                                              in [Optional=DefaultIsUndefined] float x2, 
+                                                                              in [Optional=DefaultIsUndefined] float y2);
+        SVGPathSegCurvetoCubicSmoothRel createSVGPathSegCurvetoCubicSmoothRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                              in [Optional=DefaultIsUndefined] float y, 
+                                                                              in [Optional=DefaultIsUndefined] float x2, 
+                                                                              in [Optional=DefaultIsUndefined] float y2);
 
-        SVGPathSegCurvetoQuadraticSmoothAbs createSVGPathSegCurvetoQuadraticSmoothAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                                      in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegCurvetoQuadraticSmoothRel createSVGPathSegCurvetoQuadraticSmoothRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                                      in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegCurvetoQuadraticSmoothAbs createSVGPathSegCurvetoQuadraticSmoothAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                                      in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegCurvetoQuadraticSmoothRel createSVGPathSegCurvetoQuadraticSmoothRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                                      in [Optional=DefaultIsUndefined] float y);
 
         readonly attribute SVGPathSegList pathSegList;
         readonly attribute SVGPathSegList normalizedPathSegList;
diff --git a/Source/WebCore/svg/SVGPathSeg.idl b/Source/WebCore/svg/SVGPathSeg.idl
index 5b967c2c9..e7ad75a8b 100644
--- a/Source/WebCore/svg/SVGPathSeg.idl
+++ b/Source/WebCore/svg/SVGPathSeg.idl
@@ -28,7 +28,7 @@ module svg {
 
     interface [
         Conditional=SVG,
-        JSCustomToJS,
+        CustomToJSObject,
         ObjCPolymorphic
     ] SVGPathSeg {
         // Path Segment Types
diff --git a/Source/WebCore/svg/SVGSVGElement.cpp b/Source/WebCore/svg/SVGSVGElement.cpp
index 8d6f1b03a..d381603ae 100644
--- a/Source/WebCore/svg/SVGSVGElement.cpp
+++ b/Source/WebCore/svg/SVGSVGElement.cpp
@@ -37,6 +37,7 @@
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "RenderObject.h"
 #include "RenderPart.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGModelObject.h"
@@ -286,25 +287,29 @@ void SVGSVGElement::parseAttribute(Attribute* attr)
 
 void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
 { 
-    bool updateRelativeLengths = false;
+    bool updateRelativeLengthsOrViewBox = false;
     if (attrName == SVGNames::widthAttr
         || attrName == SVGNames::heightAttr
         || attrName == SVGNames::xAttr
-        || attrName == SVGNames::yAttr
-        || SVGFitToViewBox::isKnownAttribute(attrName)) {
-        updateRelativeLengths = true;
+        || attrName == SVGNames::yAttr) {
+        updateRelativeLengthsOrViewBox = true;
         updateRelativeLengthsInformation();
     }
 
+    if (SVGFitToViewBox::isKnownAttribute(attrName)) {
+        updateRelativeLengthsOrViewBox = true; 
+        if (RenderObject* object = renderer())
+            object->setNeedsTransformUpdate();
+    }
+
     SVGElementInstance::InvalidationGuard invalidationGuard(this);
     if (SVGTests::handleAttributeChange(this, attrName))
         return;
 
-    if (updateRelativeLengths
+    if (updateRelativeLengthsOrViewBox
         || SVGLangSpace::isKnownAttribute(attrName)
         || SVGExternalResourcesRequired::isKnownAttribute(attrName)
-        || SVGZoomAndPan::isKnownAttribute(attrName)
-        || attrName == SVGNames::viewBoxAttr) {
+        || SVGZoomAndPan::isKnownAttribute(attrName)) {
         if (renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer());
         return;
@@ -550,12 +555,12 @@ FloatSize SVGSVGElement::currentViewportSize() const
         return FloatSize();
 
     if (renderer()->isSVGRoot()) {
-        LayoutRect frameRect = toRenderSVGRoot(renderer())->frameRect();
-        return FloatSize(frameRect.width() / renderer()->style()->effectiveZoom(), frameRect.height() / renderer()->style()->effectiveZoom());
+        LayoutRect contentBoxRect = toRenderSVGRoot(renderer())->contentBoxRect();
+        return FloatSize(contentBoxRect.width() / renderer()->style()->effectiveZoom(), contentBoxRect.height() / renderer()->style()->effectiveZoom());
     }
 
-    FloatRect frameRect = toRenderSVGViewportContainer(renderer())->viewport();
-    return FloatSize(frameRect.width() / renderer()->style()->effectiveZoom(), frameRect.height() / renderer()->style()->effectiveZoom());
+    FloatRect viewportRect = toRenderSVGViewportContainer(renderer())->viewport();
+    return FloatSize(viewportRect.width() / renderer()->style()->effectiveZoom(), viewportRect.height() / renderer()->style()->effectiveZoom());
 }
 
 bool SVGSVGElement::widthAttributeEstablishesViewport() const
@@ -726,7 +731,7 @@ Element* SVGSVGElement::getElementById(const AtomicString& id) const
             continue;
 
         Element* element = static_cast<Element*>(node);
-        if (element->hasID() && element->getIdAttribute() == id)
+        if (element->getIdAttribute() == id)
             return element;
     }
     return 0;
diff --git a/Source/WebCore/svg/SVGSVGElement.idl b/Source/WebCore/svg/SVGSVGElement.idl
index ff0309a0d..8fcd3d81e 100644
--- a/Source/WebCore/svg/SVGSVGElement.idl
+++ b/Source/WebCore/svg/SVGSVGElement.idl
@@ -55,23 +55,23 @@ module svg {
                      /*setter raises(DOMException)*/;
         readonly attribute SVGPoint currentTranslate;
 
-        unsigned long suspendRedraw(in [Optional=CallWithDefaultValue] unsigned long maxWaitMilliseconds);
-        void unsuspendRedraw(in [Optional=CallWithDefaultValue] unsigned long suspendHandleId);
+        unsigned long suspendRedraw(in [Optional=DefaultIsUndefined] unsigned long maxWaitMilliseconds);
+        void unsuspendRedraw(in [Optional=DefaultIsUndefined] unsigned long suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
         void pauseAnimations();
         void unpauseAnimations();
         boolean animationsPaused();
         float getCurrentTime();
-        void setCurrentTime(in [Optional=CallWithDefaultValue] float seconds);
-        NodeList getIntersectionList(in [Optional=CallWithDefaultValue] SVGRect rect, 
-                                     in [Optional=CallWithDefaultValue] SVGElement referenceElement);
-        NodeList getEnclosureList(in [Optional=CallWithDefaultValue] SVGRect rect, 
-                                  in [Optional=CallWithDefaultValue] SVGElement referenceElement);
-        boolean checkIntersection(in [Optional=CallWithDefaultValue] SVGElement element, 
-                                  in [Optional=CallWithDefaultValue] SVGRect rect);
-        boolean checkEnclosure(in [Optional=CallWithDefaultValue] SVGElement element, 
-                               in [Optional=CallWithDefaultValue] SVGRect rect);
+        void setCurrentTime(in [Optional=DefaultIsUndefined] float seconds);
+        NodeList getIntersectionList(in [Optional=DefaultIsUndefined] SVGRect rect, 
+                                     in [Optional=DefaultIsUndefined] SVGElement referenceElement);
+        NodeList getEnclosureList(in [Optional=DefaultIsUndefined] SVGRect rect, 
+                                  in [Optional=DefaultIsUndefined] SVGElement referenceElement);
+        boolean checkIntersection(in [Optional=DefaultIsUndefined] SVGElement element, 
+                                  in [Optional=DefaultIsUndefined] SVGRect rect);
+        boolean checkEnclosure(in [Optional=DefaultIsUndefined] SVGElement element, 
+                               in [Optional=DefaultIsUndefined] SVGRect rect);
         void deselectAll();
 
         SVGNumber createSVGNumber();
@@ -81,8 +81,8 @@ module svg {
         SVGMatrix createSVGMatrix();
         SVGRect createSVGRect();
         SVGTransform createSVGTransform();
-        SVGTransform createSVGTransformFromMatrix(in [Optional=CallWithDefaultValue] SVGMatrix matrix);
-        Element getElementById(in [Optional=CallWithDefaultValue] DOMString elementId);
+        SVGTransform createSVGTransformFromMatrix(in [Optional=DefaultIsUndefined] SVGMatrix matrix);
+        Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGStylable.idl b/Source/WebCore/svg/SVGStylable.idl
index 481eec34f..3e06563f0 100644
--- a/Source/WebCore/svg/SVGStylable.idl
+++ b/Source/WebCore/svg/SVGStylable.idl
@@ -35,7 +35,7 @@ module svg {
         readonly attribute SVGAnimatedString className;
         readonly attribute CSSStyleDeclaration style;
 
-        CSSValue getPresentationAttribute(in [Optional=CallWithDefaultValue] DOMString name);
+        CSSValue getPresentationAttribute(in [Optional=DefaultIsUndefined] DOMString name);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index 518b5b3ee..dd159a099 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -292,15 +292,22 @@ bool SVGStyledElement::isAnimatableCSSProperty(const QualifiedName& attrName)
     return cssPropertyToTypeMap().contains(attrName);
 }
 
+bool SVGStyledElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name()) > 0)
+        return true;
+    return SVGElement::isPresentationAttribute(attr);
+}
+
+void SVGStyledElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    int propertyID = SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name());
+    if (propertyID > 0)
+        addPropertyToAttributeStyle(style, propertyID, attr->value());
+}
+
 void SVGStyledElement::parseAttribute(Attribute* attr)
 {
-    int propId = SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name());
-    if (propId > 0) {
-        addCSSProperty(propId, attr->value());
-        setNeedsStyleRecalc();
-        return;
-    }
-    
     // SVG animation has currently requires special storage of values so we set
     // the className here.  svgAttributeChanged actually causes the resulting
     // style updates (instead of StyledElement::parseAttribute). We don't
diff --git a/Source/WebCore/svg/SVGStyledElement.h b/Source/WebCore/svg/SVGStyledElement.h
index 3df4c93fc..7a400641c 100644
--- a/Source/WebCore/svg/SVGStyledElement.h
+++ b/Source/WebCore/svg/SVGStyledElement.h
@@ -66,6 +66,8 @@ protected:
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual void attach();
diff --git a/Source/WebCore/svg/SVGSwitchElement.cpp b/Source/WebCore/svg/SVGSwitchElement.cpp
index 79a00ac92..7b976b2c0 100644
--- a/Source/WebCore/svg/SVGSwitchElement.cpp
+++ b/Source/WebCore/svg/SVGSwitchElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGSwitchElement.h"
 
+#include "NodeRenderingContext.h"
 #include "RenderSVGTransformableContainer.h"
 #include "SVGNames.h"
 
@@ -49,7 +50,7 @@ PassRefPtr<SVGSwitchElement> SVGSwitchElement::create(const QualifiedName& tagNa
     return adoptRef(new SVGSwitchElement(tagName, document));
 }
 
-bool SVGSwitchElement::childShouldCreateRenderer(Node* child) const
+bool SVGSwitchElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // FIXME: This function does not do what the comment below implies it does.
     // It will create a renderer for any valid SVG element children, not just the first one.
@@ -61,7 +62,7 @@ bool SVGSwitchElement::childShouldCreateRenderer(Node* child) const
         if (!element || !element->isValid())
             continue;
 
-        return node == child; // Only allow this child if it's the first valid child
+        return node == childContext.node(); // Only allow this child if it's the first valid child
     }
 
     return false;
diff --git a/Source/WebCore/svg/SVGSwitchElement.h b/Source/WebCore/svg/SVGSwitchElement.h
index 073a03851..1bf7e6cd4 100644
--- a/Source/WebCore/svg/SVGSwitchElement.h
+++ b/Source/WebCore/svg/SVGSwitchElement.h
@@ -43,7 +43,7 @@ private:
     virtual bool isValid() const { return SVGTests::isValid(); }
     virtual bool supportsFocus() const { return true; }
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 300b8c9fb..90b2d9985 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -27,10 +27,12 @@
 #include "EventListener.h"
 #include "EventNames.h"
 #include "MutationEvent.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGInline.h"
 #include "RenderSVGInlineText.h"
 #include "RenderSVGResource.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SVGDocument.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
@@ -56,19 +58,21 @@ inline SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* do
 
 PassRefPtr<SVGTRefElement> SVGTRefElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new SVGTRefElement(tagName, document));
+    RefPtr<SVGTRefElement> element = adoptRef(new SVGTRefElement(tagName, document));
+    element->createShadowSubtree();
+    return element.release();
 }
 
-class SubtreeModificationEventListener : public EventListener {
+class TargetListener : public EventListener {
 public:
-    static PassRefPtr<SubtreeModificationEventListener> create(SVGTRefElement* trefElement, String targetId)
+    static PassRefPtr<TargetListener> create(SVGTRefElement* trefElement, String targetId)
     {
-        return adoptRef(new SubtreeModificationEventListener(trefElement, targetId));
+        return adoptRef(new TargetListener(trefElement, targetId));
     }
 
-    static const SubtreeModificationEventListener* cast(const EventListener* listener)
+    static const TargetListener* cast(const EventListener* listener)
     {
-        return listener->type() == CPPEventListenerType ? static_cast<const SubtreeModificationEventListener*>(listener) : 0;
+        return listener->type() == CPPEventListenerType ? static_cast<const TargetListener*>(listener) : 0;
     }
 
     virtual bool operator==(const EventListener&);
@@ -76,15 +80,17 @@ public:
     void clear()
     {
         Element* target = m_trefElement->treeScope()->getElementById(m_targetId);
-        if (target && target->parentNode())
-            target->parentNode()->removeEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
+        if (target) {
+            target->removeEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
+            target->removeEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, false);
+        }
         
         m_trefElement = 0;
         m_targetId = String();
     }
 
 private:
-    SubtreeModificationEventListener(SVGTRefElement* trefElement, String targetId)
+    TargetListener(SVGTRefElement* trefElement, String targetId)
         : EventListener(CPPEventListenerType)
         , m_trefElement(trefElement)
         , m_targetId(targetId)
@@ -97,17 +103,20 @@ private:
     String m_targetId;
 };
 
-bool SubtreeModificationEventListener::operator==(const EventListener& listener)
+bool TargetListener::operator==(const EventListener& listener)
 {
-    if (const SubtreeModificationEventListener* subtreeModificationEventListener = SubtreeModificationEventListener::cast(&listener))
+    if (const TargetListener* subtreeModificationEventListener = TargetListener::cast(&listener))
         return m_trefElement == subtreeModificationEventListener->m_trefElement;
     return false;
 }
 
-void SubtreeModificationEventListener::handleEvent(ScriptExecutionContext*, Event* event)
+void TargetListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     if (m_trefElement && event->type() == eventNames().DOMSubtreeModifiedEvent && m_trefElement != event->target())
         m_trefElement->updateReferencedText();
+
+    if (m_trefElement && event->type() == eventNames().DOMNodeRemovedFromDocumentEvent)
+        m_trefElement->detachTarget();
 }
 
 class SVGShadowText : public Text {
@@ -144,18 +153,43 @@ SVGTRefElement::~SVGTRefElement()
     clearEventListener();
 }
 
+void SVGTRefElement::createShadowSubtree()
+{
+    ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+}
+
 void SVGTRefElement::updateReferencedText()
 {
-    Element* target = SVGURIReference::targetElementFromIRIString(href(), document());
-    ASSERT(target);
     String textContent;
-    if (target->parentNode())
+    if (Element* target = SVGURIReference::targetElementFromIRIString(href(), document()))
         textContent = target->textContent();
-    ExceptionCode ignore = 0;
-    if (!ensureShadowRoot()->firstChild())
-        shadowRoot()->appendChild(SVGShadowText::create(document(), textContent), ignore);
+
+    ASSERT(hasShadowRoot());
+    ShadowRoot* root = shadowRootList()->oldestShadowRoot();
+    if (!root->firstChild())
+        root->appendChild(SVGShadowText::create(document(), textContent), ASSERT_NO_EXCEPTION);
     else
-        shadowRoot()->firstChild()->setTextContent(textContent, ignore);
+        root->firstChild()->setTextContent(textContent, ASSERT_NO_EXCEPTION);
+}
+
+void SVGTRefElement::detachTarget()
+{
+    // Remove active listeners and clear the text content.
+    clearEventListener();
+
+    String emptyContent;
+    ExceptionCode ignore = 0;
+
+    ASSERT(hasShadowRoot());
+    Node* container = shadowRootList()->oldestShadowRoot()->firstChild();
+    if (container)
+        container->setTextContent(emptyContent, ignore);
+
+    // Mark the referenced ID as pending.
+    String id;
+    SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+    if (!hasPendingResources() && !id.isEmpty())
+        document()->accessSVGExtensions()->addPendingResource(id, this);
 }
 
 bool SVGTRefElement::isSupportedAttribute(const QualifiedName& attrName)
@@ -204,9 +238,9 @@ RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGInline(this);
 }
 
-bool SVGTRefElement::childShouldCreateRenderer(Node* child) const
+bool SVGTRefElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    return child->isInShadowTree();
+    return childContext.node()->isInShadowTree();
 }
 
 bool SVGTRefElement::rendererIsNeeded(const NodeRenderingContext& context)
@@ -247,9 +281,9 @@ void SVGTRefElement::buildPendingResource()
     if (!inDocument())
         return;
 
-    m_eventListener = SubtreeModificationEventListener::create(this, id);
-    ASSERT(target->parentNode());
-    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+    m_eventListener = TargetListener::create(this, id);
+    target->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+    target->addEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, m_eventListener.get(), false);
 }
 
 void SVGTRefElement::insertedIntoDocument()
diff --git a/Source/WebCore/svg/SVGTRefElement.h b/Source/WebCore/svg/SVGTRefElement.h
index 17a8acd59..18cbded2f 100644
--- a/Source/WebCore/svg/SVGTRefElement.h
+++ b/Source/WebCore/svg/SVGTRefElement.h
@@ -27,7 +27,7 @@
 
 namespace WebCore {
 
-class SubtreeModificationEventListener;
+class TargetListener;
 
 class SVGTRefElement : public SVGTextPositioningElement,
                        public SVGURIReference {
@@ -35,17 +35,19 @@ public:
     static PassRefPtr<SVGTRefElement> create(const QualifiedName&, Document*);
 
 private:
-    friend class SubtreeModificationEventListener;
+    friend class TargetListener;
 
     SVGTRefElement(const QualifiedName&, Document*);
     virtual ~SVGTRefElement();
 
+    void createShadowSubtree();
+
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual void insertedIntoDocument();
@@ -55,13 +57,15 @@ private:
 
     void updateReferencedText();
 
+    void detachTarget();
+
     virtual void buildPendingResource();
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGTRefElement)
         DECLARE_ANIMATED_STRING(Href, href)
     END_DECLARE_ANIMATED_PROPERTIES
 
-    RefPtr<SubtreeModificationEventListener> m_eventListener;
+    RefPtr<TargetListener> m_eventListener;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGTSpanElement.cpp b/Source/WebCore/svg/SVGTSpanElement.cpp
index 3219e6533..d13120d90 100644
--- a/Source/WebCore/svg/SVGTSpanElement.cpp
+++ b/Source/WebCore/svg/SVGTSpanElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGTSpanElement.h"
 
+#include "NodeRenderingContext.h"
 #include "RenderInline.h"
 #include "RenderSVGTSpan.h"
 #include "SVGNames.h"
@@ -45,15 +46,15 @@ RenderObject* SVGTSpanElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGTSpan(this);
 }
 
-bool SVGTSpanElement::childShouldCreateRenderer(Node* child) const
+bool SVGTSpanElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode()
-        || child->hasTagName(SVGNames::aTag)
+    if (childContext.node()->isTextNode()
+        || childContext.node()->hasTagName(SVGNames::aTag)
 #if ENABLE(SVG_FONTS)
-        || child->hasTagName(SVGNames::altGlyphTag)
+        || childContext.node()->hasTagName(SVGNames::altGlyphTag)
 #endif
-        || child->hasTagName(SVGNames::trefTag)
-        || child->hasTagName(SVGNames::tspanTag))
+        || childContext.node()->hasTagName(SVGNames::trefTag)
+        || childContext.node()->hasTagName(SVGNames::tspanTag))
         return true;
 
     return false;
diff --git a/Source/WebCore/svg/SVGTSpanElement.h b/Source/WebCore/svg/SVGTSpanElement.h
index 287cab41a..5ebab4475 100644
--- a/Source/WebCore/svg/SVGTSpanElement.h
+++ b/Source/WebCore/svg/SVGTSpanElement.h
@@ -34,7 +34,7 @@ private:
     SVGTSpanElement(const QualifiedName&, Document*);
             
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 };
 
diff --git a/Source/WebCore/svg/SVGTests.idl b/Source/WebCore/svg/SVGTests.idl
index c914a7bc8..11d9856a6 100644
--- a/Source/WebCore/svg/SVGTests.idl
+++ b/Source/WebCore/svg/SVGTests.idl
@@ -35,7 +35,7 @@ module svg {
         readonly attribute SVGStringList requiredExtensions;
         readonly attribute SVGStringList systemLanguage;
 
-        boolean hasExtension(in [Optional=CallWithDefaultValue] DOMString extension);
+        boolean hasExtension(in [Optional=DefaultIsUndefined] DOMString extension);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGTextContentElement.cpp b/Source/WebCore/svg/SVGTextContentElement.cpp
index c8dfdc5f1..1efedac93 100644
--- a/Source/WebCore/svg/SVGTextContentElement.cpp
+++ b/Source/WebCore/svg/SVGTextContentElement.cpp
@@ -228,6 +228,27 @@ bool SVGTextContentElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
+bool SVGTextContentElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name().matches(XMLNames::spaceAttr))
+        return true;
+    return SVGStyledElement::isPresentationAttribute(attr);
+}
+
+void SVGTextContentElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (!isSupportedAttribute(attr->name()))
+        SVGStyledElement::collectStyleForAttribute(attr, style);
+    else if (attr->name().matches(XMLNames::spaceAttr)) {
+        DEFINE_STATIC_LOCAL(const AtomicString, preserveString, ("preserve"));
+
+        if (attr->value() == preserveString)
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePre);
+        else
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValueNowrap);
+    }
+}
+
 void SVGTextContentElement::parseAttribute(Attribute* attr)
 {
     SVGParsingError parseError = NoError;
@@ -243,14 +264,6 @@ void SVGTextContentElement::parseAttribute(Attribute* attr)
     } else if (SVGTests::parseAttribute(attr)
                || SVGExternalResourcesRequired::parseAttribute(attr)) {
     } else if (SVGLangSpace::parseAttribute(attr)) {
-        if (attr->name().matches(XMLNames::spaceAttr)) {
-            DEFINE_STATIC_LOCAL(const AtomicString, preserveString, ("preserve"));
-
-            if (attr->value() == preserveString)
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValuePre);
-            else
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValueNowrap);
-        }
     } else
         ASSERT_NOT_REACHED();
 
diff --git a/Source/WebCore/svg/SVGTextContentElement.h b/Source/WebCore/svg/SVGTextContentElement.h
index d45bea6a1..91ae378f8 100644
--- a/Source/WebCore/svg/SVGTextContentElement.h
+++ b/Source/WebCore/svg/SVGTextContentElement.h
@@ -104,6 +104,8 @@ protected:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGTextContentElement.idl b/Source/WebCore/svg/SVGTextContentElement.idl
index cdd32e9fc..6ce8a5302 100644
--- a/Source/WebCore/svg/SVGTextContentElement.idl
+++ b/Source/WebCore/svg/SVGTextContentElement.idl
@@ -42,20 +42,20 @@ module svg {
 
         long getNumberOfChars();
         float getComputedTextLength();
-        float getSubStringLength(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset, 
-                                 in [Optional=CallWithDefaultValue,IsIndex] unsigned long length)
+        float getSubStringLength(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset, 
+                                 in [Optional=DefaultIsUndefined,IsIndex] unsigned long length)
             raises(DOMException);
-        SVGPoint getStartPositionOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        SVGPoint getStartPositionOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGPoint getEndPositionOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        SVGPoint getEndPositionOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGRect getExtentOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        SVGRect getExtentOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        float getRotationOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        float getRotationOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        long getCharNumAtPosition(in [Optional=CallWithDefaultValue] SVGPoint point);
-        void selectSubString(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset, 
-                             in [Optional=CallWithDefaultValue,IsIndex] unsigned long length)
+        long getCharNumAtPosition(in [Optional=DefaultIsUndefined] SVGPoint point);
+        void selectSubString(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset, 
+                             in [Optional=DefaultIsUndefined,IsIndex] unsigned long length)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/svg/SVGTextElement.cpp b/Source/WebCore/svg/SVGTextElement.cpp
index 5d46d82b2..54a64a57e 100644
--- a/Source/WebCore/svg/SVGTextElement.cpp
+++ b/Source/WebCore/svg/SVGTextElement.cpp
@@ -26,6 +26,7 @@
 #include "AffineTransform.h"
 #include "Attribute.h"
 #include "FloatRect.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGText.h"
 #include "SVGElementInstance.h"
@@ -141,16 +142,16 @@ RenderObject* SVGTextElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGText(this);
 }
 
-bool SVGTextElement::childShouldCreateRenderer(Node* child) const
+bool SVGTextElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode()
-        || child->hasTagName(SVGNames::aTag)
+    if (childContext.node()->isTextNode()
+        || childContext.node()->hasTagName(SVGNames::aTag)
 #if ENABLE(SVG_FONTS)
-        || child->hasTagName(SVGNames::altGlyphTag)
+        || childContext.node()->hasTagName(SVGNames::altGlyphTag)
 #endif
-        || child->hasTagName(SVGNames::textPathTag)
-        || child->hasTagName(SVGNames::trefTag)
-        || child->hasTagName(SVGNames::tspanTag))
+        || childContext.node()->hasTagName(SVGNames::textPathTag)
+        || childContext.node()->hasTagName(SVGNames::trefTag)
+        || childContext.node()->hasTagName(SVGNames::tspanTag))
         return true;
 
     return false;
diff --git a/Source/WebCore/svg/SVGTextElement.h b/Source/WebCore/svg/SVGTextElement.h
index e8a419358..32118f5bb 100644
--- a/Source/WebCore/svg/SVGTextElement.h
+++ b/Source/WebCore/svg/SVGTextElement.h
@@ -53,7 +53,7 @@ private:
     virtual AffineTransform localCoordinateSpaceTransform(SVGLocatable::CTMScope mode) const { return SVGTransformable::localCoordinateSpaceTransform(mode); }
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
             
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGTextPathElement.cpp b/Source/WebCore/svg/SVGTextPathElement.cpp
index 84c9a724a..c8cfdd294 100644
--- a/Source/WebCore/svg/SVGTextPathElement.cpp
+++ b/Source/WebCore/svg/SVGTextPathElement.cpp
@@ -24,6 +24,7 @@
 #include "SVGTextPathElement.h"
 
 #include "Attribute.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGTextPath.h"
 #include "SVGElementInstance.h"
@@ -117,12 +118,12 @@ RenderObject* SVGTextPathElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderSVGTextPath(this);
 }
 
-bool SVGTextPathElement::childShouldCreateRenderer(Node* child) const
+bool SVGTextPathElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode()
-        || child->hasTagName(SVGNames::aTag)
-        || child->hasTagName(SVGNames::trefTag)
-        || child->hasTagName(SVGNames::tspanTag))
+    if (childContext.node()->isTextNode()
+        || childContext.node()->hasTagName(SVGNames::aTag)
+        || childContext.node()->hasTagName(SVGNames::trefTag)
+        || childContext.node()->hasTagName(SVGNames::tspanTag))
         return true;
 
     return false;
diff --git a/Source/WebCore/svg/SVGTextPathElement.h b/Source/WebCore/svg/SVGTextPathElement.h
index 499c80d58..99bf6221c 100644
--- a/Source/WebCore/svg/SVGTextPathElement.h
+++ b/Source/WebCore/svg/SVGTextPathElement.h
@@ -122,7 +122,7 @@ private:
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index fd7f2d217..e342ee4ad 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -345,14 +345,21 @@ bool SVGUseElement::willRecalcStyle(StyleChange change)
         if (SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement())
             shadowRoot->setNeedsStyleRecalc();
     }
+    // Do not do style calculation during shadow tree construction because it may cause nodes to
+    // be attached before they should be. Style recalc will happen when the tree is constructed
+    // and explicitly attached.
+    if (m_updatesBlocked)
+        return false;
     return true;
 }
 
 void SVGUseElement::didRecalcStyle(StyleChange change)
 {
     // Assure that the shadow tree has not been marked for recreation, while we're building it.
-    if (m_updatesBlocked)
-        ASSERT(!m_needsShadowTreeRecreation);
+    if (m_updatesBlocked && m_needsShadowTreeRecreation) {
+        // We are about to recreate the tree while in the middle of recreating the tree.
+        return;
+    }
 
     RenderSVGShadowTreeRootContainer* shadowRoot = static_cast<RenderSVGShadowTreeRootContainer*>(renderer());
     if (!shadowRoot)
diff --git a/Source/WebCore/svg/animation/SMILTime.h b/Source/WebCore/svg/animation/SMILTime.h
index f7276c3ce..18abdae59 100644
--- a/Source/WebCore/svg/animation/SMILTime.h
+++ b/Source/WebCore/svg/animation/SMILTime.h
@@ -55,6 +55,32 @@ private:
     double m_time;
 };
 
+class SMILTimeWithOrigin {
+public:
+    enum Origin {
+        ParserOrigin,
+        ScriptOrigin
+    };
+
+    SMILTimeWithOrigin()
+        : m_origin(ParserOrigin)
+    {
+    }
+
+    SMILTimeWithOrigin(const SMILTime& time, Origin origin)
+        : m_time(time)
+        , m_origin(origin)
+    {
+    }
+
+    const SMILTime& time() const { return m_time; }
+    bool originIsScript() const { return m_origin == ScriptOrigin; }
+
+private:
+    SMILTime m_time;
+    Origin m_origin;
+};
+
 inline bool operator==(const SMILTime& a, const SMILTime& b) { return a.isFinite() && a.value() == b.value(); }
 inline bool operator!(const SMILTime& a) { return !a.isFinite() || !a.value(); }
 inline bool operator!=(const SMILTime& a, const SMILTime& b) { return !operator==(a, b); }
@@ -62,6 +88,7 @@ inline bool operator>(const SMILTime& a, const SMILTime& b) { return a.value() >
 inline bool operator<(const SMILTime& a, const SMILTime& b) { return a.value() < b.value(); }
 inline bool operator>=(const SMILTime& a, const SMILTime& b) { return a.value() > b.value() || operator==(a, b); }
 inline bool operator<=(const SMILTime& a, const SMILTime& b) { return a.value() < b.value() || operator==(a, b); }
+inline bool operator<(const SMILTimeWithOrigin& a, const SMILTimeWithOrigin& b) { return a.time() < b.time(); }
 
 SMILTime operator+(const SMILTime&, const SMILTime&);
 SMILTime operator-(const SMILTime&, const SMILTime&);
diff --git a/Source/WebCore/svg/animation/SMILTimeContainer.cpp b/Source/WebCore/svg/animation/SMILTimeContainer.cpp
index 82369e9cd..692f28b5f 100644
--- a/Source/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/Source/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -123,13 +123,13 @@ void SMILTimeContainer::resume()
 
 void SMILTimeContainer::setElapsed(SMILTime time)
 {
+    // If the documment didn't begin yet, record a new start time, we'll seek to once its possible.
     if (!m_beginTime) {
         m_presetStartTime = time.value();
         return;
     }
 
-    double now = currentTime();
-    m_beginTime = now - time.value();
+    m_beginTime = currentTime() - time.value();
     m_accumulatedPauseTime = 0;
 
     Vector<SVGSMILElement*> toReset;
@@ -137,8 +137,7 @@ void SMILTimeContainer::setElapsed(SMILTime time)
     for (unsigned n = 0; n < toReset.size(); ++n)
         toReset[n]->reset();
 
-    if (isPaused())
-        updateAnimations(now - m_beginTime - m_accumulatedPauseTime);
+    updateAnimations(time);
 }
 
 void SMILTimeContainer::startTimer(SMILTime fireTime, SMILTime minimumDelay)
@@ -157,8 +156,7 @@ void SMILTimeContainer::timerFired(Timer<SMILTimeContainer>*)
 {
     ASSERT(m_beginTime);
     ASSERT(!m_pauseTime);
-    SMILTime elapsed = this->elapsed();
-    updateAnimations(elapsed);
+    updateAnimations(elapsed());
 }
 
 void SMILTimeContainer::updateDocumentOrderIndexes()
@@ -221,49 +219,20 @@ String SMILTimeContainer::baseValueFor(ElementAttributePair key)
     ASSERT(attributeName != anyQName());
     String baseValue;
     if (SVGAnimationElement::isTargetAttributeCSSProperty(targetElement, attributeName))
-        baseValue = computedStyle(targetElement)->getPropertyValue(cssPropertyID(attributeName.localName()));
+        baseValue = CSSComputedStyleDeclaration::create(targetElement)->getPropertyValue(cssPropertyID(attributeName.localName()));
     else
         baseValue = targetElement->getAttribute(attributeName);
     m_savedBaseValues.add(key, baseValue);
     return baseValue;
 }
 
-void SMILTimeContainer::sampleAnimationAtTime(const String& elementId, double newTime)
-{
-    ASSERT(m_beginTime);
-    ASSERT(!isPaused());
-
-    // Fast-forward to the time DRT wants to sample
-    m_timer.stop();
-
-    updateAnimations(elapsed(), newTime, elementId);
-}
-
-void SMILTimeContainer::updateAnimations(SMILTime elapsed, double nextManualSampleTime, const String& nextSamplingTarget)
+void SMILTimeContainer::updateAnimations(SMILTime elapsed)
 {
     SMILTime earliersFireTime = SMILTime::unresolved();
 
     Vector<SVGSMILElement*> toAnimate;
     copyToVector(m_scheduledAnimations, toAnimate);
 
-    if (nextManualSampleTime) {
-        SMILTime samplingDiff;
-        for (unsigned n = 0; n < toAnimate.size(); ++n) {
-            SVGSMILElement* animation = toAnimate[n];
-            ASSERT(animation->timeContainer() == this);
-
-            SVGElement* targetElement = animation->targetElement();
-            // FIXME: This should probably be using getIdAttribute instead of idForStyleResolution.
-            if (!targetElement || !targetElement->hasID() || targetElement->idForStyleResolution() != nextSamplingTarget)
-                continue;
-
-            samplingDiff = animation->intervalBegin();
-            break;
-        }
-
-        elapsed = SMILTime(nextManualSampleTime) + samplingDiff;
-    }
-
     // Sort according to priority. Elements with later begin time have higher priority.
     // In case of a tie, document order decides. 
     // FIXME: This should also consider timing relationships between the elements. Dependents
diff --git a/Source/WebCore/svg/animation/SMILTimeContainer.h b/Source/WebCore/svg/animation/SMILTimeContainer.h
index a2d0b8fed..d4d06da48 100644
--- a/Source/WebCore/svg/animation/SMILTimeContainer.h
+++ b/Source/WebCore/svg/animation/SMILTimeContainer.h
@@ -63,15 +63,12 @@ public:
 
     void setDocumentOrderIndexesDirty() { m_documentOrderIndexesDirty = true; }
 
-    // Move to a specific time. Only used for DRT testing purposes.
-    void sampleAnimationAtTime(const String& elementId, double seconds);
-
 private:
     SMILTimeContainer(SVGSVGElement* owner);
     
     void timerFired(Timer<SMILTimeContainer>*);
     void startTimer(SMILTime fireTime, SMILTime minimumDelay = 0);
-    void updateAnimations(SMILTime elapsed, double nextManualSampleTime = 0, const String& nextSamplingTarget = String());
+    void updateAnimations(SMILTime elapsed);
     
     void updateDocumentOrderIndexes();
     void sortByPriority(Vector<SVGSMILElement*>& smilElements, SMILTime elapsed);
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index 790e27d81..dda170bf9 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -134,7 +134,7 @@ SVGSMILElement::SVGSMILElement(const QualifiedName& tagName, Document* doc)
     , m_cachedMin(invalidCachedTime)
     , m_cachedMax(invalidCachedTime)
 {
-    reset();
+    resolveFirstInterval();
 }
 
 SVGSMILElement::~SVGSMILElement()
@@ -168,6 +168,14 @@ static inline QualifiedName constructQualifiedName(const SVGElement* svgElement,
     return QualifiedName(nullAtom, localName, namespaceURI);
 }
 
+static inline void clearTimesWithDynamicOrigins(Vector<SMILTimeWithOrigin>& timeList)
+{
+    for (int i = timeList.size() - 1; i >= 0; --i) {
+        if (timeList[i].originIsScript())
+            timeList.remove(i);
+    }
+}
+
 void SVGSMILElement::reset()
 {
     m_activeState = Inactive;
@@ -178,7 +186,6 @@ void SVGSMILElement::reset()
     m_lastPercent = 0;
     m_lastRepeat = 0;
     m_nextProgressTime = 0;
-
     resolveFirstInterval();
 }
 
@@ -200,7 +207,7 @@ void SVGSMILElement::insertedIntoDocument()
 
     // "If no attribute is present, the default begin value (an offset-value of 0) must be evaluated."
     if (!fastHasAttribute(SVGNames::beginAttr))
-        m_beginTimes.append(0);
+        m_beginTimes.append(SMILTimeWithOrigin());
 
     if (m_isWaitingForFirstInterval) {
         resolveFirstInterval();
@@ -282,7 +289,7 @@ SMILTime SVGSMILElement::parseClockValue(const String& data)
     return result;
 }
     
-static void sortTimeList(Vector<SMILTime>& timeList)
+static void sortTimeList(Vector<SMILTimeWithOrigin>& timeList)
 {
     std::sort(timeList.begin(), timeList.end());
 }
@@ -364,12 +371,12 @@ bool SVGSMILElement::isSMILElement(Node* node)
     
 void SVGSMILElement::parseBeginOrEnd(const String& parseString, BeginOrEnd beginOrEnd)
 {
-    Vector<SMILTime>& timeList = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
+    Vector<SMILTimeWithOrigin>& timeList = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
     if (beginOrEnd == End)
         m_hasEndEventConditions = false;
     HashSet<double> existing;
     for (unsigned n = 0; n < timeList.size(); ++n)
-        existing.add(timeList[n].value());
+        existing.add(timeList[n].time().value());
     Vector<String> splitString;
     parseString.split(';', splitString);
     for (unsigned n = 0; n < splitString.size(); ++n) {
@@ -377,7 +384,7 @@ void SVGSMILElement::parseBeginOrEnd(const String& parseString, BeginOrEnd begin
         if (value.isUnresolved())
             parseCondition(splitString[n], beginOrEnd);
         else if (!existing.contains(value.value()))
-            timeList.append(value);
+            timeList.append(SMILTimeWithOrigin(value, SMILTimeWithOrigin::ParserOrigin));
     }
     sortTimeList(timeList);
 }
@@ -513,17 +520,32 @@ SVGElement* SVGSMILElement::targetElement()
     ContainerNode* target = href.isEmpty() ? parentNode() : SVGURIReference::targetElementFromIRIString(href, document());
     if (!target || !target->isSVGElement())
         return 0;
-    
+
     m_targetElement = static_cast<SVGElement*>(target);
     document()->accessSVGExtensions()->addAnimationElementToTarget(this, m_targetElement);
+
+    targetElementDidChange(m_targetElement);
+
     return m_targetElement;
 }
 
-SMILTime SVGSMILElement::elapsed() const 
+void SVGSMILElement::resetTargetElement()
+{
+    m_targetElement = 0;
+
+    // Force the animation to recompute values that are only calculated when an animation becomes active.
+    // Failing to do this means that a target reset and change during active animation may result in
+    // invalid state.
+    m_activeState = Inactive;
+
+    targetElementDidChange(0);
+}
+
+SMILTime SVGSMILElement::elapsed() const
 {
     return m_timeContainer ? m_timeContainer->elapsed() : 0;
-} 
-    
+}
+
 bool SVGSMILElement::isInactive() const
 {
      return m_activeState == Inactive;
@@ -616,67 +638,67 @@ SMILTime SVGSMILElement::simpleDuration() const
 {
     return min(dur(), SMILTime::indefinite());
 }
-    
-void SVGSMILElement::addBeginTime(SMILTime eventTime, SMILTime beginTime)
+
+void SVGSMILElement::addBeginTime(SMILTime eventTime, SMILTime beginTime, SMILTimeWithOrigin::Origin origin)
 {
-    m_beginTimes.append(beginTime);
+    m_beginTimes.append(SMILTimeWithOrigin(beginTime, origin));
     sortTimeList(m_beginTimes);
     beginListChanged(eventTime);
 }
-    
-void SVGSMILElement::addEndTime(SMILTime eventTime, SMILTime endTime)
+
+void SVGSMILElement::addEndTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin origin)
 {
-    m_endTimes.append(endTime);
+    m_endTimes.append(SMILTimeWithOrigin(endTime, origin));
     sortTimeList(m_endTimes);
     endListChanged(eventTime);
 }
-    
-inline SMILTime extractTimeFromVector(const SMILTime* position)
+
+inline SMILTime extractTimeFromVector(const SMILTimeWithOrigin* position)
 {
-    return *position;
+    return position->time();
 }
 
 SMILTime SVGSMILElement::findInstanceTime(BeginOrEnd beginOrEnd, SMILTime minimumTime, bool equalsMinimumOK) const
 {
-    const Vector<SMILTime>& list = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
+    const Vector<SMILTimeWithOrigin>& list = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
     int sizeOfList = list.size();
 
     if (!sizeOfList)
         return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
 
-    const SMILTime* result = binarySearch<const SMILTime, SMILTime, extractTimeFromVector>(list.begin(), sizeOfList, minimumTime, WTF::KeyMustNotBePresentInArray);
+    const SMILTimeWithOrigin* result = binarySearch<const SMILTimeWithOrigin, SMILTime, extractTimeFromVector>(list.begin(), sizeOfList, minimumTime, WTF::KeyMustNotBePresentInArray);
     int indexOfResult = result - list.begin();
-
-    if (sizeOfList - 1 > indexOfResult && list[indexOfResult] < minimumTime)
+    if (sizeOfList - 1 > indexOfResult && list[indexOfResult].time() < minimumTime)
         ++indexOfResult;
 
     ASSERT(indexOfResult < sizeOfList);
+    const SMILTime& currentTime = list[indexOfResult].time();
 
     // "The special value "indefinite" does not yield an instance time in the begin list."
-    if (list[indexOfResult].isIndefinite() && beginOrEnd == Begin)
+    if (currentTime.isIndefinite() && beginOrEnd == Begin)
         return SMILTime::unresolved();
 
-    if (list[indexOfResult] < minimumTime)
+    if (currentTime < minimumTime)
         return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
 
     // If the equals is NOT accepted, we have to find a bigger one.
-    if (list[indexOfResult] == minimumTime && !equalsMinimumOK) {
+    if (currentTime == minimumTime && !equalsMinimumOK) {
         if (indexOfResult + 1 >= sizeOfList)
             return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
     }
 
-    while (indexOfResult < sizeOfList - 1 && list[indexOfResult] == list[indexOfResult + 1])
+    while (indexOfResult < sizeOfList - 1 && currentTime == list[indexOfResult + 1].time())
         ++indexOfResult;
 
-    if (list[indexOfResult] > minimumTime)
-        return list[indexOfResult];
-    if (list[indexOfResult] == minimumTime) {
+    if (currentTime > minimumTime)
+        return currentTime;
+    if (currentTime == minimumTime) {
         if (indexOfResult + 1 < sizeOfList - 1)
-            return list[indexOfResult + 1];
+            return list[indexOfResult + 1].time();
         return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
     }
 
-    return list[indexOfResult];
+    return currentTime;
 }
 
 SMILTime SVGSMILElement::repeatingDuration() const
@@ -1041,7 +1063,13 @@ void SVGSMILElement::beginByLinkActivation()
     SMILTime elapsed = this->elapsed();
     addBeginTime(elapsed, elapsed);
 }
-    
+
+void SVGSMILElement::endedActiveInterval()
+{
+    clearTimesWithDynamicOrigins(m_beginTimes);
+    clearTimesWithDynamicOrigins(m_endTimes);
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.h b/Source/WebCore/svg/animation/SVGSMILElement.h
index 334f97573..9e1dfd014 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.h
+++ b/Source/WebCore/svg/animation/SVGSMILElement.h
@@ -54,7 +54,7 @@ public:
     SMILTimeContainer* timeContainer() const { return m_timeContainer.get(); }
 
     SVGElement* targetElement();
-    void resetTargetElement() { m_targetElement = 0; }
+    void resetTargetElement();
     const QualifiedName& attributeName() const { return m_attributeName; }
 
     void beginByLinkActivation();
@@ -109,15 +109,18 @@ public:
     virtual void applyResultsToTarget() = 0;
 
 protected:
-    void addBeginTime(SMILTime eventTime, SMILTime endTime);
-    void addEndTime(SMILTime eventTime, SMILTime endTime);
+    void addBeginTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin = SMILTimeWithOrigin::ParserOrigin);
+    void addEndTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin = SMILTimeWithOrigin::ParserOrigin);
 
     void setInactive() { m_activeState = Inactive; }
 
+    // Sub-classes may need to take action when the target is changed.
+    virtual void targetElementDidChange(SVGElement*) { }
+
 private:
     virtual void startedActiveInterval() = 0;
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement) = 0;
-    virtual void endedActiveInterval() = 0;
+    void endedActiveInterval();
 
     enum BeginOrEnd {
         Begin,
@@ -199,8 +202,8 @@ private:
     TimeDependentSet m_timeDependents;
 
     // Instance time lists
-    Vector<SMILTime> m_beginTimes;
-    Vector<SMILTime> m_endTimes;
+    Vector<SMILTimeWithOrigin> m_beginTimes;
+    Vector<SMILTimeWithOrigin> m_endTimes;
 
     // This is the upcoming or current interval
     SMILTime m_intervalBegin;
@@ -230,4 +233,3 @@ private:
 
 #endif // ENABLE(SVG)
 #endif // SVGSMILElement_h
-
diff --git a/Source/WebCore/svg/graphics/SVGImage.cpp b/Source/WebCore/svg/graphics/SVGImage.cpp
index bbcc91b52..7e1ce2854 100644
--- a/Source/WebCore/svg/graphics/SVGImage.cpp
+++ b/Source/WebCore/svg/graphics/SVGImage.cpp
@@ -337,12 +337,6 @@ bool SVGImage::dataChanged(bool allDataReceived)
 #endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
         pageClients.inspectorClient = dummyInspectorClient;
-#if ENABLE(DEVICE_ORIENTATION)
-        static DeviceMotionClient* dummyDeviceMotionClient = new EmptyDeviceMotionClient;
-        pageClients.deviceMotionClient = dummyDeviceMotionClient;
-        static DeviceOrientationClient* dummyDeviceOrientationClient = new EmptyDeviceOrientationClient;
-        pageClients.deviceOrientationClient = dummyDeviceOrientationClient;
-#endif
 
         // FIXME: If this SVG ends up loading itself, we might leak the world.
         // The Cache code does not know about CachedImages holding Frames and
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h b/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
index e6bd013eb..6e4c4879d 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
@@ -37,15 +37,14 @@ struct SVGAnimatedPropertySynchronizer<true> {
         // Attribute directly to avoid a call to Element::attributeChanged
         // that could cause the SVGElement to erroneously reset its properties.
         // svg/dom/SVGStringList-basics.xhtml exercises this behavior.
-        NamedNodeMap* namedAttrMap = ownerElement->ensureUpdatedAttributes();
-        Attribute* old = namedAttrMap->getAttributeItem(attrName);
+        ElementAttributeData* attributeData = ownerElement->ensureUpdatedAttributeData();
+        Attribute* old = attributeData->getAttributeItem(attrName);
         if (old && value.isNull())
-            namedAttrMap->removeAttribute(old->name());
+            attributeData->removeAttribute(old->name(), ownerElement);
         else if (!old && !value.isNull())
-            namedAttrMap->addAttribute(ownerElement->createAttribute(attrName, value));
+            attributeData->addAttribute(Attribute::create(attrName, value), ownerElement);
         else if (old && !value.isNull())
             old->setValue(value);
-
     }
 };
 
diff --git a/Source/WebCore/svg/svgtags.in b/Source/WebCore/svg/svgtags.in
index e12a5542f..9c6422962 100644
--- a/Source/WebCore/svg/svgtags.in
+++ b/Source/WebCore/svg/svgtags.in
@@ -11,7 +11,7 @@ altGlyphItem
 #endif
 animate
 animateColor
-animateMotion JSInterfaceName=SVGElement
+animateMotion
 animateTransform
 set
 circle
@@ -64,7 +64,7 @@ g
 #if ENABLE_SVG_FONTS
 glyph
 glyphRef
-hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement
+hkern interfaceName=SVGHKernElement
 #endif
 image
 line
@@ -75,7 +75,7 @@ metadata
 #if ENABLE_SVG_FONTS
 missing_glyph
 #endif
-mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement
+mpath interfaceName=SVGMPathElement
 path
 pattern
 polygon
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index c2b045dca..2884e5661 100644
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -36,14 +36,6 @@
 #include "Page.h"
 #include "Settings.h"
 
-#if ENABLE(GESTURE_EVENTS)
-#include "PlatformGestureEvent.h"
-#endif
-
-#if ENABLE(SMOOTH_SCROLLING)
-#include "ScrollAnimator.h"
-#endif
-
 #if ENABLE(INPUT_COLOR)
 #include "ColorChooser.h"
 #endif
@@ -172,43 +164,6 @@ void InternalSettings::setAcceleratedDrawingEnabled(bool enabled, ExceptionCode&
     settings()->setAcceleratedDrawingEnabled(enabled);
 }
 
-void InternalSettings::setEnableScrollAnimator(bool enabled, ExceptionCode& ec)
-{
-    InternalSettingsGuardForSettings();
-#if ENABLE(SMOOTH_SCROLLING)
-    settings()->setEnableScrollAnimator(enabled);
-#else
-    UNUSED_PARAM(enabled);
-#endif
-}
-
-void InternalSettings::setZoomAnimatorTransform(float scale, float tx, float ty, ExceptionCode& ec)
-{
-    InternalSettingsGuardForFrame();
-
-#if ENABLE(GESTURE_EVENTS)
-    PlatformGestureEvent pge(PlatformEvent::GestureDoubleTap, IntPoint(tx, ty), IntPoint(tx, ty), 0, scale, 0.f, 0, 0, 0, 0);
-    frame()->eventHandler()->handleGestureEvent(pge);
-#else
-    UNUSED_PARAM(scale);
-    UNUSED_PARAM(tx);
-    UNUSED_PARAM(ty);
-#endif
-}
-
-void InternalSettings::setZoomParameters(float scale, float x, float y, ExceptionCode& ec)
-{
-    InternalSettingsGuardForFrameView();
-
-#if ENABLE(SMOOTH_SCROLLING)
-    frame()->view()->scrollAnimator()->setZoomParametersForTest(scale, x, y);
-#else
-    UNUSED_PARAM(scale);
-    UNUSED_PARAM(x);
-    UNUSED_PARAM(y);
-#endif
-}
-
 void InternalSettings::setMockScrollbarsEnabled(bool enabled, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
@@ -253,12 +208,6 @@ bool InternalSettings::unifiedTextCheckingEnabled(ExceptionCode& ec)
     return settings()->unifiedTextCheckerEnabled();
 }
 
-float InternalSettings::pageScaleFactor(ExceptionCode& ec)
-{
-    InternalSettingsGuardForPageReturn(0);
-    return page()->pageScaleFactor();
-}
-
 void InternalSettings::setPageScaleFactor(float scaleFactor, int x, int y, ExceptionCode& ec)
 {
     InternalSettingsGuardForPage();
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index 64800926c..ef66c9959 100644
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -52,16 +52,12 @@ public:
     void setEnableCompositingForScrollableFrames(bool enabled, ExceptionCode&);
     void setAcceleratedDrawingEnabled(bool enabled, ExceptionCode&);
     void setAcceleratedFiltersEnabled(bool enabled, ExceptionCode&);
-    void setEnableScrollAnimator(bool enabled, ExceptionCode&);
-    void setZoomAnimatorTransform(float scale, float tx, float ty, ExceptionCode&);
-    void setZoomParameters(float scale, float x, float y, ExceptionCode&);
     void setMockScrollbarsEnabled(bool enabled, ExceptionCode&);
     void setPasswordEchoEnabled(bool enabled, ExceptionCode&);
     void setPasswordEchoDurationInSeconds(double durationInSeconds, ExceptionCode&);
     void setFixedElementsLayoutRelativeToFrame(bool, ExceptionCode&);
     void setUnifiedTextCheckingEnabled(bool, ExceptionCode&);
     bool unifiedTextCheckingEnabled(ExceptionCode&);
-    float pageScaleFactor(ExceptionCode&);
     void setPageScaleFactor(float scaleFactor, int x, int y, ExceptionCode&);
     void setPerTileDrawingEnabled(bool enabled, ExceptionCode&);
     void setTouchEventEmulationEnabled(bool enabled, ExceptionCode&);
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index 036008384..dd9519ec2 100644
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -33,16 +33,12 @@ module window {
         void setEnableCompositingForScrollableFrames(in boolean enabled) raises(DOMException);
         void setAcceleratedDrawingEnabled(in boolean enabled) raises(DOMException);
         void setAcceleratedFiltersEnabled(in boolean enabled) raises(DOMException);
-        void setEnableScrollAnimator(in boolean enabled) raises(DOMException);
-        void setZoomAnimatorTransform(in float scale, in float tx, in float ty) raises(DOMException);
-        void setZoomParameters(in float scale, in float x, in float y) raises(DOMException);
         void setMockScrollbarsEnabled(in boolean enabled) raises(DOMException);
         void setPasswordEchoEnabled(in boolean enabled) raises(DOMException);
         void setPasswordEchoDurationInSeconds(in double durationInSeconds) raises(DOMException);
         void setFixedElementsLayoutRelativeToFrame(in boolean enabled) raises(DOMException);
         void setUnifiedTextCheckingEnabled(in boolean enabled) raises (DOMException);
         boolean unifiedTextCheckingEnabled() raises (DOMException);
-        float pageScaleFactor() raises(DOMException);
         void setPageScaleFactor(in float scaleFactor, in long x, in long y) raises(DOMException);
         void setTouchEventEmulationEnabled(in boolean enabled) raises(DOMException);
     };
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index 06e34cd3c..84e9cf754 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -50,15 +50,14 @@
 #include "RenderTreeAsText.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SpellChecker.h"
 #include "TextIterator.h"
 
-#if ENABLE(GESTURE_EVENTS)
-#include "PlatformGestureEvent.h"
-#endif
-
-#if ENABLE(SMOOTH_SCROLLING)
-#include "ScrollAnimator.h"
+#if ENABLE(SHADOW_DOM)
+#include "RuntimeEnabledFeatures.h"
+#else
+#include <wtf/UnusedParam.h>
 #endif
 
 #if ENABLE(INPUT_COLOR)
@@ -157,6 +156,16 @@ bool Internals::isValidContentSelect(Element* contentElement, ExceptionCode& ec)
     return toHTMLContentElement(contentElement)->isSelectValid();
 }
 
+bool Internals::attached(Node* node, ExceptionCode& ec)
+{
+    if (!node) {
+        ec = INVALID_ACCESS_ERR;
+        return false;
+    }
+
+    return node->attached();
+}
+
 String Internals::elementRenderTreeAsText(Element* element, ExceptionCode& ec)
 {
     if (!element) {
@@ -173,11 +182,11 @@ String Internals::elementRenderTreeAsText(Element* element, ExceptionCode& ec)
     return representation;
 }
 
-size_t Internals::numberOfScopedHTMLStyleChildren(const Element* element, ExceptionCode& ec) const
+size_t Internals::numberOfScopedHTMLStyleChildren(const Node* scope, ExceptionCode& ec) const
 {
-    if (element)
+    if (scope && (scope->isElementNode() || scope->isShadowRoot()))
 #if ENABLE(STYLE_SCOPED)
-        return element->numberOfScopedHTMLStyleChildren();
+        return scope->numberOfScopedHTMLStyleChildren();
 #else
         return 0;
 #endif
@@ -193,20 +202,43 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::ensureShadowRoot(Eleme
         return 0;
     }
 
-    if (ShadowRoot* root = host->shadowRoot())
-        return root;
+    if (host->hasShadowRoot())
+        return host->shadowRootList()->youngestShadowRoot();
 
     return ShadowRoot::create(host, ec).get();
 }
 
 Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::shadowRoot(Element* host, ExceptionCode& ec)
 {
+    // FIXME: Internals::shadowRoot() in tests should be converted to youngestShadowRoot() or oldestShadowRoot().
+    // https://bugs.webkit.org/show_bug.cgi?id=78465
+    return youngestShadowRoot(host, ec);
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::youngestShadowRoot(Element* host, ExceptionCode& ec)
+{
+    if (!host) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    if (!host->hasShadowRoot())
+        return 0;
+
+    return host->shadowRootList()->youngestShadowRoot();
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::oldestShadowRoot(Element* host, ExceptionCode& ec)
+{
     if (!host) {
         ec = INVALID_ACCESS_ERR;
         return 0;
     }
 
-    return host->shadowRoot();
+    if (!host->hasShadowRoot())
+        return 0;
+
+    return host->shadowRootList()->oldestShadowRoot();
 }
 
 void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
@@ -219,6 +251,15 @@ void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
     host->removeShadowRoot();
 }
 
+void Internals::setMultipleShadowSubtreesEnabled(bool enabled)
+{
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled(enabled);
+#else
+    UNUSED_PARAM(enabled);
+#endif
+}
+
 Element* Internals::includerFor(Node* node, ExceptionCode& ec)
 {
     if (!node) {
@@ -226,7 +267,7 @@ Element* Internals::includerFor(Node* node, ExceptionCode& ec)
         return 0;
     }
 
-    return NodeRenderingContext(node).includer();
+    return NodeRenderingContext(node).insertionPoint();
 }
 
 String Internals::shadowPseudoId(Element* element, ExceptionCode& ec)
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index 439dc75c6..ea2f8b8af 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -57,7 +57,7 @@ public:
 
     bool isPreloaded(Document*, const String& url);
 
-    size_t numberOfScopedHTMLStyleChildren(const Element*, ExceptionCode&) const;
+    size_t numberOfScopedHTMLStyleChildren(const Node*, ExceptionCode&) const;
 
 #if ENABLE(SHADOW_DOM)
     typedef ShadowRoot ShadowRootIfShadowDOMEnabledOrNode;
@@ -66,13 +66,18 @@ public:
 #endif
     ShadowRootIfShadowDOMEnabledOrNode* ensureShadowRoot(Element* host, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* shadowRoot(Element* host, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* youngestShadowRoot(Element* host, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* oldestShadowRoot(Element* host, ExceptionCode&);
     void removeShadowRoot(Element* host, ExceptionCode&);
+    void setMultipleShadowSubtreesEnabled(bool);
     Element* includerFor(Node*, ExceptionCode&);
     String shadowPseudoId(Element*, ExceptionCode&);
     PassRefPtr<Element> createContentElement(Document*, ExceptionCode&);
     Element* getElementByIdInShadowRoot(Node* shadowRoot, const String& id, ExceptionCode&);
     bool isValidContentSelect(Element* contentElement, ExceptionCode&);
 
+    bool attached(Node*, ExceptionCode&);
+
 #if ENABLE(INPUT_COLOR)
     void selectColorInColorChooser(Element*, const String& colorValue);
 #endif
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index 9bf05751d..ba76d486d 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -30,15 +30,20 @@ module window {
         DOMString elementRenderTreeAsText(in Element element) raises(DOMException);
         boolean isPreloaded(in Document document, in DOMString url);
 
-        unsigned long numberOfScopedHTMLStyleChildren(in Element element) raises(DOMException);
+        unsigned long numberOfScopedHTMLStyleChildren(in Node scope) raises(DOMException);
 
 #if defined(ENABLE_SHADOW_DOM)
         ShadowRoot ensureShadowRoot(in Element host) raises (DOMException);
         ShadowRoot shadowRoot(in Element host) raises (DOMException);
+        ShadowRoot youngestShadowRoot(in Element host) raises (DOMException);
+        ShadowRoot oldestShadowRoot(in Element host) raises (DOMException);
 #else
         Node ensureShadowRoot(in Element host) raises (DOMException);
         Node shadowRoot(in Element host) raises (DOMException);
+        Node youngestShadowRoot(in Element host) raises (DOMException);
+        Node oldestShadowRoot(in Element host) raises (DOMException);
 #endif
+        void setMultipleShadowSubtreesEnabled(in boolean enabled);
         Element includerFor(in Node node) raises (DOMException);
         void removeShadowRoot(in Element host) raises (DOMException);
         DOMString shadowPseudoId(in Element element) raises (DOMException);
@@ -46,6 +51,8 @@ module window {
         Element getElementByIdInShadowRoot(in Node shadowRoot, in DOMString id) raises(DOMException);
         boolean isValidContentSelect(in Element contentElement) raises(DOMException);
 
+        boolean attached(in Node node) raises(DOMException);
+
 #if defined(ENABLE_INPUT_COLOR) && ENABLE_INPUT_COLOR
         void selectColorInColorChooser(in Element element, in DOMString colorValue);
 #endif
diff --git a/Source/WebCore/webaudio/AsyncAudioDecoder.cpp b/Source/WebCore/webaudio/AsyncAudioDecoder.cpp
index c26824398..f00bd1adc 100644
--- a/Source/WebCore/webaudio/AsyncAudioDecoder.cpp
+++ b/Source/WebCore/webaudio/AsyncAudioDecoder.cpp
@@ -49,8 +49,7 @@ AsyncAudioDecoder::~AsyncAudioDecoder()
     m_queue.kill();
     
     // Stop thread.
-    void* exitCode;
-    waitForThreadCompletion(m_threadID, &exitCode);
+    waitForThreadCompletion(m_threadID);
     m_threadID = 0;
 }
 
@@ -66,12 +65,11 @@ void AsyncAudioDecoder::decodeAsync(ArrayBuffer* audioData, float sampleRate, Pa
 }
 
 // Asynchronously decode in this thread.
-void* AsyncAudioDecoder::threadEntry(void* threadData)
+void AsyncAudioDecoder::threadEntry(void* threadData)
 {
     ASSERT(threadData);
     AsyncAudioDecoder* decoder = reinterpret_cast<AsyncAudioDecoder*>(threadData);
     decoder->runLoop();
-    return 0;
 }
 
 void AsyncAudioDecoder::runLoop()
diff --git a/Source/WebCore/webaudio/AsyncAudioDecoder.h b/Source/WebCore/webaudio/AsyncAudioDecoder.h
index e2fc4dcb0..ced8058c0 100644
--- a/Source/WebCore/webaudio/AsyncAudioDecoder.h
+++ b/Source/WebCore/webaudio/AsyncAudioDecoder.h
@@ -76,7 +76,7 @@ private:
         RefPtr<AudioBuffer> m_audioBuffer;
     };
     
-    static void* threadEntry(void* threadData);
+    static void threadEntry(void* threadData);
     void runLoop();
 
     WTF::ThreadIdentifier m_threadID;
diff --git a/Source/WebCore/webaudio/AudioBufferCallback.idl b/Source/WebCore/webaudio/AudioBufferCallback.idl
index f4b8303a7..9b35477c6 100644
--- a/Source/WebCore/webaudio/AudioBufferCallback.idl
+++ b/Source/WebCore/webaudio/AudioBufferCallback.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         Callback
     ] AudioBufferCallback {
         boolean handleEvent(in AudioBuffer audioBuffer);
diff --git a/Source/WebCore/webaudio/AudioBufferSourceNode.idl b/Source/WebCore/webaudio/AudioBufferSourceNode.idl
index 6f983afe3..eedb0cb70 100644
--- a/Source/WebCore/webaudio/AudioBufferSourceNode.idl
+++ b/Source/WebCore/webaudio/AudioBufferSourceNode.idl
@@ -26,7 +26,7 @@ module audio {
     // A cached (non-streamed), memory-resident audio source
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioBufferSourceNode : AudioSourceNode {
         attribute [CustomSetter] AudioBuffer buffer
             setter raises (DOMException);
diff --git a/Source/WebCore/webaudio/AudioContext.cpp b/Source/WebCore/webaudio/AudioContext.cpp
index 0c1664fb8..afc81130b 100644
--- a/Source/WebCore/webaudio/AudioContext.cpp
+++ b/Source/WebCore/webaudio/AudioContext.cpp
@@ -102,8 +102,10 @@ PassRefPtr<AudioContext> AudioContext::create(Document* document)
     ASSERT(isMainThread());
     if (s_hardwareContextCount >= MaxHardwareContexts)
         return 0;
-        
-    return adoptRef(new AudioContext(document));
+
+    RefPtr<AudioContext> audioContext(adoptRef(new AudioContext(document)));
+    audioContext->suspendIfNeeded();
+    return audioContext.release();
 }
 
 PassRefPtr<AudioContext> AudioContext::createOfflineContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate, ExceptionCode& ec)
@@ -118,7 +120,9 @@ PassRefPtr<AudioContext> AudioContext::createOfflineContext(Document* document,
         return 0;
     }
 
-    return adoptRef(new AudioContext(document, numberOfChannels, numberOfFrames, sampleRate));
+    RefPtr<AudioContext> audioContext(new AudioContext(document, numberOfChannels, numberOfFrames, sampleRate));
+    audioContext->suspendIfNeeded();
+    return audioContext.release();
 }
 
 // Constructor for rendering to the audio hardware.
diff --git a/Source/WebCore/webaudio/AudioDestinationNode.h b/Source/WebCore/webaudio/AudioDestinationNode.h
index 581edd801..d07833da9 100644
--- a/Source/WebCore/webaudio/AudioDestinationNode.h
+++ b/Source/WebCore/webaudio/AudioDestinationNode.h
@@ -49,8 +49,6 @@ public:
     size_t currentSampleFrame() { return m_currentSampleFrame; }
     double currentTime() { return currentSampleFrame() / static_cast<double>(sampleRate()); }
 
-    virtual float sampleRate() const = 0;
-
     virtual unsigned numberOfChannels() const { return 2; } // FIXME: update when multi-channel (more than stereo) is supported
 
     virtual void startRendering() = 0;
diff --git a/Source/WebCore/webaudio/AudioDestinationNode.idl b/Source/WebCore/webaudio/AudioDestinationNode.idl
index 1266952df..7ce4043b9 100644
--- a/Source/WebCore/webaudio/AudioDestinationNode.idl
+++ b/Source/WebCore/webaudio/AudioDestinationNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioDestinationNode : AudioNode {
         readonly attribute long numberOfChannels;
     };
diff --git a/Source/WebCore/webaudio/AudioGain.idl b/Source/WebCore/webaudio/AudioGain.idl
index 6e70d160d..75974277d 100644
--- a/Source/WebCore/webaudio/AudioGain.idl
+++ b/Source/WebCore/webaudio/AudioGain.idl
@@ -29,7 +29,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioGain : AudioParam {
     };
 }
diff --git a/Source/WebCore/webaudio/AudioGainNode.idl b/Source/WebCore/webaudio/AudioGainNode.idl
index 6b365fdbe..ba3163f94 100644
--- a/Source/WebCore/webaudio/AudioGainNode.idl
+++ b/Source/WebCore/webaudio/AudioGainNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioGainNode : AudioNode {
         // FIXME: eventually it will be interesting to remove the readonly restriction, but need to properly deal with thread safety here.
         readonly attribute AudioGain gain;
diff --git a/Source/WebCore/webaudio/AudioNode.h b/Source/WebCore/webaudio/AudioNode.h
index 1aeb54b68..dffd7118e 100644
--- a/Source/WebCore/webaudio/AudioNode.h
+++ b/Source/WebCore/webaudio/AudioNode.h
@@ -118,7 +118,7 @@ public:
     void connect(AudioNode*, unsigned outputIndex, unsigned inputIndex, ExceptionCode&);
     void disconnect(unsigned outputIndex, ExceptionCode&);
 
-    float sampleRate() const { return m_sampleRate; }
+    virtual float sampleRate() const { return m_sampleRate; }
 
     // processIfNecessary() is called by our output(s) when the rendering graph needs this AudioNode to process.
     // This method ensures that the AudioNode will only process once per rendering time quantum even if it's called repeatedly.
diff --git a/Source/WebCore/webaudio/AudioNode.idl b/Source/WebCore/webaudio/AudioNode.idl
index 06f873e3a..cfaa73b2c 100644
--- a/Source/WebCore/webaudio/AudioNode.idl
+++ b/Source/WebCore/webaudio/AudioNode.idl
@@ -30,10 +30,10 @@ module audio {
         readonly attribute unsigned long numberOfInputs;
         readonly attribute unsigned long numberOfOutputs;
 
-        void connect(in AudioNode destination, in [Optional=CallWithDefaultValue] unsigned long output, in [Optional=CallWithDefaultValue] unsigned long input)
+        void connect(in AudioNode destination, in [Optional=DefaultIsUndefined] unsigned long output, in [Optional=DefaultIsUndefined] unsigned long input)
             raises(DOMException);
 
-        void disconnect(in [Optional=CallWithDefaultValue] unsigned long output)
+        void disconnect(in [Optional=DefaultIsUndefined] unsigned long output)
             raises(DOMException);
     };
 }
diff --git a/Source/WebCore/webaudio/AudioPannerNode.cpp b/Source/WebCore/webaudio/AudioPannerNode.cpp
index 7790b5ee5..110577326 100644
--- a/Source/WebCore/webaudio/AudioPannerNode.cpp
+++ b/Source/WebCore/webaudio/AudioPannerNode.cpp
@@ -222,7 +222,7 @@ void AudioPannerNode::getAzimuthElevation(double* outAzimuth, double* outElevati
 
     // Elevation
     double elevation = 90.0 - 180.0 * acos(sourceListener.dot(up)) / piDouble;
-    fixNANs(azimuth); // avoid illegal values
+    fixNANs(elevation); // avoid illegal values
 
     if (elevation > 90.0)
         elevation = 180.0 - elevation;
diff --git a/Source/WebCore/webaudio/AudioPannerNode.idl b/Source/WebCore/webaudio/AudioPannerNode.idl
index e15cb379e..5061e7825 100644
--- a/Source/WebCore/webaudio/AudioPannerNode.idl
+++ b/Source/WebCore/webaudio/AudioPannerNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioPannerNode : AudioNode {
         // Panning model
         const unsigned short EQUALPOWER = 0;
diff --git a/Source/WebCore/webaudio/AudioParamTimeline.cpp b/Source/WebCore/webaudio/AudioParamTimeline.cpp
index eff1ea79b..cd8f53676 100644
--- a/Source/WebCore/webaudio/AudioParamTimeline.cpp
+++ b/Source/WebCore/webaudio/AudioParamTimeline.cpp
@@ -242,6 +242,13 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
                 // The value goes exponentially from value1 to value2 in a duration of deltaTime seconds (corresponding to numSampleFrames).
                 // Compute the per-sample multiplier.
                 float multiplier = powf(value2 / value1, 1 / numSampleFrames);
+
+                // Set the starting value of the exponential ramp. This is the same as multiplier ^
+                // AudioUtilities::timeToSampleFrame(currentTime - time1, sampleRate), but is more
+                // accurate, especially if multiplier is close to 1.
+                value = value1 * powf(value2 / value1,
+                                      AudioUtilities::timeToSampleFrame(currentTime - time1, sampleRate) / numSampleFrames);
+
                 for (; writeIndex < fillToFrame; ++writeIndex) {
                     values[writeIndex] = value;
                     value *= multiplier;
diff --git a/Source/WebCore/webaudio/AudioProcessingEvent.idl b/Source/WebCore/webaudio/AudioProcessingEvent.idl
index b963493bb..b6995f7d7 100644
--- a/Source/WebCore/webaudio/AudioProcessingEvent.idl
+++ b/Source/WebCore/webaudio/AudioProcessingEvent.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioProcessingEvent : Event {
         readonly attribute AudioBuffer inputBuffer;
         readonly attribute AudioBuffer outputBuffer; 
diff --git a/Source/WebCore/webaudio/BiquadFilterNode.idl b/Source/WebCore/webaudio/BiquadFilterNode.idl
index c3f52a3b7..d143065df 100644
--- a/Source/WebCore/webaudio/BiquadFilterNode.idl
+++ b/Source/WebCore/webaudio/BiquadFilterNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] BiquadFilterNode : AudioNode {
         // Filter type.
         const unsigned short LOWPASS = 0;
diff --git a/Source/WebCore/webaudio/ConvolverNode.idl b/Source/WebCore/webaudio/ConvolverNode.idl
index a91e3eb3d..0f561f0ff 100644
--- a/Source/WebCore/webaudio/ConvolverNode.idl
+++ b/Source/WebCore/webaudio/ConvolverNode.idl
@@ -26,7 +26,7 @@ module audio {
     // A linear convolution effect
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] ConvolverNode : AudioNode {
         attribute [JSCustomSetter] AudioBuffer buffer;
         attribute boolean normalize;
diff --git a/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp b/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
index e26456375..fe47accfa 100644
--- a/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
+++ b/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 DefaultAudioDestinationNode::DefaultAudioDestinationNode(AudioContext* context)
     : AudioDestinationNode(context, AudioDestination::hardwareSampleRate())
 {
-    initialize();
 }
 
 DefaultAudioDestinationNode::~DefaultAudioDestinationNode()
diff --git a/Source/WebCore/webaudio/DefaultAudioDestinationNode.h b/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
index 630bdc335..e7ac1cdba 100644
--- a/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
+++ b/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
@@ -45,9 +45,6 @@ public:
     // AudioNode   
     virtual void initialize();
     virtual void uninitialize();
-    
-    float sampleRate() const { return m_destination->sampleRate(); }
-
     virtual void startRendering();
     
 private:
diff --git a/Source/WebCore/webaudio/DelayNode.idl b/Source/WebCore/webaudio/DelayNode.idl
index 2ba529549..a21ac3095 100644
--- a/Source/WebCore/webaudio/DelayNode.idl
+++ b/Source/WebCore/webaudio/DelayNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] DelayNode : AudioNode {
         readonly attribute AudioParam delayTime;
     };
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
index ea8b58922..263755595 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
@@ -33,13 +33,16 @@
 #include "AudioNodeOutput.h"
 #include "DynamicsCompressor.h"
 
+// Set output to stereo by default.
+static const unsigned defaultNumberOfOutputChannels = 2;
+
 namespace WebCore {
 
 DynamicsCompressorNode::DynamicsCompressorNode(AudioContext* context, float sampleRate)
     : AudioNode(context, sampleRate)
 {
     addInput(adoptPtr(new AudioNodeInput(this)));
-    addOutput(adoptPtr(new AudioNodeOutput(this, 2)));
+    addOutput(adoptPtr(new AudioNodeOutput(this, defaultNumberOfOutputChannels)));
     
     setNodeType(NodeTypeDynamicsCompressor);
     
@@ -70,7 +73,7 @@ void DynamicsCompressorNode::initialize()
         return;
 
     AudioNode::initialize();    
-    m_dynamicsCompressor = adoptPtr(new DynamicsCompressor(true, sampleRate()));
+    m_dynamicsCompressor = adoptPtr(new DynamicsCompressor(sampleRate(), defaultNumberOfOutputChannels));
 }
 
 void DynamicsCompressorNode::uninitialize()
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.idl b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
index dd25f10ab..faad13e3c 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.idl
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] DynamicsCompressorNode : AudioNode {
     };
 }
diff --git a/Source/WebCore/webaudio/HighPass2FilterNode.idl b/Source/WebCore/webaudio/HighPass2FilterNode.idl
index fdd31d241..25ccba883 100644
--- a/Source/WebCore/webaudio/HighPass2FilterNode.idl
+++ b/Source/WebCore/webaudio/HighPass2FilterNode.idl
@@ -27,7 +27,7 @@ module audio {
     // FIXME: design BiquadNode and use instead of this
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] HighPass2FilterNode : AudioNode {
         readonly attribute AudioParam cutoff;
         readonly attribute AudioParam resonance;
diff --git a/Source/WebCore/webaudio/JavaScriptAudioNode.idl b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
index 5f05a1189..83e3e6285 100644
--- a/Source/WebCore/webaudio/JavaScriptAudioNode.idl
+++ b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
@@ -26,7 +26,7 @@ module audio {
     // For real-time audio stream synthesis/processing in JavaScript 
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSCustomMarkFunction,
 #if defined(V8_BINDING) && V8_BINDING
         EventTarget
diff --git a/Source/WebCore/webaudio/LowPass2FilterNode.idl b/Source/WebCore/webaudio/LowPass2FilterNode.idl
index c8d6c8899..ae3f05a6c 100644
--- a/Source/WebCore/webaudio/LowPass2FilterNode.idl
+++ b/Source/WebCore/webaudio/LowPass2FilterNode.idl
@@ -27,7 +27,7 @@ module audio {
     // FIXME: design BiquadNode and use instead of this
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] LowPass2FilterNode : AudioNode {
         readonly attribute AudioParam cutoff;
         readonly attribute AudioParam resonance;
diff --git a/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl b/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl
index 3f459e1f6..f09e98fea 100644
--- a/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl
+++ b/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO&VIDEO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] MediaElementAudioSourceNode : AudioSourceNode {
         readonly attribute HTMLMediaElement mediaElement;
     };
diff --git a/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
index 54f454881..4ef693917 100644
--- a/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
+++ b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] OfflineAudioCompletionEvent : Event {
         readonly attribute AudioBuffer renderedBuffer;
     };
diff --git a/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp b/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
index 198a5020b..a40e6057b 100644
--- a/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
+++ b/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
@@ -47,8 +47,6 @@ OfflineAudioDestinationNode::OfflineAudioDestinationNode(AudioContext* context,
     , m_startedRendering(false)
 {
     m_renderBus = adoptPtr(new AudioBus(renderTarget->numberOfChannels(), renderQuantumSize));
-    
-    initialize();
 }
 
 OfflineAudioDestinationNode::~OfflineAudioDestinationNode()
@@ -70,7 +68,7 @@ void OfflineAudioDestinationNode::uninitialize()
         return;
 
     if (m_renderThread) {
-        waitForThreadCompletion(m_renderThread, 0);
+        waitForThreadCompletion(m_renderThread);
         m_renderThread = 0;
     }
 
@@ -92,13 +90,11 @@ void OfflineAudioDestinationNode::startRendering()
 }
 
 // Do offline rendering in this thread.
-void* OfflineAudioDestinationNode::renderEntry(void* threadData)
+void OfflineAudioDestinationNode::renderEntry(void* threadData)
 {
     OfflineAudioDestinationNode* destinationNode = reinterpret_cast<OfflineAudioDestinationNode*>(threadData);
     ASSERT(destinationNode);
     destinationNode->render();
-    
-    return 0;
 }
 
 void OfflineAudioDestinationNode::render()
diff --git a/Source/WebCore/webaudio/OfflineAudioDestinationNode.h b/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
index c4d567a5d..c2da6fffc 100644
--- a/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
+++ b/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
@@ -48,8 +48,7 @@ public:
     // AudioNode   
     virtual void initialize();
     virtual void uninitialize();
-    
-    float sampleRate() const { return m_renderTarget->sampleRate(); }
+    virtual float sampleRate() const { return m_renderTarget->sampleRate(); }
 
     void startRendering();
     
@@ -65,7 +64,7 @@ private:
     // Rendering thread.
     volatile ThreadIdentifier m_renderThread;
     bool m_startedRendering;
-    static void* renderEntry(void* threadData);
+    static void renderEntry(void* threadData);
     void render();
     
     // For completion callback on main thread.
diff --git a/Source/WebCore/webaudio/RealtimeAnalyser.cpp b/Source/WebCore/webaudio/RealtimeAnalyser.cpp
index a3f807d83..54a9d1cb0 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyser.cpp
+++ b/Source/WebCore/webaudio/RealtimeAnalyser.cpp
@@ -45,8 +45,8 @@ using namespace std;
 namespace WebCore {
 
 const double RealtimeAnalyser::DefaultSmoothingTimeConstant  = 0.8;
-const double RealtimeAnalyser::DefaultMinDecibels = -100.0;
-const double RealtimeAnalyser::DefaultMaxDecibels = -30.0;
+const double RealtimeAnalyser::DefaultMinDecibels = -100;
+const double RealtimeAnalyser::DefaultMaxDecibels = -30;
 
 const unsigned RealtimeAnalyser::DefaultFFTSize = 2048;
 // All FFT implementations are expected to handle power-of-two sizes MinFFTSize <= size <= MaxFFTSize.
@@ -132,13 +132,13 @@ void applyWindow(float* p, size_t n)
     
     // Blackman window
     double alpha = 0.16;
-    double a0 = 0.5 * (1.0 - alpha);
+    double a0 = 0.5 * (1 - alpha);
     double a1 = 0.5;
     double a2 = 0.5 * alpha;
     
     for (unsigned i = 0; i < n; ++i) {
         double x = static_cast<double>(i) / static_cast<double>(n);
-        double window = a0 - a1 * cos(2.0 * piDouble * x) + a2 * cos(4.0 * piDouble * x);
+        double window = a0 - a1 * cos(2 * piDouble * x) + a2 * cos(4 * piDouble * x);
         p[i] *= float(window);
     }
 }
@@ -175,10 +175,10 @@ void RealtimeAnalyser::doFFTAnalysis()
     float* imagP = m_analysisFrame->imagData();
 
     // Blow away the packed nyquist component.
-    imagP[0] = 0.0f;
+    imagP[0] = 0;
     
     // Normalize so than an input sine wave at 0dBfs registers as 0dBfs (undo FFT scaling factor).
-    const double MagnitudeScale = 1.0 / DefaultFFTSize;
+    const double magnitudeScale = 1.0 / DefaultFFTSize;
 
     // A value of 0 does no averaging with the previous result.  Larger values produce slower, but smoother changes.
     double k = m_smoothingTimeConstant;
@@ -190,8 +190,8 @@ void RealtimeAnalyser::doFFTAnalysis()
     size_t n = magnitudeBuffer().size();
     for (size_t i = 0; i < n; ++i) {
         Complex c(realP[i], imagP[i]);
-        double scalarMagnitude = abs(c) * MagnitudeScale;        
-        destination[i] = float(k * destination[i] + (1.0 - k) * scalarMagnitude);
+        double scalarMagnitude = abs(c) * magnitudeScale;        
+        destination[i] = float(k * destination[i] + (1 - k) * scalarMagnitude);
     }
 }
 
@@ -205,7 +205,7 @@ void RealtimeAnalyser::getFloatFrequencyData(Float32Array* destinationArray)
     doFFTAnalysis();
     
     // Convert from linear magnitude to floating-point decibels.
-    const double MinDecibels = m_minDecibels;
+    const double minDecibels = m_minDecibels;
     unsigned sourceLength = magnitudeBuffer().size();
     size_t len = min(sourceLength, destinationArray->length());
     if (len > 0) {
@@ -214,7 +214,7 @@ void RealtimeAnalyser::getFloatFrequencyData(Float32Array* destinationArray)
         
         for (unsigned i = 0; i < len; ++i) {
             float linearValue = source[i];
-            double dbMag = !linearValue ? MinDecibels : AudioUtilities::linearToDecibels(linearValue);
+            double dbMag = !linearValue ? minDecibels : AudioUtilities::linearToDecibels(linearValue);
             destination[i] = float(dbMag);
         }
     }
@@ -233,21 +233,22 @@ void RealtimeAnalyser::getByteFrequencyData(Uint8Array* destinationArray)
     unsigned sourceLength = magnitudeBuffer().size();
     size_t len = min(sourceLength, destinationArray->length());
     if (len > 0) {
-        const double RangeScaleFactor = m_maxDecibels == m_minDecibels ? 1.0 : 1.0 / (m_maxDecibels - m_minDecibels);
+        const double rangeScaleFactor = m_maxDecibels == m_minDecibels ? 1 : 1 / (m_maxDecibels - m_minDecibels);
+        const double minDecibels = m_minDecibels;
 
         const float* source = magnitudeBuffer().data();
         unsigned char* destination = destinationArray->data();        
         
         for (unsigned i = 0; i < len; ++i) {
             float linearValue = source[i];
-            double dbMag = !linearValue ? m_minDecibels : AudioUtilities::linearToDecibels(linearValue);
+            double dbMag = !linearValue ? minDecibels : AudioUtilities::linearToDecibels(linearValue);
             
             // The range m_minDecibels to m_maxDecibels will be scaled to byte values from 0 to UCHAR_MAX.
-            double scaledValue = UCHAR_MAX * (dbMag - m_minDecibels) * RangeScaleFactor;
+            double scaledValue = UCHAR_MAX * (dbMag - minDecibels) * rangeScaleFactor;
 
             // Clip to valid range.
-            if (scaledValue < 0.0)
-                scaledValue = 0.0;
+            if (scaledValue < 0)
+                scaledValue = 0;
             if (scaledValue > UCHAR_MAX)
                 scaledValue = UCHAR_MAX;
             
@@ -280,12 +281,12 @@ void RealtimeAnalyser::getByteTimeDomainData(Uint8Array* destinationArray)
             // Buffer access is protected due to modulo operation.
             float value = inputBuffer[(i + writeIndex - fftSize + InputBufferSize) % InputBufferSize];
 
-            // Scale from nominal -1.0 -> +1.0 to unsigned byte.
-            double scaledValue = 128.0 * (value + 1.0);
+            // Scale from nominal -1 -> +1 to unsigned byte.
+            double scaledValue = 128 * (value + 1);
 
             // Clip to valid range.
-            if (scaledValue < 0.0)
-                scaledValue = 0.0;
+            if (scaledValue < 0)
+                scaledValue = 0;
             if (scaledValue > UCHAR_MAX)
                 scaledValue = UCHAR_MAX;
             
diff --git a/Source/WebCore/webaudio/RealtimeAnalyserNode.idl b/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
index 73d55746b..50edbc174 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
+++ b/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] RealtimeAnalyserNode : AudioNode {
         attribute unsigned long fftSize;
         readonly attribute unsigned long frequencyBinCount;
diff --git a/Source/WebCore/webaudio/WaveShaperNode.idl b/Source/WebCore/webaudio/WaveShaperNode.idl
index a33bc012d..16a4acf7c 100644
--- a/Source/WebCore/webaudio/WaveShaperNode.idl
+++ b/Source/WebCore/webaudio/WaveShaperNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] WaveShaperNode : AudioNode {
         attribute [JSCustomSetter] Float32Array curve;
     };
diff --git a/Source/WebCore/websockets/CloseEvent.idl b/Source/WebCore/websockets/CloseEvent.idl
index e36c9494a..ea75111ac 100644
--- a/Source/WebCore/websockets/CloseEvent.idl
+++ b/Source/WebCore/websockets/CloseEvent.idl
@@ -36,7 +36,7 @@ module events {
     ] CloseEvent : Event {
         readonly attribute [InitializedByEventConstructor] boolean wasClean;
         readonly attribute [InitializedByEventConstructor] unsigned short code;
-        readonly attribute [InitializedByEventConstructor, ConvertingNullStringTo=Undefined] DOMString reason;
+        readonly attribute [InitializedByEventConstructor] DOMString reason;
     };
 
 }
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp b/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
index 17f24fb4d..029e4ffd7 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc.  All rights reserved.
+ * Copyright (C) 2009, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -34,6 +34,7 @@
 
 #include "ThreadableWebSocketChannel.h"
 
+#include "Document.h"
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
 #include "ThreadableWebSocketChannelClientWrapper.h"
@@ -66,7 +67,7 @@ PassRefPtr<ThreadableWebSocketChannel> ThreadableWebSocketChannel::create(Script
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    return WebSocketChannel::create(context, client);
+    return WebSocketChannel::create(static_cast<Document*>(context), client);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.h b/Source/WebCore/websockets/ThreadableWebSocketChannel.h
index e93cf8684..a14582a8f 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.h
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannel.h
@@ -53,6 +53,7 @@ public:
     virtual bool useHixie76Protocol() = 0;
     virtual void connect(const KURL&, const String& protocol) = 0;
     virtual String subprotocol() = 0; // Will be available after didConnect() callback is invoked.
+    virtual String extensions() = 0; // Will be available after didConnect() callback is invoked.
     virtual bool send(const String& message) = 0;
     virtual bool send(const ArrayBuffer&) = 0;
     virtual bool send(const Blob&) = 0;
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
index 3be04a98f..dcb1802a2 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
@@ -29,20 +29,22 @@
  */
 
 #include "config.h"
-#if ENABLE(WEB_SOCKETS)
+#if ENABLE(WEB_SOCKETS) && ENABLE(WORKERS)
 #include "ThreadableWebSocketChannelClientWrapper.h"
 
 #include "CrossThreadCopier.h"
 #include "CrossThreadTask.h"
+#include "ScriptExecutionContext.h"
 #include "WebSocketChannelClient.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper(WebSocketChannelClient* client)
-    : m_client(client)
-    , m_syncMethodDone(false)
+ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper(ScriptExecutionContext* context, WebSocketChannelClient* client)
+    : m_context(context)
+    , m_client(client)
+    , m_syncMethodDone(true)
     , m_useHixie76Protocol(true)
     , m_sendRequestResult(false)
     , m_bufferedAmount(0)
@@ -50,9 +52,9 @@ ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper
 {
 }
 
-PassRefPtr<ThreadableWebSocketChannelClientWrapper> ThreadableWebSocketChannelClientWrapper::create(WebSocketChannelClient* client)
+PassRefPtr<ThreadableWebSocketChannelClientWrapper> ThreadableWebSocketChannelClientWrapper::create(ScriptExecutionContext* context, WebSocketChannelClient* client)
 {
-    return adoptRef(new ThreadableWebSocketChannelClientWrapper(client));
+    return adoptRef(new ThreadableWebSocketChannelClientWrapper(context, client));
 }
 
 void ThreadableWebSocketChannelClientWrapper::clearSyncMethodDone()
@@ -95,6 +97,21 @@ void ThreadableWebSocketChannelClientWrapper::setSubprotocol(const String& subpr
         memcpy(m_subprotocol.data(), subprotocol.characters(), sizeof(UChar) * length);
 }
 
+String ThreadableWebSocketChannelClientWrapper::extensions() const
+{
+    if (m_extensions.isEmpty())
+        return String("");
+    return String(m_extensions);
+}
+
+void ThreadableWebSocketChannelClientWrapper::setExtensions(const String& extensions)
+{
+    unsigned length = extensions.length();
+    m_extensions.resize(length);
+    if (length)
+        memcpy(m_extensions.data(), extensions.characters(), sizeof(UChar) * length);
+}
+
 bool ThreadableWebSocketChannelClientWrapper::sendRequestResult() const
 {
     return m_sendRequestResult;
@@ -175,9 +192,22 @@ void ThreadableWebSocketChannelClientWrapper::resume()
     processPendingTasks();
 }
 
+void ThreadableWebSocketChannelClientWrapper::processPendingTasksCallback(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> wrapper)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    wrapper->processPendingTasks();
+}
+
 void ThreadableWebSocketChannelClientWrapper::processPendingTasks()
 {
-    ASSERT(!m_suspended);
+    if (m_suspended)
+        return;
+    if (!m_syncMethodDone) {
+        // When a synchronous operation is in progress (i.e. the execution stack contains
+        // WorkerThreadableWebSocketChannel::waitForMethodCompletion()), we cannot invoke callbacks in this run loop.
+        m_context->postTask(createCallbackTask(&ThreadableWebSocketChannelClientWrapper::processPendingTasksCallback, this));
+        return;
+    }
     Vector<OwnPtr<ScriptExecutionContext::Task> > tasks;
     tasks.swap(m_pendingTasks);
     for (Vector<OwnPtr<ScriptExecutionContext::Task> >::const_iterator iter = tasks.begin(); iter != tasks.end(); ++iter)
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
index ec9397cdb..4b9b7fde7 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -31,7 +31,7 @@
 #ifndef ThreadableWebSocketChannelClientWrapper_h
 #define ThreadableWebSocketChannelClientWrapper_h
 
-#if ENABLE(WEB_SOCKETS)
+#if ENABLE(WEB_SOCKETS) && ENABLE(WORKERS)
 
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
@@ -44,11 +44,12 @@
 
 namespace WebCore {
 
+class ScriptExecutionContext;
 class WebSocketChannelClient;
 
 class ThreadableWebSocketChannelClientWrapper : public ThreadSafeRefCounted<ThreadableWebSocketChannelClientWrapper> {
 public:
-    static PassRefPtr<ThreadableWebSocketChannelClientWrapper> create(WebSocketChannelClient*);
+    static PassRefPtr<ThreadableWebSocketChannelClientWrapper> create(ScriptExecutionContext*, WebSocketChannelClient*);
 
     void clearSyncMethodDone();
     void setSyncMethodDone();
@@ -59,9 +60,11 @@ public:
     bool useHixie76Protocol() const;
     void setUseHixie76Protocol(bool);
 
-    // Subprotocol is cached too. Will be available when didConnect() callback is invoked.
+    // Subprotocol and extensions are cached too. Will be available when didConnect() callback is invoked.
     String subprotocol() const;
     void setSubprotocol(const String&);
+    String extensions() const;
+    void setExtensions(const String&);
 
     bool sendRequestResult() const;
     void setSendRequestResult(bool);
@@ -81,21 +84,26 @@ public:
     void suspend();
     void resume();
 
-protected:
-    ThreadableWebSocketChannelClientWrapper(WebSocketChannelClient*);
+private:
+    ThreadableWebSocketChannelClientWrapper(ScriptExecutionContext*, WebSocketChannelClient*);
 
     void processPendingTasks();
+
     static void didConnectCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>);
     static void didReceiveMessageCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, const String& message);
     static void didReceiveBinaryDataCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, PassOwnPtr<Vector<char> >);
     static void didUpdateBufferedAmountCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, unsigned long bufferedAmount);
     static void didStartClosingHandshakeCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>);
     static void didCloseCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, unsigned long unhandledBufferedAmount, WebSocketChannelClient::ClosingHandshakeCompletionStatus, unsigned short code, const String& reason);
+    static void processPendingTasksCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>);
 
+    ScriptExecutionContext* m_context;
     WebSocketChannelClient* m_client;
     bool m_syncMethodDone;
     bool m_useHixie76Protocol;
-    Vector<UChar> m_subprotocol; // ThreadSafeRefCounted must not have a String member variable.
+    // ThreadSafeRefCounted must not have String member variables.
+    Vector<UChar> m_subprotocol;
+    Vector<UChar> m_extensions;
     bool m_sendRequestResult;
     unsigned long m_bufferedAmount;
     bool m_suspended;
diff --git a/Source/WebCore/websockets/WebSocket.cpp b/Source/WebCore/websockets/WebSocket.cpp
index 5e213b871..36dbb6f32 100644
--- a/Source/WebCore/websockets/WebSocket.cpp
+++ b/Source/WebCore/websockets/WebSocket.cpp
@@ -155,6 +155,7 @@ WebSocket::WebSocket(ScriptExecutionContext* context)
     , m_binaryType(BinaryTypeBlob)
     , m_useHixie76Protocol(true)
     , m_subprotocol("")
+    , m_extensions("")
 {
 }
 
@@ -164,6 +165,13 @@ WebSocket::~WebSocket()
         m_channel->disconnect();
 }
 
+PassRefPtr<WebSocket> WebSocket::create(ScriptExecutionContext* context)
+{
+    RefPtr<WebSocket> webSocket(adoptRef(new WebSocket(context)));
+    webSocket->suspendIfNeeded();
+    return webSocket.release();
+}
+
 void WebSocket::connect(const String& url, ExceptionCode& ec)
 {
     Vector<String> protocols;
@@ -380,8 +388,7 @@ String WebSocket::extensions() const
 {
     if (m_useHixie76Protocol)
         return String();
-    // WebSocket protocol extension is not supported yet.
-    return "";
+    return m_extensions;
 }
 
 String WebSocket::binaryType() const
diff --git a/Source/WebCore/websockets/WebSocket.h b/Source/WebCore/websockets/WebSocket.h
index b860b75c7..1e44245e8 100644
--- a/Source/WebCore/websockets/WebSocket.h
+++ b/Source/WebCore/websockets/WebSocket.h
@@ -53,7 +53,7 @@ class WebSocket : public RefCounted<WebSocket>, public EventTarget, public Activ
 public:
     static void setIsAvailable(bool);
     static bool isAvailable();
-    static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
+    static PassRefPtr<WebSocket> create(ScriptExecutionContext*);
     virtual ~WebSocket();
 
     enum State {
@@ -136,6 +136,7 @@ private:
     BinaryType m_binaryType;
     bool m_useHixie76Protocol;
     String m_subprotocol;
+    String m_extensions;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/WebSocket.idl b/Source/WebCore/websockets/WebSocket.idl
index b8dee1398..92835ae43 100644
--- a/Source/WebCore/websockets/WebSocket.idl
+++ b/Source/WebCore/websockets/WebSocket.idl
@@ -57,10 +57,10 @@ module websockets {
         attribute EventListener onerror;
         attribute EventListener onclose;
 
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString protocol;
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString extensions;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString protocol;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString extensions;
 
-        attribute [ConvertNullStringTo=Undefined] DOMString binaryType
+        attribute [TreatReturnedNullStringAs=Undefined] DOMString binaryType
             setter raises(DOMException);
 
         // FIXME: Use overloading provided by our IDL code generator.
diff --git a/Source/WebCore/websockets/WebSocketChannel.cpp b/Source/WebCore/websockets/WebSocketChannel.cpp
index 53436e39a..ec0706db4 100644
--- a/Source/WebCore/websockets/WebSocketChannel.cpp
+++ b/Source/WebCore/websockets/WebSocketChannel.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -70,7 +70,7 @@ const double TCPMaximumSegmentLifetime = 2 * 60.0;
 
 // Constants for hybi-10 frame format.
 const unsigned char finalBit = 0x80;
-const unsigned char reserved1Bit = 0x40;
+const unsigned char compressBit = 0x40;
 const unsigned char reserved2Bit = 0x20;
 const unsigned char reserved3Bit = 0x10;
 const unsigned char opCodeMask = 0xF;
@@ -81,15 +81,8 @@ const size_t payloadLengthWithTwoByteExtendedLengthField = 126;
 const size_t payloadLengthWithEightByteExtendedLengthField = 127;
 const size_t maskingKeyWidthInBytes = 4;
 
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeContinuation = 0x0;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeText = 0x1;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeBinary = 0x2;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeClose = 0x8;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodePing = 0x9;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodePong = 0xA;
-
-WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketChannelClient* client)
-    : m_context(context)
+WebSocketChannel::WebSocketChannel(Document* document, WebSocketChannelClient* client)
+    : m_document(document)
     , m_client(client)
     , m_buffer(0)
     , m_bufferSize(0)
@@ -110,12 +103,10 @@ WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketCha
     , m_blobLoaderStatus(BlobLoaderNotStarted)
 #endif
 {
-    ASSERT(m_context->isDocument());
-    Document* document = static_cast<Document*>(m_context);
-    if (Settings* settings = document->settings())
+    if (Settings* settings = m_document->settings())
         m_useHixie76Protocol = settings->useHixie76WebSocketProtocol();
 
-    if (Page* page = document->page())
+    if (Page* page = m_document->page())
         m_identifier = page->progress()->createUniqueIdentifier();
 }
 
@@ -134,10 +125,10 @@ void WebSocketChannel::connect(const KURL& url, const String& protocol)
     LOG(Network, "WebSocketChannel %p connect", this);
     ASSERT(!m_handle);
     ASSERT(!m_suspended);
-    m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_context, m_useHixie76Protocol));
+    m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_document, m_useHixie76Protocol));
     m_handshake->reset();
     if (m_identifier)
-        InspectorInstrumentation::didCreateWebSocket(m_context, m_identifier, url, m_context->url());
+        InspectorInstrumentation::didCreateWebSocket(m_document, m_identifier, url, m_document->url());
     ref();
     m_handle = SocketStreamHandle::create(m_handshake->url(), this);
 }
@@ -153,6 +144,17 @@ String WebSocketChannel::subprotocol()
     return serverProtocol;
 }
 
+String WebSocketChannel::extensions()
+{
+    LOG(Network, "WebSocketChannel %p extensions", this);
+    if (!m_handshake || m_handshake->mode() != WebSocketHandshake::Connected)
+        return "";
+    String extensions = m_handshake->acceptedExtensions();
+    if (extensions.isNull())
+        return "";
+    return extensions;
+}
+
 bool WebSocketChannel::send(const String& message)
 {
     LOG(Network, "WebSocketChannel %p send %s", this, message.utf8().data());
@@ -174,7 +176,7 @@ bool WebSocketChannel::send(const ArrayBuffer& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send arraybuffer %p", this, &binaryData);
     ASSERT(!m_useHixie76Protocol);
-    enqueueRawFrame(OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
+    enqueueRawFrame(WebSocketFrame::OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
     return true;
 }
 
@@ -182,7 +184,7 @@ bool WebSocketChannel::send(const Blob& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send blob %s", this, binaryData.url().string().utf8().data());
     ASSERT(!m_useHixie76Protocol);
-    enqueueBlobFrame(OpCodeBinary, binaryData);
+    enqueueBlobFrame(WebSocketFrame::OpCodeBinary, binaryData);
     return true;
 }
 
@@ -190,7 +192,7 @@ bool WebSocketChannel::send(const char* data, int length)
 {
     LOG(Network, "WebSocketChannel %p send binary %p (%dB)", this, data, length);
     ASSERT(!m_useHixie76Protocol);
-    enqueueRawFrame(OpCodeBinary, data, length);
+    enqueueRawFrame(WebSocketFrame::OpCodeBinary, data, length);
     return true;
 }
 
@@ -217,8 +219,8 @@ void WebSocketChannel::fail(const String& reason)
 {
     LOG(Network, "WebSocketChannel %p fail: %s", this, reason.utf8().data());
     ASSERT(!m_suspended);
-    if (m_context)
-        m_context->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, reason, m_handshake->clientOrigin());
+    if (m_document)
+        m_document->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, reason, m_handshake->clientOrigin());
     if (!m_useHixie76Protocol) {
         // Hybi-10 specification explicitly states we must not continue to handle incoming data
         // once the WebSocket connection is failed (section 7.1.7).
@@ -236,12 +238,12 @@ void WebSocketChannel::fail(const String& reason)
 void WebSocketChannel::disconnect()
 {
     LOG(Network, "WebSocketChannel %p disconnect", this);
-    if (m_identifier && m_context)
-        InspectorInstrumentation::didCloseWebSocket(m_context, m_identifier);
+    if (m_identifier && m_document)
+        InspectorInstrumentation::didCloseWebSocket(m_document, m_identifier);
     if (m_handshake)
         m_handshake->clearScriptExecutionContext();
     m_client = 0;
-    m_context = 0;
+    m_document = 0;
     if (m_handle)
         m_handle->disconnect();
 }
@@ -262,10 +264,10 @@ void WebSocketChannel::didOpenSocketStream(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didOpenSocketStream", this);
     ASSERT(handle == m_handle);
-    if (!m_context)
+    if (!m_document)
         return;
     if (m_identifier)
-        InspectorInstrumentation::willSendWebSocketHandshakeRequest(m_context, m_identifier, m_handshake->clientHandshakeRequest());
+        InspectorInstrumentation::willSendWebSocketHandshakeRequest(m_document, m_identifier, m_handshake->clientHandshakeRequest());
     CString handshakeMessage = m_handshake->clientHandshakeMessage();
     if (!handle->send(handshakeMessage.data(), handshakeMessage.length()))
         fail("Failed to send WebSocket handshake.");
@@ -274,8 +276,8 @@ void WebSocketChannel::didOpenSocketStream(SocketStreamHandle* handle)
 void WebSocketChannel::didCloseSocketStream(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didCloseSocketStream", this);
-    if (m_identifier && m_context)
-        InspectorInstrumentation::didCloseWebSocket(m_context, m_identifier);
+    if (m_identifier && m_document)
+        InspectorInstrumentation::didCloseWebSocket(m_document, m_identifier);
     ASSERT_UNUSED(handle, handle == m_handle || !m_handle);
     m_closed = true;
     if (m_closingTimer.isActive())
@@ -288,7 +290,7 @@ void WebSocketChannel::didCloseSocketStream(SocketStreamHandle* handle)
             return;
         WebSocketChannelClient* client = m_client;
         m_client = 0;
-        m_context = 0;
+        m_document = 0;
         m_handle = 0;
         if (client)
             client->didClose(m_unhandledBufferedAmount, m_receivedClosingHandshake ? WebSocketChannelClient::ClosingHandshakeComplete : WebSocketChannelClient::ClosingHandshakeIncomplete, m_closeEventCode, m_closeEventReason);
@@ -301,7 +303,7 @@ void WebSocketChannel::didReceiveSocketStreamData(SocketStreamHandle* handle, co
     LOG(Network, "WebSocketChannel %p didReceiveSocketStreamData %d", this, len);
     RefPtr<WebSocketChannel> protect(this); // The client can close the channel, potentially removing the last reference.
     ASSERT(handle == m_handle);
-    if (!m_context) {
+    if (!m_document) {
         return;
     }
     if (len <= 0) {
@@ -335,7 +337,7 @@ void WebSocketChannel::didFailSocketStream(SocketStreamHandle* handle, const Soc
 {
     LOG(Network, "WebSocketChannel %p didFailSocketStream", this);
     ASSERT(handle == m_handle || !m_handle);
-    if (m_context) {
+    if (m_document) {
         String message;
         if (error.isNull())
             message = "WebSocket network error";
@@ -347,7 +349,7 @@ void WebSocketChannel::didFailSocketStream(SocketStreamHandle* handle, const Soc
         ASSERT(failingURL.isNull() || m_handshake->url().string() == failingURL);
         if (failingURL.isNull())
             failingURL = m_handshake->url().string();
-        m_context->addConsoleMessage(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message, failingURL);
+        m_document->addConsoleMessage(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message, failingURL);
     }
     m_shouldDiscardReceivedData = true;
     handle->disconnect();
@@ -453,14 +455,11 @@ bool WebSocketChannel::processBuffer()
             return false;
         if (m_handshake->mode() == WebSocketHandshake::Connected) {
             if (m_identifier)
-                InspectorInstrumentation::didReceiveWebSocketHandshakeResponse(m_context, m_identifier, m_handshake->serverHandshakeResponse());
+                InspectorInstrumentation::didReceiveWebSocketHandshakeResponse(m_document, m_identifier, m_handshake->serverHandshakeResponse());
             if (!m_handshake->serverSetCookie().isEmpty()) {
-                if (m_context->isDocument()) {
-                    Document* document = static_cast<Document*>(m_context);
-                    if (cookiesEnabled(document)) {
-                        ExceptionCode ec; // Exception (for sandboxed documents) ignored.
-                        document->setCookie(m_handshake->serverSetCookie(), ec);
-                    }
+                if (cookiesEnabled(m_document)) {
+                    ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+                    m_document->setCookie(m_handshake->serverSetCookie(), ec);
                 }
             }
             // FIXME: handle set-cookie2.
@@ -521,7 +520,7 @@ void WebSocketChannel::startClosingHandshake(int code, const String& reason)
             buf.append(static_cast<char>(lowByte));
             buf.append(reason.utf8().data(), reason.utf8().length());
         }
-        enqueueRawFrame(OpCodeClose, buf.data(), buf.size());
+        enqueueRawFrame(WebSocketFrame::OpCodeClose, buf.data(), buf.size());
     }
     m_closing = true;
     if (m_client)
@@ -536,7 +535,7 @@ void WebSocketChannel::closingTimerFired(Timer<WebSocketChannel>* timer)
         m_handle->disconnect();
 }
 
-WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(FrameData& frame)
+WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(WebSocketFrame& frame, const char*& frameEnd)
 {
     const char* p = m_buffer;
     const char* bufferEnd = m_buffer + m_bufferSize;
@@ -548,10 +547,10 @@ WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(FrameData& frame
     unsigned char secondByte = *p++;
 
     bool final = firstByte & finalBit;
-    bool reserved1 = firstByte & reserved1Bit;
+    bool compress = firstByte & compressBit;
     bool reserved2 = firstByte & reserved2Bit;
     bool reserved3 = firstByte & reserved3Bit;
-    OpCode opCode = firstByte & opCodeMask;
+    unsigned char opCode = firstByte & opCodeMask;
 
     bool masked = secondByte & maskBit;
     uint64_t payloadLength64 = secondByte & payloadLengthMask;
@@ -595,15 +594,15 @@ WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(FrameData& frame
             payload[i] ^= maskingKey[i % maskingKeyWidthInBytes]; // Unmask the payload.
     }
 
-    frame.opCode = opCode;
+    frame.opCode = static_cast<WebSocketFrame::OpCode>(opCode);
     frame.final = final;
-    frame.reserved1 = reserved1;
+    frame.compress = compress;
     frame.reserved2 = reserved2;
     frame.reserved3 = reserved3;
     frame.masked = masked;
     frame.payload = p + maskingKeyLength;
     frame.payloadLength = payloadLength;
-    frame.frameEnd = p + maskingKeyLength + payloadLength;
+    frameEnd = p + maskingKeyLength + payloadLength;
     return FrameOK;
 }
 
@@ -611,50 +610,54 @@ bool WebSocketChannel::processFrame()
 {
     ASSERT(m_buffer);
 
-    FrameData frame;
-    if (parseFrame(frame) != FrameOK)
+    WebSocketFrame frame;
+    const char* frameEnd;
+    if (parseFrame(frame, frameEnd) != FrameOK)
         return false;
 
+    ASSERT(m_buffer < frameEnd);
+    ASSERT(frameEnd <= m_buffer + m_bufferSize);
+
     // Validate the frame data.
-    if (isReservedOpCode(frame.opCode)) {
+    if (WebSocketFrame::isReservedOpCode(frame.opCode)) {
         fail("Unrecognized frame opcode: " + String::number(frame.opCode));
         return false;
     }
 
-    if (frame.reserved1 || frame.reserved2 || frame.reserved3) {
-        fail("One or more reserved bits are on: reserved1 = " + String::number(frame.reserved1) + ", reserved2 = " + String::number(frame.reserved2) + ", reserved3 = " + String::number(frame.reserved3));
+    if (frame.reserved2 || frame.reserved3) {
+        fail("One or more reserved bits are on: reserved2 = " + String::number(frame.reserved2) + ", reserved3 = " + String::number(frame.reserved3));
         return false;
     }
 
     // All control frames must not be fragmented.
-    if (isControlOpCode(frame.opCode) && !frame.final) {
+    if (WebSocketFrame::isControlOpCode(frame.opCode) && !frame.final) {
         fail("Received fragmented control frame: opcode = " + String::number(frame.opCode));
         return false;
     }
 
     // All control frames must have a payload of 125 bytes or less, which means the frame must not contain
     // the "extended payload length" field.
-    if (isControlOpCode(frame.opCode) && frame.payloadLength > maxPayloadLengthWithoutExtendedLengthField) {
+    if (WebSocketFrame::isControlOpCode(frame.opCode) && frame.payloadLength > maxPayloadLengthWithoutExtendedLengthField) {
         fail("Received control frame having too long payload: " + String::number(frame.payloadLength) + " bytes");
         return false;
     }
 
     // A new data frame is received before the previous continuous frame finishes.
     // Note that control frames are allowed to come in the middle of continuous frames.
-    if (m_hasContinuousFrame && frame.opCode != OpCodeContinuation && !isControlOpCode(frame.opCode)) {
+    if (m_hasContinuousFrame && frame.opCode != WebSocketFrame::OpCodeContinuation && !WebSocketFrame::isControlOpCode(frame.opCode)) {
         fail("Received new data frame but previous continuous frame is unfinished.");
         return false;
     }
 
     switch (frame.opCode) {
-    case OpCodeContinuation:
+    case WebSocketFrame::OpCodeContinuation:
         // An unexpected continuation frame is received without any leading frame.
         if (!m_hasContinuousFrame) {
             fail("Received unexpected continuation frame.");
             return false;
         }
         m_continuousFrameData.append(frame.payload, frame.payloadLength);
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         if (frame.final) {
             // onmessage handler may eventually call the other methods of this channel,
             // so we should pretend that we have finished to read this frame and
@@ -664,7 +667,7 @@ bool WebSocketChannel::processFrame()
             OwnPtr<Vector<char> > continuousFrameData = adoptPtr(new Vector<char>);
             m_continuousFrameData.swap(*continuousFrameData);
             m_hasContinuousFrame = false;
-            if (m_continuousFrameOpCode == OpCodeText) {
+            if (m_continuousFrameOpCode == WebSocketFrame::OpCodeText) {
                 String message;
                 if (continuousFrameData->size())
                     message = String::fromUTF8(continuousFrameData->data(), continuousFrameData->size());
@@ -674,48 +677,48 @@ bool WebSocketChannel::processFrame()
                     fail("Could not decode a text frame as UTF-8.");
                 else
                     m_client->didReceiveMessage(message);
-            } else if (m_continuousFrameOpCode == OpCodeBinary)
+            } else if (m_continuousFrameOpCode == WebSocketFrame::OpCodeBinary)
                 m_client->didReceiveBinaryData(continuousFrameData.release());
         }
         break;
 
-    case OpCodeText:
+    case WebSocketFrame::OpCodeText:
         if (frame.final) {
             String message;
             if (frame.payloadLength)
                 message = String::fromUTF8(frame.payload, frame.payloadLength);
             else
                 message = "";
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
             if (message.isNull())
                 fail("Could not decode a text frame as UTF-8.");
             else
                 m_client->didReceiveMessage(message);
         } else {
             m_hasContinuousFrame = true;
-            m_continuousFrameOpCode = OpCodeText;
+            m_continuousFrameOpCode = WebSocketFrame::OpCodeText;
             ASSERT(m_continuousFrameData.isEmpty());
             m_continuousFrameData.append(frame.payload, frame.payloadLength);
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
         }
         break;
 
-    case OpCodeBinary:
+    case WebSocketFrame::OpCodeBinary:
         if (frame.final) {
             OwnPtr<Vector<char> > binaryData = adoptPtr(new Vector<char>(frame.payloadLength));
             memcpy(binaryData->data(), frame.payload, frame.payloadLength);
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
             m_client->didReceiveBinaryData(binaryData.release());
         } else {
             m_hasContinuousFrame = true;
-            m_continuousFrameOpCode = OpCodeBinary;
+            m_continuousFrameOpCode = WebSocketFrame::OpCodeBinary;
             ASSERT(m_continuousFrameData.isEmpty());
             m_continuousFrameData.append(frame.payload, frame.payloadLength);
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
         }
         break;
 
-    case OpCodeClose:
+    case WebSocketFrame::OpCodeClose:
         if (frame.payloadLength >= 2) {
             unsigned char highByte = static_cast<unsigned char>(frame.payload[0]);
             unsigned char lowByte = static_cast<unsigned char>(frame.payload[1]);
@@ -726,7 +729,7 @@ bool WebSocketChannel::processFrame()
             m_closeEventReason = String::fromUTF8(&frame.payload[2], frame.payloadLength - 2);
         else
             m_closeEventReason = "";
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         m_receivedClosingHandshake = true;
         startClosingHandshake(m_closeEventCode, m_closeEventReason);
         if (m_closing) {
@@ -735,20 +738,20 @@ bool WebSocketChannel::processFrame()
         }
         break;
 
-    case OpCodePing:
-        enqueueRawFrame(OpCodePong, frame.payload, frame.payloadLength);
-        skipBuffer(frame.frameEnd - m_buffer);
+    case WebSocketFrame::OpCodePing:
+        enqueueRawFrame(WebSocketFrame::OpCodePong, frame.payload, frame.payloadLength);
+        skipBuffer(frameEnd - m_buffer);
         break;
 
-    case OpCodePong:
+    case WebSocketFrame::OpCodePong:
         // A server may send a pong in response to our ping, or an unsolicited pong which is not associated with
         // any specific ping. Either way, there's nothing to do on receipt of pong.
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         break;
 
     default:
         ASSERT_NOT_REACHED();
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         break;
     }
 
@@ -849,14 +852,14 @@ void WebSocketChannel::enqueueTextFrame(const String& string)
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
     OwnPtr<QueuedFrame> frame = adoptPtr(new QueuedFrame);
-    frame->opCode = OpCodeText;
+    frame->opCode = WebSocketFrame::OpCodeText;
     frame->frameType = QueuedFrameTypeString;
     frame->stringData = string;
     m_outgoingFrameQueue.append(frame.release());
     processOutgoingFrameQueue();
 }
 
-void WebSocketChannel::enqueueRawFrame(OpCode opCode, const char* data, size_t dataLength)
+void WebSocketChannel::enqueueRawFrame(WebSocketFrame::OpCode opCode, const char* data, size_t dataLength)
 {
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
@@ -870,7 +873,7 @@ void WebSocketChannel::enqueueRawFrame(OpCode opCode, const char* data, size_t d
     processOutgoingFrameQueue();
 }
 
-void WebSocketChannel::enqueueBlobFrame(OpCode opCode, const Blob& blob)
+void WebSocketChannel::enqueueBlobFrame(WebSocketFrame::OpCode opCode, const Blob& blob)
 {
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
@@ -911,7 +914,7 @@ void WebSocketChannel::processOutgoingFrameQueue()
                 ASSERT(!m_blobLoader);
                 m_blobLoader = adoptPtr(new FileReaderLoader(FileReaderLoader::ReadAsArrayBuffer, this));
                 m_blobLoaderStatus = BlobLoaderStarted;
-                m_blobLoader->start(m_context, frame->blobData.get());
+                m_blobLoader->start(m_document, frame->blobData.get());
                 m_outgoingFrameQueue.prepend(frame.release());
                 return;
 
@@ -961,44 +964,57 @@ void WebSocketChannel::abortOutgoingFrameQueue()
 #endif
 }
 
-bool WebSocketChannel::sendFrame(OpCode opCode, const char* data, size_t dataLength)
+static void appendMaskedFramePayload(const WebSocketFrame& frame, Vector<char>& frameData)
 {
-    ASSERT(m_handle);
-    ASSERT(!m_suspended);
+    size_t maskingKeyStart = frameData.size();
+    frameData.grow(frameData.size() + maskingKeyWidthInBytes); // Add placeholder for masking key. Will be overwritten.
+    size_t payloadStart = frameData.size();
+    frameData.append(frame.payload, frame.payloadLength);
+
+    cryptographicallyRandomValues(frameData.data() + maskingKeyStart, maskingKeyWidthInBytes);
+    for (size_t i = 0; i < frame.payloadLength; ++i)
+        frameData[payloadStart + i] ^= frameData[maskingKeyStart + i % maskingKeyWidthInBytes];
+}
 
-    Vector<char> frame;
-    ASSERT(!(opCode & ~opCodeMask)); // Checks whether "opCode" fits in the range of opCodes.
-    frame.append(finalBit | opCode);
-    if (dataLength <= maxPayloadLengthWithoutExtendedLengthField)
-        frame.append(maskBit | dataLength);
-    else if (dataLength <= 0xFFFF) {
-        frame.append(maskBit | payloadLengthWithTwoByteExtendedLengthField);
-        frame.append((dataLength & 0xFF00) >> 8);
-        frame.append(dataLength & 0xFF);
+static void makeFrameData(const WebSocketFrame& frame, Vector<char>& frameData)
+{
+    unsigned char firstByte = (frame.final ? finalBit : 0) | frame.opCode;
+    if (frame.compress)
+        firstByte |= compressBit;
+    frameData.append(firstByte);
+    if (frame.payloadLength <= maxPayloadLengthWithoutExtendedLengthField)
+        frameData.append(maskBit | frame.payloadLength);
+    else if (frame.payloadLength <= 0xFFFF) {
+        frameData.append(maskBit | payloadLengthWithTwoByteExtendedLengthField);
+        frameData.append((frame.payloadLength & 0xFF00) >> 8);
+        frameData.append(frame.payloadLength & 0xFF);
     } else {
-        frame.append(maskBit | payloadLengthWithEightByteExtendedLengthField);
+        frameData.append(maskBit | payloadLengthWithEightByteExtendedLengthField);
         char extendedPayloadLength[8];
-        size_t remaining = dataLength;
+        size_t remaining = frame.payloadLength;
         // Fill the length into extendedPayloadLength in the network byte order.
         for (int i = 0; i < 8; ++i) {
             extendedPayloadLength[7 - i] = remaining & 0xFF;
             remaining >>= 8;
         }
         ASSERT(!remaining);
-        frame.append(extendedPayloadLength, 8);
+        frameData.append(extendedPayloadLength, 8);
     }
 
-    // Mask the frame.
-    size_t maskingKeyStart = frame.size();
-    frame.grow(frame.size() + maskingKeyWidthInBytes); // Add placeholder for masking key. Will be overwritten.
-    size_t payloadStart = frame.size();
-    frame.append(data, dataLength);
+    appendMaskedFramePayload(frame, frameData);
+}
 
-    cryptographicallyRandomValues(frame.data() + maskingKeyStart, maskingKeyWidthInBytes);
-    for (size_t i = 0; i < dataLength; ++i)
-        frame[payloadStart + i] ^= frame[maskingKeyStart + i % maskingKeyWidthInBytes];
+bool WebSocketChannel::sendFrame(WebSocketFrame::OpCode opCode, const char* data, size_t dataLength)
+{
+    ASSERT(m_handle);
+    ASSERT(!m_suspended);
 
-    return m_handle->send(frame.data(), frame.size());
+    ASSERT(!(opCode & ~opCodeMask)); // Checks whether "opCode" fits in the range of opCodes.
+    WebSocketFrame frame(opCode, true, false, true, data, dataLength);
+    Vector<char> frameData;
+    makeFrameData(frame, frameData);
+
+    return m_handle->send(frameData.data(), frameData.size());
 }
 
 bool WebSocketChannel::sendFrameHixie76(const char* data, size_t dataLength)
diff --git a/Source/WebCore/websockets/WebSocketChannel.h b/Source/WebCore/websockets/WebSocketChannel.h
index 9f9bab8b1..4bb28c9f2 100644
--- a/Source/WebCore/websockets/WebSocketChannel.h
+++ b/Source/WebCore/websockets/WebSocketChannel.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -37,6 +37,7 @@
 #include "SocketStreamHandleClient.h"
 #include "ThreadableWebSocketChannel.h"
 #include "Timer.h"
+#include "WebSocketFrame.h"
 #include "WebSocketHandshake.h"
 #include <wtf/Deque.h>
 #include <wtf/Forward.h>
@@ -46,8 +47,8 @@
 namespace WebCore {
 
 class Blob;
+class Document;
 class FileReaderLoader;
-class ScriptExecutionContext;
 class SocketStreamHandle;
 class SocketStreamError;
 class WebSocketChannelClient;
@@ -59,7 +60,7 @@ class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStrea
 {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client) { return adoptRef(new WebSocketChannel(context, client)); }
+    static PassRefPtr<WebSocketChannel> create(Document* document, WebSocketChannelClient* client) { return adoptRef(new WebSocketChannel(document, client)); }
     virtual ~WebSocketChannel();
 
     bool send(const char* data, int length);
@@ -68,6 +69,7 @@ public:
     virtual bool useHixie76Protocol() OVERRIDE;
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
+    virtual String extensions() OVERRIDE;
     virtual bool send(const String& message) OVERRIDE;
     virtual bool send(const ArrayBuffer&) OVERRIDE;
     virtual bool send(const Blob&) OVERRIDE;
@@ -118,7 +120,7 @@ protected:
     virtual void derefThreadableWebSocketChannel() { deref(); }
 
 private:
-    WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*);
+    WebSocketChannel(Document*, WebSocketChannelClient*);
 
     bool appendToBuffer(const char* data, size_t len);
     void skipBuffer(size_t len);
@@ -127,38 +129,13 @@ private:
     void startClosingHandshake(int code, const String& reason);
     void closingTimerFired(Timer<WebSocketChannel>*);
 
-    // Hybi-10 opcodes.
-    typedef unsigned int OpCode;
-    static const OpCode OpCodeContinuation;
-    static const OpCode OpCodeText;
-    static const OpCode OpCodeBinary;
-    static const OpCode OpCodeClose;
-    static const OpCode OpCodePing;
-    static const OpCode OpCodePong;
-
-    static bool isNonControlOpCode(OpCode opCode) { return opCode == OpCodeContinuation || opCode == OpCodeText || opCode == OpCodeBinary; }
-    static bool isControlOpCode(OpCode opCode) { return opCode == OpCodeClose || opCode == OpCodePing || opCode == OpCodePong; }
-    static bool isReservedOpCode(OpCode opCode) { return !isNonControlOpCode(opCode) && !isControlOpCode(opCode); }
-
     enum ParseFrameResult {
         FrameOK,
         FrameIncomplete,
         FrameError
     };
 
-    struct FrameData {
-        OpCode opCode;
-        bool final;
-        bool reserved1;
-        bool reserved2;
-        bool reserved3;
-        bool masked;
-        const char* payload;
-        size_t payloadLength;
-        const char* frameEnd;
-    };
-
-    ParseFrameResult parseFrame(FrameData&); // May modify part of m_buffer to unmask the frame.
+    ParseFrameResult parseFrame(WebSocketFrame&, const char*& frameEnd); // May modify part of m_buffer to unmask the frame.
 
     bool processFrame();
     bool processFrameHixie76();
@@ -179,7 +156,7 @@ private:
         QueuedFrameTypeBlob
     };
     struct QueuedFrame {
-        OpCode opCode;
+        WebSocketFrame::OpCode opCode;
         QueuedFrameType frameType;
         // Only one of the following items is used, according to the value of frameType.
         String stringData;
@@ -187,8 +164,8 @@ private:
         RefPtr<Blob> blobData;
     };
     void enqueueTextFrame(const String&);
-    void enqueueRawFrame(OpCode, const char* data, size_t dataLength);
-    void enqueueBlobFrame(OpCode, const Blob&);
+    void enqueueRawFrame(WebSocketFrame::OpCode, const char* data, size_t dataLength);
+    void enqueueBlobFrame(WebSocketFrame::OpCode, const Blob&);
 
     void processOutgoingFrameQueue();
     void abortOutgoingFrameQueue();
@@ -207,7 +184,7 @@ private:
 
     // If you are going to send a hybi-10 frame, you need to use the outgoing frame queue
     // instead of call sendFrame() directly.
-    bool sendFrame(OpCode, const char* data, size_t dataLength);
+    bool sendFrame(WebSocketFrame::OpCode, const char* data, size_t dataLength);
     bool sendFrameHixie76(const char* data, size_t dataLength);
 
 #if ENABLE(BLOB)
@@ -219,7 +196,7 @@ private:
     };
 #endif
 
-    ScriptExecutionContext* m_context;
+    Document* m_document;
     WebSocketChannelClient* m_client;
     OwnPtr<WebSocketHandshake> m_handshake;
     RefPtr<SocketStreamHandle> m_handle;
@@ -241,7 +218,7 @@ private:
 
     // Private members only for hybi-10 protocol.
     bool m_hasContinuousFrame;
-    OpCode m_continuousFrameOpCode;
+    WebSocketFrame::OpCode m_continuousFrameOpCode;
     Vector<char> m_continuousFrameData;
     unsigned short m_closeEventCode;
     String m_closeEventReason;
diff --git a/Source/WebCore/websockets/WebSocketDeflater.cpp b/Source/WebCore/websockets/WebSocketDeflater.cpp
new file mode 100644
index 000000000..47ea94055
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketDeflater.cpp
@@ -0,0 +1,212 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketDeflater.h"
+
+#include "Logging.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/StringExtras.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+#include <zlib.h>
+
+namespace WebCore {
+
+static const int defaultMemLevel = 1;
+static const size_t bufferIncrementUnit = 4096;
+
+PassOwnPtr<WebSocketDeflater> WebSocketDeflater::create(int windowBits, ContextTakeOverMode contextTakeOverMode)
+{
+    return adoptPtr(new WebSocketDeflater(windowBits, contextTakeOverMode));
+}
+
+WebSocketDeflater::WebSocketDeflater(int windowBits, ContextTakeOverMode contextTakeOverMode)
+    : m_windowBits(windowBits)
+    , m_contextTakeOverMode(contextTakeOverMode)
+{
+    ASSERT(m_windowBits >= 8);
+    ASSERT(m_windowBits <= 15);
+    m_stream = adoptPtr(new z_stream);
+    memset(m_stream.get(), 0, sizeof(z_stream));
+}
+
+bool WebSocketDeflater::initialize()
+{
+    return deflateInit2(m_stream.get(), Z_DEFAULT_COMPRESSION, Z_DEFLATED, -m_windowBits, defaultMemLevel, Z_DEFAULT_STRATEGY) == Z_OK;
+}
+
+WebSocketDeflater::~WebSocketDeflater()
+{
+    int result = deflateEnd(m_stream.get());
+    if (result != Z_OK)
+        LOG(Network, "deflateEnd() failed: %d", result);
+}
+
+static void setStreamParameter(z_stream* stream, const char* inputData, size_t inputLength, char* outputData, size_t outputLength)
+{
+    stream->next_in = reinterpret_cast<Bytef*>(const_cast<char*>(inputData));
+    stream->avail_in = inputLength;
+    stream->next_out = reinterpret_cast<Bytef*>(outputData);
+    stream->avail_out = outputLength;
+}
+
+bool WebSocketDeflater::addBytes(const char* data, size_t length)
+{
+    if (!length)
+        return false;
+
+    size_t maxLength = deflateBound(m_stream.get(), length);
+    size_t writePosition = m_buffer.size();
+    m_buffer.grow(writePosition + maxLength);
+    setStreamParameter(m_stream.get(), data, length, m_buffer.data() + writePosition, maxLength);
+    int result = deflate(m_stream.get(), Z_NO_FLUSH);
+    if (result != Z_OK || m_stream->avail_in > 0)
+        return false;
+
+    m_buffer.shrink(writePosition + maxLength - m_stream->avail_out);
+    return true;
+}
+
+bool WebSocketDeflater::finish()
+{
+    while (true) {
+        size_t writePosition = m_buffer.size();
+        m_buffer.grow(writePosition + bufferIncrementUnit);
+        size_t availableCapacity = m_buffer.size() - writePosition;
+        setStreamParameter(m_stream.get(), 0, 0, m_buffer.data() + writePosition, availableCapacity);
+        int result = deflate(m_stream.get(), Z_SYNC_FLUSH);
+        m_buffer.shrink(writePosition + availableCapacity - m_stream->avail_out);
+        if (result == Z_OK)
+            break;
+        if (result != Z_BUF_ERROR)
+            return false;
+    }
+    // Remove 4 octets from the tail as the specification requires.
+    if (m_buffer.size() <= 4)
+        return false;
+    m_buffer.resize(m_buffer.size() - 4);
+    return true;
+}
+
+void WebSocketDeflater::reset()
+{
+    m_buffer.clear();
+    if (m_contextTakeOverMode == DoNotTakeOverContext)
+        deflateReset(m_stream.get());
+}
+
+PassOwnPtr<WebSocketInflater> WebSocketInflater::create(int windowBits)
+{
+    return adoptPtr(new WebSocketInflater(windowBits));
+}
+
+WebSocketInflater::WebSocketInflater(int windowBits)
+    : m_windowBits(windowBits)
+{
+    m_stream = adoptPtr(new z_stream);
+    memset(m_stream.get(), 0, sizeof(z_stream));
+}
+
+bool WebSocketInflater::initialize()
+{
+    return inflateInit2(m_stream.get(), -m_windowBits) == Z_OK;
+}
+
+WebSocketInflater::~WebSocketInflater()
+{
+    int result = inflateEnd(m_stream.get());
+    if (result != Z_OK)
+        LOG(Network, "inflateEnd() failed: %d", result);
+}
+
+bool WebSocketInflater::addBytes(const char* data, size_t length)
+{
+    if (!length)
+        return false;
+
+    size_t consumedSoFar = 0;
+    while (consumedSoFar < length) {
+        size_t writePosition = m_buffer.size();
+        m_buffer.grow(writePosition + bufferIncrementUnit);
+        size_t availableCapacity = m_buffer.size() - writePosition;
+        size_t remainingLength = length - consumedSoFar;
+        setStreamParameter(m_stream.get(), data + consumedSoFar, remainingLength, m_buffer.data() + writePosition, availableCapacity);
+        int result = inflate(m_stream.get(), Z_NO_FLUSH);
+        consumedSoFar += remainingLength - m_stream->avail_in;
+        m_buffer.shrink(writePosition + availableCapacity - m_stream->avail_out);
+        if (result == Z_BUF_ERROR)
+            continue;
+        if (result != Z_OK)
+            return false;
+    }
+    ASSERT(consumedSoFar == length);
+    return true;
+}
+
+bool WebSocketInflater::finish()
+{
+    static const char* strippedFields = "\0\0\xff\xff";
+    static const size_t strippedLength = 4;
+
+    // Appends 4 octests of 0x00 0x00 0xff 0xff
+    size_t consumedSoFar = 0;
+    while (consumedSoFar < strippedLength) {
+        size_t writePosition = m_buffer.size();
+        m_buffer.grow(writePosition + bufferIncrementUnit);
+        size_t availableCapacity = m_buffer.size() - writePosition;
+        size_t remainingLength = strippedLength - consumedSoFar;
+        setStreamParameter(m_stream.get(), strippedFields + consumedSoFar, remainingLength, m_buffer.data() + writePosition, availableCapacity);
+        int result = inflate(m_stream.get(), Z_FINISH);
+        consumedSoFar += remainingLength - m_stream->avail_in;
+        m_buffer.shrink(writePosition + availableCapacity - m_stream->avail_out);
+        if (result == Z_BUF_ERROR)
+            continue;
+        if (result != Z_OK && result != Z_STREAM_END)
+            return false;
+    }
+    ASSERT(consumedSoFar == strippedLength);
+
+    return true;
+}
+
+void WebSocketInflater::reset()
+{
+    m_buffer.clear();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/websockets/WebSocketDeflater.h b/Source/WebCore/websockets/WebSocketDeflater.h
new file mode 100644
index 000000000..9c630dcfb
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketDeflater.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketDeflater_h
+#define WebSocketDeflater_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+struct z_stream_s;
+typedef z_stream_s z_stream;
+
+namespace WebCore {
+
+class WebSocketDeflater {
+public:
+    enum ContextTakeOverMode {
+        DoNotTakeOverContext,
+        TakeOverContext
+    };
+    static PassOwnPtr<WebSocketDeflater> create(int windowBits, ContextTakeOverMode = TakeOverContext);
+
+    ~WebSocketDeflater();
+
+    bool initialize();
+    bool addBytes(const char*, size_t);
+    bool finish();
+    const char* data() { return m_buffer.data(); }
+    size_t size() const { return m_buffer.size(); }
+    void reset();
+
+private:
+    WebSocketDeflater(int windowBits, ContextTakeOverMode);
+
+    int m_windowBits;
+    ContextTakeOverMode m_contextTakeOverMode;
+    Vector<char> m_buffer;
+    OwnPtr<z_stream> m_stream;
+};
+
+class WebSocketInflater {
+public:
+    static PassOwnPtr<WebSocketInflater> create(int windowBits = 15);
+
+    ~WebSocketInflater();
+
+    bool initialize();
+    bool addBytes(const char*, size_t);
+    bool finish();
+    const char* data() { return m_buffer.data(); }
+    size_t size() const { return m_buffer.size(); }
+    void reset();
+
+private:
+    explicit WebSocketInflater(int windowBits);
+
+    int m_windowBits;
+    Vector<char> m_buffer;
+    OwnPtr<z_stream> m_stream;
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketDeflater_h
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp b/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp
new file mode 100644
index 000000000..7c592ad1b
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp
@@ -0,0 +1,278 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketExtensionDispatcher.h"
+
+#include <wtf/ASCIICType.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class ExtensionParser {
+public:
+    ExtensionParser(const char* start, const char* end)
+        : m_current(start)
+        , m_end(end)
+    {
+    }
+    bool finished();
+    bool parsedSuccessfully();
+    const String& currentToken() { return m_currentToken; }
+
+    // The following member functions basically follow the grammer defined
+    // in Section 2.2 of RFC 2616.
+    bool consumeToken();
+    bool consumeQuotedString();
+    bool consumeQuotedStringOrToken();
+    bool consumeCharacter(char);
+
+private:
+    void skipSpaces();
+
+    const char* m_current;
+    const char* m_end;
+    String m_currentToken;
+};
+
+bool ExtensionParser::finished()
+{
+    return m_current >= m_end;
+}
+
+bool ExtensionParser::parsedSuccessfully()
+{
+    return m_current == m_end;
+}
+
+static bool isSeparator(char character)
+{
+    static const char* separatorCharacters = "()<>@,;:\\\"/[]?={} \t";
+    const char* p = strchr(separatorCharacters, character);
+    return p && *p;
+}
+
+void ExtensionParser::skipSpaces()
+{
+    while (m_current < m_end && (*m_current == ' ' || *m_current == '\t'))
+        ++m_current;
+}
+
+bool ExtensionParser::consumeToken()
+{
+    skipSpaces();
+    const char* start = m_current;
+    while (m_current < m_end && isASCIIPrintable(*m_current) && !isSeparator(*m_current))
+        ++m_current;
+    if (start < m_current) {
+        m_currentToken = String(start, m_current - start);
+        return true;
+    }
+    return false;
+}
+
+bool ExtensionParser::consumeQuotedString()
+{
+    skipSpaces();
+    if (m_current >= m_end || *m_current != '"')
+        return false;
+
+    Vector<char> buffer;
+    ++m_current;
+    while (m_current < m_end && *m_current != '"') {
+        if (*m_current == '\\' && ++m_current >= m_end)
+            return false;
+        buffer.append(*m_current);
+        ++m_current;
+    }
+    if (m_current >= m_end || *m_current != '"')
+        return false;
+    m_currentToken = String::fromUTF8(buffer.data(), buffer.size());
+    ++m_current;
+    return true;
+}
+
+bool ExtensionParser::consumeQuotedStringOrToken()
+{
+    // This is ok because consumeQuotedString() doesn't update m_current or
+    // makes it same as m_end on failure.
+    return consumeQuotedString() || consumeToken();
+}
+
+bool ExtensionParser::consumeCharacter(char character)
+{
+    skipSpaces();
+    if (m_current < m_end && *m_current == character) {
+        ++m_current;
+        return true;
+    }
+    return false;
+}
+
+void WebSocketExtensionDispatcher::reset()
+{
+    m_processors.clear();
+}
+
+void WebSocketExtensionDispatcher::addProcessor(PassOwnPtr<WebSocketExtensionProcessor> processor)
+{
+    for (size_t i = 0; i < m_processors.size(); ++i) {
+        if (m_processors[i]->extensionToken() == processor->extensionToken())
+            return;
+    }
+    ASSERT(processor->handshakeString().length());
+    ASSERT(!processor->handshakeString().contains('\n'));
+    ASSERT(!processor->handshakeString().contains(static_cast<UChar>('\0')));
+    m_processors.append(processor);
+}
+
+const String WebSocketExtensionDispatcher::createHeaderValue() const
+{
+    size_t numProcessors = m_processors.size();
+    if (!numProcessors)
+        return String();
+
+    StringBuilder builder;
+    builder.append(m_processors[0]->handshakeString());
+    for (size_t i = 1; i < numProcessors; ++i) {
+        builder.append(", ");
+        builder.append(m_processors[i]->handshakeString());
+    }
+    return builder.toString();
+}
+
+void WebSocketExtensionDispatcher::appendAcceptedExtension(const String& extensionToken, HashMap<String, String>& extensionParameters)
+{
+    if (!m_acceptedExtensionsBuilder.isEmpty())
+        m_acceptedExtensionsBuilder.append(", ");
+    m_acceptedExtensionsBuilder.append(extensionToken);
+    // FIXME: Should use ListHashSet to keep the order of the parameters.
+    for (HashMap<String, String>::const_iterator iterator = extensionParameters.begin(); iterator != extensionParameters.end(); ++iterator) {
+        m_acceptedExtensionsBuilder.append("; ");
+        m_acceptedExtensionsBuilder.append(iterator->first);
+        if (!iterator->second.isNull()) {
+            m_acceptedExtensionsBuilder.append("=");
+            m_acceptedExtensionsBuilder.append(iterator->second);
+        }
+    }
+}
+
+void WebSocketExtensionDispatcher::fail(const String& reason)
+{
+    m_failureReason = reason;
+    m_acceptedExtensionsBuilder.clear();
+}
+
+bool WebSocketExtensionDispatcher::processHeaderValue(const String& headerValue)
+{
+    if (!headerValue.length())
+        return true;
+
+    // If we don't send Sec-WebSocket-Extensions header, the server should not return the header.
+    if (!m_processors.size()) {
+        fail("Received unexpected Sec-WebSocket-Extensions header");
+        return false;
+    }
+
+    const CString headerValueData = headerValue.utf8();
+    ExtensionParser parser(headerValueData.data(), headerValueData.data() + headerValueData.length());
+    while (!parser.finished()) {
+        // Parse extension-token.
+        if (!parser.consumeToken()) {
+            fail("Sec-WebSocket-Extensions header is invalid");
+            return false;
+        }
+        String extensionToken = parser.currentToken();
+
+        // Parse extension-parameters if exists.
+        HashMap<String, String> extensionParameters;
+        while (parser.consumeCharacter(';')) {
+            if (!parser.consumeToken()) {
+                fail("Sec-WebSocket-Extensions header is invalid");
+                return false;
+            }
+
+            String parameterToken = parser.currentToken();
+            if (parser.consumeCharacter('=')) {
+                if (parser.consumeQuotedStringOrToken())
+                    extensionParameters.add(parameterToken, parser.currentToken());
+                else {
+                    fail("Sec-WebSocket-Extensions header is invalid");
+                    return false;
+                }
+            } else
+                extensionParameters.add(parameterToken, String());
+        }
+        if (!parser.finished() && !parser.consumeCharacter(',')) {
+            fail("Sec-WebSocket-Extensions header is invalid");
+            return false;
+        }
+
+        size_t index;
+        for (index = 0; index < m_processors.size(); ++index) {
+            WebSocketExtensionProcessor* processor = m_processors[index].get();
+            if (extensionToken == processor->extensionToken()) {
+                if (processor->processResponse(extensionParameters)) {
+                    appendAcceptedExtension(extensionToken, extensionParameters);
+                    break;
+                }
+                fail(processor->failureReason());
+                return false;
+            }
+        }
+        // There is no extension which can process the response.
+        if (index == m_processors.size()) {
+            fail("Received unexpected extension: " + extensionToken);
+            return false;
+        }
+    }
+    return parser.parsedSuccessfully();
+}
+
+String WebSocketExtensionDispatcher::acceptedExtensions() const
+{
+    if (m_acceptedExtensionsBuilder.isEmpty())
+        return String();
+    return m_acceptedExtensionsBuilder.toStringPreserveCapacity();
+}
+
+String WebSocketExtensionDispatcher::failureReason() const
+{
+    return m_failureReason;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.h b/Source/WebCore/websockets/WebSocketExtensionDispatcher.h
new file mode 100644
index 000000000..35cd769ea
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketExtensionDispatcher.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketExtensionDispatcher_h
+#define WebSocketExtensionDispatcher_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketExtensionProcessor.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class WebSocketExtensionDispatcher {
+public:
+    WebSocketExtensionDispatcher() { }
+
+    void reset();
+    void addProcessor(PassOwnPtr<WebSocketExtensionProcessor>);
+    const String createHeaderValue() const;
+
+    bool processHeaderValue(const String&);
+    String acceptedExtensions() const;
+    String failureReason() const;
+
+private:
+    void appendAcceptedExtension(const String& extensionToken, HashMap<String, String>& extensionParameters);
+    void fail(const String& reason);
+
+    Vector<OwnPtr<WebSocketExtensionProcessor> > m_processors;
+    StringBuilder m_acceptedExtensionsBuilder;
+    String m_failureReason;
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketExtensionDispatcher_h
diff --git a/Source/WebCore/websockets/WebSocketExtensionProcessor.h b/Source/WebCore/websockets/WebSocketExtensionProcessor.h
new file mode 100644
index 000000000..ee3d53d41
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketExtensionProcessor.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketExtensionProcessor_h
+#define WebSocketExtensionProcessor_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include <wtf/HashMap.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class WebSocketExtensionProcessor {
+public:
+    virtual ~WebSocketExtensionProcessor() { }
+
+    String extensionToken() const { return m_extensionToken; }
+
+    // The return value of this method will be a part of the value of
+    // Sec-WebSocket-Extensions.
+    virtual String handshakeString() = 0;
+
+    // This should validate the server's response parameters which are passed
+    // as HashMap<key, value>. This may also do something for the extension.
+    // Note that this method may be called more than once when the server
+    // response contains duplicate extension token that matches extensionToken().
+    virtual bool processResponse(const HashMap<String, String>&) = 0;
+
+    // If procecssResponse() returns false, this should provide the reason.
+    virtual String failureReason() { return "Extension " + m_extensionToken + " failed"; }
+
+protected:
+    WebSocketExtensionProcessor(const String& extensionToken)
+        : m_extensionToken(extensionToken)
+    {
+    }
+
+private:
+    String m_extensionToken;
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketExtensionProcessor_h
diff --git a/Source/WebCore/websockets/WebSocketFrame.h b/Source/WebCore/websockets/WebSocketFrame.h
new file mode 100644
index 000000000..7efea78db
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketFrame.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketFrame_h
+#define WebSocketFrame_h
+
+#if ENABLE(WEB_SOCKETS)
+
+namespace WebCore {
+
+struct WebSocketFrame {
+    // RFC6455 opcodes.
+    enum OpCode {
+        OpCodeContinuation = 0x0,
+        OpCodeText = 0x1,
+        OpCodeBinary = 0x2,
+        OpCodeClose = 0x8,
+        OpCodePing = 0x9,
+        OpCodePong = 0xA,
+        OpCodeInvalid = 0x10
+    };
+
+    static bool isNonControlOpCode(OpCode opCode) { return opCode == OpCodeContinuation || opCode == OpCodeText || opCode == OpCodeBinary; }
+    static bool isControlOpCode(OpCode opCode) { return opCode == OpCodeClose || opCode == OpCodePing || opCode == OpCodePong; }
+    static bool isReservedOpCode(OpCode opCode) { return !isNonControlOpCode(opCode) && !isControlOpCode(opCode); }
+
+    WebSocketFrame(OpCode opCode = OpCodeInvalid, bool final = false, bool compress = false, bool masked = false, const char* payload = 0, size_t payloadLength = 0)
+        : opCode(opCode)
+        , final(final)
+        , compress(compress)
+        , reserved2(false)
+        , reserved3(false)
+        , masked(masked)
+        , payload(payload)
+        , payloadLength(payloadLength)
+    {
+    }
+
+    OpCode opCode;
+    bool final;
+    bool compress;
+    bool reserved2;
+    bool reserved3;
+    bool masked;
+    const char* payload;
+    size_t payloadLength;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketFrame_h
diff --git a/Source/WebCore/websockets/WebSocketHandshake.cpp b/Source/WebCore/websockets/WebSocketHandshake.cpp
index 8909efaf1..8cc509e59 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.cpp
+++ b/Source/WebCore/websockets/WebSocketHandshake.cpp
@@ -287,6 +287,9 @@ CString WebSocketHandshake::clientHandshakeMessage() const
     } else {
         fields.append("Sec-WebSocket-Key: " + m_secWebSocketKey);
         fields.append("Sec-WebSocket-Version: 13");
+        const String extensionValue = m_extensionDispatcher.createHeaderValue();
+        if (extensionValue.length())
+            fields.append("Sec-WebSocket-Extensions: " + extensionValue);
     }
 
     // Fields in the handshake are sent by the client in a random order; the
@@ -344,6 +347,9 @@ WebSocketHandshakeRequest WebSocketHandshake::clientHandshakeRequest() const
     } else {
         request.addHeaderField("Sec-WebSocket-Key", m_secWebSocketKey);
         request.addHeaderField("Sec-WebSocket-Version", "13");
+        const String extensionValue = m_extensionDispatcher.createHeaderValue();
+        if (extensionValue.length())
+            request.addHeaderField("Sec-WebSocket-Extensions", extensionValue);
     }
 
     return request;
@@ -352,6 +358,7 @@ WebSocketHandshakeRequest WebSocketHandshake::clientHandshakeRequest() const
 void WebSocketHandshake::reset()
 {
     m_mode = Incomplete;
+    m_extensionDispatcher.reset();
 }
 
 void WebSocketHandshake::clearScriptExecutionContext()
@@ -469,9 +476,9 @@ String WebSocketHandshake::serverWebSocketAccept() const
     return m_response.headerFields().get("sec-websocket-accept");
 }
 
-String WebSocketHandshake::serverWebSocketExtensions() const
+String WebSocketHandshake::acceptedExtensions() const
 {
-    return m_response.headerFields().get("sec-websocket-extensions");
+    return m_extensionDispatcher.acceptedExtensions();
 }
 
 const WebSocketHandshakeResponse& WebSocketHandshake::serverHandshakeResponse() const
@@ -479,6 +486,11 @@ const WebSocketHandshakeResponse& WebSocketHandshake::serverHandshakeResponse()
     return m_response;
 }
 
+void WebSocketHandshake::addExtensionProcessor(PassOwnPtr<WebSocketExtensionProcessor> processor)
+{
+    m_extensionDispatcher.addProcessor(processor);
+}
+
 KURL WebSocketHandshake::httpURLForAuthenticationAndCookies() const
 {
     KURL url = m_url.copy();
@@ -625,7 +637,15 @@ const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* e
             return 0;
         }
         LOG(Network, "name=%s value=%s", nameStr.string().utf8().data(), valueStr.utf8().data());
-        m_response.addHeaderField(nameStr, valueStr);
+        // Sec-WebSocket-Extensions may be split. We parse and check the
+        // header value every time the header appears.
+        if (equalIgnoringCase("sec-websocket-extensions", nameStr)) {
+            if (!m_extensionDispatcher.processHeaderValue(valueStr)) {
+                m_failureReason = m_extensionDispatcher.failureReason();
+                return 0;
+            }
+        } else
+            m_response.addHeaderField(nameStr, valueStr);
     }
     ASSERT_NOT_REACHED();
     return 0;
@@ -639,7 +659,6 @@ bool WebSocketHandshake::checkResponseHeaders()
     const String& serverUpgrade = this->serverUpgrade();
     const String& serverConnection = this->serverConnection();
     const String& serverWebSocketAccept = this->serverWebSocketAccept();
-    const String& serverWebSocketExtensions = this->serverWebSocketExtensions();
 
     if (serverUpgrade.isNull()) {
         m_failureReason = "Error during WebSocket handshake: 'Upgrade' header is missing";
@@ -692,13 +711,6 @@ bool WebSocketHandshake::checkResponseHeaders()
             m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Accept mismatch";
             return false;
         }
-        if (!serverWebSocketExtensions.isNull()) {
-            // WebSocket protocol extensions are not supported yet.
-            // We do not send Sec-WebSocket-Extensions header in our request, thus
-            // servers should not return this header, either.
-            m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Extensions header is invalid";
-            return false;
-        }
     }
     return true;
 }
diff --git a/Source/WebCore/websockets/WebSocketHandshake.h b/Source/WebCore/websockets/WebSocketHandshake.h
index 12c184019..b025f0c27 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.h
+++ b/Source/WebCore/websockets/WebSocketHandshake.h
@@ -35,8 +35,11 @@
 
 #include "KURL.h"
 #include "PlatformString.h"
+#include "WebSocketExtensionDispatcher.h"
+#include "WebSocketExtensionProcessor.h"
 #include "WebSocketHandshakeRequest.h"
 #include "WebSocketHandshakeResponse.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -81,10 +84,12 @@ public:
     String serverUpgrade() const;
     String serverConnection() const;
     String serverWebSocketAccept() const; // Only for hybi-10 handshake.
-    String serverWebSocketExtensions() const; // Only for hybi-10 handshake.
+    String acceptedExtensions() const;
 
     const WebSocketHandshakeResponse& serverHandshakeResponse() const;
 
+    void addExtensionProcessor(PassOwnPtr<WebSocketExtensionProcessor>);
+
 private:
     KURL httpURLForAuthenticationAndCookies() const;
 
@@ -116,6 +121,8 @@ private:
     // For hybi-10 handshake.
     String m_secWebSocketKey;
     String m_expectedAccept;
+
+    WebSocketExtensionDispatcher m_extensionDispatcher;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
index f0e63e125..c7486557a 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -36,6 +36,7 @@
 
 #include "Blob.h"
 #include "CrossThreadTask.h"
+#include "Document.h"
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
 #include "ThreadableWebSocketChannelClientWrapper.h"
@@ -53,7 +54,7 @@ namespace WebCore {
 
 WorkerThreadableWebSocketChannel::WorkerThreadableWebSocketChannel(WorkerContext* context, WebSocketChannelClient* client, const String& taskMode)
     : m_workerContext(context)
-    , m_workerClientWrapper(ThreadableWebSocketChannelClientWrapper::create(client))
+    , m_workerClientWrapper(ThreadableWebSocketChannelClientWrapper::create(context, client))
     , m_bridge(Bridge::create(m_workerClientWrapper, m_workerContext, taskMode))
 {
 }
@@ -82,6 +83,12 @@ String WorkerThreadableWebSocketChannel::subprotocol()
     return m_workerClientWrapper->subprotocol();
 }
 
+String WorkerThreadableWebSocketChannel::extensions()
+{
+    ASSERT(m_workerClientWrapper);
+    return m_workerClientWrapper->extensions();
+}
+
 bool WorkerThreadableWebSocketChannel::send(const String& message)
 {
     if (!m_bridge)
@@ -145,7 +152,7 @@ void WorkerThreadableWebSocketChannel::resume()
 WorkerThreadableWebSocketChannel::Peer::Peer(PassRefPtr<ThreadableWebSocketChannelClientWrapper> clientWrapper, WorkerLoaderProxy& loaderProxy, ScriptExecutionContext* context, const String& taskMode)
     : m_workerClientWrapper(clientWrapper)
     , m_loaderProxy(loaderProxy)
-    , m_mainWebSocketChannel(WebSocketChannel::create(context, this))
+    , m_mainWebSocketChannel(WebSocketChannel::create(static_cast<Document*>(context), this))
     , m_taskMode(taskMode)
 {
     ASSERT(isMainThread());
@@ -262,17 +269,18 @@ void WorkerThreadableWebSocketChannel::Peer::resume()
     m_mainWebSocketChannel->resume();
 }
 
-static void workerContextDidConnect(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, const String& subprotocol)
+static void workerContextDidConnect(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, const String& subprotocol, const String& extensions)
 {
     ASSERT_UNUSED(context, context->isWorkerContext());
     workerClientWrapper->setSubprotocol(subprotocol);
+    workerClientWrapper->setExtensions(extensions);
     workerClientWrapper->didConnect();
 }
 
 void WorkerThreadableWebSocketChannel::Peer::didConnect()
 {
     ASSERT(isMainThread());
-    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidConnect, m_workerClientWrapper, m_mainWebSocketChannel->subprotocol()), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidConnect, m_workerClientWrapper, m_mainWebSocketChannel->subprotocol(), m_mainWebSocketChannel->extensions()), m_taskMode);
 }
 
 static void workerContextDidReceiveMessage(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, const String& message)
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
index 2b1fa38df..317fce93c 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
+++ b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
@@ -64,6 +64,7 @@ public:
     virtual bool useHixie76Protocol() OVERRIDE;
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
+    virtual String extensions() OVERRIDE;
     virtual bool send(const String& message) OVERRIDE;
     virtual bool send(const ArrayBuffer&) OVERRIDE;
     virtual bool send(const Blob&) OVERRIDE;
diff --git a/Source/WebCore/workers/AbstractWorker.idl b/Source/WebCore/workers/AbstractWorker.idl
index e11e34c10..3c90d1ed7 100644
--- a/Source/WebCore/workers/AbstractWorker.idl
+++ b/Source/WebCore/workers/AbstractWorker.idl
@@ -34,7 +34,7 @@ module threads {
     interface [
         Conditional=WORKERS,
         ActiveDOMObject,
-        JSCustomToJS,
+        JSCustomToJSObject,
         EventTarget
     ] AbstractWorker {
 
diff --git a/Source/WebCore/workers/DOMWindowWorker.idl b/Source/WebCore/workers/DOMWindowWorker.idl
new file mode 100644
index 000000000..80bb93a39
--- /dev/null
+++ b/Source/WebCore/workers/DOMWindowWorker.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Supplemental=DOMWindow
+    ] DOMWindowWorker {
+        attribute [Conditional=WORKERS] WorkerConstructor Worker; // Usable with the new operator
+        attribute [Conditional=SHARED_WORKERS, JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+    };
+
+}
diff --git a/Source/WebCore/workers/SharedWorker.cpp b/Source/WebCore/workers/SharedWorker.cpp
index ff0792c54..9e94ee50f 100644
--- a/Source/WebCore/workers/SharedWorker.cpp
+++ b/Source/WebCore/workers/SharedWorker.cpp
@@ -58,6 +58,8 @@ PassRefPtr<SharedWorker> SharedWorker::create(ScriptExecutionContext* context, c
     OwnPtr<MessagePortChannel> remotePort = channel->port2()->disentangle(ec);
     ASSERT(remotePort);
 
+    worker->suspendIfNeeded();
+
     KURL scriptURL = worker->resolveURL(url, ec);
     if (scriptURL.isEmpty())
         return 0;
diff --git a/Source/WebCore/workers/SharedWorker.idl b/Source/WebCore/workers/SharedWorker.idl
index 5c7e47752..d2152720e 100644
--- a/Source/WebCore/workers/SharedWorker.idl
+++ b/Source/WebCore/workers/SharedWorker.idl
@@ -36,12 +36,12 @@ module threads {
         ActiveDOMObject,
         JSCustomConstructor,
         ConstructorParameters=2,
-        Constructor(in DOMString scriptURL, in [Optional=CallWithNullValue] DOMString name),
+        Constructor(in DOMString scriptURL, in [Optional=DefaultIsNullString] DOMString name),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
         JSCustomMarkFunction,
         JSGenerateToNativeObject,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] SharedWorker : AbstractWorker {
         readonly attribute MessagePort port;
     };
diff --git a/Source/WebCore/workers/Worker.cpp b/Source/WebCore/workers/Worker.cpp
index b3236a7cf..ec965a4e7 100644
--- a/Source/WebCore/workers/Worker.cpp
+++ b/Source/WebCore/workers/Worker.cpp
@@ -60,6 +60,8 @@ PassRefPtr<Worker> Worker::create(ScriptExecutionContext* context, const String&
 {
     RefPtr<Worker> worker = adoptRef(new Worker(context));
 
+    worker->suspendIfNeeded();
+
     KURL scriptURL = worker->resolveURL(url, ec);
     if (scriptURL.isEmpty())
         return 0;
@@ -148,7 +150,6 @@ void Worker::notifyFinished()
         if (InspectorInstrumentation::shouldPauseDedicatedWorkerOnStart(scriptExecutionContext()))
             startMode = PauseWorkerContextOnStart;
         m_contextProxy->startWorkerContext(m_scriptLoader->url(), scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script(), startMode);
-        InspectorInstrumentation::didStartWorkerContext(scriptExecutionContext(), m_contextProxy, m_scriptLoader->url());
         InspectorInstrumentation::scriptImported(scriptExecutionContext(), m_scriptLoader->identifier(), m_scriptLoader->script());
     }
     m_scriptLoader = nullptr;
diff --git a/Source/WebCore/workers/Worker.idl b/Source/WebCore/workers/Worker.idl
index 623f84727..867d36710 100644
--- a/Source/WebCore/workers/Worker.idl
+++ b/Source/WebCore/workers/Worker.idl
@@ -36,7 +36,7 @@ module threads {
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
         JSGenerateToNativeObject,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] Worker : AbstractWorker {
 
         attribute EventListener onmessage;
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index a2cd2392e..a5408d785 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -29,13 +29,14 @@ module threads {
     interface [
         Conditional=WORKERS,
         JSCustomMarkFunction,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         EventTarget,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         JSLegacyParent=JSWorkerContextBase,
         JSNoStaticTables,
-        OmitConstructor
+        OmitConstructor,
+        V8CustomToJSObject
     ] WorkerContext {
 
         // WorkerGlobalScope
@@ -59,10 +60,10 @@ module threads {
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        void clearTimeout(in [Optional=CallWithDefaultValue] long handle);
+        void clearTimeout(in [Optional=DefaultIsUndefined] long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        void clearInterval(in [Optional=CallWithDefaultValue] long handle);
+        void clearInterval(in [Optional=DefaultIsUndefined] long handle);
 
 
         // EventTarget interface
diff --git a/Source/WebCore/workers/WorkerMessagingProxy.cpp b/Source/WebCore/workers/WorkerMessagingProxy.cpp
index 6cbdbe9e8..1fdccbd62 100644
--- a/Source/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/Source/WebCore/workers/WorkerMessagingProxy.cpp
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */
 
@@ -276,6 +276,7 @@ void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const Strin
                                                                          m_scriptExecutionContext->contentSecurityPolicy()->headerType());
     workerThreadCreated(thread);
     thread->start();
+    InspectorInstrumentation::didStartWorkerContext(m_scriptExecutionContext.get(), this, scriptURL);
 }
 
 void WorkerMessagingProxy::postMessageToWorkerObject(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
@@ -315,7 +316,7 @@ void WorkerMessagingProxy::postExceptionToWorkerObject(const String& errorMessag
 {
     m_scriptExecutionContext->postTask(WorkerExceptionTask::create(errorMessage, lineNumber, sourceURL, this));
 }
-    
+
 static void postConsoleMessageTask(ScriptExecutionContext* context, WorkerMessagingProxy* messagingProxy, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
     if (messagingProxy->askedToTerminate())
@@ -410,6 +411,7 @@ void WorkerMessagingProxy::sendMessageToInspector(const String& message)
         return;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_workerThread->runLoop().postTaskForMode(createCallbackTask(dispatchOnInspectorBackendTask, String(message)), WorkerDebuggerAgent::debuggerTaskMode);
+    WorkerDebuggerAgent::interruptAndDispatchInspectorCommands(m_workerThread.get());
 #endif
 }
 #endif
diff --git a/Source/WebCore/workers/WorkerRunLoop.cpp b/Source/WebCore/workers/WorkerRunLoop.cpp
index 992a09aeb..eb665d26b 100644
--- a/Source/WebCore/workers/WorkerRunLoop.cpp
+++ b/Source/WebCore/workers/WorkerRunLoop.cpp
@@ -132,26 +132,28 @@ void WorkerRunLoop::run(WorkerContext* context)
     ModePredicate modePredicate(defaultMode());
     MessageQueueWaitResult result;
     do {
-        result = runInMode(context, modePredicate);
+        result = runInMode(context, modePredicate, WaitForMessage);
     } while (result != MessageQueueTerminated);
     runCleanupTasks(context);
 }
 
-MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const String& mode)
+MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const String& mode, WaitMode waitMode)
 {
     RunLoopSetup setup(*this);
     ModePredicate modePredicate(mode);
-    MessageQueueWaitResult result = runInMode(context, modePredicate);
+    MessageQueueWaitResult result = runInMode(context, modePredicate, waitMode);
     return result;
 }
 
-MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const ModePredicate& predicate)
+MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const ModePredicate& predicate, WaitMode waitMode)
 {
     ASSERT(context);
     ASSERT(context->thread());
     ASSERT(context->thread()->threadID() == currentThread());
 
-    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<Task>::infiniteTime();
+    double absoluteTime = 0.0;
+    if (waitMode == WaitForMessage)
+        absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<Task>::infiniteTime();
     MessageQueueWaitResult result;
     OwnPtr<WorkerRunLoop::Task> task = m_messageQueue.waitForMessageFilteredWithTimeout(result, predicate, absoluteTime);
 
diff --git a/Source/WebCore/workers/WorkerRunLoop.h b/Source/WebCore/workers/WorkerRunLoop.h
index 842c62127..3916d6ac5 100644
--- a/Source/WebCore/workers/WorkerRunLoop.h
+++ b/Source/WebCore/workers/WorkerRunLoop.h
@@ -52,8 +52,10 @@ namespace WebCore {
         // Blocking call. Waits for tasks and timers, invokes the callbacks.
         void run(WorkerContext*);
 
+        enum WaitMode { WaitForMessage, DontWaitForMessage };
+
         // Waits for a single task and returns.
-        MessageQueueWaitResult runInMode(WorkerContext*, const String& mode);
+        MessageQueueWaitResult runInMode(WorkerContext*, const String& mode, WaitMode = WaitForMessage);
 
         void terminate();
         bool terminated() const { return m_messageQueue.killed(); }
@@ -82,7 +84,7 @@ namespace WebCore {
 
     private:
         friend class RunLoopSetup;
-        MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&);
+        MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&, WaitMode);
 
         // Runs any clean up tasks that are currently in the queue and returns.
         // This should only be called when the context is closed or loop has been terminated.
diff --git a/Source/WebCore/workers/WorkerThread.cpp b/Source/WebCore/workers/WorkerThread.cpp
index 93ba0bfb0..34cf909ff 100644
--- a/Source/WebCore/workers/WorkerThread.cpp
+++ b/Source/WebCore/workers/WorkerThread.cpp
@@ -123,12 +123,12 @@ bool WorkerThread::start()
     return m_threadID;
 }
 
-void* WorkerThread::workerThreadStart(void* thread)
+void WorkerThread::workerThreadStart(void* thread)
 {
-    return static_cast<WorkerThread*>(thread)->workerThread();
+    static_cast<WorkerThread*>(thread)->workerThread();
 }
 
-void* WorkerThread::workerThread()
+void WorkerThread::workerThread()
 {
     {
         MutexLocker lock(m_threadCreationMutex);
@@ -173,8 +173,6 @@ void* WorkerThread::workerThread()
 
     // The thread object may be already destroyed from notification now, don't try to access "this".
     detachThread(threadID);
-
-    return 0;
 }
 
 void WorkerThread::runEventLoop()
diff --git a/Source/WebCore/workers/WorkerThread.h b/Source/WebCore/workers/WorkerThread.h
index 6646b1148..e3a11df00 100644
--- a/Source/WebCore/workers/WorkerThread.h
+++ b/Source/WebCore/workers/WorkerThread.h
@@ -80,8 +80,8 @@ namespace WebCore {
 
     private:
         // Static function executed as the core routine on the new thread. Passed a pointer to a WorkerThread object.
-        static void* workerThreadStart(void*);
-        void* workerThread();
+        static void workerThreadStart(void*);
+        void workerThread();
 
         ThreadIdentifier m_threadID;
         WorkerRunLoop m_runLoop;
diff --git a/Source/WebCore/xml/DOMParser.idl b/Source/WebCore/xml/DOMParser.idl
index 716400814..5e51bc1e7 100644
--- a/Source/WebCore/xml/DOMParser.idl
+++ b/Source/WebCore/xml/DOMParser.idl
@@ -21,7 +21,7 @@ module xpath {
     interface [
         Constructor
     ] DOMParser {
-        Document parseFromString(in [Optional=CallWithDefaultValue] DOMString str, 
-                                 in [Optional=CallWithDefaultValue] DOMString contentType);
+        Document parseFromString(in [Optional=DefaultIsUndefined] DOMString str, 
+                                 in [Optional=DefaultIsUndefined] DOMString contentType);
     };
 }
diff --git a/Source/WebCore/xml/DOMWindowXML.idl b/Source/WebCore/xml/DOMWindowXML.idl
new file mode 100644
index 000000000..e527350ca
--- /dev/null
+++ b/Source/WebCore/xml/DOMWindowXML.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Supplemental=DOMWindow
+    ] DOMWindowXML {
+        // Mozilla has a separate XMLDocument object for XML documents. 
+        // We just use Document for this.
+        attribute DocumentConstructor XMLDocument;
+        attribute DOMParserConstructor DOMParser;
+        attribute XMLSerializerConstructor XMLSerializer;
+        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
+        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
+        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
+        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
+        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
+    };
+
+}
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index 41f0621ec..7ed8212ee 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -154,7 +154,10 @@ static void logConsoleError(ScriptExecutionContext* context, const String& messa
 
 PassRefPtr<XMLHttpRequest> XMLHttpRequest::create(ScriptExecutionContext* context, PassRefPtr<SecurityOrigin> securityOrigin)
 {
-    return adoptRef(new XMLHttpRequest(context, securityOrigin));
+    RefPtr<XMLHttpRequest> xmlHttpRequest(adoptRef(new XMLHttpRequest(context, securityOrigin)));
+    xmlHttpRequest->suspendIfNeeded();
+
+    return xmlHttpRequest.release();
 }
 
 XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context, PassRefPtr<SecurityOrigin> securityOrigin)
diff --git a/Source/WebCore/xml/XMLHttpRequest.idl b/Source/WebCore/xml/XMLHttpRequest.idl
index b45baf2b1..0dcedfed1 100644
--- a/Source/WebCore/xml/XMLHttpRequest.idl
+++ b/Source/WebCore/xml/XMLHttpRequest.idl
@@ -89,11 +89,11 @@ module xml {
         readonly attribute XMLHttpRequestUpload upload;
 
         // response
-        [ConvertNullStringTo=Undefined] DOMString getAllResponseHeaders()
+        [TreatReturnedNullStringAs=Undefined] DOMString getAllResponseHeaders()
             raises(DOMException);
-        [ConvertNullStringTo=Null] DOMString getResponseHeader(in DOMString header)
+        [TreatReturnedNullStringAs=Null] DOMString getResponseHeader(in DOMString header)
             raises(DOMException);
-        readonly attribute [CustomGetter] DOMString responseText // The custom getter implements ConvertNullStringTo=Null
+        readonly attribute [CustomGetter] DOMString responseText // The custom getter implements TreatReturnedNullStringAs=Null
             getter raises(DOMException);
         readonly attribute Document responseXML
             getter raises(DOMException);
diff --git a/Source/WebCore/xml/XMLSerializer.idl b/Source/WebCore/xml/XMLSerializer.idl
index 5dabfdf15..58327cc2a 100644
--- a/Source/WebCore/xml/XMLSerializer.idl
+++ b/Source/WebCore/xml/XMLSerializer.idl
@@ -23,7 +23,7 @@ module xpath {
     interface [
         Constructor
     ] XMLSerializer {
-        DOMString serializeToString(in [Optional=CallWithDefaultValue] Node node)
+        DOMString serializeToString(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/xml/XPathEvaluator.idl b/Source/WebCore/xml/XPathEvaluator.idl
index 4d47ecfee..cb9950c2a 100644
--- a/Source/WebCore/xml/XPathEvaluator.idl
+++ b/Source/WebCore/xml/XPathEvaluator.idl
@@ -21,17 +21,17 @@ module xpath {
     interface [
         Constructor
     ] XPathEvaluator {
-        XPathExpression createExpression(in [Optional=CallWithDefaultValue] DOMString expression,
-                                         in [Optional=CallWithDefaultValue] XPathNSResolver resolver)
+        XPathExpression createExpression(in [Optional=DefaultIsUndefined] DOMString expression,
+                                         in [Optional=DefaultIsUndefined] XPathNSResolver resolver)
             raises(DOMException);
 
-        XPathNSResolver createNSResolver(in [Optional=CallWithDefaultValue] Node nodeResolver);
+        XPathNSResolver createNSResolver(in [Optional=DefaultIsUndefined] Node nodeResolver);
 
-        XPathResult evaluate(in [Optional=CallWithDefaultValue] DOMString expression,
-                             in [Optional=CallWithDefaultValue] Node contextNode, 
-                             in [Optional=CallWithDefaultValue] XPathNSResolver resolver,
-                             in [Optional=CallWithDefaultValue] unsigned short type,
-                             in [Optional=CallWithDefaultValue] XPathResult inResult)
+        XPathResult evaluate(in [Optional=DefaultIsUndefined] DOMString expression,
+                             in [Optional=DefaultIsUndefined] Node contextNode, 
+                             in [Optional=DefaultIsUndefined] XPathNSResolver resolver,
+                             in [Optional=DefaultIsUndefined] unsigned short type,
+                             in [Optional=DefaultIsUndefined] XPathResult inResult)
             raises(DOMException);
     };
 }
diff --git a/Source/WebCore/xml/XPathExpression.idl b/Source/WebCore/xml/XPathExpression.idl
index add53cff4..5e60840d2 100644
--- a/Source/WebCore/xml/XPathExpression.idl
+++ b/Source/WebCore/xml/XPathExpression.idl
@@ -21,9 +21,9 @@
 module xpath {
 
     interface XPathExpression {
-        [ObjCLegacyUnnamedParameters] XPathResult evaluate(in [Optional=CallWithDefaultValue] Node contextNode, 
-                                            in [Optional=CallWithDefaultValue] unsigned short type, 
-                                            in [Optional=CallWithDefaultValue] XPathResult inResult)
+        [ObjCLegacyUnnamedParameters] XPathResult evaluate(in [Optional=DefaultIsUndefined] Node contextNode, 
+                                            in [Optional=DefaultIsUndefined] unsigned short type, 
+                                            in [Optional=DefaultIsUndefined] XPathResult inResult)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/xml/XPathNSResolver.idl b/Source/WebCore/xml/XPathNSResolver.idl
index e1d4e0e26..e9fa41be4 100644
--- a/Source/WebCore/xml/XPathNSResolver.idl
+++ b/Source/WebCore/xml/XPathNSResolver.idl
@@ -24,7 +24,7 @@ module xpath {
         ObjCProtocol,
         OmitConstructor
     ] XPathNSResolver {
-        [ConvertNullStringTo=Null] DOMString lookupNamespaceURI(in [Optional=CallWithDefaultValue] DOMString prefix);
+        [TreatReturnedNullStringAs=Null] DOMString lookupNamespaceURI(in [Optional=DefaultIsUndefined] DOMString prefix);
     };
 
 }
diff --git a/Source/WebCore/xml/XPathResult.idl b/Source/WebCore/xml/XPathResult.idl
index cb5c92263..77c5b8e7c 100644
--- a/Source/WebCore/xml/XPathResult.idl
+++ b/Source/WebCore/xml/XPathResult.idl
@@ -52,7 +52,7 @@ module xpath {
             
         Node iterateNext()
             raises (DOMException);
-        Node snapshotItem(in [Optional=CallWithDefaultValue] unsigned long index)
+        Node snapshotItem(in [Optional=DefaultIsUndefined] unsigned long index)
             raises (DOMException);
     };
 
diff --git a/Source/WebCore/xml/XPathUtil.cpp b/Source/WebCore/xml/XPathUtil.cpp
index 4c45fcbca..7a8ff33cf 100644
--- a/Source/WebCore/xml/XPathUtil.cpp
+++ b/Source/WebCore/xml/XPathUtil.cpp
@@ -85,7 +85,6 @@ bool isValidContextNode(Node* node)
         case Node::ENTITY_NODE:
         case Node::ENTITY_REFERENCE_NODE:
         case Node::NOTATION_NODE:
-        case Node::SHADOW_ROOT_NODE:
             return false;
         case Node::TEXT_NODE:
             return !(node->parentNode() && node->parentNode()->isAttributeNode());
diff --git a/Source/WebCore/xml/XSLTProcessor.idl b/Source/WebCore/xml/XSLTProcessor.idl
index 4fcae9af5..48ec6c20e 100644
--- a/Source/WebCore/xml/XSLTProcessor.idl
+++ b/Source/WebCore/xml/XSLTProcessor.idl
@@ -42,7 +42,7 @@ module xml {
         [Custom] Document transformToDocument(in Node source);
 
         [Custom] void setParameter(in DOMString namespaceURI, in DOMString localName, in DOMString value);
-        [Custom, ConvertNullStringTo=Undefined] DOMString getParameter(in DOMString namespaceURI, in DOMString localName);
+        [Custom, TreatReturnedNullStringAs=Undefined] DOMString getParameter(in DOMString namespaceURI, in DOMString localName);
         [Custom] void removeParameter(in DOMString namespaceURI, in DOMString localName);
         void clearParameters();
 
diff --git a/Source/WebCore/xml/parser/MarkupTokenBase.h b/Source/WebCore/xml/parser/MarkupTokenBase.h
index 7a30ed604..986538b8d 100644
--- a/Source/WebCore/xml/parser/MarkupTokenBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenBase.h
@@ -540,7 +540,7 @@ inline void AtomicMarkupTokenBase<Token>::initializeAttributes(const typename To
         ASSERT(attribute.m_valueRange.m_start);
         ASSERT(attribute.m_valueRange.m_end);
 
-        String value(attribute.m_value.data(), attribute.m_value.size());
+        AtomicString value(attribute.m_value.data(), attribute.m_value.size());
         m_attributes->insertAttribute(Attribute::create(nameForAttribute(attribute), value), false);
     }
 }
diff --git a/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp b/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp
index cd6ea1494..75b319ffe 100644
--- a/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp
+++ b/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp
@@ -138,7 +138,7 @@ XMLDocumentParser::XMLDocumentParser(DocumentFragment* fragment, Element* parent
 
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedNodeMap* attrs = element->updatedAttributes()) {
+        if (ElementAttributeData* attrs = element->updatedAttributeData()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")